Skip to content

Commit f524459

Browse files
committed
Merge branch 'release/20120103000001' into stable
2 parents fdea0ad + 166e3f4 commit f524459

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+1522
-78
lines changed

data/armitage/armitage.jar

5.51 KB
Binary file not shown.

data/armitage/whatsnew.txt

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,41 @@
11
Armitage Changelog
22
==================
33

4+
30 Dec 11 - last release of the year?
5+
---------
6+
- Hosts -> Clear Database now clears the sessions and clients tables
7+
- Fixed a bug preventing dynamic workspace port/session filter from
8+
working on a fresh database. This was a fun one. This only affected
9+
folks with a completely fresh database and because Hosts -> Clear
10+
Database didn't clear everything, this went unnoticed until now.
11+
- Added various reverse shell payloads to payload helper dialog.
12+
- Added file chooser helper for SigningCert and SigningKey options.
13+
- Added hack to return correct route info when setting up pivoting through
14+
Java meterpreter.
15+
- Armitage now posts a note to the event log when a user starts a browser
16+
exploit or a server module.
17+
- Armitage now supports dragging and dropping a module onto a host in graph
18+
and table view. This action opens the module launcher configured to work
19+
with that host.
20+
- Drastically rewrote MSF Scans. MSF Scans now intelligently builds a list
21+
of ports to scan based on what Metasploit can do. After an initial port
22+
scan, MSF Scans runs discovery modules against relevant hosts. As a bonus
23+
you will see all of the output of these scans.
24+
- Enhanced the Windows heuristic used to guess which OS image to display
25+
- The deconfliction server throttle is now less draconian about how long it
26+
throttles a call.
27+
- Armitage no longer posts to the event log from the UI thread (this will
28+
prevent the UI from blocking in some cases)
29+
- Command shell now handles interaction with d-server in a separate thread
30+
from the UI thread. This will prevent UI blocking in some cases.
31+
- Added Ping Sweep... option for non-Windows meterpreter sessions. Now Java
32+
meterpreter users have a quick host discovery option.
33+
- Change Host OS option now matches new Metasploit database schema.
34+
- Deconfliction server now sets LHOST to the IP address you provided. Also,
35+
Armitage clients do not overwrite LHOST once it is set.
36+
- Interacting with a shell in team mode no longer blocks UI to communicate
37+
with d-server.
38+
439
12 Dec 11
540
---------
641
- Armitage teaming mode now downloads the resulting file for any fileformat

lib/msf/core/auxiliary/report.rb

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ def db
1919
end
2020

2121
def myworkspace
22-
return @myworkspace if @myworkspace
2322
@myworkspace = framework.db.find_workspace(self.workspace)
2423
end
2524

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,201 @@
1+
require 'msf/core/post/windows/services'
2+
3+
4+
module Msf
5+
class Post
6+
module Windows
7+
8+
module ShadowCopy
9+
include Msf::Post::Windows::WindowsServices
10+
11+
12+
def get_vss_device(id)
13+
result = get_sc_param(id,'DeviceObject')
14+
end
15+
16+
def vss_list
17+
ids = vss_get_ids
18+
shadow_copies = []
19+
ids.each do |id|
20+
print_status "Getting data for Shadow Copy #{id} (This may take a minute)"
21+
shadow_copies << get_sc_details("\"#{id}\"")
22+
end
23+
return shadow_copies
24+
end
25+
26+
def vss_get_ids
27+
result = wmicexec('shadowcopy get id')
28+
ids = result.scan(/\{\w{8}-\w{4}-\w{4}-\w{4}-\w{12}\}/)
29+
return ids
30+
end
31+
32+
def vss_get_storage
33+
storage={}
34+
storage['AllocatedSpace'] = vss_get_storage_param('AllocatedSpace')
35+
storage['MaxSpace'] = vss_get_storage_param('MaxSpace')
36+
storage['UsedSpace'] = vss_get_storage_param('UsedSpace')
37+
return storage
38+
end
39+
40+
def get_sc_details(id)
41+
shadowcopy={}
42+
shadowcopy['ID'] = id
43+
shadowcopy['ClientAccessible'] = get_sc_param(id,'ClientAccessible')
44+
shadowcopy['Count'] = get_sc_param(id,'Count')
45+
shadowcopy['DeviceObject'] = get_sc_param(id,'DeviceObject')
46+
shadowcopy['Differential'] = get_sc_param(id,'Differential')
47+
shadowcopy['ExposedLocally'] = get_sc_param(id,'ExposedLocally')
48+
shadowcopy['ExposedName'] = get_sc_param(id,'ExposedName')
49+
shadowcopy['ExposedRemotely'] = get_sc_param(id,'ExposedRemotely')
50+
shadowcopy['HardwareAssisted'] = get_sc_param(id,'HardwareAssisted')
51+
shadowcopy['Imported'] = get_sc_param(id,'Imported')
52+
shadowcopy['NoAutoRelease'] = get_sc_param(id,'NoAutoRelease')
53+
shadowcopy['NotSurfaced'] = get_sc_param(id,'Notsurfaced')
54+
shadowcopy['NoWriters'] = get_sc_param(id,'NoWriters')
55+
shadowcopy['OriginiatingMachine'] = get_sc_param(id,'OriginatingMachine')
56+
shadowcopy['Persistent'] = get_sc_param(id,'Persistent')
57+
shadowcopy['Plex'] = get_sc_param(id,'Plex')
58+
shadowcopy['ProviderID'] = get_sc_param(id,'ProviderID')
59+
shadowcopy['ServiceMachine'] = get_sc_param(id,'ServiceMachine')
60+
shadowcopy['SetID'] = get_sc_param(id,'SetID')
61+
shadowcopy['State'] = get_sc_param(id,'State')
62+
shadowcopy['Transportable'] = get_sc_param(id,'Transportable')
63+
shadowcopy['VolumeName'] = get_sc_param(id,'VolumeName')
64+
return shadowcopy
65+
end
66+
67+
def get_sc_param(id,param_name)
68+
result = wmicexec("shadowcopy where(id=#{id}) get #{param_name}")
69+
result.gsub!(param_name,'')
70+
result.gsub!(/\s/,'')
71+
end
72+
73+
def vss_get_storage_param(param_name)
74+
result = wmicexec("shadowstorage get #{param_name}")
75+
result.gsub!(param_name,'')
76+
result.gsub!(/\s/,'')
77+
end
78+
79+
def vss_set_storage(bytes)
80+
result = wmicexec("shadowstorage set MaxSpace=\"#{bytes}\"")
81+
if result.include?("success")
82+
return true
83+
else
84+
return false
85+
end
86+
end
87+
88+
def create_shadowcopy(volume)
89+
result = wmicexec("shadowcopy call create \"ClientAccessible\", \"#{volume}\"")
90+
retval = result.match(/ReturnValue = (\d)/)
91+
case retval[1].to_i
92+
when 0
93+
print_status("ShadowCopy created successfully")
94+
sc_id = result.match(/ShadowID = ("\{\w{8}-\w{4}-\w{4}-\w{4}-\w{12}\}")/)
95+
return sc_id[1]
96+
when 1
97+
print_error("Access Denied")
98+
when 2
99+
print_error("Invalid Argument")
100+
when 3
101+
print_error("Specified volume not found")
102+
when 4
103+
print_error("Specified volume not supported")
104+
when 5
105+
print_error("Unsupported shadow copy context")
106+
when 6
107+
print_error("Insufficient Storage")
108+
when 7
109+
print_error("Volume is in use")
110+
when 8
111+
print_error("Maximum number of shadow copies reached")
112+
when 9
113+
print_error("Another shadow copy operation is already in progress")
114+
when 10
115+
print_error("Shadow copy provider vetoed the operation")
116+
when 11
117+
print_error("Shadow copy provider not registered")
118+
when 12
119+
print_error("Shadow copy provider failure")
120+
else
121+
print_error("Unknown error")
122+
end
123+
return nil
124+
end
125+
126+
def start_vss
127+
vss_state = wmicexec('Service where(name="VSS") get state')
128+
if vss_state=~ /Running/
129+
print_status("Volume Shadow Copy service is running.")
130+
else
131+
print_status("Volume Shadow Copy service not running. Starting it now...")
132+
begin
133+
ss_result = service_start("VSS")
134+
case ss_result
135+
when 0
136+
print_status("Volume Shadow Copy started successfully.")
137+
when 1
138+
print_error("Volume Shadow Copy already running.")
139+
when 2
140+
print_error("Volume Shadow Copy is disabled.")
141+
print_status("Attempting to re-enable...")
142+
service_change_startup("VSS","manual")
143+
ss_result = service_start("VSS")
144+
if ss_result == 0
145+
return true
146+
else
147+
return false
148+
end
149+
end
150+
rescue
151+
print_error("Insufficient Privs to start service!")
152+
return false
153+
end
154+
end
155+
return true
156+
end
157+
158+
def wmicexec(wmiccmd)
159+
tmpout = ''
160+
session.response_timeout=120
161+
begin
162+
tmp = session.fs.file.expand_path("%TEMP%")
163+
wmicfl = tmp + "\\"+ sprintf("%.5d",rand(100000))
164+
r = session.sys.process.execute("cmd.exe /c %SYSTEMROOT%\\system32\\wbem\\wmic.exe /append:#{wmicfl} #{wmiccmd}", nil, {'Hidden' => true})
165+
sleep(2)
166+
#Making sure that wmic finishes before executing next wmic command
167+
prog2check = "wmic.exe"
168+
found = 0
169+
while found == 0
170+
session.sys.process.get_processes().each do |x|
171+
found =1
172+
if prog2check == (x['name'].downcase)
173+
sleep(0.5)
174+
found = 0
175+
end
176+
end
177+
end
178+
r.close
179+
180+
# Read the output file of the wmic commands
181+
wmioutfile = session.fs.file.new(wmicfl, "rb")
182+
until wmioutfile.eof?
183+
tmpout << wmioutfile.read
184+
end
185+
wmioutfile.close
186+
rescue ::Exception => e
187+
print_error("Error running WMIC commands: #{e.class} #{e}")
188+
end
189+
# We delete the file with the wmic command output.
190+
c = session.sys.process.execute("cmd.exe /c del #{wmicfl}", nil, {'Hidden' => true})
191+
c.close
192+
tmpout.gsub!(/[^[:print:]]/,'') #scrub out garbage
193+
return tmpout
194+
end
195+
196+
197+
end
198+
end
199+
end
200+
end
201+

lib/msf/core/rpc/v10/client.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ def call(meth, *args)
7171
resp = MessagePack.unpack(res.body)
7272

7373
if resp and resp.kind_of?(::Hash) and resp['error'] == true
74-
raise Msf::RPC::ServerException.new(res.code, resp['error_message'] || resp['error_string'], resp['error_class'], resp['error_backtrace'])
74+
raise Msf::RPC::ServerException.new(resp['error_code'] || res.code, resp['error_message'] || resp['error_string'], resp['error_class'], resp['error_backtrace'])
7575
end
7676

7777
return resp

lib/msf/ui/console/command_dispatcher/core.rb

Lines changed: 95 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,9 @@ def commands
8888
"kill" => "Kill a job",
8989
"load" => "Load a framework plugin",
9090
"loadpath" => "Searches for and loads modules from a path",
91+
"popm" => "Pops the latest module off of the module stack and makes it active",
92+
"pushm" => "Pushes the active or list of modules onto the module stack",
93+
"previous" => "Sets the previously loaded module as the current module",
9194
"quit" => "Exit the console",
9295
"resource" => "Run the commands stored in a file",
9396
"makerc" => "Save commands entered since start to a file",
@@ -118,6 +121,8 @@ def initialize(driver)
118121

119122
@dscache = {}
120123
@cache_payloads = nil
124+
@previous_module = nil
125+
@module_name_stack = []
121126
end
122127

123128
#
@@ -2127,8 +2132,9 @@ def cmd_use(*args)
21272132
return false
21282133
end
21292134

2130-
# If there's currently an active module, go back
2135+
# If there's currently an active module, enqueque it and go back
21312136
if (active_module)
2137+
@previous_module = active_module
21322138
cmd_back()
21332139
end
21342140

@@ -2153,6 +2159,94 @@ def cmd_use(*args)
21532159
driver.update_prompt("#{prompt} #{mod.type}(%bld%red#{mod.shortname}%clr) ", prompt_char, true)
21542160
end
21552161

2162+
#
2163+
# Command to take to the previously active module
2164+
#
2165+
def cmd_previous()
2166+
if @previous_module
2167+
self.cmd_use(@previous_module.fullname)
2168+
else
2169+
print_error("There isn't a previous module at the moment")
2170+
end
2171+
end
2172+
2173+
#
2174+
# Help for the 'previous' command
2175+
#
2176+
def cmd_previous_help
2177+
print_line "Usage: previous"
2178+
print_line
2179+
print_line "Set the previously loaded module as the current module"
2180+
print_line
2181+
end
2182+
2183+
#
2184+
# Command to enqueque a module on the module stack
2185+
#
2186+
def cmd_pushm(*args)
2187+
# could check if each argument is a valid module, but for now let them hang themselves
2188+
if args.count > 0
2189+
args.each do |arg|
2190+
@module_name_stack.push(arg)
2191+
# Note new modules are appended to the array and are only module (full)names
2192+
end
2193+
else #then just push the active module
2194+
if active_module
2195+
#print_status "Pushing the active module"
2196+
@module_name_stack.push(active_module.fullname)
2197+
else
2198+
print_error("There isn't an active module and you didn't specify a module to push")
2199+
return self.cmd_pushm_help
2200+
end
2201+
end
2202+
end
2203+
2204+
#
2205+
# Help for the 'pushm' command
2206+
#
2207+
def cmd_pushm_help
2208+
print_line "Usage: pushm [module1 [,module2, module3...]]"
2209+
print_line
2210+
print_line "push current active module or specified modules onto the module stack"
2211+
print_line
2212+
end
2213+
2214+
#
2215+
# Command to dequeque a module from the module stack
2216+
#
2217+
def cmd_popm(*args)
2218+
if (args.count > 1 or not args[0].respond_to?("to_i"))
2219+
return self.cmd_popm_help
2220+
elsif args.count == 1
2221+
# then pop 'n' items off the stack, but don't change the active module
2222+
if args[0].to_i >= @module_name_stack.count
2223+
# in case they pass in a number >= the length of @module_name_stack
2224+
@module_name_stack = []
2225+
print_status("The module stack is empty")
2226+
else
2227+
@module_name_stack.pop[args[0]]
2228+
end
2229+
else #then just pop the array and make that the active module
2230+
pop = @module_name_stack.pop
2231+
if pop
2232+
return self.cmd_use(pop)
2233+
else
2234+
print_error("There isn't anything to pop, the module stack is empty")
2235+
end
2236+
end
2237+
end
2238+
2239+
#
2240+
# Help for the 'popm' command
2241+
#
2242+
def cmd_popm_help
2243+
print_line "Usage: popm [n]"
2244+
print_line
2245+
print_line "pop the latest module off of the module stack and make it the active module"
2246+
print_line "or pop n modules off the stack, but don't change the active module"
2247+
print_line
2248+
end
2249+
21562250
#
21572251
# Tab completion for the use command
21582252
#

0 commit comments

Comments
 (0)