Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Install mingw in Docker #16311

Merged

Conversation

sjanusz-r7
Copy link
Contributor

@sjanusz-r7 sjanusz-r7 commented Mar 8, 2022

This PR installs mingw in Docker so that the module json file can be populated with windows encrypted shell entries.

Verification

From #15652

  • docker build -t metasploitframework/metasploit-framework:latest .
  • ./tools/automation/cache/update_module_cache.sh
  • Verify the updated db/modules_metadata_base.json file includes encrypted payloads metadata
  • Verify the encrypted payloads are searchable in msfconsole without mingw being installed on the host machine, and that they are usable - but provide the user a warning that mingw is missing

@adfoster-r7
Copy link
Contributor

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index 23390a0777..c6f1351ac6 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -183772,6 +183772,76 @@
     "session_types": false,
     "needs_cleanup": false
   },
+  "payload_windows/x64/encrypted_shell/reverse_tcp": {
+    "name": "Windows Command Shell, Encrypted Reverse TCP Stager",
+    "fullname": "payload/windows/x64/encrypted_shell/reverse_tcp",
+    "aliases": [
+
+    ],
+    "rank": 300,
+    "disclosure_date": null,
+    "type": "payload",
+    "author": [
+      "Matt Graeber",
+      "Shelby Pace"
+    ],
+    "description": "Spawn a piped command shell (staged). Connect to MSF and read in stage",
+    "references": [
+
+    ],
+    "platform": "Windows",
+    "arch": "x64",
+    "rport": null,
+    "autofilter_ports": null,
+    "autofilter_services": null,
+    "targets": null,
+    "mod_time": "2020-09-22 02:56:51 +0000",
+    "path": "/modules/payloads/stagers/windows/x64/encrypted_reverse_tcp.rb",
+    "is_install_path": true,
+    "ref_name": "windows/x64/encrypted_shell/reverse_tcp",
+    "check": false,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+    },
+    "session_types": false,
+    "needs_cleanup": false
+  },
+  "payload_windows/x64/encrypted_shell_reverse_tcp": {
+    "name": "Windows Encrypted Reverse Shell",
+    "fullname": "payload/windows/x64/encrypted_shell_reverse_tcp",
+    "aliases": [
+
+    ],
+    "rank": 300,
+    "disclosure_date": null,
+    "type": "payload",
+    "author": [
+      "Matt Graeber",
+      "Shelby Pace"
+    ],
+    "description": "Connect back to attacker and spawn an encrypted command shell",
+    "references": [
+
+    ],
+    "platform": "Windows",
+    "arch": "x64",
+    "rport": null,
+    "autofilter_ports": null,
+    "autofilter_services": null,
+    "targets": null,
+    "mod_time": "2021-01-05 14:59:46 +0000",
+    "path": "/modules/payloads/singles/windows/x64/encrypted_shell_reverse_tcp.rb",
+    "is_install_path": true,
+    "ref_name": "windows/x64/encrypted_shell_reverse_tcp",
+    "check": false,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+    },
+    "session_types": false,
+    "needs_cleanup": false
+  },
   "payload_windows/x64/exec": {
     "name": "Windows x64 Execute Command",
     "fullname": "payload/windows/x64/exec",

Looks like the 32 bit version isn't generated still, am I missing anything? 👀

@adfoster-r7
Copy link
Contributor

Looks like sorting out the 32 bit cache information will be more effort, let's land this separately

@adfoster-r7 adfoster-r7 merged commit 49bea72 into rapid7:master Mar 9, 2022
@adfoster-r7
Copy link
Contributor

adfoster-r7 commented Mar 9, 2022

Release Notes

This updates msfconsole's search functionality to include the 64 bit variant of payload_windows/x64/encrypted_shell payloads

@adfoster-r7
Copy link
Contributor

Confirmed that Jenkins grabbed these in now too 0296e59

@smcintyre-r7 smcintyre-r7 added the rn-fix release notes fix label Mar 10, 2022
This pull request was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
rn-fix release notes fix
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants