Posts Tagged Metasploit

Java_signed_applet with RJB

I just wasted a lot of time trying to get the java_signed_applet exploit module working in Metasploit. Not that it doesn’t work by default, but you will get the warning [-] [-] The JDK failed to initialized: no such file to load — rjb [-] In order to dynamically sign the applet, you must install […]

, , , , , ,

Leave a comment

Command stagers in Windows

Command injection/execution bugs are a relatively common vulnerability. For example, Internet Explorer, Google Chrome, and Mozilla Firefox have all had these problems, at least including common add-ons. (see http://www.securityfocus.com/archive/1/archive/1/499570/100/0/threaded, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-5045, etc.) Many server-side scripts in webapps also suffer from the same issues. Against a Linux target, many exploitation possibilities abound, from staging a payload via […]

, , , , , , ,

Leave a comment

EXE injection plus

For those interested in metasploit (or whatever) payload injection into EXE files, the metasploit patch (now posted http://www.metasploit.com/redmine/projects/framework/repository/revisions/8896) is based on one case, albeit the most likely to work, of my original program in C and Win32 API. This original program also can embed the payload if it fits into unused space at the end of a code section, which […]

, ,

Leave a comment

Metasploit EXE code injection

I recently posed a patch to inject an arbitrary metasploit payload into a win32 exe while attempting to not affect the behavior of the host exe. I’m not the best ruby ninja, but I do at least know a little about the PE format. https://metasploit.com/redmine/issues/1244#change-3739 the patch: https://metasploit.com/redmine/attachments/196/inject.patch Payload is run in a separate thread. […]

, ,

Leave a comment

Shellcode API hashes

For all you shellcoders out there; to make Windows API calling easier, you can use Stephen Fewer’s block_api.asm in the Metasploit tree. http://www.metasploit.com/redmine/projects/framework/repository/revisions/8160/entry/external/source/shellcode/windows/x86/src/block/block_api.asm But you need the function hashes, which if you don’t have the DLL on your current OS, or the python file, or something like that can be annoying. So I posted a […]

, , ,

Leave a comment