View difference between Paste ID: HumEARa4 and gYDJwFeQ
SHOW: | | - or go back to the newest paste.
1-
msf auxiliary(meterp_compare) > rerun
1+
Some more commands to add to Java Meterpreter
2-
[*] Reloading module...
2+
3
meterp_compare module is at: https://github.com/schierlm/metasploit-framework/blob/0898309db9f0d8e05850e3e37b71119ae64864d9/unstable-modules/auxiliary/meterp_compare.rb
4-
[+] Scanning sessions:
4+
5-
[*]     1 | java/java | {"Computer"=>"MICHAEL", "OS"=>"Windows 7 6.1 (amd64)", "Architecture"=>nil, "System Language"=>nil}
5+
meterp_compare output is at: http://pastebin.com/gYDJwFeQ
6-
[*]     4 | php/php | {"Computer"=>"MICHAEL", "OS"=>"Windows NT MICHAEL 6.1 build 7601 (Windows 7 Business Edition Service Pack 1) i586", "Architecture"=>nil, "System Language"=>nil}
6+
7-
[*]     5 | python/python | {"Computer"=>"MICHAEL", "OS"=>"CYGWIN_NT-6.1 1.7.25(0.270/5/3) 2013-08-31 20:37", "Architecture"=>"x86_64", "System Language"=>nil}
7+
"Architecture"
8-
[*]     6 | x86/win32 | {"Computer"=>"MICHAEL", "OS"=>"Windows 7 (Build 7601, Service Pack 1).", "Architecture"=>"x64 (Current Process is WOW64)", "System Language"=>"de_DE"}
8+
	-> System.getProperty("os.arch")
9-
[+] Supported command groups:
9+
	http://docs.oracle.com/javase/1.5.0/docs/api/java/lang/System.html#getProperty(java.lang.String)
10-
[*]     1 | java/java     |   CD  GH
10+
	@since 1.0
11-
[*]     4 | php/php       | AB  E  H
11+
12-
[*]     5 | python/python | A  DEF H
12+
"System Language" 
13-
[*]     6 | x86/win32     |  B  EFGHI
13+
	-> Easy, Locale.getDefault().toString()
14-
[+] Commands in each group:
14+
	http://docs.oracle.com/javase/1.5.0/docs/api/java/util/Locale.html#getDefault()
15-
[*]   A | ["stdapi_fs_delete"]
15+
	http://docs.oracle.com/javase/1.5.0/docs/api/java/util/Locale.html#toString()
16-
[*]   B | ["stdapi_sys_process_kill"]
16+
	@since 1.0
17-
[*]   C | ["channel_create_stdapi_net_tcp_server", "channel_create_stdapi_net_udp_client"]
17+
18-
[*]   D | ["channel_create_stdapi_fs_file", "channel_create_stdapi_net_tcp_client"]
18+
stdapi_fs_delete 
19-
[*]   E | ["stdapi_sys_config_getenv", "stdapi_sys_process_close", "stdapi_sys_process_getpid"]
19+
	-> File.delete()
20-
[*]   F | ["stdapi_fs_file_move", "stdapi_net_resolve_host", "stdapi_net_resolve_hosts"]
20+
	http://docs.oracle.com/javase/1.5.0/docs/api/java/io/File.html#delete()
21-
[*]   G | ["stdapi_net_config_get_interfaces", "stdapi_net_config_get_routes", "stdapi_ui_desktop_screenshot", "webcam_audio_record"]
21+
	@since 1.0
22-
[*]   H | ["core_loadlib", "stdapi_fs_chdir", "stdapi_fs_delete_dir", "stdapi_fs_delete_file", "stdapi_fs_file_expand_path", "stdapi_fs_getwd", "stdapi_fs_ls",
22+
23-
"stdapi_fs_mkdir", "stdapi_fs_md5", "stdapi_fs_search", "stdapi_fs_separator", "stdapi_fs_stat", "stdapi_fs_sha1", "stdapi_net_socket_tcp_shutdown", "stdapi_sys_config_getuid", "stdapi_sys_config_sysinfo", "stdapi_sys_process_execute", "stdapi_sys_process_get_processes"]
23+
stdapi_sys_config_getenv
24-
[*]   I | ["webcam_stop", "webcam_get_frame", "webcam_start", "webcam_list", "stdapi_sys_power_exitwindows", "stdapi_sys_eventlog_close", "stdapi_sys_eventlog_clear", "stdapi_sys_eventlog_oldest", "stdapi_sys_eventlog_read", "stdapi_sys_eventlog_numrecords", "stdapi_sys_eventlog_open", "stdapi_ui_desktop_set", "stdapi_ui_desktop_get", "stdapi_ui_desktop_enum", "stdapi_ui_get_keys", "stdapi_ui_stop_keyscan", "stdapi_ui_start_keyscan", "stdapi_ui_get_idle_time", "stdapi_ui_enable_keyboard", "stdapi_ui_enable_mouse", "stdapi_net_config_get_proxy", "stdapi_net_config_get_netstat", "stdapi_net_config_get_arp_table", "stdapi_net_config_remove_route", "stdapi_net_config_add_route", "stdapi_sys_config_drop_token", "stdapi_sys_config_steal_token", "stdapi_sys_config_getprivs", "stdapi_sys_config_rev2self", "stdapi_registry_delete_value", "stdapi_registry_enum_value", "stdapi_registry_query_class", "stdapi_registry_query_value", "stdapi_registry_set_value", "stdapi_registry_close_key", "stdapi_registry_delete_key", "stdapi_registry_enum_key", "stdapi_registry_create_key", "stdapi_registry_open_remote_key", "stdapi_registry_open_key", "stdapi_registry_unload_key", "stdapi_registry_load_key",
24+
	-> System.getenv()
25-
"stdapi_registry_check_key_exists", "stdapi_sys_process_thread_set_regs", "stdapi_sys_process_thread_query_regs", "stdapi_sys_process_thread_terminate", "stdapi_sys_process_thread_resume", "stdapi_sys_process_thread_suspend", "stdapi_sys_process_thread_get_threads", "stdapi_sys_process_thread_close", "stdapi_sys_process_thread_create", "stdapi_sys_process_thread_open", "stdapi_sys_process_memory_unlock", "stdapi_sys_process_memory_lock", "stdapi_sys_process_memory_protect", "stdapi_sys_process_memory_query", "stdapi_sys_process_memory_write", "stdapi_sys_process_memory_read", "stdapi_sys_process_memory_free", "stdapi_sys_process_memory_allocate", "stdapi_sys_process_image_get_images", "stdapi_sys_process_image_unload", "stdapi_sys_process_image_get_proc_address", "stdapi_sys_process_image_load", "stdapi_sys_process_wait", "stdapi_sys_process_get_info", "stdapi_sys_process_attach", "stdapi_railgun_memwrite", "stdapi_railgun_memread", "stdapi_railgun_api_multi", "stdapi_railgun_api", "core_channel_open"]
25+
	http://docs.oracle.com/javase/1.5.0/docs/api/java/lang/System.html#getenv()
26-
[*] Auxiliary module execution completed
26+
	@since 1.5
27-
msf auxiliary(meterp_compare) >
27+
	Note that the version that takes a String was available before, but did not return system environment variables
28
	A sensible fallback for Pre 1.5 JDK would be to return empty results or hack something up for %COMSPEC% (similar to expand_path)
29
	
30
31
stdapi_fs_file_move
32
	-> File.renameTo()
33
	http://docs.oracle.com/javase/1.5.0/docs/api/java/io/File.html#renameTo(java.io.File)
34
	@since 1.0
35
	Be aware that renameTo can fail due to platform specific reasons, so the proper fallback would be a copy loop
36
	
37
stdapi_net_resolve_host
38
stdapi_net_resolve_hosts
39
	InetAddress.getByName(...).getAddress() [or getHostAddress()]
40
	http://docs.oracle.com/javase/1.5.0/docs/api/java/net/InetAddress.html#getByName(java.lang.String)
41
	http://docs.oracle.com/javase/1.5.0/docs/api/java/net/InetAddress.html#getAddress()
42
	@since 1.0
43
	
44
stdapi_net_config_get_proxy
45
	-> possible if running inside an applet, but AFAIK not possible when spawned separately