working on freefloatftp_user.rb
freefloatftp_user.rb
Merge branch 'master' into freefloatftp_user
...
got freefloatftp_user.rb working
added description
description spacing
changed return address
added exe-only options to win32pe generation
added CHECK functionality to the existing module
adjusted DOS part to use HttpClient
Move Java meterpreter next to JavaPayload

to make further refactoring easier
Convert JavaPayload project to use Maven

Functionality and build result is 1:1 the same as before. Auxiliary ant
targets have been converted to Maven profiles.
Convert Java Meterpreter project to use Maven

Functionality and build result is 1:1 the same as before. Auxiliary ant
targets have been converted to Maven profiles.
Add version compatibility checks for JavaPayload

Check JavaPayload and Java Meterpreter against version incompatibilities
for Java 1.2, 1.3, 1.4, 1.5, and 1.6.

Note that webcam_audio_record is currently excluded from the checks, as it
uses Sun proprietary API for building the WAV file and is therefore
failing the build (and will most likely crash Meterpreter if run on a JVM
of version 1.4 or later that is not based on the Sun/Oracle JVM).

Possible workarounds (apart from either removing the module or changing it
to produce empty files when WAV creation is not supported) include
implementing the WAV file writer ourselves or providing raw PCM files
instead.
Remove old .gitignore entries
Add unit tests for JavaPayload

Downgrad JUnit version since JUnit 4 can only work with -target 1.5 or
higher class files.

Covered are Shell and Meterpreter stage, StreamForwarder, MemoryBuffer,
AESEncryption and Payload (Bind, Reverse, Spawn, AESPassword).
Add shellcode for RC4 decoding

Provided as a block to be included into stagers and/or decoder stubs.
Also included is a test shellcode that can be used for verifying that the
algorithm is compatible to Ruby's OpenSSL RC4 algorithm.
Add shellcode for RC4 bind and reverse stagers

Those stagers will encrypt the initial stage with a 128-bit RC4 key and
the stage length with a XOR key. Both keys are embedded in the stager.

This should provide good evasion capabilities in addition to some
protection against MITM reversing (if the stager is sent a different
route, like in an executable on an USB key).

Note that, from a cryptanalyst's standpoint, it is a bad idea to reuse the
same stager (or stagers with the same RC4 and XOR keys) more than once
since an identical key will result in an identical keystream and make
correlation attacks easy. But I doubt that matters in practice.

Also note that since communication after the initial statging is not
encrypted, these stagers should be used in combination with additional
encryption support in the payloads (like Meterpreter).
Add stager modules for RC4 bind and reverse stagers

See the commit message of my last commit for caveats.