{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/meterpreter/issues/184","labels_url":"https://api.github.com/repos/rapid7/meterpreter/issues/184/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/meterpreter/issues/184/comments","events_url":"https://api.github.com/repos/rapid7/meterpreter/issues/184/events","html_url":"https://github.com/rapid7/meterpreter/issues/184","id":102161089,"number":184,"title":"Meterpreter offline actions","user":{"login":"NickSampanis","id":8640198,"avatar_url":"https://avatars.githubusercontent.com/u/8640198?v=3","gravatar_id":"","url":"https://api.github.com/users/NickSampanis","html_url":"https://github.com/NickSampanis","followers_url":"https://api.github.com/users/NickSampanis/followers","following_url":"https://api.github.com/users/NickSampanis/following{/other_user}","gists_url":"https://api.github.com/users/NickSampanis/gists{/gist_id}","starred_url":"https://api.github.com/users/NickSampanis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NickSampanis/subscriptions","organizations_url":"https://api.github.com/users/NickSampanis/orgs","repos_url":"https://api.github.com/users/NickSampanis/repos","events_url":"https://api.github.com/users/NickSampanis/events{/privacy}","received_events_url":"https://api.github.com/users/NickSampanis/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-08-20T15:07:08Z","updated_at":"2015-08-23T01:17:59Z","closed_at":null,"body":"Greetings,\r\nI created this issue in order to discuss with you an extension that i am thinking to implement for offline activities in meterpreter such as keylogging/sniffing (maybe even password cracking :P). You may\r\nable to give me some feedback or answer some questions about the technical implementation of \r\nthe project. The whole idea behind this, is that an attacker should be able to set offline activities\r\nand connect back after a period of time being able to get the results of those activities.\r\n\r\nNow from the technical point of view(for windows platform). The extension will give you a choice to inject any process by giving the process id.\r\ni)When you inject the process with a dll, after the reflective loader runs all the initialization, it should create a namedpipe with a random name provided by the client.\r\nii)the client should store the name of the pipe, somewhere in metasploit's local memory\r\niii)anytime the client should be able to open the pipe and give commands like\r\n(run_keylogger, stop_keylogger, dump_keylogger, remove_injected_dll), which will send back to the client an output.\r\n\r\nNow some technical questions.\r\n i)should i make 2 different dlls? one like priv and one like elevator?\r\nbecause priv doesn't inject it self to the remote process, it rather injects elevator.\r\n(after a short irc chat i had with @bcook-r7 he told me that i would be better if the code\r\ninjecting/removing the dll goes to stdapi or extapi. should i implement the other one  in \"source/offline\"\r\nas offline.dll?\r\n\r\nii)do you have any idea where is an appropriate way to store this informations(the random name of the pipe for a specific victim)?\r\n\r\niii)how does the whole thing sounds? @OJ  @hmoore-r7  @bcook-r7 \r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/meterpreter/issues/comments/133768832","html_url":"https://github.com/rapid7/meterpreter/issues/184#issuecomment-133768832","issue_url":"https://api.github.com/repos/rapid7/meterpreter/issues/184","id":133768832,"user":{"login":"OJ","id":28896,"avatar_url":"https://avatars.githubusercontent.com/u/28896?v=3","gravatar_id":"","url":"https://api.github.com/users/OJ","html_url":"https://github.com/OJ","followers_url":"https://api.github.com/users/OJ/followers","following_url":"https://api.github.com/users/OJ/following{/other_user}","gists_url":"https://api.github.com/users/OJ/gists{/gist_id}","starred_url":"https://api.github.com/users/OJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OJ/subscriptions","organizations_url":"https://api.github.com/users/OJ/orgs","repos_url":"https://api.github.com/users/OJ/repos","events_url":"https://api.github.com/users/OJ/events{/privacy}","received_events_url":"https://api.github.com/users/OJ/received_events","type":"User","site_admin":false},"created_at":"2015-08-23T01:17:59Z","updated_at":"2015-08-23T01:17:59Z","body":"We should move this over to Metasploit Payloads. :+1: "}}