librex 0.0.68 → 0.0.70

data/lib/rex/exploitation/ropdb.rb

@@ -0,0 +1,189 @@
+require 'rex/text'
+require 'rexml/document'
+
+
+module Rex
+module Exploitation
+
+###
+#
+# This class provides methods to access the ROP database, in order to generate
+# a ROP-compatible payload on the fly.
+#
+###
+class RopDb
+  def initialize
+    @base_path = File.join(File.dirname(__FILE__), '../../../data/ropdb/')
+  end
+
+  public
+
+
+  #
+  # Returns true if a ROP chain is available, otherwise false
+  #
+  def has_rop?(rop_name)
+    File.exists?(File.join(@base_path, "#{rop_name}.xml"))
+  end
+
+  #
+  # Returns an array of ROP gadgets. Each gadget can either be an offset, or a value (symbol or
+  # some integer).  When the value is a symbol, it can be one of these: :nop, :junk, :size,
+  # :unsafe_negate_size, and :safe_negate_size
+  # Note if no RoP is found, it returns an empry array.
+  # Arguments:
+  # rop_name - name of the ROP chain.
+  # opts     - A hash of optional arguments:
+  #            'target' - A regex string search against the compatibility list.
+  #            'base'   - Specify a different base for the ROP gadgets.
+  #
+  def select_rop(rop, opts={})
+    target = opts['target'] || ''
+    base   = opts['base']   || nil
+
+    raise RuntimeError, "#{rop} ROP chain is not available" if not has_rop?(rop)
+    xml = load_rop(File.join(@base_path, "#{rop}.xml"))
+
+    gadgets = []
+
+    xml.elements.each("db/rop") { |e|
+      name = e.attributes['name']
+      next if not has_target?(e, target)
+
+      if not base
+        default = e.elements['gadgets'].attributes['base'].scan(/^0x([0-9a-f]+)$/i).flatten[0]
+        base = default.to_i(16)
+      end
+
+      gadgets << parse_gadgets(e, base)
+    }
+    return gadgets.flatten
+  end
+
+
+  #
+  # Returns a payload with the user-supplied stack-pivot, a ROP chain,
+  # and then shellcode.
+  # Arguments:
+  # rop     - Name of the ROP chain
+  # payload - Payload in binary
+  # opts    - A hash of optional arguments:
+  #           'nop'      - Used to generate nops with generate_sled()
+  #           'badchars' - Used in a junk gadget
+  #           'pivot'    - Stack pivot in binary
+  #           'target'   - A regex string search against the compatibility list.
+  #           'base'     - Specify a different base for the ROP gadgets.
+  #
+  def generate_rop_payload(rop, payload, opts={})
+    nop      = opts['nop']      || nil
+    badchars = opts['badchars'] || ''
+    pivot    = opts['pivot']    || ''
+    target   = opts['target']   || ''
+    base     = opts['base']     || nil
+
+    rop = select_rop(rop, {'target'=>target, 'base'=>base})
+    # Replace the reserved words with actual gadgets
+    rop = rop.map {|e|
+      if e == :nop
+        sled = (nop) ? nop.generate_sled(4, badchars).unpack("V*")[0] : 0x90909090
+      elsif e == :junk
+        Rex::Text.rand_text(4, badchars).unpack("V")[0].to_i
+      elsif e == :size
+        payload.length
+      elsif e == :unsafe_negate_size
+        get_unsafe_size(payload.length)
+      elsif e == :safe_negate_size
+        get_safe_size(payload.length)
+      else
+        e
+      end
+    }.pack("V*")
+
+    raise RuntimeError, "No ROP chain generated successfully" if rop.empty?
+
+    return pivot + rop + payload
+  end
+
+  private
+
+
+  #
+  # Returns a size that's safe from null bytes.
+  # This function will keep incrementing the value of "s" until it's safe from null bytes.
+  #
+  def get_safe_size(s)
+    safe_size = get_unsafe_size(s)
+    while (safe_size.to_s(16).rjust(8, '0')).scan(/../).include?("00")
+      safe_size -= 1
+    end
+
+    safe_size
+  end
+
+
+  #
+  # Returns a size that might contain one or more null bytes
+  #
+  def get_unsafe_size(s)
+    0xffffffff - s + 1
+  end
+
+
+  #
+  # Checks if a ROP chain is compatible
+  #
+  def has_target?(rop, target)
+    rop.elements.each('compatibility/target') { |t|
+      return true if t.text =~ /#{target}/i
+    }
+    return false
+  end
+
+  #
+  # Returns the database in XML
+  #
+  def load_rop(file_path)
+    f = File.open(file_path, 'rb')
+    xml = REXML::Document.new(f.read(f.stat.size))
+    f.close
+    return xml
+  end
+
+
+  #
+  # Returns gadgets
+  #
+  def parse_gadgets(e, image_base)
+    gadgets = []
+    e.elements.each('gadgets/gadget') { |g|
+      offset = g.attributes['offset']
+      value  = g.attributes['value']
+
+      if offset
+        addr = offset.scan(/^0x([0-9a-f]+)$/i).flatten[0]
+        gadgets << (image_base + addr.to_i(16))
+      elsif value
+        case value
+        when 'nop'
+          gadgets << :nop
+        when 'junk'
+          gadgets << :junk
+        when 'size'
+          gadgets << :size
+        when 'unsafe_negate_size'
+          gadgets << :unsafe_negate_size
+        when 'safe_negate_size'
+          gadgets << :safe_negate_size
+        else
+          gadgets << value.to_i(16)
+        end
+      else
+        raise RuntimeError, "Missing offset or value attribute in '#{name}'"
+      end
+    }
+    return gadgets
+  end
+end
+
+end
+end

data/lib/rex/exploitation/seh.rb

@@ -15,77 +15,77 @@ module Exploitation
 ###
 class Seh
 
-	#
-	# Creates a new instance of the class and initializes it with the supplied
-	# bad character list.  The space argument denotes how much room is
-	# available for random padding and the NOP argument can be used to generate
-	# a random NOP sled that is better than 0x90.
-	#
-	def initialize(badchars = nil, space = nil, nop = nil)
-		self.badchars = badchars || ''
-		self.space    = (space && space > 121) ? 121 : space
-		self.nop      = nop
-	end
-
-	#
-	# Generates an SEH record
-	#
-	def generate_seh_record(handler, dynamic=false)
-		if (dynamic)
-			generate_dynamic_seh_record(handler)
-		else
-			generate_static_seh_record(handler)
-		end
-	end
-
-	#
-	# Generates a fake SEH registration record with the supplied handler
-	# address for the handler, and a nop generator to use when generating
-	# padding inside the next pointer.  The NOP generator must implement the
-	# 'generate_sled' method that takes a length and a list of bad
-	# characters.
-	#
-	def generate_dynamic_seh_record(handler)
-
-		# Generate the padding up to the size specified or 121 characters
-		# maximum to account for the maximum range of a short jump plus the
-		# record size.
-		pad    = rand(space || 121)
-		rsize  = pad + 8
-
-		# Calculate the random index into the next ptr to store the short jump
-		# instruction
-		jmpidx = rand(3)
-
-		# Build the prefixed sled for the bytes that come before the short jump
-		# instruction
-		sled = (nop) ? nop.generate_sled(jmpidx, badchars) : ("\x90" * jmpidx)
-
-		# Seed the record and any space after the record with random text
-		record = Rex::Text.rand_text(rsize, badchars)
-
-		# Build the next pointer and short jump instruction
-		record[jmpidx, 2] = Rex::Arch::X86.jmp_short((rsize - jmpidx) - 2)
-		record[0, jmpidx] = sled
-
-		# Set the handler in the registration record
-		record[4, 4]      = [ handler ].pack('V')
-
-		# Return the generated record to the caller
-		record
-	end
-
-	#
-	# Generates a static SEH registration record with a specific handler and
-	# next pointer.
-	#
-	def generate_static_seh_record(handler)
-		"\xeb\x06" + Rex::Text.rand_text(2, badchars) + [ handler ].pack('V')
-	end
+  #
+  # Creates a new instance of the class and initializes it with the supplied
+  # bad character list.  The space argument denotes how much room is
+  # available for random padding and the NOP argument can be used to generate
+  # a random NOP sled that is better than 0x90.
+  #
+  def initialize(badchars = nil, space = nil, nop = nil)
+    self.badchars = badchars || ''
+    self.space    = (space && space > 121) ? 121 : space
+    self.nop      = nop
+  end
+
+  #
+  # Generates an SEH record
+  #
+  def generate_seh_record(handler, dynamic=false)
+    if (dynamic)
+      generate_dynamic_seh_record(handler)
+    else
+      generate_static_seh_record(handler)
+    end
+  end
+
+  #
+  # Generates a fake SEH registration record with the supplied handler
+  # address for the handler, and a nop generator to use when generating
+  # padding inside the next pointer.  The NOP generator must implement the
+  # 'generate_sled' method that takes a length and a list of bad
+  # characters.
+  #
+  def generate_dynamic_seh_record(handler)
+
+    # Generate the padding up to the size specified or 121 characters
+    # maximum to account for the maximum range of a short jump plus the
+    # record size.
+    pad    = rand(space || 121)
+    rsize  = pad + 8
+
+    # Calculate the random index into the next ptr to store the short jump
+    # instruction
+    jmpidx = rand(3)
+
+    # Build the prefixed sled for the bytes that come before the short jump
+    # instruction
+    sled = (nop) ? nop.generate_sled(jmpidx, badchars) : ("\x90" * jmpidx)
+
+    # Seed the record and any space after the record with random text
+    record = Rex::Text.rand_text(rsize, badchars)
+
+    # Build the next pointer and short jump instruction
+    record[jmpidx, 2] = Rex::Arch::X86.jmp_short((rsize - jmpidx) - 2)
+    record[0, jmpidx] = sled
+
+    # Set the handler in the registration record
+    record[4, 4]      = [ handler ].pack('V')
+
+    # Return the generated record to the caller
+    record
+  end
+
+  #
+  # Generates a static SEH registration record with a specific handler and
+  # next pointer.
+  #
+  def generate_static_seh_record(handler)
+    "\xeb\x06" + Rex::Text.rand_text(2, badchars) + [ handler ].pack('V')
+  end
 
 protected
 
-	attr_accessor :badchars, :space, :nop # :nodoc:
+  attr_accessor :badchars, :space, :nop # :nodoc:
 
 end
 

data/lib/rex/file.rb

@@ -13,59 +13,106 @@ module Rex
 ###
 module FileUtils
 
-	#
-	# This methods cleans the supplied path of directory traversal sequences
-	# It must accept path/with/..a/folder../starting/or/ending/in/two/dots
-	# but clean ../something as well as path/with/..\traversal
-	#
-	def self.clean_path(old)
-		path = old
-		while(path.index(/\/..\/|\/..\\|\\..\\|\\..\/|\A..\\|\A..\//) != nil)
-			path.gsub!(/\A..\\|\A..\//,'') #eliminate starting ..\ or ../
-			path.gsub!(/\/..\/|\/..\\/,'/') #clean linux style
-			path.gsub!(/\\..\\|\\..\//,'\\') #clean windows style
-		end
-		path
-	end
-
-	#
-	# This method searches the PATH environment variable for
-	# a fully qualified path to the supplied file name.
-	#
-	def self.find_full_path(file_name)
-
-		# Check for the absolute fast first
-		if (file_name[0,1] == "/" and ::File.exists?(file_name) and ::File::Stat.new(file_name))
-			return file_name
-		end
-
-		path = Rex::Compat.getenv('PATH')
-		if (path)
-			path.split(::File::PATH_SEPARATOR).each { |base|
-				begin
-					# Deal with Windows paths surrounded by quotes.  Prevents
-					# silliness like trying to look for
-					# '"C:\\framework\\nmap"\\nmap.exe' which will always fail.
-					base = $1 if base =~ /^"(.*)"$/
-					path = base + ::File::SEPARATOR + file_name
-					if (::File::Stat.new(path) and not ::File.directory?(path))
-						return path
-					end
-				rescue
-				end
-			}
-		end
-		return nil
-	end
+  #
+  # This method joins the paths together in Unix format.
+  #
+  def self.normalize_unix_path(*strs)
+    new_str = strs * '/'
+    new_str = new_str.gsub!("//", "/") while new_str.index("//")
+
+    new_str
+  end
+
+  #
+  # This method joins the paths together in Windows format.
+  # All reserved characters will be filtered out, including:
+  #  " * : < > ? \ / |
+  #
+  def self.normalize_win_path(*strs)
+    # Convert to the same format so the parsing is easier
+    s = strs * '\\'
+
+    # Filter out double slashes
+    s = s.gsub(/\\\\/, '\\') while s.index('\\\\')
+
+    # Keep the trailing slash if exists
+    trailing_s = ('\\' if s =~ /\\$/) || ''
+
+    # Check the items (fie/dir) individually
+    s = s.split(/\\/)
+
+    # Parse the path prefix
+    prefix = (s[0] || '').gsub(/[\*<>\?\/]/, '')
+
+    # Delete the original prefix. We want the new one later.
+    s.delete_at(0)
+
+    # Filter out all the reserved characters
+    s.map! {|e| e.gsub(/["\*:<>\?\\\/|]/, '') }
+
+    # Put the modified prefix back
+    s.insert(0, prefix)
+
+    # And then safely join the items
+    s *= '\\'
+
+    # Add the trailing slash back if exists
+    s << trailing_s
+  end
+
+  #
+  # This method cleans the supplied path of directory traversal sequences
+  # It must accept path/with/..a/folder../starting/or/ending/in/two/dots
+  # but clean ../something as well as path/with/..\traversal
+  #
+  def self.clean_path(old)
+    path = old
+    while(path.index(/\/..\/|\/..\\|\\..\\|\\..\/|\A..\\|\A..\//) != nil)
+      path.gsub!(/\A..\\|\A..\//,'') #eliminate starting ..\ or ../
+      path.gsub!(/\/..\/|\/..\\/,'/') #clean linux style
+      path.gsub!(/\\..\\|\\..\//,'\\') #clean windows style
+    end
+    path
+  end
+
+  #
+  # This method searches the PATH environment variable for
+  # a fully qualified path to the supplied file name.
+  #
+  def self.find_full_path(file_name)
+
+    # Check for the absolute fast first
+    if (file_name[0,1] == "/" and ::File.exists?(file_name) and ::File::Stat.new(file_name))
+      return file_name
+    end
+
+    path = Rex::Compat.getenv('PATH')
+    if (path)
+      path.split(::File::PATH_SEPARATOR).each { |base|
+        begin
+          # Deal with Windows paths surrounded by quotes.  Prevents
+          # silliness like trying to look for
+          # '"C:\\framework\\nmap"\\nmap.exe' which will always fail.
+          base = $1 if base =~ /^"(.*)"$/
+          path = base + ::File::SEPARATOR + file_name
+          if (::File::Stat.new(path) and not ::File.directory?(path))
+            return path
+          end
+        rescue
+        end
+      }
+    end
+    return nil
+  end
 
 end
 
 class Quickfile < ::Tempfile
-	def initialize(*args)
-		super(*args)
-		self.binmode
-		ObjectSpace.undefine_finalizer(self)
-	end
+  def initialize(*args)
+    super(*args)
+    self.binmode
+    ObjectSpace.undefine_finalizer(self)
+  end
 end
 
 module Find