librex 0.0.68 → 0.0.70

Sign up to get free protection for your applications and to get access to all the features.
Files changed (528) hide show
  1. checksums.yaml +15 -0
  2. data/README.markdown +1 -1
  3. data/Rakefile +18 -16
  4. data/lib/rex.rb +14 -10
  5. data/lib/rex/LICENSE +2 -2
  6. data/lib/rex/arch.rb +76 -76
  7. data/lib/rex/arch/sparc.rb +57 -58
  8. data/lib/rex/arch/x86.rb +506 -496
  9. data/lib/rex/assembly/nasm.rb +83 -84
  10. data/lib/rex/compat.rb +228 -173
  11. data/lib/rex/constants.rb +47 -37
  12. data/lib/rex/elfparsey.rb +0 -3
  13. data/lib/rex/elfparsey/elf.rb +107 -110
  14. data/lib/rex/elfparsey/elfbase.rb +244 -247
  15. data/lib/rex/elfparsey/exceptions.rb +0 -3
  16. data/lib/rex/elfscan.rb +0 -3
  17. data/lib/rex/elfscan/scanner.rb +184 -166
  18. data/lib/rex/elfscan/search.rb +35 -38
  19. data/lib/rex/encoder/alpha2.rb +1 -2
  20. data/lib/rex/encoder/alpha2/alpha_mixed.rb +52 -53
  21. data/lib/rex/encoder/alpha2/alpha_upper.rb +62 -63
  22. data/lib/rex/encoder/alpha2/generic.rb +77 -78
  23. data/lib/rex/encoder/alpha2/unicode_mixed.rb +101 -97
  24. data/lib/rex/encoder/alpha2/unicode_upper.rb +106 -107
  25. data/lib/rex/encoder/bloxor/bloxor.rb +326 -0
  26. data/lib/rex/encoder/ndr.rb +68 -68
  27. data/lib/rex/encoder/nonalpha.rb +50 -51
  28. data/lib/rex/encoder/nonupper.rb +50 -51
  29. data/lib/rex/encoder/xdr.rb +78 -78
  30. data/lib/rex/encoder/xor.rb +52 -53
  31. data/lib/rex/encoder/xor/dword.rb +1 -2
  32. data/lib/rex/encoder/xor/dword_additive.rb +1 -2
  33. data/lib/rex/encoders/xor_dword.rb +17 -18
  34. data/lib/rex/encoders/xor_dword_additive.rb +35 -36
  35. data/lib/rex/encoding/xor.rb +0 -1
  36. data/lib/rex/encoding/xor/byte.rb +3 -4
  37. data/lib/rex/encoding/xor/dword.rb +3 -4
  38. data/lib/rex/encoding/xor/dword_additive.rb +72 -73
  39. data/lib/rex/encoding/xor/exceptions.rb +2 -3
  40. data/lib/rex/encoding/xor/generic.rb +129 -130
  41. data/lib/rex/encoding/xor/qword.rb +3 -4
  42. data/lib/rex/encoding/xor/word.rb +3 -4
  43. data/lib/rex/exceptions.rb +100 -101
  44. data/lib/rex/exploitation/cmdstager.rb +3 -3
  45. data/lib/rex/exploitation/cmdstager/base.rb +170 -156
  46. data/lib/rex/exploitation/cmdstager/bourne.rb +105 -0
  47. data/lib/rex/exploitation/cmdstager/debug_asm.rb +110 -113
  48. data/lib/rex/exploitation/cmdstager/debug_write.rb +106 -109
  49. data/lib/rex/exploitation/cmdstager/echo.rb +164 -0
  50. data/lib/rex/exploitation/cmdstager/printf.rb +122 -0
  51. data/lib/rex/exploitation/cmdstager/tftp.rb +34 -27
  52. data/lib/rex/exploitation/cmdstager/vbs.rb +95 -98
  53. data/lib/rex/exploitation/egghunter.rb +359 -346
  54. data/lib/rex/exploitation/encryptjs.rb +60 -60
  55. data/lib/rex/exploitation/heaplib.rb +76 -76
  56. data/lib/rex/exploitation/js.rb +6 -0
  57. data/lib/rex/exploitation/js/detect.rb +69 -0
  58. data/lib/rex/exploitation/js/memory.rb +81 -0
  59. data/lib/rex/exploitation/js/network.rb +84 -0
  60. data/lib/rex/exploitation/js/utils.rb +33 -0
  61. data/lib/rex/exploitation/jsobfu.rb +448 -424
  62. data/lib/rex/exploitation/obfuscatejs.rb +301 -301
  63. data/lib/rex/exploitation/omelet.rb +257 -257
  64. data/lib/rex/exploitation/opcodedb.rb +699 -699
  65. data/lib/rex/exploitation/ropdb.rb +189 -0
  66. data/lib/rex/exploitation/seh.rb +68 -68
  67. data/lib/rex/file.rb +96 -49
  68. data/lib/rex/image_source.rb +0 -3
  69. data/lib/rex/image_source/disk.rb +45 -48
  70. data/lib/rex/image_source/image_source.rb +33 -36
  71. data/lib/rex/image_source/memory.rb +17 -20
  72. data/lib/rex/io/bidirectional_pipe.rb +118 -115
  73. data/lib/rex/io/datagram_abstraction.rb +13 -14
  74. data/lib/rex/io/ring_buffer.rb +273 -273
  75. data/lib/rex/io/stream.rb +284 -284
  76. data/lib/rex/io/stream_abstraction.rb +183 -181
  77. data/lib/rex/io/stream_server.rb +193 -193
  78. data/lib/rex/job_container.rb +167 -167
  79. data/lib/rex/logging.rb +0 -1
  80. data/lib/rex/logging/log_dispatcher.rb +113 -113
  81. data/lib/rex/logging/log_sink.rb +17 -17
  82. data/lib/rex/logging/sinks/flatfile.rb +36 -36
  83. data/lib/rex/logging/sinks/stderr.rb +27 -27
  84. data/lib/rex/mac_oui.rb +16572 -16571
  85. data/lib/rex/machparsey.rb +0 -1
  86. data/lib/rex/machparsey/exceptions.rb +0 -1
  87. data/lib/rex/machparsey/mach.rb +160 -161
  88. data/lib/rex/machparsey/machbase.rb +367 -368
  89. data/lib/rex/machscan.rb +0 -1
  90. data/lib/rex/machscan/scanner.rb +175 -176
  91. data/lib/rex/mime/encoding.rb +17 -0
  92. data/lib/rex/mime/header.rb +58 -58
  93. data/lib/rex/mime/message.rb +140 -137
  94. data/lib/rex/mime/part.rb +41 -12
  95. data/lib/rex/nop/opty2.rb +90 -90
  96. data/lib/rex/nop/opty2_tables.rb +273 -273
  97. data/lib/rex/ole.rb +0 -4
  98. data/lib/rex/ole/clsid.rb +26 -30
  99. data/lib/rex/ole/difat.rb +121 -125
  100. data/lib/rex/ole/directory.rb +205 -209
  101. data/lib/rex/ole/direntry.rb +217 -221
  102. data/lib/rex/ole/fat.rb +79 -83
  103. data/lib/rex/ole/header.rb +178 -182
  104. data/lib/rex/ole/minifat.rb +49 -53
  105. data/lib/rex/ole/propset.rb +113 -117
  106. data/lib/rex/ole/samples/create_ole.rb +8 -9
  107. data/lib/rex/ole/samples/dir.rb +10 -11
  108. data/lib/rex/ole/samples/dump_stream.rb +14 -15
  109. data/lib/rex/ole/samples/ole_info.rb +5 -6
  110. data/lib/rex/ole/storage.rb +372 -376
  111. data/lib/rex/ole/stream.rb +33 -37
  112. data/lib/rex/ole/substorage.rb +20 -24
  113. data/lib/rex/ole/util.rb +137 -141
  114. data/lib/rex/parser/acunetix_nokogiri.rb +398 -398
  115. data/lib/rex/parser/apple_backup_manifestdb.rb +116 -116
  116. data/lib/rex/parser/appscan_nokogiri.rb +359 -359
  117. data/lib/rex/parser/arguments.rb +88 -88
  118. data/lib/rex/parser/burp_session_nokogiri.rb +258 -258
  119. data/lib/rex/parser/ci_nokogiri.rb +184 -184
  120. data/lib/rex/parser/foundstone_nokogiri.rb +334 -333
  121. data/lib/rex/parser/fusionvm_nokogiri.rb +94 -94
  122. data/lib/rex/parser/ini.rb +167 -167
  123. data/lib/rex/parser/ip360_aspl_xml.rb +84 -84
  124. data/lib/rex/parser/ip360_xml.rb +77 -77
  125. data/lib/rex/parser/mbsa_nokogiri.rb +224 -224
  126. data/lib/rex/parser/nessus_xml.rb +100 -100
  127. data/lib/rex/parser/netsparker_xml.rb +89 -75
  128. data/lib/rex/parser/nexpose_raw_nokogiri.rb +677 -677
  129. data/lib/rex/parser/nexpose_simple_nokogiri.rb +322 -322
  130. data/lib/rex/parser/nexpose_xml.rb +105 -105
  131. data/lib/rex/parser/nmap_nokogiri.rb +386 -386
  132. data/lib/rex/parser/nmap_xml.rb +116 -116
  133. data/lib/rex/parser/nokogiri_doc_mixin.rb +223 -221
  134. data/lib/rex/parser/openvas_nokogiri.rb +162 -162
  135. data/lib/rex/parser/outpost24_nokogiri.rb +239 -0
  136. data/lib/rex/parser/retina_xml.rb +90 -90
  137. data/lib/rex/parser/unattend.rb +171 -0
  138. data/lib/rex/parser/wapiti_nokogiri.rb +89 -89
  139. data/lib/rex/payloads/win32/common.rb +14 -14
  140. data/lib/rex/payloads/win32/kernel.rb +36 -36
  141. data/lib/rex/payloads/win32/kernel/common.rb +32 -32
  142. data/lib/rex/payloads/win32/kernel/recovery.rb +27 -27
  143. data/lib/rex/payloads/win32/kernel/stager.rb +170 -170
  144. data/lib/rex/peparsey.rb +0 -3
  145. data/lib/rex/peparsey/exceptions.rb +0 -3
  146. data/lib/rex/peparsey/pe.rb +196 -199
  147. data/lib/rex/peparsey/pe_memdump.rb +35 -38
  148. data/lib/rex/peparsey/pebase.rb +1633 -1652
  149. data/lib/rex/peparsey/section.rb +115 -124
  150. data/lib/rex/pescan.rb +0 -3
  151. data/lib/rex/pescan/analyze.rb +351 -351
  152. data/lib/rex/pescan/scanner.rb +182 -182
  153. data/lib/rex/pescan/search.rb +59 -59
  154. data/lib/rex/platforms/windows.rb +37 -37
  155. data/lib/rex/poly.rb +111 -110
  156. data/lib/rex/poly/block.rb +419 -417
  157. data/lib/rex/poly/machine.rb +12 -0
  158. data/lib/rex/poly/machine/machine.rb +829 -0
  159. data/lib/rex/poly/machine/x86.rb +508 -0
  160. data/lib/rex/poly/register.rb +70 -70
  161. data/lib/rex/poly/register/x86.rb +22 -22
  162. data/lib/rex/post.rb +0 -1
  163. data/lib/rex/post/dir.rb +35 -36
  164. data/lib/rex/post/file.rb +140 -141
  165. data/lib/rex/post/file_stat.rb +198 -199
  166. data/lib/rex/post/io.rb +167 -168
  167. data/lib/rex/post/meterpreter.rb +1 -1
  168. data/lib/rex/post/meterpreter/channel.rb +389 -390
  169. data/lib/rex/post/meterpreter/channel_container.rb +33 -34
  170. data/lib/rex/post/meterpreter/channels/pool.rb +129 -130
  171. data/lib/rex/post/meterpreter/channels/pools/file.rb +35 -36
  172. data/lib/rex/post/meterpreter/channels/pools/stream_pool.rb +72 -73
  173. data/lib/rex/post/meterpreter/channels/stream.rb +62 -63
  174. data/lib/rex/post/meterpreter/client.rb +442 -436
  175. data/lib/rex/post/meterpreter/client_core.rb +326 -310
  176. data/lib/rex/post/meterpreter/dependencies.rb +0 -1
  177. data/lib/rex/post/meterpreter/extension.rb +12 -13
  178. data/lib/rex/post/meterpreter/extensions/espia/espia.rb +35 -36
  179. data/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb +71 -0
  180. data/lib/rex/post/meterpreter/extensions/extapi/clipboard/clipboard.rb +169 -0
  181. data/lib/rex/post/meterpreter/extensions/extapi/extapi.rb +45 -0
  182. data/lib/rex/post/meterpreter/extensions/extapi/service/service.rb +104 -0
  183. data/lib/rex/post/meterpreter/extensions/extapi/tlv.rb +77 -0
  184. data/lib/rex/post/meterpreter/extensions/extapi/window/window.rb +56 -0
  185. data/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb +75 -0
  186. data/lib/rex/post/meterpreter/extensions/incognito/incognito.rb +70 -71
  187. data/lib/rex/post/meterpreter/extensions/kiwi/kiwi.rb +361 -0
  188. data/lib/rex/post/meterpreter/extensions/kiwi/tlv.rb +76 -0
  189. data/lib/rex/post/meterpreter/extensions/lanattacks/dhcp/dhcp.rb +78 -0
  190. data/lib/rex/post/meterpreter/extensions/lanattacks/lanattacks.rb +22 -78
  191. data/lib/rex/post/meterpreter/extensions/lanattacks/tftp/tftp.rb +49 -0
  192. data/lib/rex/post/meterpreter/extensions/lanattacks/tlv.rb +4 -4
  193. data/lib/rex/post/meterpreter/extensions/mimikatz/mimikatz.rb +128 -0
  194. data/lib/rex/post/meterpreter/extensions/mimikatz/tlv.rb +16 -0
  195. data/lib/rex/post/meterpreter/extensions/networkpug/networkpug.rb +38 -39
  196. data/lib/rex/post/meterpreter/extensions/networkpug/tlv.rb +1 -1
  197. data/lib/rex/post/meterpreter/extensions/priv/fs.rb +95 -96
  198. data/lib/rex/post/meterpreter/extensions/priv/passwd.rb +39 -40
  199. data/lib/rex/post/meterpreter/extensions/priv/priv.rb +80 -85
  200. data/lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb +94 -95
  201. data/lib/rex/post/meterpreter/extensions/stdapi/constants.rb +207 -147
  202. data/lib/rex/post/meterpreter/extensions/stdapi/fs/dir.rb +258 -259
  203. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb +366 -301
  204. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file_stat.rb +72 -73
  205. data/lib/rex/post/meterpreter/extensions/stdapi/fs/io.rb +24 -25
  206. data/lib/rex/post/meterpreter/extensions/stdapi/net/arp.rb +59 -0
  207. data/lib/rex/post/meterpreter/extensions/stdapi/net/config.rb +227 -149
  208. data/lib/rex/post/meterpreter/extensions/stdapi/net/interface.rb +107 -108
  209. data/lib/rex/post/meterpreter/extensions/stdapi/net/netstat.rb +97 -0
  210. data/lib/rex/post/meterpreter/extensions/stdapi/net/resolve.rb +106 -0
  211. data/lib/rex/post/meterpreter/extensions/stdapi/net/route.rb +41 -42
  212. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb +102 -101
  213. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb +151 -152
  214. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb +142 -142
  215. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb +185 -185
  216. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb +38118 -38117
  217. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb +7 -7
  218. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_advapi32.rb +2086 -2084
  219. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_crypt32.rb +15 -15
  220. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_iphlpapi.rb +80 -80
  221. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb +3835 -3833
  222. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb +84 -28
  223. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ntdll.rb +151 -137
  224. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_shell32.rb +15 -6
  225. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_user32.rb +3155 -3155
  226. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_version.rb +41 -0
  227. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wlanapi.rb +70 -70
  228. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wldap32.rb +128 -0
  229. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ws2_32.rb +596 -596
  230. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb +310 -301
  231. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb +71 -61
  232. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb +100 -100
  233. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb +14 -14
  234. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/mock_magic.rb +488 -488
  235. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/multicall.rb +273 -264
  236. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb +5 -5
  237. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb +240 -238
  238. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/tlv.rb +17 -15
  239. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb +61 -61
  240. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb +654 -635
  241. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb +49 -49
  242. data/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb +103 -102
  243. data/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb +98 -68
  244. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb +165 -166
  245. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log_subsystem/event_record.rb +16 -17
  246. data/lib/rex/post/meterpreter/extensions/stdapi/sys/power.rb +34 -36
  247. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb +363 -364
  248. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb +102 -103
  249. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/io.rb +28 -29
  250. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb +303 -304
  251. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb +113 -114
  252. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb +260 -261
  253. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb +165 -166
  254. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_value.rb +69 -70
  255. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb +160 -161
  256. data/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb +143 -144
  257. data/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb +29 -12
  258. data/lib/rex/post/meterpreter/extensions/stdapi/ui.rb +230 -231
  259. data/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +181 -44
  260. data/lib/rex/post/meterpreter/inbound_packet_handler.rb +12 -13
  261. data/lib/rex/post/meterpreter/object_aliases.rb +56 -57
  262. data/lib/rex/post/meterpreter/packet.rb +591 -592
  263. data/lib/rex/post/meterpreter/packet_dispatcher.rb +506 -496
  264. data/lib/rex/post/meterpreter/packet_parser.rb +72 -73
  265. data/lib/rex/post/meterpreter/packet_response_waiter.rb +56 -57
  266. data/lib/rex/post/meterpreter/ui/console.rb +112 -112
  267. data/lib/rex/post/meterpreter/ui/console/command_dispatcher.rb +53 -53
  268. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +911 -854
  269. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/espia.rb +86 -86
  270. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi.rb +65 -0
  271. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +198 -0
  272. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard.rb +444 -0
  273. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/service.rb +199 -0
  274. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/window.rb +118 -0
  275. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/wmi.rb +108 -0
  276. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/incognito.rb +220 -220
  277. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/kiwi.rb +509 -0
  278. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks.rb +60 -0
  279. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/dhcp.rb +254 -0
  280. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/tftp.rb +159 -0
  281. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/mimikatz.rb +182 -0
  282. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/networkpug.rb +173 -173
  283. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv.rb +40 -40
  284. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb +75 -77
  285. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/passwd.rb +30 -30
  286. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/timestomp.rb +105 -105
  287. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb +182 -182
  288. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi.rb +37 -37
  289. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb +504 -482
  290. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb +401 -330
  291. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb +883 -581
  292. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/ui.rb +296 -299
  293. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb +320 -153
  294. data/lib/rex/post/meterpreter/ui/console/interactive_channel.rb +78 -78
  295. data/lib/rex/post/permission.rb +0 -1
  296. data/lib/rex/post/process.rb +39 -40
  297. data/lib/rex/post/thread.rb +41 -42
  298. data/lib/rex/post/ui.rb +35 -36
  299. data/lib/rex/proto/addp.rb +218 -0
  300. data/lib/rex/proto/dcerpc/client.rb +344 -344
  301. data/lib/rex/proto/dcerpc/exceptions.rb +128 -128
  302. data/lib/rex/proto/dcerpc/handle.rb +32 -32
  303. data/lib/rex/proto/dcerpc/ndr.rb +56 -56
  304. data/lib/rex/proto/dcerpc/packet.rb +249 -245
  305. data/lib/rex/proto/dcerpc/response.rb +170 -170
  306. data/lib/rex/proto/dcerpc/uuid.rb +65 -65
  307. data/lib/rex/proto/dcerpc/wdscp.rb +3 -0
  308. data/lib/rex/proto/dcerpc/wdscp/constants.rb +89 -0
  309. data/lib/rex/proto/dcerpc/wdscp/packet.rb +94 -0
  310. data/lib/rex/proto/dhcp.rb +0 -1
  311. data/lib/rex/proto/dhcp/constants.rb +0 -1
  312. data/lib/rex/proto/dhcp/server.rb +303 -304
  313. data/lib/rex/proto/drda/constants.rb +1 -1
  314. data/lib/rex/proto/drda/packet.rb +186 -186
  315. data/lib/rex/proto/drda/utils.rb +104 -104
  316. data/lib/rex/proto/http.rb +1 -0
  317. data/lib/rex/proto/http/client.rb +692 -820
  318. data/lib/rex/proto/http/client_request.rb +472 -0
  319. data/lib/rex/proto/http/handler.rb +25 -25
  320. data/lib/rex/proto/http/handler/erb.rb +104 -104
  321. data/lib/rex/proto/http/handler/proc.rb +37 -37
  322. data/lib/rex/proto/http/header.rb +149 -149
  323. data/lib/rex/proto/http/packet.rb +388 -382
  324. data/lib/rex/proto/http/request.rb +332 -335
  325. data/lib/rex/proto/http/response.rb +132 -72
  326. data/lib/rex/proto/http/server.rb +348 -338
  327. data/lib/rex/proto/iax2/call.rb +310 -310
  328. data/lib/rex/proto/iax2/client.rb +197 -197
  329. data/lib/rex/proto/iax2/codecs/alaw.rb +4 -4
  330. data/lib/rex/proto/iax2/codecs/mulaw.rb +4 -4
  331. data/lib/rex/proto/ipmi.rb +57 -0
  332. data/lib/rex/proto/ipmi/channel_auth_reply.rb +88 -0
  333. data/lib/rex/proto/ipmi/open_session_reply.rb +35 -0
  334. data/lib/rex/proto/ipmi/rakp2.rb +35 -0
  335. data/lib/rex/proto/ipmi/utils.rb +125 -0
  336. data/lib/rex/proto/natpmp.rb +1 -5
  337. data/lib/rex/proto/natpmp/constants.rb +4 -4
  338. data/lib/rex/proto/natpmp/packet.rb +25 -25
  339. data/lib/rex/proto/ntlm/base.rb +271 -271
  340. data/lib/rex/proto/ntlm/constants.rb +61 -61
  341. data/lib/rex/proto/ntlm/crypt.rb +348 -352
  342. data/lib/rex/proto/ntlm/exceptions.rb +3 -3
  343. data/lib/rex/proto/ntlm/message.rb +468 -471
  344. data/lib/rex/proto/ntlm/utils.rb +746 -746
  345. data/lib/rex/proto/pjl.rb +30 -0
  346. data/lib/rex/proto/pjl/client.rb +162 -0
  347. data/lib/rex/proto/proxy/socks4a.rb +440 -440
  348. data/lib/rex/proto/rfb.rb +1 -8
  349. data/lib/rex/proto/rfb/cipher.rb +46 -49
  350. data/lib/rex/proto/rfb/client.rb +179 -182
  351. data/lib/rex/proto/rfb/constants.rb +18 -21
  352. data/lib/rex/proto/smb/client.rb +1954 -1843
  353. data/lib/rex/proto/smb/constants.rb +533 -516
  354. data/lib/rex/proto/smb/crypt.rb +21 -21
  355. data/lib/rex/proto/smb/evasions.rb +43 -43
  356. data/lib/rex/proto/smb/exceptions.rb +791 -791
  357. data/lib/rex/proto/smb/simpleclient.rb +142 -286
  358. data/lib/rex/proto/smb/simpleclient/open_file.rb +106 -0
  359. data/lib/rex/proto/smb/simpleclient/open_pipe.rb +57 -0
  360. data/lib/rex/proto/smb/utils.rb +81 -81
  361. data/lib/rex/proto/sunrpc/client.rb +158 -158
  362. data/lib/rex/proto/tftp.rb +0 -1
  363. data/lib/rex/proto/tftp/client.rb +289 -289
  364. data/lib/rex/proto/tftp/constants.rb +9 -10
  365. data/lib/rex/proto/tftp/server.rb +466 -467
  366. data/lib/rex/random_identifier_generator.rb +176 -0
  367. data/lib/rex/registry.rb +1 -1
  368. data/lib/rex/registry/hive.rb +88 -88
  369. data/lib/rex/registry/lfkey.rb +25 -25
  370. data/lib/rex/registry/nodekey.rb +30 -30
  371. data/lib/rex/registry/regf.rb +10 -10
  372. data/lib/rex/registry/valuekey.rb +43 -43
  373. data/lib/rex/registry/valuelist.rb +13 -13
  374. data/lib/rex/ropbuilder/rop.rb +254 -253
  375. data/lib/rex/script.rb +21 -22
  376. data/lib/rex/script/base.rb +51 -50
  377. data/lib/rex/script/meterpreter.rb +2 -2
  378. data/lib/rex/service.rb +24 -24
  379. data/lib/rex/service_manager.rb +132 -132
  380. data/lib/rex/services/local_relay.rb +398 -398
  381. data/lib/rex/socket.rb +758 -763
  382. data/lib/rex/socket/comm.rb +95 -95
  383. data/lib/rex/socket/comm/local.rb +507 -440
  384. data/lib/rex/socket/ip.rb +118 -118
  385. data/lib/rex/socket/parameters.rb +351 -350
  386. data/lib/rex/socket/range_walker.rb +445 -368
  387. data/lib/rex/socket/ssl_tcp.rb +323 -317
  388. data/lib/rex/socket/ssl_tcp_server.rb +173 -158
  389. data/lib/rex/socket/subnet_walker.rb +48 -48
  390. data/lib/rex/socket/switch_board.rb +259 -259
  391. data/lib/rex/socket/tcp.rb +58 -56
  392. data/lib/rex/socket/tcp_server.rb +42 -42
  393. data/lib/rex/socket/udp.rb +152 -152
  394. data/lib/rex/sslscan/result.rb +200 -0
  395. data/lib/rex/sslscan/scanner.rb +205 -0
  396. data/lib/rex/struct2.rb +0 -1
  397. data/lib/rex/struct2/c_struct.rb +162 -163
  398. data/lib/rex/struct2/c_struct_template.rb +21 -22
  399. data/lib/rex/struct2/constant.rb +6 -7
  400. data/lib/rex/struct2/element.rb +30 -31
  401. data/lib/rex/struct2/generic.rb +60 -61
  402. data/lib/rex/struct2/restraint.rb +40 -41
  403. data/lib/rex/struct2/s_string.rb +60 -61
  404. data/lib/rex/struct2/s_struct.rb +97 -98
  405. data/lib/rex/sync.rb +0 -1
  406. data/lib/rex/sync/event.rb +62 -72
  407. data/lib/rex/sync/read_write_lock.rb +149 -149
  408. data/lib/rex/sync/ref.rb +42 -42
  409. data/lib/rex/sync/thread_safe.rb +59 -59
  410. data/lib/rex/text.rb +1803 -1315
  411. data/lib/rex/thread_factory.rb +25 -25
  412. data/lib/rex/time.rb +44 -44
  413. data/lib/rex/transformer.rb +91 -91
  414. data/lib/rex/ui/interactive.rb +265 -265
  415. data/lib/rex/ui/output.rb +66 -60
  416. data/lib/rex/ui/progress_tracker.rb +79 -79
  417. data/lib/rex/ui/subscriber.rb +144 -134
  418. data/lib/rex/ui/text/color.rb +76 -76
  419. data/lib/rex/ui/text/dispatcher_shell.rb +512 -505
  420. data/lib/rex/ui/text/input.rb +96 -96
  421. data/lib/rex/ui/text/input/buffer.rb +58 -58
  422. data/lib/rex/ui/text/input/readline.rb +114 -114
  423. data/lib/rex/ui/text/input/socket.rb +77 -77
  424. data/lib/rex/ui/text/input/stdio.rb +24 -24
  425. data/lib/rex/ui/text/irb_shell.rb +45 -41
  426. data/lib/rex/ui/text/output.rb +64 -60
  427. data/lib/rex/ui/text/output/buffer.rb +42 -42
  428. data/lib/rex/ui/text/output/buffer/stdout.rb +25 -0
  429. data/lib/rex/ui/text/output/file.rb +24 -24
  430. data/lib/rex/ui/text/output/socket.rb +24 -24
  431. data/lib/rex/ui/text/output/stdio.rb +29 -29
  432. data/lib/rex/ui/text/output/tee.rb +36 -36
  433. data/lib/rex/ui/text/progress_tracker.rb +37 -37
  434. data/lib/rex/ui/text/shell.rb +371 -361
  435. data/lib/rex/ui/text/table.rb +320 -284
  436. data/lib/rex/zip.rb +0 -1
  437. data/lib/rex/zip/archive.rb +115 -94
  438. data/lib/rex/zip/blocks.rb +101 -100
  439. data/lib/rex/zip/entry.rb +108 -99
  440. data/lib/rex/zip/jar.rb +261 -206
  441. data/lib/rex/zip/samples/comment.rb +1 -2
  442. data/lib/rex/zip/samples/mkwar.rb +12 -13
  443. data/lib/rex/zip/samples/mkzip.rb +1 -2
  444. data/lib/rex/zip/samples/recursive.rb +29 -30
  445. metadata +424 -446
  446. data/lib/rex/arch/sparc.rb.ut.rb +0 -19
  447. data/lib/rex/arch/x86.rb.ut.rb +0 -94
  448. data/lib/rex/assembly/nasm.rb.ut.rb +0 -23
  449. data/lib/rex/encoder/ndr.rb.ut.rb +0 -45
  450. data/lib/rex/encoder/xdr.rb.ut.rb +0 -30
  451. data/lib/rex/encoders/xor_dword_additive.rb.ut.rb +0 -13
  452. data/lib/rex/encoding/xor.rb.ts.rb +0 -15
  453. data/lib/rex/encoding/xor/byte.rb.ut.rb +0 -22
  454. data/lib/rex/encoding/xor/dword.rb.ut.rb +0 -16
  455. data/lib/rex/encoding/xor/dword_additive.rb.ut.rb +0 -16
  456. data/lib/rex/encoding/xor/generic.rb.ut.rb +0 -121
  457. data/lib/rex/encoding/xor/word.rb.ut.rb +0 -14
  458. data/lib/rex/exceptions.rb.ut.rb +0 -45
  459. data/lib/rex/exploitation/egghunter.rb.ut.rb +0 -28
  460. data/lib/rex/exploitation/javascriptosdetect.js +0 -1014
  461. data/lib/rex/exploitation/javascriptosdetect.rb +0 -43
  462. data/lib/rex/exploitation/omelet.rb.ut.rb +0 -27
  463. data/lib/rex/exploitation/opcodedb.rb.ut.rb +0 -280
  464. data/lib/rex/exploitation/seh.rb.ut.rb +0 -20
  465. data/lib/rex/file.rb.ut.rb +0 -17
  466. data/lib/rex/io/ring_buffer.rb.ut.rb +0 -135
  467. data/lib/rex/nop/opty2.rb.ut.rb +0 -24
  468. data/lib/rex/parser/arguments.rb.ut.rb +0 -68
  469. data/lib/rex/parser/ini.rb.ut.rb +0 -30
  470. data/lib/rex/post/meterpreter/extensions/stdapi/railgun.rb.ts.rb +0 -18
  471. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb.ut.rb +0 -39
  472. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb.ut.rb +0 -37
  473. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb.ut.rb +0 -52
  474. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb.ut.rb +0 -43
  475. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb.ut.rb +0 -128
  476. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb.ut.rb +0 -64
  477. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb.ut.rb +0 -29
  478. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb.ut.rb +0 -155
  479. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb.ut.rb +0 -128
  480. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb.ut.rb +0 -124
  481. data/lib/rex/proto.rb.ts.rb +0 -9
  482. data/lib/rex/proto/dcerpc.rb.ts.rb +0 -10
  483. data/lib/rex/proto/dcerpc/client.rb.ut.rb +0 -492
  484. data/lib/rex/proto/dcerpc/handle.rb.ut.rb +0 -86
  485. data/lib/rex/proto/dcerpc/ndr.rb.ut.rb +0 -42
  486. data/lib/rex/proto/dcerpc/packet.rb.ut.rb +0 -57
  487. data/lib/rex/proto/dcerpc/response.rb.ut.rb +0 -16
  488. data/lib/rex/proto/dcerpc/uuid.rb.ut.rb +0 -47
  489. data/lib/rex/proto/drda.rb.ts.rb +0 -18
  490. data/lib/rex/proto/drda/constants.rb.ut.rb +0 -24
  491. data/lib/rex/proto/drda/packet.rb.ut.rb +0 -110
  492. data/lib/rex/proto/drda/utils.rb.ut.rb +0 -85
  493. data/lib/rex/proto/http.rb.ts.rb +0 -13
  494. data/lib/rex/proto/http/client.rb.ut.rb +0 -96
  495. data/lib/rex/proto/http/handler/erb.rb.ut.rb +0 -22
  496. data/lib/rex/proto/http/handler/erb.rb.ut.rb.rhtml +0 -1
  497. data/lib/rex/proto/http/handler/proc.rb.ut.rb +0 -25
  498. data/lib/rex/proto/http/header.rb.ut.rb +0 -47
  499. data/lib/rex/proto/http/packet.rb.ut.rb +0 -166
  500. data/lib/rex/proto/http/request.rb.ut.rb +0 -215
  501. data/lib/rex/proto/http/response.rb.ut.rb +0 -150
  502. data/lib/rex/proto/http/server.rb.ut.rb +0 -80
  503. data/lib/rex/proto/ntlm.rb.ut.rb +0 -181
  504. data/lib/rex/proto/rfb.rb.ut.rb +0 -40
  505. data/lib/rex/proto/smb.rb.ts.rb +0 -9
  506. data/lib/rex/proto/smb/client.rb.ut.rb +0 -224
  507. data/lib/rex/proto/smb/constants.rb.ut.rb +0 -19
  508. data/lib/rex/proto/smb/simpleclient.rb.ut.rb +0 -129
  509. data/lib/rex/proto/smb/utils.rb.ut.rb +0 -21
  510. data/lib/rex/proto/tftp/server.rb.ut.rb +0 -29
  511. data/lib/rex/service_manager.rb.ut.rb +0 -33
  512. data/lib/rex/socket.rb.ut.rb +0 -108
  513. data/lib/rex/socket/comm/local.rb.ut.rb +0 -76
  514. data/lib/rex/socket/parameters.rb.ut.rb +0 -52
  515. data/lib/rex/socket/range_walker.rb.ut.rb +0 -56
  516. data/lib/rex/socket/ssl_tcp.rb.ut.rb +0 -40
  517. data/lib/rex/socket/ssl_tcp_server.rb.ut.rb +0 -62
  518. data/lib/rex/socket/subnet_walker.rb.ut.rb +0 -29
  519. data/lib/rex/socket/switch_board.rb.ut.rb +0 -53
  520. data/lib/rex/socket/tcp.rb.ut.rb +0 -65
  521. data/lib/rex/socket/tcp_server.rb.ut.rb +0 -45
  522. data/lib/rex/socket/udp.rb.ut.rb +0 -45
  523. data/lib/rex/test.rb +0 -36
  524. data/lib/rex/text.rb.ut.rb +0 -193
  525. data/lib/rex/transformer.rb.ut.rb +0 -39
  526. data/lib/rex/ui/text/color.rb.ut.rb +0 -19
  527. data/lib/rex/ui/text/progress_tracker.rb.ut.rb +0 -35
  528. data/lib/rex/ui/text/table.rb.ut.rb +0 -56
@@ -5,84 +5,84 @@ module Rex
5
5
  module Encoder
6
6
  module NDR
7
7
 
8
- # Provide padding to align the string to the 32bit boundary
9
- def NDR.align(string)
10
- return "\x00" * ((4 - (string.length & 3)) & 3)
11
- end
8
+ # Provide padding to align the string to the 32bit boundary
9
+ def NDR.align(string)
10
+ return "\x00" * ((4 - (string.length & 3)) & 3)
11
+ end
12
12
 
13
- # Encode a 4 byte long
14
- # use to encode:
15
- # long element_1;
16
- def NDR.long(string)
17
- return [string].pack('V')
18
- end
13
+ # Encode a 4 byte long
14
+ # use to encode:
15
+ # long element_1;
16
+ def NDR.long(string)
17
+ return [string].pack('V')
18
+ end
19
19
 
20
- # Encode a 2 byte short
21
- # use to encode:
22
- # short element_1;
23
- def NDR.short(string)
24
- return [string].pack('v')
25
- end
20
+ # Encode a 2 byte short
21
+ # use to encode:
22
+ # short element_1;
23
+ def NDR.short(string)
24
+ return [string].pack('v')
25
+ end
26
26
 
27
- # Encode a single byte
28
- # use to encode:
29
- # byte element_1;
30
- def NDR.byte(string)
31
- return [string].pack('c')
32
- end
27
+ # Encode a single byte
28
+ # use to encode:
29
+ # byte element_1;
30
+ def NDR.byte(string)
31
+ return [string].pack('c')
32
+ end
33
33
 
34
- # Encode a byte array
35
- # use to encode:
36
- # char element_1
37
- def NDR.UniConformantArray(string)
38
- return long(string.length) + string + align(string)
39
- end
34
+ # Encode a byte array
35
+ # use to encode:
36
+ # char element_1
37
+ def NDR.UniConformantArray(string)
38
+ return long(string.length) + string + align(string)
39
+ end
40
40
 
41
- # Encode a string
42
- # use to encode:
43
- # char *element_1;
44
- def NDR.string(string)
45
- string << "\x00" # null pad
46
- return long(string.length) + long(0) + long(string.length) + string + align(string)
47
- end
41
+ # Encode a string
42
+ # use to encode:
43
+ # char *element_1;
44
+ def NDR.string(string)
45
+ string << "\x00" # null pad
46
+ return long(string.length) + long(0) + long(string.length) + string + align(string)
47
+ end
48
48
 
49
- # Encode a string
50
- # use to encode:
51
- # w_char *element_1;
52
- def NDR.wstring(string)
53
- string = string + "\x00" # null pad
54
- return long(string.length) + long(0) + long(string.length) + Rex::Text.to_unicode(string) + align(Rex::Text.to_unicode(string))
55
- end
49
+ # Encode a string
50
+ # use to encode:
51
+ # w_char *element_1;
52
+ def NDR.wstring(string)
53
+ string = string + "\x00" # null pad
54
+ return long(string.length) + long(0) + long(string.length) + Rex::Text.to_unicode(string) + align(Rex::Text.to_unicode(string))
55
+ end
56
56
 
57
- # Encode a string and make it unique
58
- # use to encode:
59
- # [unique] w_char *element_1;
60
- def NDR.uwstring(string)
61
- string = string + "\x00" # null pad
62
- return long(rand(0xffffffff))+long(string.length) + long(0) + long(string.length) + Rex::Text.to_unicode(string) + align(Rex::Text.to_unicode(string))
63
- end
57
+ # Encode a string and make it unique
58
+ # use to encode:
59
+ # [unique] w_char *element_1;
60
+ def NDR.uwstring(string)
61
+ string = string + "\x00" # null pad
62
+ return long(rand(0xffffffff))+long(string.length) + long(0) + long(string.length) + Rex::Text.to_unicode(string) + align(Rex::Text.to_unicode(string))
63
+ end
64
64
 
65
- # Encode a string that is already unicode encoded
66
- # use to encode:
67
- # w_char *element_1;
68
- def NDR.wstring_prebuilt(string)
69
- # if the string len is odd, thats bad!
70
- if string.length % 2 > 0
71
- string = string + "\x00"
72
- end
73
- len = string.length / 2;
74
- return long(len) + long(0) + long(len) + string + align(string)
75
- end
65
+ # Encode a string that is already unicode encoded
66
+ # use to encode:
67
+ # w_char *element_1;
68
+ def NDR.wstring_prebuilt(string)
69
+ # if the string len is odd, thats bad!
70
+ if string.length % 2 > 0
71
+ string = string + "\x00"
72
+ end
73
+ len = string.length / 2;
74
+ return long(len) + long(0) + long(len) + string + align(string)
75
+ end
76
76
 
77
- # alias to wstring, going away soon
78
- def NDR.UnicodeConformantVaryingString(string)
79
- NDR.wstring(string)
80
- end
77
+ # alias to wstring, going away soon
78
+ def NDR.UnicodeConformantVaryingString(string)
79
+ NDR.wstring(string)
80
+ end
81
81
 
82
- # alias to wstring_prebuilt, going away soon
83
- def NDR.UnicodeConformantVaryingStringPreBuilt(string)
84
- NDR.wstring_prebuilt(string)
85
- end
82
+ # alias to wstring_prebuilt, going away soon
83
+ def NDR.UnicodeConformantVaryingStringPreBuilt(string)
84
+ NDR.wstring_prebuilt(string)
85
+ end
86
86
 
87
87
  end
88
88
  end
@@ -1,4 +1,3 @@
1
- #!/usr/bin/env ruby
2
1
  # -*- coding: binary -*-
3
2
 
4
3
  require 'rex/text'
@@ -8,55 +7,55 @@ module Encoder
8
7
 
9
8
  class NonAlpha
10
9
 
11
- def NonAlpha.gen_decoder()
12
- decoder =
13
- "\x66\xB9\xFF\xFF" +
14
- "\xEB\x19" + # Jmp to table
15
- "\x5E" + # pop esi
16
- "\x8B\xFE" + # mov edi, esi - Get table addr
17
- "\x83\xC7" + "A" + # add edi, tablelen - Get shellcode addr
18
- "\x8B\xD7" + # mov edx, edi - Hold end of table ptr
19
- "\x3B\xF2" + # cmp esi, edx
20
- "\x7D\x0B" + # jle to end
21
- "\xB0\x7B" + # mov eax, 0x7B - Set up eax with magic
22
- "\xF2\xAE" + # repne scasb - Find magic!
23
- "\xFF\xCF" + # dec edi - scasb purs us one ahead
24
- "\xAC" + # lodsb
25
- "\x28\x07" + # subb [edi], al
26
- "\xEB\xF1" + # jmp BACK!
27
- "\xEB" + "B" + # jmp [shellcode]
28
- "\xE8\xE2\xFF\xFF\xFF"
29
- end
30
-
31
- def NonAlpha.encode_byte(block, table, tablelen)
32
- if (tablelen > 255) or (block == 0x7B)
33
- raise RuntimeError, "BadChar"
34
- end
35
-
36
- if (block >= 0x41 and block <= 0x5A) or (block >= 0x61 and block <= 0x7A)
37
- # gen offset, return magic
38
- offset = 0x7b - block;
39
- table += offset.chr
40
- tablelen = tablelen + 1
41
- block = 0x7B
42
- end
43
-
44
- return [block.chr, table, tablelen]
45
- end
46
-
47
- def NonAlpha.encode(buf)
48
- table = ""
49
- tablelen = 0
50
- nonascii = ""
51
- encoded = gen_decoder()
52
- buf.each_byte { |block|
53
- newchar, table, tablelen = encode_byte(block.unpack('C')[0], table, tablelen)
54
- nonascii += newchar
55
- }
56
- encoded.gsub!(/A/, tablelen)
57
- encoded.gsub!(/B/, tablelen+5)
58
- encoded += table
59
- encoded += nonascii
60
- end
10
+ def NonAlpha.gen_decoder()
11
+ decoder =
12
+ "\x66\xB9\xFF\xFF" +
13
+ "\xEB\x19" + # Jmp to table
14
+ "\x5E" + # pop esi
15
+ "\x8B\xFE" + # mov edi, esi - Get table addr
16
+ "\x83\xC7" + "A" + # add edi, tablelen - Get shellcode addr
17
+ "\x8B\xD7" + # mov edx, edi - Hold end of table ptr
18
+ "\x3B\xF2" + # cmp esi, edx
19
+ "\x7D\x0B" + # jle to end
20
+ "\xB0\x7B" + # mov eax, 0x7B - Set up eax with magic
21
+ "\xF2\xAE" + # repne scasb - Find magic!
22
+ "\xFF\xCF" + # dec edi - scasb purs us one ahead
23
+ "\xAC" + # lodsb
24
+ "\x28\x07" + # subb [edi], al
25
+ "\xEB\xF1" + # jmp BACK!
26
+ "\xEB" + "B" + # jmp [shellcode]
27
+ "\xE8\xE2\xFF\xFF\xFF"
28
+ end
29
+
30
+ def NonAlpha.encode_byte(block, table, tablelen)
31
+ if (tablelen > 255) or (block == 0x7B)
32
+ raise RuntimeError, "BadChar"
33
+ end
34
+
35
+ if (block >= 0x41 and block <= 0x5A) or (block >= 0x61 and block <= 0x7A)
36
+ # gen offset, return magic
37
+ offset = 0x7b - block;
38
+ table += offset.chr
39
+ tablelen = tablelen + 1
40
+ block = 0x7B
41
+ end
42
+
43
+ return [block.chr, table, tablelen]
44
+ end
45
+
46
+ def NonAlpha.encode(buf)
47
+ table = ""
48
+ tablelen = 0
49
+ nonascii = ""
50
+ encoded = gen_decoder()
51
+ buf.each_byte { |block|
52
+ newchar, table, tablelen = encode_byte(block.unpack('C')[0], table, tablelen)
53
+ nonascii += newchar
54
+ }
55
+ encoded.gsub!(/A/, tablelen)
56
+ encoded.gsub!(/B/, tablelen+5)
57
+ encoded += table
58
+ encoded += nonascii
59
+ end
61
60
 
62
61
  end end end
@@ -1,4 +1,3 @@
1
- #!/usr/bin/env ruby
2
1
  # -*- coding: binary -*-
3
2
 
4
3
  require 'rex/text'
@@ -7,59 +6,59 @@ module Rex
7
6
  module Encoder
8
7
 
9
8
  class NonUpper
10
-
11
-
12
- def NonUpper.gen_decoder()
13
- decoder =
14
- "\x66\xB9\xFF\xFF" +
15
- "\xEB\x19" + # Jmp to table
16
- "\x5E" + # pop esi
17
- "\x8B\xFE" + # mov edi, esi - Get table addr
18
- "\x83\xC7" + "A" + # add edi, tablelen - Get shellcode addr
19
- "\x8B\xD7" + # mov edx, edi - Hold end of table ptr
20
- "\x3B\xF2" + # cmp esi, edx
21
- "\x7D\x0B" + # jle to end
22
- "\xB0\x7B" + # mov eax, 0x7B - Set up eax with magic
23
- "\xF2\xAE" + # repne scasb - Find magic!
24
- "\xFF\xCF" + # dec edi - scasb purs us one ahead
25
- "\xAC" + # lodsb
26
- "\x28\x07" + # subb [edi], al
27
- "\xEB\xF1" + # jmp BACK!
28
- "\xEB" + "B" + # jmp [shellcode]
29
- "\xE8\xE2\xFF\xFF\xFF"
30
- end
31
9
 
32
- def NonUpper.encode_byte(badchars, block, table, tablelen)
33
- if (tablelen > 255) or (block == 0x40)
34
- raise RuntimeError, "BadChar"
35
- end
36
-
37
- if (block >= 0x41 and block <= 0x40) or (badchars =~ block)
38
- # gen offset, return magic
39
- offset = 0x40 - block;
40
- table += offset.chr
41
- tablelen = tablelen + 1
42
- block = 0x40
43
- end
44
10
 
45
- return [block.chr, table, tablelen]
46
- end
11
+ def NonUpper.gen_decoder()
12
+ decoder =
13
+ "\x66\xB9\xFF\xFF" +
14
+ "\xEB\x19" + # Jmp to table
15
+ "\x5E" + # pop esi
16
+ "\x8B\xFE" + # mov edi, esi - Get table addr
17
+ "\x83\xC7" + "A" + # add edi, tablelen - Get shellcode addr
18
+ "\x8B\xD7" + # mov edx, edi - Hold end of table ptr
19
+ "\x3B\xF2" + # cmp esi, edx
20
+ "\x7D\x0B" + # jle to end
21
+ "\xB0\x7B" + # mov eax, 0x7B - Set up eax with magic
22
+ "\xF2\xAE" + # repne scasb - Find magic!
23
+ "\xFF\xCF" + # dec edi - scasb purs us one ahead
24
+ "\xAC" + # lodsb
25
+ "\x28\x07" + # subb [edi], al
26
+ "\xEB\xF1" + # jmp BACK!
27
+ "\xEB" + "B" + # jmp [shellcode]
28
+ "\xE8\xE2\xFF\xFF\xFF"
29
+ end
47
30
 
48
- def NonUpper.encode(buf)
49
- table = ""
50
- tablelen = 0
51
- nonascii = ""
52
- encoded = gen_decoder()
53
- buf.each_byte {
54
- |block|
31
+ def NonUpper.encode_byte(badchars, block, table, tablelen)
32
+ if (tablelen > 255) or (block == 0x40)
33
+ raise RuntimeError, "BadChar"
34
+ end
55
35
 
56
- newchar, table, tablelen = encode_byte(block.unpack('C')[0], table, tablelen)
57
- nonascii += newchar
58
- }
59
- encoded.gsub!(/A/, tablelen)
60
- encoded.gsub!(/B/, tablelen+5)
61
- encoded += table
62
- encoded += nonascii
63
- end
36
+ if (block >= 0x41 and block <= 0x40) or (badchars =~ block)
37
+ # gen offset, return magic
38
+ offset = 0x40 - block;
39
+ table += offset.chr
40
+ tablelen = tablelen + 1
41
+ block = 0x40
42
+ end
43
+
44
+ return [block.chr, table, tablelen]
45
+ end
46
+
47
+ def NonUpper.encode(buf)
48
+ table = ""
49
+ tablelen = 0
50
+ nonascii = ""
51
+ encoded = gen_decoder()
52
+ buf.each_byte {
53
+ |block|
54
+
55
+ newchar, table, tablelen = encode_byte(block.unpack('C')[0], table, tablelen)
56
+ nonascii += newchar
57
+ }
58
+ encoded.gsub!(/A/, tablelen)
59
+ encoded.gsub!(/B/, tablelen+5)
60
+ encoded += table
61
+ encoded += nonascii
62
+ end
64
63
 
65
64
  end end end
@@ -8,99 +8,99 @@ module Encoder
8
8
  #
9
9
  ###
10
10
  module XDR
11
- MAX_ARG = 0xffffffff
11
+ MAX_ARG = 0xffffffff
12
12
 
13
- # Also: unsigned int, bool, enum
14
- def XDR.encode_int(int)
15
- return [int].pack('N')
16
- end
13
+ # Also: unsigned int, bool, enum
14
+ def XDR.encode_int(int)
15
+ return [int].pack('N')
16
+ end
17
17
 
18
- def XDR.decode_int!(data)
19
- return data.slice!(0..3).unpack('N')[0] if data
18
+ def XDR.decode_int!(data)
19
+ return data.slice!(0..3).unpack('N')[0] if data
20
20
  data = 0
21
- end
21
+ end
22
22
 
23
- def XDR.encode_lchar(char)
24
- char |= 0xffffff00 if char & 0x80 != 0
25
- return encode_int(char)
26
- end
23
+ def XDR.encode_lchar(char)
24
+ char |= 0xffffff00 if char & 0x80 != 0
25
+ return encode_int(char)
26
+ end
27
27
 
28
- def XDR.decode_lchar!(data)
29
- return (decode_int!(data) & 0xff).chr
30
- end
28
+ def XDR.decode_lchar!(data)
29
+ return (decode_int!(data) & 0xff).chr
30
+ end
31
31
 
32
- # Also: Variable length opaque
33
- def XDR.encode_string(str, max=MAX_ARG)
34
- raise ArgumentError, 'XDR: String too long' if str.length > max
35
- len = str.length
36
- str << "\x00" * ((4 - (len & 3)) & 3)
37
- return encode_int(len) + str
38
- end
32
+ # Also: Variable length opaque
33
+ def XDR.encode_string(str, max=MAX_ARG)
34
+ raise ArgumentError, 'XDR: String too long' if str.length > max
35
+ len = str.length
36
+ str << "\x00" * ((4 - (len & 3)) & 3)
37
+ return encode_int(len) + str
38
+ end
39
39
 
40
- def XDR.decode_string!(data)
41
- real_len = decode_int!(data)
42
- return "" if real_len == 0
43
- align_len = (real_len + 3) & ~3
44
- return data.slice!(0..align_len-1).slice(0..real_len-1)
45
- end
40
+ def XDR.decode_string!(data)
41
+ real_len = decode_int!(data)
42
+ return "" if real_len == 0
43
+ align_len = (real_len + 3) & ~3
44
+ return data.slice!(0..align_len-1).slice(0..real_len-1)
45
+ end
46
46
 
47
- def XDR.encode_varray(arr, max=MAX_ARG, &block)
48
- raise ArgumentError, 'XDR: Too many array elements' if arr.length > max
49
- return encode_int(arr.length) + arr.collect(&block).join(nil)
50
- end
47
+ def XDR.encode_varray(arr, max=MAX_ARG, &block)
48
+ raise ArgumentError, 'XDR: Too many array elements' if arr.length > max
49
+ return encode_int(arr.length) + arr.collect(&block).join(nil)
50
+ end
51
51
 
52
- def XDR.decode_varray!(data)
53
- buf = []
54
- 1.upto(decode_int!(data)) { buf.push(yield(data)) }
55
- return buf
56
- end
52
+ def XDR.decode_varray!(data)
53
+ buf = []
54
+ 1.upto(decode_int!(data)) { buf.push(yield(data)) }
55
+ return buf
56
+ end
57
57
 
58
- # encode(0, [0, 1], "foo", ["bar", 4]) does:
59
- # encode_int(0) +
60
- # encode_varray([0, 1]) { |i| XDR.encode_int(i) } +
61
- # encode_string("foo") +
62
- # encode_string("bar", 4)
63
- def XDR.encode(*data)
64
- data.collect do |var|
65
- if var.kind_of?(String)
66
- encode_string(var)
67
- elsif var.kind_of?(Integer)
68
- encode_int(var)
69
- elsif var.kind_of?(Array) && var[0].kind_of?(String)
70
- raise ArgumentError, 'XDR: Incorrect string array arguments' if var.length != 2
71
- encode_string(var[0], var[1])
72
- elsif var.kind_of?(Array) && var[0].kind_of?(Integer)
73
- encode_varray(var) { |i| XDR.encode_int(i) }
74
- # 0 means an empty array index in the case of Integer and an empty string in
75
- # the case of String so we get the best of both worlds
76
- elsif var.kind_of?(Array) && var[0].nil?
77
- encode_int(0)
78
- else
79
- type = var.class
80
- type = var[0].class if var.kind_of?(Array)
81
- raise TypeError, "XDR: encode does not support #{type}"
82
- end
83
- end.join(nil)
84
- end
58
+ # encode(0, [0, 1], "foo", ["bar", 4]) does:
59
+ # encode_int(0) +
60
+ # encode_varray([0, 1]) { |i| XDR.encode_int(i) } +
61
+ # encode_string("foo") +
62
+ # encode_string("bar", 4)
63
+ def XDR.encode(*data)
64
+ data.collect do |var|
65
+ if var.kind_of?(String)
66
+ encode_string(var)
67
+ elsif var.kind_of?(Integer)
68
+ encode_int(var)
69
+ elsif var.kind_of?(Array) && var[0].kind_of?(String)
70
+ raise ArgumentError, 'XDR: Incorrect string array arguments' if var.length != 2
71
+ encode_string(var[0], var[1])
72
+ elsif var.kind_of?(Array) && var[0].kind_of?(Integer)
73
+ encode_varray(var) { |i| XDR.encode_int(i) }
74
+ # 0 means an empty array index in the case of Integer and an empty string in
75
+ # the case of String so we get the best of both worlds
76
+ elsif var.kind_of?(Array) && var[0].nil?
77
+ encode_int(0)
78
+ else
79
+ type = var.class
80
+ type = var[0].class if var.kind_of?(Array)
81
+ raise TypeError, "XDR: encode does not support #{type}"
82
+ end
83
+ end.join(nil)
84
+ end
85
85
 
86
86
  # decode(buf, Integer, String, [Integer], [String]) does:
87
87
  # [decode_int!(buf), decode_string!(buf),
88
88
  # decode_varray!(buf) { |i| XDR.decode_int!(i) },
89
89
  # decode_varray!(buf) { |s| XDR.decode_string(s) }]
90
- def XDR.decode!(buf, *data)
91
- return *data.collect do |var|
92
- if data.length == 0
93
- elsif var.kind_of?(Array) && var[0] == String
94
- decode_varray!(buf) { |s| XDR.decode_string!(s) }
95
- elsif var.kind_of?(Array) && var[0] == Integer
96
- decode_varray!(buf) { |i| XDR.decode_int!(i) }
97
- elsif var == String
98
- decode_string!(buf)
99
- elsif var == Integer
100
- decode_int!(buf)
101
- end
102
- end
103
- end
90
+ def XDR.decode!(buf, *data)
91
+ return *data.collect do |var|
92
+ if data.length == 0
93
+ elsif var.kind_of?(Array) && var[0] == String
94
+ decode_varray!(buf) { |s| XDR.decode_string!(s) }
95
+ elsif var.kind_of?(Array) && var[0] == Integer
96
+ decode_varray!(buf) { |i| XDR.decode_int!(i) }
97
+ elsif var == String
98
+ decode_string!(buf)
99
+ elsif var == Integer
100
+ decode_int!(buf)
101
+ end
102
+ end
103
+ end
104
104
  end
105
105
 
106
106
  end