metasploit_payloads-mettle 1.0.48.pre.1 → 1.0.48.pre.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8235852f0bf86bbc1161af81e7d93043de5033e3ffe0e296905dd9195f0deccc
-  data.tar.gz: 117057997f13fd669c73aa379b0390a783f453c608475fff4b7e412bffd2dbb5
+  metadata.gz: 9300e087f6aeb5624418edca451f73c44c5eb0e8d9725ccd24bb3da9f11565c8
+  data.tar.gz: 6928973f689d58601acadd0b530e9e248fb77700fc0bf0c00dc271861adf6183
 SHA512:
-  metadata.gz: ce89c69bc4c58c95d69361979cad35f3dedab951e00b76f9886242a9679f639fcc93185d6b669df83d425b0aacc49997c395a92f1ae9b220a36904e6a423a45a
-  data.tar.gz: 7ba1f8c7b79b5b6cd7f1727193af6c9554385ec2d1abccdf35e73f4f25c4a20cb600c381c7181a36cd4ee21072e2a253a5b2f94b0824e455831b17a3f2d66de1
+  metadata.gz: 7cf43fbd94e0bdaec4540f1497c0ff4997dd05d1275f191689bb8dd137a44c01ed72e8d89c2c4b0fb5102cb659b3301624183a4123dc7eee84eb257b4d0d1330
+  data.tar.gz: accb75cd4baf1b8b6bbcc7b622ac60acfb729a08224ff8ebcd3fbecc75e311881af352f9b2aa003c0485bc171282a183fa89360f2c2960fee34efc2f00819d25

data/lib/metasploit_payloads/mettle/version.rb

@@ -1,7 +1,7 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
   class Mettle
-    VERSION = '1.0.48.pre.1'
+    VERSION = '1.0.48.pre.2'
 
     def self.version
       VERSION

data/lib/metasploit_payloads/mettle.rb

@@ -16,6 +16,8 @@ module MetasploitPayloads
 
     CMDLINE_MAX = 2000
     CMDLINE_SIG = 'DEFAULT_OPTS'.freeze
+    CONFIG_BLOCK_MAX = 8192
+    CONFIG_BLOCK_SIG = 'CONFIG_BLOCK'.freeze
     #
     # Config is a hash. Valid keys are:
     #  :uri to connect to
@@ -36,6 +38,9 @@ module MetasploitPayloads
     def to_binary(format=:process_image)
       bin = self.class.read(@platform, format)
       unless @config.empty?
+        if @config[:config_block]
+          bin = add_config_block(bin, @config[:config_block])
+        end
         params = generate_argv
         bin = add_args(bin, params)
       end
@@ -47,6 +52,10 @@ module MetasploitPayloads
     def generate_argv
       cmd_line = 'mettle '
       @config.each do |opt, val|
+        # :config_block is embedded into the binary via add_config_block (a
+        # TLV blob parsed natively); it is not a command-line option.
+        next if opt == :config_block
+
         cmd_line << "-#{short_opt(opt)} \"#{val}\" "
       end
       if cmd_line.length > CMDLINE_MAX
@@ -77,6 +86,20 @@ module MetasploitPayloads
       end
     end
 
+    # Layout in the binary: [length:4 BE][config_bytes][zero padding] within
+    # the CONFIG_BLOCK_MAX-byte slot. Carrying the length explicitly avoids
+    # a trailing-null ambiguity — the XOR-encoded config can legitimately
+    # end in 0x00, which would otherwise be eaten by a backward scan.
+    def add_config_block(bin, config_bytes)
+      usable = CONFIG_BLOCK_MAX - 4
+      if config_bytes.length > usable
+        raise Mettle::Error, 'mettle config block too large', caller
+      end
+      payload = [config_bytes.length].pack('N') + config_bytes
+      padded = payload + "\x00" * (CONFIG_BLOCK_MAX - payload.length)
+      bin.sub(CONFIG_BLOCK_SIG + "\x00" * (CONFIG_BLOCK_MAX - CONFIG_BLOCK_SIG.length), padded)
+    end
+
     def add_args(bin, params)
       if params[8] != "\x00"
         bin.sub(CMDLINE_SIG +  ' ' * (CMDLINE_MAX - CMDLINE_SIG.length), params)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit_payloads-mettle
 version: !ruby/object:Gem::Version
-  version: 1.0.48.pre.1
+  version: 1.0.48.pre.2
 platform: ruby
 authors:
 - Adam Cammack