rex 1.0.2 → 2.0.2

data/lib/rex/exploitation/powershell/psh_methods.rb

@@ -0,0 +1,70 @@
+# -*- coding: binary -*-
+
+module Rex
+module Exploitation
+module Powershell
+  ##
+  # Convenience methods for generating powershell code in Ruby
+  ##
+
+  module PshMethods
+    #
+    # Download file via .NET WebClient
+    #
+    # @param src [String] URL to the file
+    # @param target [String] Location to save the file
+    #
+    # @return [String] Powershell code to download a file
+    def self.download(src, target)
+      target ||= '$pwd\\' << src.split('/').last
+      %Q^(new-object System.Net.WebClient).DownloadFile("#{src}", "#{target}")^
+    end
+
+    #
+    # Uninstall app, or anything named like app
+    #
+    # @param app [String] Name of application
+    # @param fuzzy [Boolean] Whether to apply a fuzzy match (-like) to
+    #   the application name
+    #
+    # @return [String] Powershell code to uninstall an application
+    def self.uninstall(app, fuzzy = true)
+      match = fuzzy ? '-like' : '-eq'
+      %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^
+    end
+
+    #
+    # Create secure string from plaintext
+    #
+    # @param str [String] String to create as a SecureString
+    #
+    # @return [String] Powershell code to create a SecureString
+    def self.secure_string(str)
+      %Q(ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$)
+    end
+
+    #
+    # Find PID of file lock owner
+    #
+    # @param filename [String] Filename
+    #
+    # @return [String] Powershell code to identify the PID of a file
+    #   lock owner
+    def self.who_locked_file(filename)
+      %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
+    end
+
+    #
+    # Return last time of login
+    #
+    # @param user [String] Username
+    #
+    # @return [String] Powershell code to return the last time of a user
+    #   login
+    def self.get_last_login(user)
+      %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
+    end
+  end
+end
+end
+end

data/lib/rex/exploitation/powershell/script.rb

@@ -0,0 +1,99 @@
+# -*- coding: binary -*-
+
+require 'rex'
+require 'forwardable'
+
+module Rex
+module Exploitation
+module Powershell
+  class Script
+    attr_accessor :code
+    attr_reader :functions, :rig
+
+    include Output
+    include Parser
+    include Obfu
+    # Pretend we are actually a string
+    extend ::Forwardable
+    # In case someone messes with String we delegate based on its instance methods
+    # eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}|
+    def_delegators :@code, :each_line, :strip, :chars, :intern, :chr, :casecmp, :ascii_only?, :<, :tr_s,
+                   :!=, :capitalize!, :ljust, :to_r, :sum, :private_methods, :gsub, :dump, :match, :to_sym,
+                   :enum_for, :display, :tr_s!, :freeze, :gsub, :split, :rindex, :<<, :<=>, :+, :lstrip!,
+                   :encoding, :start_with?, :swapcase, :lstrip!, :encoding, :start_with?, :swapcase,
+                   :each_byte, :lstrip, :codepoints, :insert, :getbyte, :swapcase!, :delete, :rjust, :>=,
+                   :!, :count, :slice, :clone, :chop!, :prepend, :succ!, :upcase, :include?, :frozen?,
+                   :delete!, :chop, :lines, :replace, :next, :=~, :==, :rstrip!, :%, :upcase!, :each_char,
+                   :hash, :rstrip, :length, :reverse, :setbyte, :bytesize, :squeeze, :>, :center, :[],
+                   :<=, :to_c, :slice!, :chomp!, :next!, :downcase, :unpack, :crypt, :partition,
+                   :between?, :squeeze!, :to_s, :chomp, :bytes, :clear, :!~, :to_i, :valid_encoding?, :===,
+                   :tr, :downcase!, :scan, :sub!, :each_codepoint, :reverse!, :class, :size, :empty?, :byteslice,
+                   :initialize_clone, :to_str, :to_enum, :tap, :tr!, :trust, :encode!, :sub, :oct, :succ, :index,
+                   :[]=, :encode, :*, :hex, :to_f, :strip!, :rpartition, :ord, :capitalize, :upto, :force_encoding,
+                   :end_with?
+
+    def initialize(code)
+      @code = ''
+      @rig = Rex::RandomIdentifierGenerator.new
+
+      begin
+        # Open code file for reading
+        fd = ::File.new(code, 'rb')
+        while (line = fd.gets)
+          @code << line
+        end
+
+        # Close open file
+        fd.close
+      rescue Errno::ENAMETOOLONG, Errno::ENOENT
+        # Treat code as a... code
+        @code = code.to_s.dup # in case we're eating another script
+      end
+      @functions = get_func_names.map { |f| get_func(f) }
+    end
+
+    ##
+    # Class methods
+    ##
+
+    #
+    # Convert binary to byte array, read from file if able
+    #
+    # @param input_data [String] Path to powershell file or powershell
+    #   code string
+    # @param var_name [String] Byte array variable name
+    #
+    # @return [String] input_data as a powershell byte array
+    def self.to_byte_array(input_data, var_name = Rex::Text.rand_text_alpha(rand(3) + 3))
+      # File will raise an exception if the path contains null byte
+      if input_data.include? "\x00"
+        code = input_data
+      else
+        code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+      end
+
+      code = code.unpack('C*')
+      psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
+      lines = []
+      1.upto(code.length - 1) do |byte|
+        if (byte % 10 == 0)
+          lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
+        else
+          lines.push ",0x#{code[byte].to_s(16)}"
+        end
+      end
+
+      psh << lines.join('') + "\r\n"
+    end
+
+    #
+    # Return list of code modifier methods
+    #
+    # @return [Array] Code modifiers
+    def self.code_modifiers
+      instance_methods.select { |m| m =~ /^(strip|sub)/ }
+    end
+  end # class Script
+end
+end
+end

data/lib/rex/exploitation/ropdb.rb

@@ -0,0 +1,190 @@
+# -*- coding: binary -*-
+require 'rex/text'
+require 'rexml/document'
+
+
+module Rex
+module Exploitation
+
+###
+#
+# This class provides methods to access the ROP database, in order to generate
+# a ROP-compatible payload on the fly.
+#
+###
+class RopDb
+  def initialize
+    @base_path = File.join(File.dirname(__FILE__), '../../../data/ropdb/')
+  end
+
+  public
+
+
+  #
+  # Returns true if a ROP chain is available, otherwise false
+  #
+  def has_rop?(rop_name)
+    File.exists?(File.join(@base_path, "#{rop_name}.xml"))
+  end
+
+  #
+  # Returns an array of ROP gadgets. Each gadget can either be an offset, or a value (symbol or
+  # some integer).  When the value is a symbol, it can be one of these: :nop, :junk, :size,
+  # :unsafe_negate_size, and :safe_negate_size
+  # Note if no RoP is found, it returns an empry array.
+  # Arguments:
+  # rop_name - name of the ROP chain.
+  # opts     - A hash of optional arguments:
+  #            'target' - A regex string search against the compatibility list.
+  #            'base'   - Specify a different base for the ROP gadgets.
+  #
+  def select_rop(rop, opts={})
+    target = opts['target'] || ''
+    base   = opts['base']   || nil
+
+    raise RuntimeError, "#{rop} ROP chain is not available" if not has_rop?(rop)
+    xml = load_rop(File.join(@base_path, "#{rop}.xml"))
+
+    gadgets = []
+
+    xml.elements.each("db/rop") { |e|
+      name = e.attributes['name']
+      next if not has_target?(e, target)
+
+      if not base
+        default = e.elements['gadgets'].attributes['base'].scan(/^0x([0-9a-f]+)$/i).flatten[0]
+        base = default.to_i(16)
+      end
+
+      gadgets << parse_gadgets(e, base)
+    }
+    return gadgets.flatten
+  end
+
+
+  #
+  # Returns a payload with the user-supplied stack-pivot, a ROP chain,
+  # and then shellcode.
+  # Arguments:
+  # rop     - Name of the ROP chain
+  # payload - Payload in binary
+  # opts    - A hash of optional arguments:
+  #           'nop'      - Used to generate nops with generate_sled()
+  #           'badchars' - Used in a junk gadget
+  #           'pivot'    - Stack pivot in binary
+  #           'target'   - A regex string search against the compatibility list.
+  #           'base'     - Specify a different base for the ROP gadgets.
+  #
+  def generate_rop_payload(rop, payload, opts={})
+    nop      = opts['nop']      || nil
+    badchars = opts['badchars'] || ''
+    pivot    = opts['pivot']    || ''
+    target   = opts['target']   || ''
+    base     = opts['base']     || nil
+
+    rop = select_rop(rop, {'target'=>target, 'base'=>base})
+    # Replace the reserved words with actual gadgets
+    rop = rop.map {|e|
+      if e == :nop
+        sled = (nop) ? nop.generate_sled(4, badchars).unpack("V*")[0] : 0x90909090
+      elsif e == :junk
+        Rex::Text.rand_text(4, badchars).unpack("V")[0].to_i
+      elsif e == :size
+        payload.length
+      elsif e == :unsafe_negate_size
+        get_unsafe_size(payload.length)
+      elsif e == :safe_negate_size
+        get_safe_size(payload.length)
+      else
+        e
+      end
+    }.pack("V*")
+
+    raise RuntimeError, "No ROP chain generated successfully" if rop.empty?
+
+    return pivot + rop + payload
+  end
+
+  private
+
+
+  #
+  # Returns a size that's safe from null bytes.
+  # This function will keep incrementing the value of "s" until it's safe from null bytes.
+  #
+  def get_safe_size(s)
+    safe_size = get_unsafe_size(s)
+    while (safe_size.to_s(16).rjust(8, '0')).scan(/../).include?("00")
+      safe_size -= 1
+    end
+
+    safe_size
+  end
+
+
+  #
+  # Returns a size that might contain one or more null bytes
+  #
+  def get_unsafe_size(s)
+    0xffffffff - s + 1
+  end
+
+
+  #
+  # Checks if a ROP chain is compatible
+  #
+  def has_target?(rop, target)
+    rop.elements.each('compatibility/target') { |t|
+      return true if t.text =~ /#{target}/i
+    }
+    return false
+  end
+
+  #
+  # Returns the database in XML
+  #
+  def load_rop(file_path)
+    f = File.open(file_path, 'rb')
+    xml = REXML::Document.new(f.read(f.stat.size))
+    f.close
+    return xml
+  end
+
+
+  #
+  # Returns gadgets
+  #
+  def parse_gadgets(e, image_base)
+    gadgets = []
+    e.elements.each('gadgets/gadget') { |g|
+      offset = g.attributes['offset']
+      value  = g.attributes['value']
+
+      if offset
+        addr = offset.scan(/^0x([0-9a-f]+)$/i).flatten[0]
+        gadgets << (image_base + addr.to_i(16))
+      elsif value
+        case value
+        when 'nop'
+          gadgets << :nop
+        when 'junk'
+          gadgets << :junk
+        when 'size'
+          gadgets << :size
+        when 'unsafe_negate_size'
+          gadgets << :unsafe_negate_size
+        when 'safe_negate_size'
+          gadgets << :safe_negate_size
+        else
+          gadgets << value.to_i(16)
+        end
+      else
+        raise RuntimeError, "Missing offset or value attribute in '#{name}'"
+      end
+    }
+    return gadgets
+  end
+end
+
+end
+end

data/lib/rex/exploitation/seh.rb

@@ -0,0 +1,93 @@
+# -*- coding: binary -*-
+require 'rex/text'
+require 'rex/arch/x86'
+
+module Rex
+module Exploitation
+
+###
+#
+# This class provides methods for generating SEH registration records
+# in a dynamic and flexible fashion.  The records can be generated with
+# the short jump at a random offset into the next pointer and with random
+# padding in between the handler and the attacker's payload.
+#
+###
+class Seh
+
+  #
+  # Creates a new instance of the class and initializes it with the supplied
+  # bad character list.  The space argument denotes how much room is
+  # available for random padding and the NOP argument can be used to generate
+  # a random NOP sled that is better than 0x90.
+  #
+  def initialize(badchars = nil, space = nil, nop = nil)
+    self.badchars = badchars || ''
+    self.space    = (space && space > 121) ? 121 : space
+    self.nop      = nop
+  end
+
+  #
+  # Generates an SEH record
+  #
+  def generate_seh_record(handler, dynamic=false)
+    if (dynamic)
+      generate_dynamic_seh_record(handler)
+    else
+      generate_static_seh_record(handler)
+    end
+  end
+
+  #
+  # Generates a fake SEH registration record with the supplied handler
+  # address for the handler, and a nop generator to use when generating
+  # padding inside the next pointer.  The NOP generator must implement the
+  # 'generate_sled' method that takes a length and a list of bad
+  # characters.
+  #
+  def generate_dynamic_seh_record(handler)
+
+    # Generate the padding up to the size specified or 121 characters
+    # maximum to account for the maximum range of a short jump plus the
+    # record size.
+    pad    = rand(space || 121)
+    rsize  = pad + 8
+
+    # Calculate the random index into the next ptr to store the short jump
+    # instruction
+    jmpidx = rand(3)
+
+    # Build the prefixed sled for the bytes that come before the short jump
+    # instruction
+    sled = (nop) ? nop.generate_sled(jmpidx, badchars) : ("\x90" * jmpidx)
+
+    # Seed the record and any space after the record with random text
+    record = Rex::Text.rand_text(rsize, badchars)
+
+    # Build the next pointer and short jump instruction
+    record[jmpidx, 2] = Rex::Arch::X86.jmp_short((rsize - jmpidx) - 2)
+    record[0, jmpidx] = sled
+
+    # Set the handler in the registration record
+    record[4, 4]      = [ handler ].pack('V')
+
+    # Return the generated record to the caller
+    record
+  end
+
+  #
+  # Generates a static SEH registration record with a specific handler and
+  # next pointer.
+  #
+  def generate_static_seh_record(handler)
+    "\xeb\x06" + Rex::Text.rand_text(2, badchars) + [ handler ].pack('V')
+  end
+
+protected
+
+  attr_accessor :badchars, :space, :nop # :nodoc:
+
+end
+
+end
+end