rex 1.0.2 → 2.0.2

data/lib/rex/elfparsey/exceptions.rb

@@ -0,0 +1,25 @@
+# -*- coding: binary -*-
+
+module Rex
+module ElfParsey
+
+class ElfError < ::RuntimeError
+end
+
+class ParseError < ElfError
+end
+
+class ElfHeaderError < ParseError
+end
+
+class ProgramHeaderError < ParseError
+end
+
+class BoundsError < ElfError
+end
+
+class WtfError < ElfError
+end
+
+end
+end

data/lib/rex/elfscan.rb

@@ -0,0 +1,10 @@
+# -*- coding: binary -*-
+
+module Rex
+module ElfScan
+
+end
+end
+
+require 'rex/elfscan/scanner'
+require 'rex/elfscan/search'

data/lib/rex/elfscan/scanner.rb

@@ -0,0 +1,226 @@
+# -*- coding: binary -*-
+require 'metasm'
+
+module Rex
+module ElfScan
+module Scanner
+class Generic
+
+  attr_accessor :elf, :regex
+
+  def initialize(elf)
+    self.elf = elf
+  end
+
+  def config(param)
+  end
+
+  def scan(param)
+    config(param)
+
+    $stdout.puts "[#{param['file']}]"
+    elf.program_header.each do |program_header|
+
+      # Scan only loadable segment entries in the program header table
+      if program_header.p_type == Rex::ElfParsey::ElfBase::PT_LOAD
+        hits = scan_segment(program_header, param)
+        hits.each do |hit|
+          rva  = hit[0]
+          message  = hit[1].is_a?(Array) ? hit[1].join(" ") : hit[1]
+          $stdout.puts elf.ptr_s(rva) + " " + message
+          if(param['disasm'])
+            message.gsub!("; ", "\n")
+            if message.include?("retn")
+              message.gsub!("retn", "ret")
+            end
+
+            begin
+              d2 = Metasm::Shellcode.assemble(Metasm::Ia32.new, message).disassemble
+            rescue Metasm::ParseError
+              d2 = Metasm::Shellcode.disassemble(Metasm::Ia32.new, [message].pack('H*'))
+            end
+
+            addr = 0
+            while ((di = d2.disassemble_instruction(addr)))
+              disasm = "0x%08x\t" % (rva + addr)
+              disasm << di.instruction.to_s
+              $stdout.puts disasm
+              addr = di.next_addr
+            end
+          end
+        end
+      end
+
+    end
+  end
+
+  def scan_segment(program_header, param={})
+    []
+  end
+end
+
+class JmpRegScanner < Generic
+
+  def config(param)
+    regnums = param['args']
+
+    # build a list of the call bytes
+    calls  = _build_byte_list(0xd0, regnums - [4]) # note call esp's don't work..
+    jmps   = _build_byte_list(0xe0, regnums)
+    pushs1 = _build_byte_list(0x50, regnums)
+    pushs2 = _build_byte_list(0xf0, regnums)
+
+    regexstr = '('
+    if !calls.empty?
+      regexstr += "\xff[#{calls}]|"
+    end
+
+    regexstr += "\xff[#{jmps}]|([#{pushs1}]|\xff[#{pushs2}])(\xc3|\xc2..))"
+
+    self.regex = Regexp.new(regexstr, nil, 'n')
+  end
+
+  # build a list for regex of the possible bytes, based on a base
+  # byte and a list of register numbers..
+  def _build_byte_list(base, regnums)
+    regnums.collect { |regnum| Regexp.escape((base | regnum).chr) }.join('')
+  end
+
+  def _ret_size(offset)
+    case elf.read(offset, 1)
+      when "\xc3"
+        return 1
+      when "\xc2"
+        return 3
+    end
+
+    raise "wtf"
+  end
+
+  def _parse_ret(data)
+    if data.length == 1
+      return "ret"
+    else
+      return "retn 0x%04x" % data[1, 2].unpack('v')[0]
+    end
+  end
+
+
+  def scan_segment(program_header, param={})
+    offset = program_header.p_offset
+
+    hits = []
+
+    while (offset = elf.index(regex, offset)) != nil
+
+      rva     = elf.offset_to_rva(offset)
+      message = ''
+
+      parse_ret = false
+
+      byte1 = elf.read(offset, 1).unpack('C')[0]
+
+      if byte1 == 0xff
+        byte2   = elf.read(offset+1, 1).unpack('C')[0]
+        regname = Rex::Arch::X86.reg_name32(byte2 & 0x7)
+
+        case byte2 & 0xf8
+        when 0xd0
+          message = "call #{regname}"
+          offset += 2
+        when 0xe0
+          message = "jmp #{regname}"
+          offset += 2
+        when 0xf0
+          retsize = _ret_size(offset+2)
+          message = "push #{regname}; " + _parse_ret(elf.read(offset+2, retsize))
+          offset += 2 + retsize
+        else
+          raise "wtf"
+        end
+      else
+        regname = Rex::Arch::X86.reg_name32(byte1 & 0x7)
+        retsize = _ret_size(offset+1)
+        message = "push #{regname}; " + _parse_ret(elf.read(offset+1, retsize))
+        offset += 1 + retsize
+      end
+
+      hits << [ rva, message ]
+    end
+
+    return hits
+  end
+end
+
+class PopPopRetScanner < JmpRegScanner
+
+  def config(param)
+    pops = _build_byte_list(0x58, (0 .. 7).to_a - [4]) # we don't want pop esp's...
+    self.regex = Regexp.new("[#{pops}][#{pops}](\xc3|\xc2..)", nil, 'n')
+  end
+
+  def scan_segment(program_header, param={})
+    offset = program_header.p_offset
+
+    hits = []
+
+    while offset < program_header.p_offset + program_header.p_filesz &&
+    (offset = elf.index(regex, offset)) != nil
+
+      rva     = elf.offset_to_rva(offset)
+      message = ''
+
+      pops = elf.read(offset, 2)
+      reg1 = Rex::Arch::X86.reg_name32(pops[0,1].unpack('C*')[0] & 0x7)
+      reg2 = Rex::Arch::X86.reg_name32(pops[1,1].unpack('C*')[0] & 0x7)
+
+      message = "pop #{reg1}; pop #{reg2}; "
+
+      retsize = _ret_size(offset+2)
+      message += _parse_ret(elf.read(offset+2, retsize))
+
+      offset += 2 + retsize
+
+      hits << [ rva, message ]
+    end
+
+    return hits
+  end
+end
+
+class RegexScanner < JmpRegScanner
+
+  def config(param)
+    self.regex = Regexp.new(param['args'], nil, 'n')
+  end
+
+  def scan_segment(program_header, param={})
+    offset = program_header.p_offset
+
+    hits = []
+
+    while offset < program_header.p_offset + program_header.p_filesz &&
+    (offset = elf.index(regex, offset)) != nil
+
+      idx = offset
+      buf = ''
+      mat = nil
+
+      while (! (mat = buf.match(regex)))
+        buf << elf.read(idx, 1)
+        idx += 1
+      end
+
+      rva = elf.offset_to_rva(offset)
+
+      hits << [ rva, buf.unpack("H*") ]
+      offset += buf.length
+    end
+
+    return hits
+  end
+end
+
+end
+end
+end

data/lib/rex/elfscan/search.rb

@@ -0,0 +1,44 @@
+# -*- coding: binary -*-
+
+module Rex
+module ElfScan
+module Search
+
+  class DumpRVA
+    attr_accessor :elf
+
+    def initialize(elf)
+      self.elf = elf
+    end
+
+    def config(param)
+      @address = param['args']
+    end
+
+    def scan(param)
+      config(param)
+
+      $stdout.puts "[#{param['file']}]"
+
+      # Adjust based on -A and -B flags
+      pre = param['before'] || 0
+      suf = param['after']  || 16
+
+      @address -= pre
+      @address = 0 if (@address < 0 || ! @address)
+      buf = elf.read_rva(@address, suf)
+      $stdout.puts elf.ptr_s(@address) + " " + buf.unpack("H*")[0]
+    end
+  end
+
+  class DumpOffset < DumpRVA
+    def config(param)
+      begin
+        @address = elf.offset_to_rva(param['args'])
+      rescue Rex::ElfParsey::BoundsError
+      end
+    end
+  end
+end
+end
+end

data/lib/rex/encoder/alpha2.rb

@@ -0,0 +1,31 @@
+# -*- coding: binary -*-
+
+#
+# ________________________________________________________________________________
+#
+#     ,sSSs,,s,  ,sSSSs,  ALPHA 2: Zero-tolerance. (build 07)
+#    SS"  Y$P"  SY"  ,SY
+#   iS'   dY       ,sS"   Unicode-proof uppercase alphanumeric shellcode encoding.
+#   YS,  dSb    ,sY"      Copyright (C) 2003, 2004 by Berend-Jan Wever.
+#   `"YSS'"S' 'SSSSSSSP   <skylined@edup.tudelft.nl>
+# ________________________________________________________________________________
+#
+
+#
+# make sure the namespace is created
+#
+
+module Rex
+module Encoder
+module Alpha2
+end end end
+
+#
+# include the Alpha2 encodings
+#
+
+require 'rex/encoder/alpha2/generic'
+require 'rex/encoder/alpha2/alpha_mixed'
+require 'rex/encoder/alpha2/alpha_upper'
+require 'rex/encoder/alpha2/unicode_mixed'
+require 'rex/encoder/alpha2/unicode_upper'

data/lib/rex/encoder/alpha2/alpha_mixed.rb

@@ -0,0 +1,68 @@
+# -*- coding: binary -*-
+
+require 'rex/encoder/alpha2/generic'
+
+module Rex
+module Encoder
+module Alpha2
+
+class AlphaMixed < Generic
+
+  def self.gen_decoder_prefix(reg, offset)
+    if (offset > 32)
+      raise "Critical: Offset is greater than 32"
+    end
+
+    # use inc ebx as a nop here so we still pad correctly
+    if (offset <= 16)
+      nop = 'C' * offset
+      mod = 'I' * (16 - offset) + nop + '7QZ'    # dec ecx,,, push ecx, pop edx
+      edxmod = 'J' * (17 - offset)
+    else
+      mod = 'A' * (offset - 16)
+      nop = 'C' * (16 - mod.length)
+      mod << nop + '7QZ'
+      edxmod = 'B' * (17 - (offset - 16))
+    end
+    regprefix = {
+      'EAX'   => 'PY' + mod,                         # push eax, pop ecx
+      'ECX'   => 'I' + mod,                          # dec ecx
+      'EDX'   =>  edxmod + nop + '7RY',			   # dec edx,,, push edx, pop ecx
+      'EBX'   => 'SY' + mod,                         # push ebx, pop ecx
+      'ESP'   => 'TY' + mod,                         # push esp, pop ecx
+      'EBP'   => 'UY' + mod,                         # push ebp, pop ecx
+      'ESI'   => 'VY' + mod,                         # push esi, pop ecx
+      'EDI'   => 'WY' + mod,                         # push edi, pop ecx
+    }
+
+    reg.upcase!
+    if (not regprefix.keys.include? reg)
+      raise ArgumentError.new("Invalid register name")
+    end
+    return regprefix[reg]
+  end
+
+  def self.gen_decoder(reg, offset)
+    decoder =
+       gen_decoder_prefix(reg, offset) +
+       "jA" +          # push 0x41
+       "X" +           # pop eax
+       "P" +           # push eax
+       "0A0" +         # xor byte [ecx+30], al
+       "A" +           # inc ecx                        <---
+       "kAAQ" +        # imul eax, [ecx+42], 51 -> 10       |
+       "2AB" +         # xor al, [ecx + 42]                 |
+       "2BB" +         # xor al, [edx + 42]                 |
+       "0BB" +         # xor [edx + 42], al                 |
+       "A" +           # inc ecx                            |
+       "B" +           # inc edx                            |
+       "X" +           # pop eax                            |
+       "P" +           # push eax                           |
+       "8AB" +         # cmp [ecx + 42], al                 |
+       "uJ" +          # jnz short -------------------------
+       "I"             # first encoded char, fixes the above J
+
+    return decoder
+  end
+
+end end end end

data/lib/rex/encoder/alpha2/alpha_upper.rb

@@ -0,0 +1,79 @@
+# -*- coding: binary -*-
+
+require 'rex/encoder/alpha2/generic'
+
+module Rex
+module Encoder
+module Alpha2
+
+class AlphaUpper < Generic
+  def self.default_accepted_chars ; ('B' .. 'Z').to_a + ('0' .. '9').to_a ; end
+
+  def self.gen_decoder_prefix(reg, offset)
+    if (offset > 20)
+      raise "Critical: Offset is greater than 20"
+    end
+
+    # use inc ebx as a nop here so we still pad correctly
+    if (offset <= 10)
+      nop = 'C' * offset
+      mod = 'I' * (10 - offset) + nop + 'QZ'    # dec ecx,,, push ecx, pop edx
+      edxmod = 'J' * (11 - offset)
+    else
+      mod = 'A' * (offset - 10)
+      nop = 'C' * (10 - mod.length)
+      mod << nop + 'QZ'
+      edxmod = 'B' * (11 - (offset - 10))
+    end
+    regprefix = {
+      'EAX'   => 'PY' + mod,                        # push eax, pop ecx
+      'ECX'   => 'I' + mod,                         # dec ecx
+      'EDX'   =>  edxmod + nop + 'RY',  			  # mod edx,,, push edx, pop ecx
+      'EBX'   => 'SY' + mod,                        # push ebx, pop ecx
+      'ESP'   => 'TY' + mod,                        # push esp, pop ecx
+      'EBP'   => 'UY' + mod,                        # push ebp, pop ecx
+      'ESI'   => 'VY' + mod,                        # push esi, pop ecx
+      'EDI'   => 'WY' + mod,                        # push edi, pop edi
+    }
+
+    reg.upcase!
+    if (not regprefix.keys.include? reg)
+      raise ArgumentError.new("Invalid register name")
+    end
+    return regprefix[reg]
+
+  end
+
+  def self.gen_decoder(reg, offset)
+    decoder =
+      gen_decoder_prefix(reg, offset) +
+      "V" +           # push esi
+      "T" +           # push esp
+      "X" +           # pop eax
+      "30" +          # xor esi, [eax]
+      "V" +           # push esi
+      "X" +           # pop eax
+      "4A" +          # xor al, 41
+      "P" +           # push eax
+      "0A3" +         # xor [ecx+33], al
+      "H" +           # dec eax
+      "H" +           # dec eax
+      "0A0" +         # xor [ecx+30], al
+      "0AB" +         # xor [ecx+42], al
+      "A" +           # inc ecx   <---------------
+      "A" +           # inc ecx                   |
+      "B" +           # inc edx                   |
+      "TAAQ" +        # imul eax, [ecx+41], 10 *  |
+      "2AB" +         # xor al [ecx+42]           |
+      "2BB" +         # xor al, [edx+42]          |
+      "0BB" +         # xor [edx+42], al          |
+      "X" +           # pop eax                   |
+      "P" +           # push eax                  |
+      "8AC" +         # cmp [ecx+43], al          |
+      "JJ" +          # jnz * --------------------
+      "I"             # first encoded char, fixes the above J
+
+    return decoder
+  end
+
+end end end end