rex 1.0.2 → 2.0.2

data/lib/rex/pescan/scanner.rb

@@ -0,0 +1,230 @@
+# -*- coding: binary -*-
+require 'metasm'
+
+module Rex
+module PeScan
+module Scanner
+
+  class Generic
+
+    attr_accessor :pe, :regex
+
+    def initialize(pe)
+      self.pe = pe
+    end
+
+    def config(param)
+    end
+
+    def scan(param)
+      config(param)
+
+      $stdout.puts "[#{param['file']}]"
+      pe.all_sections.each do |section|
+        hits = scan_section(section, param)
+        hits.each do |hit|
+          vma  = pe.rva_to_vma(hit[0])
+
+          next if (param['filteraddr'] and [vma].pack("V").reverse !~ /#{param['filteraddr']}/)
+
+          msg  = hit[1].is_a?(Array) ? hit[1].join(" ") : hit[1]
+          $stdout.puts pe.ptr_s(vma) + " " + msg
+          if(param['disasm'])
+            #puts [msg].pack('H*').inspect
+            insns = []
+
+            msg.gsub!("; ", "\n")
+            if msg.include?("retn")
+              msg.gsub!("retn", "ret")
+            end
+            #puts msg
+            begin
+              d2 = Metasm::Shellcode.assemble(Metasm::Ia32.new, msg).disassemble
+            rescue Metasm::ParseError
+              d2 = Metasm::Shellcode.disassemble(Metasm::Ia32.new, [msg].pack('H*'))
+            end
+            addr = 0
+            while ((di = d2.disassemble_instruction(addr)))
+              insns << di.instruction
+              disasm = "0x%08x\t" % (vma + addr)
+              disasm << di.instruction.to_s
+              $stdout.puts disasm
+              addr = di.next_addr
+            end
+#						::Rex::Assembly::Nasm.disassemble([msg].pack("H*")).split("\n").each do |line|
+#							$stdout.puts "\tnasm: #{line.strip}"
+            #end
+          end
+        end
+      end
+    end
+
+    def scan_section(section, param={})
+      []
+    end
+  end
+
+  class JmpRegScanner < Generic
+
+    def config(param)
+      regnums = param['args']
+
+      # build a list of the call bytes
+      calls  = _build_byte_list(0xd0, regnums - [4]) # note call esp's don't work..
+      jmps   = _build_byte_list(0xe0, regnums)
+      pushs1 = _build_byte_list(0x50, regnums)
+      pushs2 = _build_byte_list(0xf0, regnums)
+
+      regexstr = '('
+      if !calls.empty?
+        regexstr += "\xff[#{calls}]|"
+      end
+
+      regexstr += "\xff[#{jmps}]|([#{pushs1}]|\xff[#{pushs2}])(\xc3|\xc2..))"
+
+      self.regex = Regexp.new(regexstr, nil, 'n')
+    end
+
+    # build a list for regex of the possible bytes, based on a base
+    # byte and a list of register numbers..
+    def _build_byte_list(base, regnums)
+      regnums.collect { |regnum| Regexp.escape((base | regnum).chr) }.join('')
+    end
+
+    def _ret_size(section, index)
+      d = section.read(index, 1)
+      case d
+        when "\xc3"
+          return 1
+        when "\xc2"
+          return 3
+      end
+
+      raise RuntimeError, "invalid return opcode"
+    end
+
+    def _parse_ret(data)
+      if data.length == 1
+        return "ret"
+      else
+        return "retn 0x%04x" % data[1, 2].unpack('v')[0]
+      end
+    end
+
+
+    def scan_section(section, param={})
+      index = 0
+
+      hits  = [ ]
+
+      while (index = section.index(regex, index)) != nil
+        rva     = section.offset_to_rva(index)
+        message = ''
+
+        parse_ret = false
+
+        byte1 = section.read(index, 1).unpack("C*")[0]
+
+        if byte1 == 0xff
+          byte2   = section.read(index+1, 1).unpack("C*")[0]
+          regname = Rex::Arch::X86.reg_name32(byte2 & 0x7)
+
+          case byte2 & 0xf8
+          when 0xd0
+            message = "call #{regname}"
+            index += 2
+          when 0xe0
+            message = "jmp #{regname}"
+            index += 2
+          when 0xf0
+            retsize = _ret_size(section, index+2)
+            message = "push #{regname}; " + _parse_ret(section.read(index+2, retsize))
+            index += 2 + retsize
+          else
+            raise "wtf"
+          end
+        else
+          regname = Rex::Arch::X86.reg_name32(byte1 & 0x7)
+          retsize = _ret_size(section, index+1)
+          message = "push #{regname}; " + _parse_ret(section.read(index+1, retsize))
+          index += 1 + retsize
+        end
+
+        hits << [ rva, message ]
+      end
+
+      return hits
+    end
+  end
+
+  class PopPopRetScanner < JmpRegScanner
+
+    def config(param)
+      pops = _build_byte_list(0x58, (0 .. 7).to_a - [4]) # we don't want pop esp's...
+      self.regex = Regexp.new("[#{pops}][#{pops}](\xc3|\xc2..)", nil, 'n')
+    end
+
+    def scan_section(section, param={})
+
+      index = 0
+
+      hits  = [ ]
+
+      while index < section.size && (index = section.index(regex, index)) != nil
+        rva     = section.offset_to_rva(index)
+        message = ''
+
+        pops = section.read(index, 2)
+        reg1 = Rex::Arch::X86.reg_name32(pops[0,1].unpack("C*")[0] & 0x7)
+        reg2 = Rex::Arch::X86.reg_name32(pops[1,1].unpack("C*")[0] & 0x7)
+
+        message = "pop #{reg1}; pop #{reg2}; "
+
+        retsize = _ret_size(section, index+2)
+        message += _parse_ret(section.read(index+2, retsize))
+
+        index += 2 + retsize
+
+        hits << [ rva, message ]
+      end
+
+      return hits
+    end
+  end
+
+  class RegexScanner < Generic
+
+    def config(param)
+      self.regex = Regexp.new(param['args'], nil, 'n')
+    end
+
+    def scan_section(section, param={})
+      index = 0
+
+      hits  = [ ]
+
+      while index < section.size && (index = section.index(regex, index)) != nil
+
+        idx = index
+        buf = ''
+        mat = nil
+
+        while (! (mat = buf.match(regex)))
+          buf << section.read(idx, 1)
+          idx += 1
+        end
+
+        rva = section.offset_to_rva(index)
+
+        hits << [ rva, buf.unpack("H*") ]
+        index += buf.length
+      end
+
+      return hits
+    end
+  end
+
+end
+end
+end
+

data/lib/rex/pescan/search.rb

@@ -0,0 +1,68 @@
+# -*- coding: binary -*-
+module Rex
+module PeScan
+module Search
+
+  require "rex/assembly/nasm"
+
+  class DumpRVA
+    attr_accessor :pe
+
+    def initialize(pe)
+      self.pe = pe
+    end
+
+    def config(param)
+      @address = pe.vma_to_rva(param['args'])
+    end
+
+    def scan(param)
+      config(param)
+
+      $stdout.puts "[#{param['file']}]"
+
+      # Adjust based on -A and -B flags
+      pre = param['before'] || 0
+      suf = param['after']  || 16
+
+      @address -= pre
+      @address = 0 if (@address < 0 || ! @address)
+
+      begin
+        buf = pe.read_rva(@address, suf)
+      rescue ::Rex::PeParsey::WtfError
+        return
+      end
+
+      $stdout.puts pe.ptr_s(pe.rva_to_vma(@address)) + " " + buf.unpack("H*")[0]
+      if(param['disasm'])
+        insns = []
+        buf.gsub!("; ", "\n")
+        if buf.include?("retn")
+          buf.gsub!("retn", "ret")
+        end
+        d2 = Metasm::Shellcode.disassemble(Metasm::Ia32.new, buf)
+        addr = 0
+        while ((di = d2.disassemble_instruction(addr)))
+          insns << di.instruction
+          disasm = "0x%08x\t" % (pe.rva_to_vma(@address) + addr)
+          disasm << di.instruction.to_s
+          $stdout.puts disasm
+          addr = di.next_addr
+        end
+      end
+
+    end
+  end
+
+  class DumpOffset < DumpRVA
+    def config(param)
+      begin
+        @address = pe.file_offset_to_rva(param['args'])
+      rescue Rex::PeParsey::BoundsError
+      end
+    end
+  end
+end
+end
+end

data/lib/rex/platforms.rb

@@ -0,0 +1,2 @@
+# -*- coding: binary -*-
+require 'rex/platforms/windows'

data/lib/rex/platforms/windows.rb

@@ -0,0 +1,52 @@
+# -*- coding: binary -*-
+module Rex
+module Platforms
+module Windows
+
+
+
+#
+# Windows Registry Constants
+#
+  REG_NONE = 1
+  REG_SZ = 1
+  REG_EXPAND_SZ = 2
+  REG_BINARY = 3
+  REG_DWORD = 4
+  REG_LITTLE_ENDIAN = 4
+  REG_BIG_ENDIAN = 5
+  REG_LINK = 6
+  REG_MULTI_SZ = 7
+
+  HKEY_CLASSES_ROOT = 0x80000000
+  HKEY_CURRENT_USER = 0x80000001
+  HKEY_LOCAL_MACHINE = 0x80000002
+  HKEY_USERS = 0x80000003
+  HKEY_PERFORMANCE_DATA = 0x80000004
+  HKEY_CURRENT_CONFIG = 0x80000005
+  HKEY_DYN_DATA = 0x80000006
+
+  def registry_hive_lookup(hive)
+    case hive
+    when 'HKCR'
+      HKEY_LOCAL_MACHINE
+    when 'HKCU'
+      HKEY_CURRENT_USER
+    when 'HKLM'
+      HKEY_LOCAL_MACHINE
+    when 'HKU'
+      HKEY_USERS
+    when 'HKPD'
+      HKEY_PERFORMANCE_DATA
+    when 'HKCC'
+      HKEY_CURRENT_CONFIG
+    when 'HKDD'
+      HKEY_DYN_DATA
+    else
+      HKEY_LOCAL_MACHINE
+    end
+  end
+
+end
+end
+end

data/lib/rex/poly.rb

@@ -0,0 +1,134 @@
+# -*- coding: binary -*-
+module Rex
+module Poly
+
+require 'rex/poly/register'
+require 'rex/poly/block'
+require 'rex/poly/machine'
+
+###
+#
+# This class encapsulates the state of a single polymorphic block set
+# generation.  It tracks the current set of consumed registers, the linear
+# list of blocks generated, the end-result buffer, and the phase of
+# generation.  The fields exposed by the State class are intended for use only
+# by the polymorphic generation subsystem and should not be modified directly.
+#
+###
+class State
+
+  #
+  # Initializes the polymorphic generation state.
+  #
+  def initialize
+    @block_list = nil
+    reset
+  end
+
+  #
+  # Resets the generation state to have a plain start by clearing all
+  # consumed registers, resetting the polymorphic buffer back to its
+  # beginning and destroying any block generation state.
+  #
+  def reset
+    # Reset the generation flag on any blocks in the block list
+    @block_list.each { |block|
+      block[0].generated = false
+    } if (@block_list)
+
+    @regnums     = Hash.new
+    @buffer      = ''
+    @block_list  = []
+    @curr_offset = 0
+    @first_phase = true
+    @badchars    = nil
+  end
+
+  #
+  # Returns true if the supplied register number is already consumed.
+  #
+  def consumed_regnum?(regnum)
+    @regnums[regnum]
+  end
+
+  #
+  # Consumes a register number, thus removing it from the pool that can be
+  # assigned.  The consumed register number is returned to the caller.
+  #
+  def consume_regnum(regnum)
+    raise RuntimeError, "Register #{regnum} is already consumed." if (consumed_regnum?(regnum))
+
+    @regnums[regnum] = true
+
+    regnum
+  end
+
+  #
+  # Acquires a register number that has not already been consumed from the
+  # supplied register number set and consumes it, returning the selected
+  # register number to the caller.  The register number is selected from the
+  # set at random.
+  #
+  def consume_regnum_from_set(regnum_set)
+    # Pick a random starting point within the supplied set.
+    idx = rand(regnum_set.length)
+
+    # Try each index in the set.
+    regnum_set.length.times { |x|
+      regnum = regnum_set[(idx + x) % regnum_set.length]
+
+      next if (consumed_regnum?(regnum))
+
+      return consume_regnum(regnum)
+    }
+
+    # If we get through the entire iteration without finding a register,
+    # then we are out of registers to assign.
+    raise RuntimeError, "No registers are available to consume from the set"
+  end
+
+  #
+  # Eliminates a register number from the consumed pool so that it can be
+  # used in the future.  This happens after a block indicates that a register
+  # has been clobbered.
+  #
+  def defecate_regnum(regnum)
+    @regnums.delete(regnum)
+  end
+
+  #
+  # The buffer state for the current polymorphic generation.  This stores the
+  # end-result of a call to generate on a LogicalBlock.
+  #
+  attr_accessor :buffer
+
+  #
+  # The linear list of blocks that is generated by calling the generate
+  # method on a LogicalBlock.
+  #
+  attr_accessor :block_list
+
+  #
+  # The current offset into the polymorphic buffer that is being generated.
+  # This is updated as blocks are appended to the block_list.
+  #
+  attr_accessor :curr_offset
+
+  #
+  # A boolean field that is used by the LogicalBlock class to track whether
+  # or not it is in the first phase (generating the block list), or in the
+  # second phase (generating the polymorphic buffer).  This phases are used
+  # to indicate whether or not the offset_of and regnum_of methods will
+  # return actual results.
+  #
+  attr_accessor :first_phase
+
+  #
+  # Characters to avoid when selecting permutations, if any.
+  #
+  attr_accessor :badchars
+
+end
+
+end
+end