rex 1.0.2 → 2.0.2

data/lib/rex/encoder/ndr.rb

@@ -0,0 +1,90 @@
+# -*- coding: binary -*-
+require "rex/text"
+
+module Rex
+module Encoder
+module NDR
+
+  # Provide padding to align the string to the 32bit boundary
+  def NDR.align(string)
+    return "\x00" * ((4 - (string.length & 3)) & 3)
+  end
+
+  # Encode a 4 byte long
+  # use to encode:
+  #       long element_1;
+  def NDR.long(string)
+    return [string].pack('V')
+  end
+
+  # Encode a 2 byte short
+  # use to encode:
+  #       short element_1;
+  def NDR.short(string)
+    return [string].pack('v')
+  end
+
+  # Encode a single byte
+  # use to encode:
+  #       byte element_1;
+  def NDR.byte(string)
+    return [string].pack('C')
+  end
+
+  # Encode a byte array
+  # use to encode:
+  #       char  element_1
+  def NDR.UniConformantArray(string)
+    return long(string.length) + string + align(string)
+  end
+
+  # Encode a string
+  # use to encode:
+  #       char *element_1;
+  def NDR.string(string)
+    string << "\x00" # null pad
+    return long(string.length) + long(0) + long(string.length) + string + align(string)
+  end
+
+  # Encode a string
+  # use to encode:
+  #       w_char *element_1;
+  def NDR.wstring(string)
+    string  = string + "\x00" # null pad
+    return long(string.length) + long(0) + long(string.length) + Rex::Text.to_unicode(string) + align(Rex::Text.to_unicode(string))
+  end
+
+  # Encode a string and make it unique
+  # use to encode:
+  #       [unique] w_char *element_1;
+  def NDR.uwstring(string)
+    string  = string + "\x00" # null pad
+    return long(rand(0xffffffff))+long(string.length) + long(0) + long(string.length) + Rex::Text.to_unicode(string) + align(Rex::Text.to_unicode(string))
+  end
+
+  # Encode a string that is already unicode encoded
+  # use to encode:
+  #       w_char *element_1;
+  def NDR.wstring_prebuilt(string)
+    # if the string len is odd, thats bad!
+    if string.length % 2 > 0
+      string = string + "\x00"
+    end
+    len = string.length / 2;
+    return long(len) + long(0) + long(len) + string + align(string)
+  end
+
+  # alias to wstring, going away soon
+  def NDR.UnicodeConformantVaryingString(string)
+    NDR.wstring(string)
+  end
+
+  # alias to wstring_prebuilt, going away soon
+  def NDR.UnicodeConformantVaryingStringPreBuilt(string)
+    NDR.wstring_prebuilt(string)
+  end
+
+end
+end
+end
+

data/lib/rex/encoder/nonalpha.rb

@@ -0,0 +1,61 @@
+# -*- coding: binary -*-
+
+require 'rex/text'
+
+module Rex
+module Encoder
+
+class NonAlpha
+
+  def NonAlpha.gen_decoder()
+    decoder =
+      "\x66\xB9\xFF\xFF" +
+      "\xEB\x19"  +               # Jmp to table
+      "\x5E"      +               # pop esi
+      "\x8B\xFE"  +               # mov edi, esi      - Get table addr
+      "\x83\xC7"  + "A" +         # add edi, tablelen - Get shellcode addr
+      "\x8B\xD7"  +               # mov edx, edi      - Hold end of table ptr
+      "\x3B\xF2"  +               # cmp esi, edx
+      "\x7D\x0B"  +               # jle to end
+      "\xB0\x7B"  +               # mov eax, 0x7B     - Set up eax with magic
+      "\xF2\xAE"  +               # repne scasb       - Find magic!
+      "\xFF\xCF"  +               # dec edi           - scasb purs us one ahead
+      "\xAC"      +               # lodsb
+      "\x28\x07"  +               # subb [edi], al
+      "\xEB\xF1"  +               # jmp BACK!
+      "\xEB"      + "B" +         # jmp [shellcode]
+      "\xE8\xE2\xFF\xFF\xFF"
+  end
+
+  def NonAlpha.encode_byte(block, table, tablelen)
+    if (tablelen > 255) or (block == 0x7B)
+      raise RuntimeError, "BadChar"
+    end
+
+    if (block >= 0x41 and block <= 0x5A) or (block >= 0x61 and block <= 0x7A)
+      # gen offset, return magic
+      offset = 0x7b - block;
+      table += offset.chr
+      tablelen = tablelen + 1
+      block = 0x7B
+    end
+
+    return [block.chr, table, tablelen]
+  end
+
+  def NonAlpha.encode(buf)
+    table = ""
+    tablelen = 0
+    nonascii = ""
+    encoded = gen_decoder()
+    buf.each_byte { |block|
+      newchar, table, tablelen = encode_byte(block.unpack('C')[0], table, tablelen)
+      nonascii += newchar
+    }
+    encoded.gsub!(/A/, tablelen)
+    encoded.gsub!(/B/, tablelen+5)
+    encoded += table
+    encoded += nonascii
+  end
+
+end end end

data/lib/rex/encoder/nonupper.rb

@@ -0,0 +1,64 @@
+# -*- coding: binary -*-
+
+require 'rex/text'
+
+module Rex
+module Encoder
+
+class NonUpper
+
+
+  def NonUpper.gen_decoder()
+    decoder =
+      "\x66\xB9\xFF\xFF" +
+      "\xEB\x19"  +               # Jmp to table
+      "\x5E"      +               # pop esi
+      "\x8B\xFE"  +               # mov edi, esi      - Get table addr
+      "\x83\xC7"  + "A" +         # add edi, tablelen - Get shellcode addr
+      "\x8B\xD7"  +               # mov edx, edi      - Hold end of table ptr
+      "\x3B\xF2"  +               # cmp esi, edx
+      "\x7D\x0B"  +               # jle to end
+      "\xB0\x7B"  +               # mov eax, 0x7B     - Set up eax with magic
+      "\xF2\xAE"  +               # repne scasb       - Find magic!
+      "\xFF\xCF"  +               # dec edi           - scasb purs us one ahead
+      "\xAC"      +               # lodsb
+      "\x28\x07"  +               # subb [edi], al
+      "\xEB\xF1"  +               # jmp BACK!
+      "\xEB"      + "B" +         # jmp [shellcode]
+      "\xE8\xE2\xFF\xFF\xFF"
+  end
+
+  def NonUpper.encode_byte(badchars, block, table, tablelen)
+    if (tablelen > 255) or (block == 0x40)
+      raise RuntimeError, "BadChar"
+    end
+
+    if (block >= 0x41 and block <= 0x40) or (badchars =~ block)
+      # gen offset, return magic
+      offset = 0x40 - block;
+      table += offset.chr
+      tablelen = tablelen + 1
+      block = 0x40
+    end
+
+    return [block.chr, table, tablelen]
+  end
+
+  def NonUpper.encode(buf)
+    table = ""
+    tablelen = 0
+    nonascii = ""
+    encoded = gen_decoder()
+    buf.each_byte {
+      |block|
+
+      newchar, table, tablelen = encode_byte(block.unpack('C')[0], table, tablelen)
+      nonascii += newchar
+    }
+    encoded.gsub!(/A/, tablelen)
+    encoded.gsub!(/B/, tablelen+5)
+    encoded += table
+    encoded += nonascii
+  end
+
+end end end

data/lib/rex/encoder/xdr.rb

@@ -0,0 +1,107 @@
+# -*- coding: binary -*-
+module Rex
+module Encoder
+
+###
+#
+# This class implements basic XDR encoding.
+#
+###
+module XDR
+  MAX_ARG = 0xffffffff
+
+  # Also: unsigned int, bool, enum
+  def XDR.encode_int(int)
+    return [int].pack('N')
+  end
+
+  def XDR.decode_int!(data)
+      return data.slice!(0..3).unpack('N')[0] if data
+      data = 0
+  end
+
+  def XDR.encode_lchar(char)
+    char |= 0xffffff00 if char & 0x80 != 0
+    return encode_int(char)
+  end
+
+  def XDR.decode_lchar!(data)
+    return (decode_int!(data) & 0xff).chr
+  end
+
+  # Also: Variable length opaque
+  def XDR.encode_string(str, max=MAX_ARG)
+    raise ArgumentError, 'XDR: String too long' if str.length > max
+    len = str.length
+    str << "\x00" * ((4 - (len & 3)) & 3)
+    return encode_int(len) + str
+  end
+
+  def XDR.decode_string!(data)
+    real_len = decode_int!(data)
+    return "" if real_len == 0
+    align_len = (real_len + 3) & ~3
+    return data.slice!(0..align_len-1).slice(0..real_len-1)
+  end
+
+  def XDR.encode_varray(arr, max=MAX_ARG, &block)
+    raise ArgumentError, 'XDR: Too many array elements' if arr.length > max
+    return encode_int(arr.length) + arr.collect(&block).join(nil)
+  end
+
+  def XDR.decode_varray!(data)
+    buf = []
+    1.upto(decode_int!(data)) { buf.push(yield(data)) }
+    return buf
+  end
+
+  # encode(0, [0, 1], "foo", ["bar", 4]) does:
+  #   encode_int(0) +
+  #   encode_varray([0, 1]) { |i| XDR.encode_int(i) } +
+  #   encode_string("foo") +
+  #   encode_string("bar", 4)
+  def XDR.encode(*data)
+    data.collect do |var|
+      if var.kind_of?(String)
+        encode_string(var)
+      elsif var.kind_of?(Integer)
+        encode_int(var)
+      elsif var.kind_of?(Array) && var[0].kind_of?(String)
+        raise ArgumentError, 'XDR: Incorrect string array arguments' if var.length != 2
+        encode_string(var[0], var[1])
+      elsif var.kind_of?(Array) && var[0].kind_of?(Integer)
+        encode_varray(var) { |i| XDR.encode_int(i) }
+      # 0 means an empty array index in the case of Integer and an empty string in
+      #   the case of String so we get the best of both worlds
+      elsif var.kind_of?(Array) && var[0].nil?
+        encode_int(0)
+      else
+        type = var.class
+        type = var[0].class if var.kind_of?(Array)
+        raise TypeError, "XDR: encode does not support #{type}"
+      end
+    end.join(nil)
+  end
+
+# decode(buf, Integer, String, [Integer], [String]) does:
+# [decode_int!(buf), decode_string!(buf),
+#   decode_varray!(buf) { |i| XDR.decode_int!(i) },
+#   decode_varray!(buf) { |s| XDR.decode_string(s) }]
+  def XDR.decode!(buf, *data)
+    return *data.collect do |var|
+      if data.length == 0
+      elsif var.kind_of?(Array) && var[0] == String
+        decode_varray!(buf) { |s| XDR.decode_string!(s) }
+      elsif var.kind_of?(Array) && var[0] == Integer
+        decode_varray!(buf) { |i| XDR.decode_int!(i) }
+      elsif var == String
+        decode_string!(buf)
+      elsif var == Integer
+        decode_int!(buf)
+      end
+    end
+  end
+end
+
+end
+end

data/lib/rex/encoder/xor.rb

@@ -0,0 +1,69 @@
+# -*- coding: binary -*-
+
+module Rex
+module Encoder
+
+###
+#
+# This class performs basic XOR encoding.
+#
+###
+class Xor
+
+  attr_accessor :raw, :encoded, :badchars, :opts, :key, :fkey # :nodoc:
+
+  #
+  # wrap that in a wanna be static class
+  #
+  def self.encode(*args)
+    self.new.encode(*args)
+  end
+
+  #
+  # Return the class associated with this encoder.
+  #
+  def encoder()
+    self.class::EncoderKlass
+  end
+
+  #
+  # This method encodes the supplied data, taking into account the badchar
+  # list, and returns the encoded buffer.
+  #
+  def encode(data, badchars = '', opts = { })
+    self.raw      = data
+    self.badchars = badchars
+    self.opts     = opts
+
+    # apply any transforms to the plaintext data
+    data = _unencoded_transform(data)
+
+    self.encoded, self.key, self.fkey = encoder().find_key_and_encode(data, badchars)
+
+    # apply any transforms to the encoded data
+    self.encoded = _encoded_transform(encoded)
+
+    return _prepend() + encoded + _append()
+  end
+
+  protected
+  def _unencoded_transform(data) # :nodoc:
+    data
+  end
+
+  def _encoded_transform(data) # :nodoc:
+    data
+  end
+
+  def _prepend() # :nodoc:
+    ""
+  end
+
+  def _append() # :nodoc:
+    ""
+  end
+
+end
+
+end end
+

data/lib/rex/encoder/xor/dword.rb

@@ -0,0 +1,13 @@
+# -*- coding: binary -*-
+
+require 'rex/encoder/xor'
+require 'rex/encoding/xor/dword'
+
+###
+#
+# This class wraps the Dword XOR encoder.
+#
+###
+class Rex::Encoder::Xor::Dword < Rex::Encoder::Xor
+  EncoderKlass = Rex::Encoding::Xor::Dword
+end

data/lib/rex/encoder/xor/dword_additive.rb

@@ -0,0 +1,13 @@
+# -*- coding: binary -*-
+
+require 'rex/encoder/xor'
+require 'rex/encoding/xor/dword_additive'
+
+###
+#
+# This class wraps the Dword XOR Additive feedback encoder.
+#
+###
+class Rex::Encoder::Xor::DwordAdditive < Rex::Encoder::Xor
+  EncoderKlass = Rex::Encoding::Xor::DwordAdditive
+end

data/lib/rex/encoders/xor_dword.rb

@@ -0,0 +1,35 @@
+# -*- coding: binary -*-
+
+require 'rex/arch/x86'
+require 'rex/encoder/xor/dword'
+
+module Rex
+module Encoders
+
+###
+#
+# Spoon's smaller variable-length encoder (updated to use call $+4 by vlad902)
+#
+###
+class XorDword < Rex::Encoder::Xor::Dword
+  module Backend
+    def _prepend
+      # set the counter to the rounded up number of dwords to decode
+      Rex::Arch::X86.set(
+        Rex::Arch::X86::ECX,
+        (encoded.length - 1 >> 2) + 1,
+        badchars
+      ) +
+      "\xe8\xff\xff\xff" +                # call $+4
+      "\xff\xc0" +                        # inc eax
+      "\x5e" +                            # pop esi
+      "\x81\x76\x0e" + key +              # xor_xor: xor [esi + 0x0e], $xorkey
+      "\x83\xee\xfc" +                    # sub esi, -4
+      "\xe2\xf4"                          # loop xor_xor
+    end
+  end
+
+  include Backend
+end
+
+end end