Land #16597, psh cmd adapter fix for encrypt shell

space-r7 · space-r7 · commit 7983f878a8d6 · 2022-06-21T09:47:05.000-05:00
diff --git a/lib/msf/core/payload.rb b/lib/msf/core/payload.rb
@@ -59,10 +59,10 @@ def initialize(info = {})
     #
     self.module_info['Dependencies'] = self.module_info['Dependencies'] || []
 
-    # If this is a staged payload but there is no stage information,
+    # If this is an adapted or staged payload but there is no stage information,
     # then this is actually a stager + single combination.  Set up the
     # information hash accordingly.
-    if self.class.include?(Msf::Payload::Single) and
+    if (self.class.include?(Msf::Payload::Adapter) || self.class.include?(Msf::Payload::Single)) and
       self.class.include?(Msf::Payload::Stager)
       self.module_info['Stage'] = {}
 
@@ -288,7 +288,7 @@ def session
   #
   # Generates the payload and returns the raw buffer to the caller.
   #
-  def generate
+  def generate(_opts = {})
     internal_generate
   end
 
diff --git a/lib/msf/core/payload/generic.rb b/lib/msf/core/payload/generic.rb
@@ -43,7 +43,7 @@ def reset
   # the actual payload in case settings have changed.  Other methods will
   # use the cached version if possible.
   #
-  def generate
+  def generate(_opts = {})
     reset
 
     redirect_to_actual(:generate)
diff --git a/lib/msf/core/payload/linux/bind_tcp.rb b/lib/msf/core/payload/linux/bind_tcp.rb
@@ -19,7 +19,7 @@ module Payload::Linux::BindTcp
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       port:     datastore['LPORT'],
       reliable: false
diff --git a/lib/msf/core/payload/linux/reverse_tcp_x86.rb b/lib/msf/core/payload/linux/reverse_tcp_x86.rb
@@ -18,7 +18,7 @@ module Payload::Linux::ReverseTcp_x86
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       port:          datastore['LPORT'],
       host:          datastore['LHOST'],
diff --git a/lib/msf/core/payload/linux/x64/reverse_tcp_x64.rb b/lib/msf/core/payload/linux/x64/reverse_tcp_x64.rb
@@ -17,7 +17,7 @@ module Payload::Linux::ReverseTcp_x64
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       port:        datastore['LPORT'],
       host:        datastore['LHOST'],
diff --git a/lib/msf/core/payload/php/bind_tcp.rb b/lib/msf/core/payload/php/bind_tcp.rb
@@ -17,7 +17,7 @@ module Payload::Php::BindTcp
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       port: datastore['LPORT']
     }
diff --git a/lib/msf/core/payload/php/reverse_tcp.rb b/lib/msf/core/payload/php/reverse_tcp.rb
@@ -17,7 +17,7 @@ module Payload::Php::ReverseTcp
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       port:        datastore['LPORT'],
       host:        datastore['LHOST'],
diff --git a/lib/msf/core/payload/python/bind_tcp.rb b/lib/msf/core/payload/python/bind_tcp.rb
@@ -16,7 +16,7 @@ module Payload::Python::BindTcp
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       port: datastore['LPORT']
     }
diff --git a/lib/msf/core/payload/python/reverse_tcp.rb b/lib/msf/core/payload/python/reverse_tcp.rb
@@ -21,7 +21,7 @@ def initialize(*args)
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       port:        datastore['LPORT'],
       host:        datastore['LHOST'],
diff --git a/lib/msf/core/payload/python/reverse_tcp_ssl.rb b/lib/msf/core/payload/python/reverse_tcp_ssl.rb
@@ -20,7 +20,7 @@ def initialize(*args)
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       port:        datastore['LPORT'],
       host:        datastore['LHOST'],
diff --git a/lib/msf/core/payload/single.rb b/lib/msf/core/payload/single.rb
@@ -23,7 +23,7 @@ def payload_type
   # return the stager.  When a stager is not used, generate will return the
   # single payload
   #
-  def generate
+  def generate(_opts = {})
     # If we're staged, then we call the super to generate the STAGER
     if staged?
       super
diff --git a/lib/msf/core/payload/windows/bind_named_pipe.rb b/lib/msf/core/payload/windows/bind_named_pipe.rb
@@ -30,7 +30,7 @@ def initialize(*args)
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       name:        datastore['PIPENAME'],
       host:        datastore['PIPEHOST'],
diff --git a/lib/msf/core/payload/windows/bind_tcp.rb b/lib/msf/core/payload/windows/bind_tcp.rb
@@ -21,7 +21,7 @@ module Payload::Windows::BindTcp
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       port:     datastore['LPORT'],
       reliable: false
diff --git a/lib/msf/core/payload/windows/bind_tcp_rc4.rb b/lib/msf/core/payload/windows/bind_tcp_rc4.rb
@@ -17,7 +17,7 @@ module Payload::Windows::BindTcpRc4
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     xorkey, rc4key = rc4_keys(datastore['RC4PASSWORD'])
     conf = {
       port:     datastore['LPORT'],
diff --git a/lib/msf/core/payload/windows/encrypted_reverse_tcp.rb b/lib/msf/core/payload/windows/encrypted_reverse_tcp.rb
@@ -61,9 +61,9 @@ def generate(opts={})
 
     src = ''
     if staged?
-      src = generate_stager(conf)
+      src = generate_stager(conf, opts)
     else
-      src = generate_c_src(conf)
+      src = generate_c_src(conf, opts)
     end
 
     link_script = module_info['DefaultOptions']['LinkerScript']
@@ -76,7 +76,7 @@ def generate(opts={})
       keep_exe:      datastore['KeepExe'],
       show_compile_cmd: datastore['ShowCompileCMD'],
       f_name:        Tempfile.new(staged? ? 'reverse_pic_stager' : 'reverse_pic_stageless').path,
-      arch:          self.arch_to_s
+      arch:          opts.fetch(:arch, self.arch_to_s)
     }
 
     comp_code = get_compiled_shellcode(src, compile_opts)
@@ -92,9 +92,9 @@ def generate(opts={})
     comp_code
   end
 
-  def initial_code
+  def initial_code(conf, opts = {})
     src = headers
-    src << align_rsp if self.arch_to_s.eql?('x64')
+    src << align_rsp if opts.fetch(:arch, self.arch_to_s).eql?('x64')
 
     if staged?
       src << chacha_func_staged
@@ -104,8 +104,8 @@ def initial_code
     src << exit_proc
   end
 
-  def generate_stager(conf)
-    src = initial_code
+  def generate_stager(conf, opts = {})
+    src = initial_code(conf, opts)
 
     if conf[:call_wsastartup]
       src << init_winsock
@@ -115,7 +115,7 @@ def generate_stager(conf)
     src << get_load_library(conf[:host], conf[:port])
     src << call_init_winsock if conf[:call_wsastartup]
     src << start_comm(conf[:uuid])
-    src << stager_comm
+    src << stager_comm(conf, opts)
   end
 
   def sends_hex_uuid?
@@ -148,21 +148,21 @@ def generate_stage(opts={})
       keep_exe:      datastore['KeepExe'],
       show_compile_cmd: datastore['ShowCompileCMD'],
       f_name:        Tempfile.new('reverse_pic_stage').path,
-      arch:          self.arch_to_s
+      arch:          opts.fetch(:arch, self.arch_to_s)
     }
 
-    src = initial_code
+    src = initial_code(conf, opts)
     src << get_new_key
     src << init_proc
-    src << exec_payload_stage
+    src << exec_payload_stage(conf, opts)
     shellcode = get_compiled_shellcode(src, comp_opts)
 
     stage_obj = Rex::Crypto::Chacha20.new(key, iv)
     stage_obj.chacha20_crypt(shellcode)
   end
 
-  def generate_c_src(conf)
-    src = initial_code
+  def generate_c_src(conf, opts = {})
+    src = initial_code(conf, opts)
 
     if conf[:call_wsastartup]
       src << init_winsock
@@ -552,9 +552,10 @@ def single_comm
     ^
   end
 
-  def stager_comm
-    reg = self.arch_to_s.eql?('x86') ? 'edi' : 'rdi'
-    inst = self.arch_to_s.eql?('x86') ? 'movl' : 'movq'
+  def stager_comm(conf, opts = {})
+    arch = opts.fetch(:arch, self.arch_to_s)
+    reg = arch.eql?('x86') ? 'edi' : 'rdi'
+    inst = arch.eql?('x86') ? 'movl' : 'movq'
 
     %Q^
         FuncRecv RecvData = (FuncRecv) GetProcAddressWithHash(#{get_hash('ws2_32.dll', 'recv')}); // hash('ws2_32.dll', 'recv') -> 0x5fc8d902
@@ -596,9 +597,10 @@ def stager_comm
     ^
   end
 
-  def exec_payload_stage
-    reg = self.arch_to_s.eql?('x86') ? 'edi' : 'rdi'
-    inst = self.arch_to_s.eql?('x86') ? 'movl' : 'movq'
+  def exec_payload_stage(conf, opts = {})
+    arch = opts.fetch(:arch, self.arch_to_s)
+    reg = arch.eql?('x86') ? 'edi' : 'rdi'
+    inst = arch.eql?('x86') ? 'movl' : 'movq'
 
     %Q^
      void ExecutePayload()
diff --git a/lib/msf/core/payload/windows/exec.rb b/lib/msf/core/payload/windows/exec.rb
@@ -57,7 +57,7 @@ def initialize(info = {})
   #
   # Constructs the payload
   #
-  def generate
+  def generate(_opts = {})
     return super + command_string + "\x00"
   end
 
diff --git a/lib/msf/core/payload/windows/exec_x64.rb b/lib/msf/core/payload/windows/exec_x64.rb
@@ -53,7 +53,7 @@ def initialize(info = {})
       ], self.class )
   end
 
-  def generate
+  def generate(_opts = {})
     return super + command_string + "\x00"
   end
 
diff --git a/lib/msf/core/payload/windows/load_library.rb b/lib/msf/core/payload/windows/load_library.rb
@@ -57,7 +57,7 @@ def initialize(info = {})
   #
   # Constructs the payload
   #
-  def generate
+  def generate(_opts = {})
     return super + dll_string + "\x00"
   end
 
diff --git a/lib/msf/core/payload/windows/pe_inject.rb b/lib/msf/core/payload/windows/pe_inject.rb
@@ -67,8 +67,9 @@ def valid?(value, check_empty: nil)
   module Payload::Windows::PEInject
     def initialize(info = {})
       super
+
       register_options([
-        OptInjectablePE.new('PE', [ true, 'The local path to the PE file to upload' ], arch: arch.first)
+        OptInjectablePE.new('PE', [ true, 'The local path to the PE file to upload' ], arch: info.fetch('AdaptedArch', arch.first))
       ], self.class)
     end
 
@@ -83,7 +84,7 @@ def pe_path
     # Transmits the reflective PE payload to the remote
     # computer so that it can be loaded into memory.
     #
-    def handle_connection(conn, _opts = {})
+    def handle_connection(conn, opts = {})
       data = ''
       begin
         File.open(pe_path, 'rb') do |f|
@@ -96,7 +97,7 @@ def handle_connection(conn, _opts = {})
       end
 
       print_status('Premapping PE file...')
-      pe_map = create_pe_memory_map(data)
+      pe_map = create_pe_memory_map(data, opts)
       print_status("Mapped PE size #{pe_map[:bytes].length}")
       opts = {}
       opts[:is_dll] = pe_map[:is_dll]
@@ -113,10 +114,10 @@ def handle_connection(conn, _opts = {})
       conn.close
     end
 
-    def create_pe_memory_map(file)
+    def create_pe_memory_map(file, opts = {})
       pe = Rex::PeParsey::Pe.new(Rex::ImageSource::Memory.new(file))
       begin
-        OptInjectablePE.assert_compatible(pe, arch.first)
+        OptInjectablePE.assert_compatible(pe, opts.fetch(:arch, arch.first))
       rescue Msf::ValidationError => e
         print_error("PE validation error: #{e.message}")
         raise
diff --git a/lib/msf/core/payload/windows/reverse_named_pipe.rb b/lib/msf/core/payload/windows/reverse_named_pipe.rb
@@ -26,7 +26,7 @@ def initialize(*args)
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       name:        datastore['PIPENAME'],
       host:        datastore['PIPEHOST'] || '.',
diff --git a/lib/msf/core/payload/windows/reverse_tcp_dns.rb b/lib/msf/core/payload/windows/reverse_tcp_dns.rb
@@ -25,7 +25,7 @@ def initialize(*args)
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       port:        datastore['LPORT'],
       host:        datastore['LHOST'],
diff --git a/lib/msf/core/payload/windows/reverse_tcp_rc4.rb b/lib/msf/core/payload/windows/reverse_tcp_rc4.rb
@@ -17,7 +17,7 @@ module Payload::Windows::ReverseTcpRc4
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     xorkey, rc4key = rc4_keys(datastore['RC4PASSWORD'])
     conf = {
       port:        datastore['LPORT'],
diff --git a/lib/msf/core/payload/windows/reverse_tcp_rc4_dns.rb b/lib/msf/core/payload/windows/reverse_tcp_rc4_dns.rb
@@ -17,7 +17,7 @@ module Payload::Windows::ReverseTcpRc4Dns
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     xorkey, rc4key = rc4_keys(datastore['RC4PASSWORD'])
     conf = {
       port:        datastore['LPORT'],
diff --git a/lib/msf/core/payload/windows/reverse_udp.rb b/lib/msf/core/payload/windows/reverse_udp.rb
@@ -16,7 +16,7 @@ module Payload::Windows::ReverseUdp
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       port:        datastore['LPORT'],
       host:        datastore['LHOST'],
diff --git a/lib/msf/core/payload/windows/reverse_win_https.rb b/lib/msf/core/payload/windows/reverse_win_https.rb
@@ -29,7 +29,7 @@ def initialize(*args)
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
 
     verify_cert_hash = get_ssl_cert_hash(datastore['StagerVerifySSLCert'],
                                          datastore['HandlerSSLCert'])
diff --git a/lib/msf/core/payload/windows/x64/bind_named_pipe_x64.rb b/lib/msf/core/payload/windows/x64/bind_named_pipe_x64.rb
@@ -30,7 +30,7 @@ def initialize(*args)
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       name:        datastore['PIPENAME'],
       host:        datastore['PIPEHOST'],
diff --git a/lib/msf/core/payload/windows/x64/bind_tcp_rc4_x64.rb b/lib/msf/core/payload/windows/x64/bind_tcp_rc4_x64.rb
@@ -16,7 +16,7 @@ module Payload::Windows::BindTcpRc4_x64
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     xorkey, rc4key = rc4_keys(datastore['RC4PASSWORD'])
     conf = {
       port:        datastore['LPORT'],
diff --git a/lib/msf/core/payload/windows/x64/bind_tcp_x64.rb b/lib/msf/core/payload/windows/x64/bind_tcp_x64.rb
@@ -19,7 +19,7 @@ module Payload::Windows::BindTcp_x64
   #
   # Generate the first stage
   #
-  def generate
+  def generate(_opts = {})
     conf = {
       port:     datastore['LPORT'],
       reliable: false
diff --git a/lib/msf/core/payload/windows/x64/reverse_named_pipe_x64.rb b/lib/msf/core/payload/windows/x64/reverse_named_pipe_x64.rb
diff --git a/lib/msf/core/payload/windows/x64/reverse_tcp_rc4_x64.rb b/lib/msf/core/payload/windows/x64/reverse_tcp_rc4_x64.rb
diff --git a/lib/msf/core/payload/windows/x64/reverse_tcp_x64.rb b/lib/msf/core/payload/windows/x64/reverse_tcp_x64.rb
diff --git a/lib/msf/core/payload/windows/x64/reverse_win_https_x64.rb b/lib/msf/core/payload/windows/x64/reverse_win_https_x64.rb
diff --git a/modules/payloads/adapters/cmd/windows/powershell.rb b/modules/payloads/adapters/cmd/windows/powershell.rb
diff --git a/modules/payloads/adapters/cmd/windows/powershell/x64.rb b/modules/payloads/adapters/cmd/windows/powershell/x64.rb

Original file line number	Diff line number	Diff line change
`@@ -59,10 +59,10 @@ def initialize(info = {})`
`59`	`59`	`#`
`60`	`60`	`self.module_info['Dependencies'] = self.module_info['Dependencies'] \|\| []`
`61`	`61`
`62`		`- # If this is a staged payload but there is no stage information,`
	`62`	`+ # If this is an adapted or staged payload but there is no stage information,`
`63`	`63`	`# then this is actually a stager + single combination. Set up the`
`64`	`64`	`# information hash accordingly.`
`65`		`- if self.class.include?(Msf::Payload::Single) and`
	`65`	`+ if (self.class.include?(Msf::Payload::Adapter) \|\| self.class.include?(Msf::Payload::Single)) and`
`66`	`66`	`self.class.include?(Msf::Payload::Stager)`
`67`	`67`	`self.module_info['Stage'] = {}`
`68`	`68`
`@@ -288,7 +288,7 @@ def session`
`288`	`288`	`#`
`289`	`289`	`# Generates the payload and returns the raw buffer to the caller.`
`290`	`290`	`#`
`291`		`- def generate`
	`291`	`+ def generate(_opts = {})`
`292`	`292`	`internal_generate`
`293`	`293`	`end`
`294`	`294`
Original file line number	Diff line number	Diff line change
`@@ -43,7 +43,7 @@ def reset`
`43`	`43`	`# the actual payload in case settings have changed. Other methods will`
`44`	`44`	`# use the cached version if possible.`
`45`	`45`	`#`
`46`		`- def generate`
	`46`	`+ def generate(_opts = {})`
`47`	`47`	`reset`
`48`	`48`
`49`	`49`	`redirect_to_actual(:generate)`
Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ module Payload::Linux::BindTcp`
`19`	`19`	`#`
`20`	`20`	`# Generate the first stage`
`21`	`21`	`#`
`22`		`- def generate`
	`22`	`+ def generate(_opts = {})`
`23`	`23`	`conf = {`
`24`	`24`	`port: datastore['LPORT'],`
`25`	`25`	`reliable: false`
Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,7 @@ module Payload::Linux::ReverseTcp_x86`
`18`	`18`	`#`
`19`	`19`	`# Generate the first stage`
`20`	`20`	`#`
`21`		`- def generate`
	`21`	`+ def generate(_opts = {})`
`22`	`22`	`conf = {`
`23`	`23`	`port: datastore['LPORT'],`
`24`	`24`	`host: datastore['LHOST'],`
Original file line number	Diff line number	Diff line change
`@@ -17,7 +17,7 @@ module Payload::Linux::ReverseTcp_x64`
`17`	`17`	`#`
`18`	`18`	`# Generate the first stage`
`19`	`19`	`#`
`20`		`- def generate`
	`20`	`+ def generate(_opts = {})`
`21`	`21`	`conf = {`
`22`	`22`	`port: datastore['LPORT'],`
`23`	`23`	`host: datastore['LHOST'],`
Original file line number	Diff line number	Diff line change
`@@ -17,7 +17,7 @@ module Payload::Php::BindTcp`
`17`	`17`	`#`
`18`	`18`	`# Generate the first stage`
`19`	`19`	`#`
`20`		`- def generate`
	`20`	`+ def generate(_opts = {})`
`21`	`21`	`conf = {`
`22`	`22`	`port: datastore['LPORT']`
`23`	`23`	`}`
Original file line number	Diff line number	Diff line change
`@@ -16,7 +16,7 @@ module Payload::Python::BindTcp`
`16`	`16`	`#`
`17`	`17`	`# Generate the first stage`
`18`	`18`	`#`
`19`		`- def generate`
	`19`	`+ def generate(_opts = {})`
`20`	`20`	`conf = {`
`21`	`21`	`port: datastore['LPORT']`
`22`	`22`	`}`
Original file line number	Diff line number	Diff line change
`@@ -21,7 +21,7 @@ def initialize(*args)`
`21`	`21`	`#`
`22`	`22`	`# Generate the first stage`
`23`	`23`	`#`
`24`		`- def generate`
	`24`	`+ def generate(_opts = {})`
`25`	`25`	`conf = {`
`26`	`26`	`port: datastore['LPORT'],`
`27`	`27`	`host: datastore['LHOST'],`
Original file line number	Diff line number	Diff line change
`@@ -20,7 +20,7 @@ def initialize(*args)`
`20`	`20`	`#`
`21`	`21`	`# Generate the first stage`
`22`	`22`	`#`
`23`		`- def generate`
	`23`	`+ def generate(_opts = {})`
`24`	`24`	`conf = {`
`25`	`25`	`port: datastore['LPORT'],`
`26`	`26`	`host: datastore['LHOST'],`