Land rapid7#3950, @agix's multiple encoder chaining

Author: Brent Cook

lib/msf/core/encoded_payload.rb

@@ -49,8 +49,6 @@ def generate(raw = nil)
     self.nop_sled      = nil
     self.encoder       = nil
     self.nop           = nil
-    self.iterations    = reqs['Iterations'].to_i
-    self.iterations    = 1 if self.iterations < 1
 
     # Increase thread priority as necessary.  This is done
     # to ensure that the encoding and sled generation get
@@ -71,8 +69,27 @@ def generate(raw = nil)
       # Generate the raw version of the payload first
       generate_raw() if self.raw.nil?
 
-      # Encode the payload
-      encode()
+      # If encoder is set, it could be an encoders list
+      # The form is "<encoder>:<iteration>, <encoder2>:<iteration>"...
+      if reqs['Encoder']
+        encoder_str = reqs['Encoder']
+        encoder_str.scan(/([^:, ]+):?([^,]+)?/).map do |encoder_opt|
+          reqs['Encoder'] = encoder_opt[0]
+
+          self.iterations = (encoder_opt[1] || reqs['Iterations']).to_i
+          self.iterations = 1 if self.iterations < 1
+
+          # Encode the payload with every encoders in the list
+          encode()
+          # Encoded payload is now the raw payload to be encoded by the next encoder
+          self.raw = self.encoded
+        end
+      else
+        self.iterations = reqs['Iterations'].to_i
+        self.iterations = 1 if self.iterations < 1
+        # No specified encoder, let BadChars or ForceEncode do their job
+        encode()
+      end
 
       # Build the NOP sled
       generate_sled()

lib/msf/core/payload/stager.rb

@@ -17,7 +17,7 @@ def initialize(info={})
         Msf::OptBool.new("EnableStageEncoding", [ false, "Encode the second stage payload", false ]),
         Msf::OptString.new("StageEncoder", [ false, "Encoder to use if EnableStageEncoding is set", nil ]),
         Msf::OptString.new("StageEncoderSaveRegisters", [ false, "Additional registers to preserve in the staged payload if EnableStageEncoding is set", "" ]),
-        Msf::OptBool.new("StageEncodingFallback", [ false, "Fallback to default encoders or no encoding if the selected StageEncoder is not compatible", true ])
+        Msf::OptBool.new("StageEncodingFallback", [ false, "Fallback to no encoding if the selected StageEncoder is not compatible", true ])
       ], Msf::Payload::Stager)
 
   end
@@ -221,22 +221,11 @@ def encode_stage_preserved_registers
   # @return [String] Encoded version of +stg+
   def encode_stage(stg)
     return stg unless encode_stage?
-    stage_enc_mod = []
+    stage_enc_mod = nil
 
     # Handle StageEncoder if specified by the user
     if datastore['StageEncoder'].to_s.length > 0
-      # Allow multiple encoders separated by commas
-      stage_enc_mod = datastore["StageEncoder"].split(',').map(&:strip).select{|x| x.to_s.length > 0}.uniq
-    end
-
-    # Add automatic encoding as a fallback if needed
-    if datastore['StageEncodingFallback']
-      stage_enc_mod << nil
-    end
-
-    # If fallback has been disabled and no encoder was parsed, exit early and rop the session
-    if stage_enc_mod.length == 0
-      raise RuntimeError, "StageEncoder is invalid and StageEncodingFallback is disabled"
+      stage_enc_mod = datastore["StageEncoder"]
     end
 
     # Allow the user to specify additional registers to preserve
@@ -247,34 +236,32 @@ def encode_stage(stg)
     saved_registers.strip!
 
     estg = nil
-
-    stage_enc_mod.each do |encoder_refname_from_user|
-
+    begin
       # Generate an encoded version of the stage.  We tell the encoding system
       # to save certain registers to ensure that it does not get clobbered.
       encp = Msf::EncodedPayload.create(
         self,
         'Raw'                => stg,
-        'Encoder'            => encoder_refname_from_user,
+        'Encoder'            => stage_enc_mod,
         'EncoderOptions'     => { 'SaveRegisters' => saved_registers },
         'ForceSaveRegisters' => true,
         'ForceEncode'        => true)
 
       if encp.encoder
-        print_status("Encoded stage with #{encp.encoder.refname}")
+        if stage_enc_mod
+          print_status("Encoded stage with #{stage_enc_mod}")
+        else
+          print_status("Encoded stage with #{encp.encoder.refname}")
+        end
         estg = encp.encoded
-
-        break
       end
-    end
-
-    if datastore['StageEncodingFallback'] && estg.nil?
-      print_warning("StageEncoder failed, falling back to no encoding")
-      estg = stg
-    end
-
-    unless estg
-      raise RuntimeError, "Stage encoding failed and StageEncodingFallback is disabled"
+    rescue
+      if datastore['StageEncodingFallback'] && estg.nil?
+        print_warning("StageEncoder failed, falling back to no encoding")
+        estg = stg
+      else
+        raise RuntimeError, "Stage encoding failed and StageEncodingFallback is disabled"
+      end
     end
 
     estg