@@ -16,6 +16,13 @@ require 'rex'
16
16
require 'msf/ui'
17
17
require 'msf/base'
18
18
19
+ # Mad payload generation
20
+ #
21
+ # @example
22
+ # venom = MsfVenom.new
23
+ # # ARGV will be parsed destructively!
24
+ # venom.parse_args(ARGV)
25
+ # $stdout.puts venom.generate
19
26
class MsfVenom
20
27
class MsfVenomError < StandardError ; end
21
28
class UsageError < MsfVenomError ; end
@@ -34,13 +41,21 @@ class MsfVenom
34
41
@framework = framework
35
42
end
36
43
44
+ # Creates a new framework object.
45
+ #
46
+ # @note Ignores any previously cached value
47
+ # @param (see ::Msf::Simple::Framework.create)
48
+ # @return [Msf::Framework]
37
49
def init_framework ( create_opts = { } )
38
50
create_opts [ :module_types ] ||= [
39
51
::Msf ::MODULE_PAYLOAD , ::Msf ::MODULE_ENCODER , ::Msf ::MODULE_NOP
40
52
]
41
53
@framework = ::Msf ::Simple ::Framework . create ( create_opts . merge ( 'DisableDatabase' => true ) )
42
54
end
43
55
56
+ # Cached framework object
57
+ #
58
+ # @return [Msf::Framework]
44
59
def framework
45
60
return @framework if @framework
46
61
@@ -49,6 +64,10 @@ class MsfVenom
49
64
@framework
50
65
end
51
66
67
+ # Initialize the options for this run from ARGV
68
+ # @param args [Array] Usually ARGV. Parsed destructively.
69
+ # @return [void]
70
+ # @raise [UsageError] When given invalid options
52
71
def parse_args ( args )
53
72
@opts = { }
54
73
@datastore = { }
@@ -181,6 +200,10 @@ class MsfVenom
181
200
encoders
182
201
end
183
202
203
+ # Read a raw payload from stdin (or whatever IO object we're currently
204
+ # using as stdin, see {#initialize})
205
+ #
206
+ # @return [String]
184
207
def payload_stdin
185
208
@in . binmode
186
209
payload = @in . read
@@ -189,7 +212,7 @@ class MsfVenom
189
212
190
213
def generate_nops ( arch , len , nop_mod = nil , nop_opts = { } )
191
214
nop_opts [ 'BadChars' ] ||= ''
192
- nop_jpts [ 'SaveRegisters' ] ||= [ 'esp' , 'ebp' , 'esi' , 'edi' ]
215
+ nop_opts [ 'SaveRegisters' ] ||= [ 'esp' , 'ebp' , 'esi' , 'edi' ]
193
216
194
217
if nop_mod
195
218
nop = framework . nops . create ( nop_mod )
@@ -267,7 +290,32 @@ class MsfVenom
267
290
"\n " + tbl . to_s + "\n "
268
291
end
269
292
293
+ # @return [String] A raw shellcode blob
294
+ # @return [nil] When commandline options conspire to produce no output
270
295
def generate_raw_payload
296
+ if @opts [ :list ]
297
+ @opts [ :list ] . each do |mod |
298
+ case mod . downcase
299
+ when "payloads"
300
+ @err . puts dump_payloads
301
+ when "encoders"
302
+ @err . puts dump_encoders ( @opts [ :arch ] )
303
+ when "nops"
304
+ @err . puts dump_nops
305
+ when "all"
306
+ # Init here so #dump_payloads doesn't create a framework with
307
+ # only payloads, etc.
308
+ init_framework
309
+ @err . puts dump_payloads
310
+ @err . puts dump_encoders
311
+ @err . puts dump_nops
312
+ else
313
+ raise UsageError , "Invalid module type"
314
+ end
315
+ end
316
+ return
317
+ end
318
+
271
319
if @opts [ :payload ] == 'stdin'
272
320
payload_raw = payload_stdin
273
321
if @opts [ :encode ] and ( @opts [ :arch ] . nil? or @opts [ :platform ] . nil? )
@@ -307,29 +355,8 @@ class MsfVenom
307
355
end
308
356
309
357
358
+ # Main dispatch method to do the right thing with the given options.
310
359
def generate
311
- if @opts [ :list ]
312
- @opts [ :list ] . each do |mod |
313
- case mod . downcase
314
- when "payloads"
315
- @err . puts dump_payloads
316
- when "encoders"
317
- @err . puts dump_encoders ( @opts [ :arch ] )
318
- when "nops"
319
- @err . puts dump_nops
320
- when "all"
321
- # Init here so #dump_payloads doesn't create a framework with
322
- # only payloads, etc.
323
- init_framework
324
- @err . puts dump_payloads
325
- @err . puts dump_encoders
326
- @err . puts dump_nops
327
- else
328
- print_error ( "Invalid module type" )
329
- end
330
- end
331
- return
332
- end
333
360
334
361
# Normalize the options
335
362
@opts [ :platform ] = ::Msf ::Module ::PlatformList . transform ( @opts [ :platform ] ) if @opts [ :platform ]
0 commit comments