Skip to content

Commit 56793d1

Browse files
committed
Fix rapid7#4866, msfvenom not properly handling platform & arch
This fixes rapid7#4866, an issue with msfvenom not properly handling special cases with generic payloads. So the story behind this fix is that we have these two problems: Problem 1: The current payload selection design relies on the payload module in order to set the platform and arch. Almost all MSF payloads contain a default platform and arch, however, the bind and reverse generic payloads don't. Problem 2: By default, Msf::Payload::Generic also explicitly sets the PLATFORM and ARCH datastore options to nil. So there is no way the payload generator can figure out what platform and arch to use. As a result of these problems, msfvenom will actually end up getting a Msf::Module::Platform as the default platform, which doesn't actually represent any valid platform we can use (such as Msf::Module::Platform::Windows). And the first item of ARCH_ALL for the arch. In addition, msfvenom has these two arguments that the user can use: --platform and --arch. In most cases, these arguments are used more like checks than actually setting anything. Because remember: Framework's payload selector retreives the platform & arch from the module (trusted), not the user input (untrusted). But from the user's perspective it's impossible to know this. After experimenting different ways to fix this, I came up with this patch. It feels sort of more like a hack than a real fix, but as far as I can tell, this is the best you can get unless you want to redesign generic payload selection.
1 parent ec28992 commit 56793d1

File tree

1 file changed

+16
-0
lines changed

1 file changed

+16
-0
lines changed

lib/msf/core/payload_generator.rb

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,8 +144,10 @@ def choose_arch(mod)
144144
if arch.blank?
145145
@arch = mod.arch.first
146146
cli_print "No Arch selected, selecting Arch: #{arch} from the payload"
147+
datastore['ARCH'] = arch if mod.kind_of?(Msf::Payload::Generic)
147148
return mod.arch.first
148149
elsif mod.arch.include? arch
150+
datastore['ARCH'] = arch if mod.kind_of?(Msf::Payload::Generic)
149151
return arch
150152
else
151153
return nil
@@ -157,14 +159,28 @@ def choose_arch(mod)
157159
# @param mod [Msf::Payload] The module class to choose a platform for
158160
# @return [Msf::Module::PlatformList] The selected platform list
159161
def choose_platform(mod)
162+
# By default, platform_list will at least return Msf::Module::Platform
163+
# if there is absolutely no pre-configured platform info at all
160164
chosen_platform = platform_list
165+
161166
if chosen_platform.platforms.empty?
162167
chosen_platform = mod.platform
163168
cli_print "No platform was selected, choosing #{chosen_platform.platforms.first} from the payload"
164169
@platform = mod.platform.platforms.first.to_s.split("::").last
165170
elsif (chosen_platform & mod.platform).empty?
166171
chosen_platform = Msf::Module::PlatformList.new
167172
end
173+
174+
begin
175+
platform_object = Msf::Module::Platform.find_platform(platform)
176+
rescue ArgumentError
177+
platform_object = nil
178+
end
179+
180+
if mod.kind_of?(Msf::Payload::Generic) && mod.send(:module_info)['Platform'].empty? && platform_object
181+
datastore['PLATFORM'] = platform
182+
end
183+
168184
chosen_platform
169185
end
170186

0 commit comments

Comments
 (0)