Land rapid7#4724, @wchen-r7's AllowWin32SEH's change on alpha encoders

jvazquez-r7 · jvazquez-r7 · commit 81cad064eaef · 2015-02-09T11:01:00.000-06:00
diff --git a/modules/encoders/x86/alpha_mixed.rb b/modules/encoders/x86/alpha_mixed.rb
@@ -55,15 +55,6 @@ def decoder_stub(state)
     buf + Rex::Encoder::Alpha2::AlphaMixed::gen_decoder(reg, off)
   end
 
-  #
-  # Configure SEH getpc code on Windows
-  #
-  def init_platform(platform)
-    if(platform.supports?(::Msf::Module::PlatformList.win32))
-      datastore['AllowWin32SEH'] = true
-    end
-  end
-
   #
   # Encodes a one byte block with the current index of the length of the
   # payload.
diff --git a/modules/encoders/x86/alpha_upper.rb b/modules/encoders/x86/alpha_upper.rb
@@ -58,16 +58,6 @@ def decoder_stub(state)
     buf + Rex::Encoder::Alpha2::AlphaUpper::gen_decoder(reg, off)
   end
 
-
-  #
-  # Configure SEH getpc code on Windows
-  #
-  def init_platform(platform)
-    if(platform.supports?(::Msf::Module::PlatformList.win32))
-      datastore['AllowWin32SEH'] = true
-    end
-  end
-
   #
   # Encodes a one byte block with the current index of the length of the
   # payload.
diff --git a/modules/exploits/windows/browser/orbit_connecting.rb b/modules/exploits/windows/browser/orbit_connecting.rb
@@ -29,6 +29,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'process',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/browser/xmplay_asx.rb b/modules/exploits/windows/browser/xmplay_asx.rb
@@ -28,10 +28,10 @@ def initialize(info = {})
           [ 'BID', '21206'],
           [ 'URL', 'http://secunia.com/advisories/22999/' ],
         ],
-
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'process',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/fileformat/acdsee_xpm.rb b/modules/exploits/windows/fileformat/acdsee_xpm.rb
@@ -32,6 +32,7 @@ def initialize(info = {})
         {
           'EXITFUNC' => 'process',
           'DisablePayloadHandler' => 'true',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/fileformat/adobe_illustrator_v14_eps.rb b/modules/exploits/windows/fileformat/adobe_illustrator_v14_eps.rb
@@ -31,6 +31,7 @@ def initialize(info = {})
         {
           'EXITFUNC' => 'seh',
           'DisablePayloadHandler' => 'true',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/fileformat/audio_wkstn_pls.rb b/modules/exploits/windows/fileformat/audio_wkstn_pls.rb
@@ -32,6 +32,7 @@ def initialize(info = {})
         {
           'EXITFUNC' => 'seh',
           'DisablePayloadHandler' => 'true',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/fileformat/blazedvd_plf.rb b/modules/exploits/windows/fileformat/blazedvd_plf.rb
@@ -35,14 +35,16 @@ def initialize(info = {})
         ],
       'DefaultOptions' =>
         {
-          'EXITFUNC' => 'process'
+          'EXITFUNC' => 'process',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
           'Space'    => 750,
           'BadChars' => "\x00\x0a\x1a",
           'DisableNops'  =>  true
         },
+
       'Platform' => 'win',
       'Targets'        =>
         [
diff --git a/modules/exploits/windows/fileformat/cain_abel_4918_rdp.rb b/modules/exploits/windows/fileformat/cain_abel_4918_rdp.rb
@@ -34,6 +34,10 @@ def initialize(info = {})
           'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
           'StackAdjustment' => -3500,
         },
+      'DefaultOptions' =>
+        {
+          'AllowWin32SEH' => true
+        },
       'Platform' => 'win',
       'Targets'        =>
         [
diff --git a/modules/exploits/windows/fileformat/destinymediaplayer16.rb b/modules/exploits/windows/fileformat/destinymediaplayer16.rb
@@ -33,6 +33,10 @@ def initialize(info = {})
           'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
           'StackAdjustment' => -3500,
         },
+      'DefaultOptions' =>
+        {
+          'AllowWin32SEH' => true
+        },
       'Platform' => 'win',
       'Targets'        =>
         [
diff --git a/modules/exploits/windows/fileformat/ezip_wizard_bof.rb b/modules/exploits/windows/fileformat/ezip_wizard_bof.rb
@@ -47,6 +47,10 @@ def initialize(info = {})
         {
           'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
         },
+      'DefaultOptions' =>
+        {
+          'AllowWin32SEH' => true
+        },
       'Targets'        =>
         [
           ['Windows Universal', { 'Offset' => 58, 'Ret' => 0x10020710 }],
diff --git a/modules/exploits/windows/fileformat/ht_mp3player_ht3_bof.rb b/modules/exploits/windows/fileformat/ht_mp3player_ht3_bof.rb
@@ -39,6 +39,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'process',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/fileformat/safenet_softremote_groupname.rb b/modules/exploits/windows/fileformat/safenet_softremote_groupname.rb
@@ -32,6 +32,7 @@ def initialize(info = {})
         {
           'EXITFUNC' => 'process',
           'DisablePayloadHandler' => 'true',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/fileformat/vuplayer_cue.rb b/modules/exploits/windows/fileformat/vuplayer_cue.rb
@@ -29,6 +29,7 @@ def initialize(info = {})
         {
           'EXITFUNC' => 'process',
           'DisablePayloadHandler' => 'true',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/fileformat/vuplayer_m3u.rb b/modules/exploits/windows/fileformat/vuplayer_m3u.rb
@@ -29,6 +29,7 @@ def initialize(info = {})
         {
           'EXITFUNC' => 'process',
           'DisablePayloadHandler' => 'true',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/fileformat/zinfaudioplayer221_pls.rb b/modules/exploits/windows/fileformat/zinfaudioplayer221_pls.rb
@@ -37,6 +37,10 @@ def initialize(info = {})
           'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
           'StackAdjustment' => -3500,
         },
+      'DefaultOptions' =>
+        {
+          'AllowWin32SEH' => true
+        },
       'Platform' => 'win',
       'Targets'        =>
         [
diff --git a/modules/exploits/windows/games/racer_503beta5.rb b/modules/exploits/windows/games/racer_503beta5.rb
@@ -34,6 +34,10 @@ def initialize(info = {})
           'BadChars' => "\x5c\x00",
           'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
         },
+      'DefaultOptions' =>
+        {
+          'AllowWin32SEH' => true
+        },
       'Platform'       => 'win',
       'Targets'        =>
         [
diff --git a/modules/exploits/windows/http/amlibweb_webquerydll_app.rb b/modules/exploits/windows/http/amlibweb_webquerydll_app.rb
@@ -37,6 +37,7 @@ def initialize(info = {})
       'DefaultOptions'	=>
         {
           'EXITFUNC'	=> 'thread',
+          'AllowWin32SEH' => true
         },
       'Payload'		=>
         {
diff --git a/modules/exploits/windows/http/apache_mod_rewrite_ldap.rb b/modules/exploits/windows/http/apache_mod_rewrite_ldap.rb
@@ -39,6 +39,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'thread',
+          'AllowWin32SEH' => true
         },
       'Privileged'     => true,
       'Platform'       => ['win'],
diff --git a/modules/exploits/windows/http/belkin_bulldog.rb b/modules/exploits/windows/http/belkin_bulldog.rb
@@ -30,6 +30,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'process',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/http/steamcast_useragent.rb b/modules/exploits/windows/http/steamcast_useragent.rb
@@ -35,6 +35,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'thread',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/imap/novell_netmail_auth.rb b/modules/exploits/windows/imap/novell_netmail_auth.rb
@@ -30,6 +30,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'thread',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/misc/bigant_server.rb b/modules/exploits/windows/misc/bigant_server.rb
@@ -31,6 +31,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'process',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/misc/bigant_server_250.rb b/modules/exploits/windows/misc/bigant_server_250.rb
@@ -36,6 +36,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'seh',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/misc/borland_interbase.rb b/modules/exploits/windows/misc/borland_interbase.rb
@@ -28,6 +28,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'thread',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/misc/poppeeper_date.rb b/modules/exploits/windows/misc/poppeeper_date.rb
@@ -30,6 +30,7 @@ module is based off of krakowlabs code.
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'process',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/misc/poppeeper_uidl.rb b/modules/exploits/windows/misc/poppeeper_uidl.rb
@@ -30,6 +30,7 @@ module is based off of krakowlabs code.
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'process',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/misc/talkative_response.rb b/modules/exploits/windows/misc/talkative_response.rb
@@ -27,6 +27,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'process',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/misc/windows_rsh.rb b/modules/exploits/windows/misc/windows_rsh.rb
@@ -30,6 +30,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'thread',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/nntp/ms05_030_nntp.rb b/modules/exploits/windows/nntp/ms05_030_nntp.rb
@@ -28,6 +28,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'process',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/novell/groupwisemessenger_client.rb b/modules/exploits/windows/novell/groupwisemessenger_client.rb
@@ -28,6 +28,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'process',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {
diff --git a/modules/exploits/windows/proxy/qbik_wingate_wwwproxy.rb b/modules/exploits/windows/proxy/qbik_wingate_wwwproxy.rb
@@ -30,6 +30,7 @@ def initialize(info = {})
       'DefaultOptions' =>
         {
           'EXITFUNC' => 'process',
+          'AllowWin32SEH' => true
         },
       'Payload'        =>
         {

Original file line number	Diff line number	Diff line change
`@@ -29,6 +29,7 @@ def initialize(info = {})`
`29`	`29`	`'DefaultOptions' =>`
`30`	`30`	`{`
`31`	`31`	`'EXITFUNC' => 'process',`
	`32`	`+ 'AllowWin32SEH' => true`
`32`	`33`	`},`
`33`	`34`	`'Payload' =>`
`34`	`35`	`{`
Original file line number	Diff line number	Diff line change
`@@ -28,10 +28,10 @@ def initialize(info = {})`
`28`	`28`	`[ 'BID', '21206'],`
`29`	`29`	`[ 'URL', 'http://secunia.com/advisories/22999/' ],`
`30`	`30`	`],`
`31`		`-`
`32`	`31`	`'DefaultOptions' =>`
`33`	`32`	`{`
`34`	`33`	`'EXITFUNC' => 'process',`
	`34`	`+ 'AllowWin32SEH' => true`
`35`	`35`	`},`
`36`	`36`	`'Payload' =>`
`37`	`37`	`{`
Original file line number	Diff line number	Diff line change
`@@ -32,6 +32,7 @@ def initialize(info = {})`
`32`	`32`	`{`
`33`	`33`	`'EXITFUNC' => 'process',`
`34`	`34`	`'DisablePayloadHandler' => 'true',`
	`35`	`+ 'AllowWin32SEH' => true`
`35`	`36`	`},`
`36`	`37`	`'Payload' =>`
`37`	`38`	`{`
Original file line number	Diff line number	Diff line change
`@@ -31,6 +31,7 @@ def initialize(info = {})`
`31`	`31`	`{`
`32`	`32`	`'EXITFUNC' => 'seh',`
`33`	`33`	`'DisablePayloadHandler' => 'true',`
	`34`	`+ 'AllowWin32SEH' => true`
`34`	`35`	`},`
`35`	`36`	`'Payload' =>`
`36`	`37`	`{`
Original file line number	Diff line number	Diff line change
`@@ -35,14 +35,16 @@ def initialize(info = {})`
`35`	`35`	`],`
`36`	`36`	`'DefaultOptions' =>`
`37`	`37`	`{`
`38`		`- 'EXITFUNC' => 'process'`
	`38`	`+ 'EXITFUNC' => 'process',`
	`39`	`+ 'AllowWin32SEH' => true`
`39`	`40`	`},`
`40`	`41`	`'Payload' =>`
`41`	`42`	`{`
`42`	`43`	`'Space' => 750,`
`43`	`44`	`'BadChars' => "\x00\x0a\x1a",`
`44`	`45`	`'DisableNops' => true`
`45`	`46`	`},`
	`47`	`+`
`46`	`48`	`'Platform' => 'win',`
`47`	`49`	`'Targets' =>`
`48`	`50`	`[`