Skip to content

Commit a543d95

Browse files
committed
Fix rapid7#4717 - Change AllowWin32SEH's default to false
This is patch to change AllowWin32SEH to false. Root cause: The truely intended behavior is that if the user doesn't set a BufferRegister and the encoder is for Windows, the AllowWin32SEH code should kick in. The problem here is that msfencode and msfvenom handle the platform information differently, so we get different results. With msfencode, the platform information isn't passed when alpha_mixed is used, so even if you're using the encoder for Win32, the encoder doesn't actually know about this. But everything works out just fine anyway because people don't actually rely on AllowWin32SEH. With msfvenom, the platform information is passed, so the encoder actually knows it's for Windows. The two conditions are met (regster and platform), so AllowWin32SEH kicks in. However, the AllowWin32SEH technique enforces the BufferRegister to ECX, and that there's no GetPC, so by default this isn't going to work. The solution: We are actually better off with setting AllowWin32SEH to false, mainly because the SEH technique is pretty much dead (congrats MSFT!). And we want the GetPC routine by default. If people want to use AllowWin32SEH routine, they can simply set AllowWin32SEH to true to bring it right back. For example: e = framework.encoders.create('x86/alpha_mixed') e.datastore.import_options_from_hash({'AllowWin32SEH'=>true}) buf = e.encode("AAAA", nil, nil, ::Msf::Module::PlatformList.win32) Or in msfvenom: msfvenom -p windows/meterpreter/bind_tcp -e x86/alpha_mixed AllowWin32SEH=true -f raw Fix rapid7#4717
1 parent 036cb77 commit a543d95

File tree

2 files changed

+0
-19
lines changed

2 files changed

+0
-19
lines changed

modules/encoders/x86/alpha_mixed.rb

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -55,15 +55,6 @@ def decoder_stub(state)
5555
buf + Rex::Encoder::Alpha2::AlphaMixed::gen_decoder(reg, off)
5656
end
5757

58-
#
59-
# Configure SEH getpc code on Windows
60-
#
61-
def init_platform(platform)
62-
if(platform.supports?(::Msf::Module::PlatformList.win32))
63-
datastore['AllowWin32SEH'] = true
64-
end
65-
end
66-
6758
#
6859
# Encodes a one byte block with the current index of the length of the
6960
# payload.

modules/encoders/x86/alpha_upper.rb

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -58,16 +58,6 @@ def decoder_stub(state)
5858
buf + Rex::Encoder::Alpha2::AlphaUpper::gen_decoder(reg, off)
5959
end
6060

61-
62-
#
63-
# Configure SEH getpc code on Windows
64-
#
65-
def init_platform(platform)
66-
if(platform.supports?(::Msf::Module::PlatformList.win32))
67-
datastore['AllowWin32SEH'] = true
68-
end
69-
end
70-
7161
#
7262
# Encodes a one byte block with the current index of the length of the
7363
# payload.

0 commit comments

Comments
 (0)