Skip to content

Commit ad46b46

Browse files
egyptegypt
committed
Landing rapid7#1463, Meatballs' cdecl fixes
2 parents 2d47be4 + 595cace commit ad46b46

File tree

6 files changed

+37
-29
lines changed

6 files changed

+37
-29
lines changed

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wldap32.rb

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,14 @@ def self.create_dll(dll_path = 'wldap32')
1616
['PCHAR', 'HostName', 'in'],
1717
['DWORD', 'PortNumber', 'in'],
1818
['DWORD', 'secure', 'in']
19-
])
19+
], 'ldap_sslinitA', "cdecl")
2020

2121
dll.add_function('ldap_bind_sA', 'DWORD',[
2222
['DWORD', 'ld', 'in'],
2323
['PCHAR', 'dn', 'in'],
2424
['PCHAR', 'cred', 'in'],
2525
['DWORD', 'method', 'in']
26-
])
26+
], 'ldap_bind_sA', "cdecl")
2727

2828
dll.add_function('ldap_search_sA', 'DWORD',[
2929
['DWORD', 'ld', 'in'],
@@ -33,70 +33,71 @@ def self.create_dll(dll_path = 'wldap32')
3333
['PCHAR', 'attrs[]', 'in'],
3434
['DWORD', 'attrsonly', 'in'],
3535
['PDWORD', 'res', 'out']
36-
])
36+
], 'ldap_search_sA', "cdecl")
3737

3838
dll.add_function('ldap_count_entries', 'DWORD',[
3939
['DWORD', 'ld', 'in'],
4040
['DWORD', 'res', 'in']
41-
])
42-
dll.add_function('ldap_first_entry', 'DWORD',[
41+
], "ldap_count_entries", "cdecl")
42+
43+
dll.add_function('ldap_first_entry', 'DWORD',[
4344
['DWORD', 'ld', 'in'],
4445
['DWORD', 'res', 'in']
45-
])
46+
], 'ldap_first_entry', "cdecl")
4647

4748
dll.add_function('ldap_next_entry', 'DWORD',[
4849
['DWORD', 'ld', 'in'],
4950
['DWORD', 'entry', 'in']
50-
])
51+
], 'ldap_next_entry', "cdecl")
5152

5253
dll.add_function('ldap_first_attributeA', 'DWORD',[
5354
['DWORD', 'ld', 'in'],
5455
['DWORD', 'entry', 'in'],
5556
['DWORD', 'ptr', 'in']
56-
])
57+
], 'ldap_first_attributeA', "cdecl")
5758

5859
dll.add_function('ldap_next_attributeA', 'DWORD',[
5960
['DWORD', 'ld', 'in'],
6061
['DWORD', 'entry', 'in'],
6162
['DWORD', 'ptr', 'inout']
62-
])
63+
], 'ldap_next_attributeA', "cdecl")
6364

6465
dll.add_function('ldap_count_values', 'DWORD',[
6566
['DWORD', 'vals', 'in'],
66-
])
67+
], 'ldap_count_values', "cdecl")
6768

6869
dll.add_function('ldap_get_values', 'DWORD',[
6970
['DWORD', 'ld', 'in'],
7071
['DWORD', 'entry', 'in'],
7172
['PCHAR', 'attr', 'in']
72-
])
73+
], 'ldap_get_values', "cdecl")
7374

7475
dll.add_function('ldap_value_free', 'DWORD',[
7576
['DWORD', 'vals', 'in'],
76-
])
77+
], 'ldap_value_free', "cdecl")
7778

7879
dll.add_function('ldap_memfree', 'VOID',[
7980
['DWORD', 'block', 'in'],
80-
])
81+
], 'ldap_memfree', "cdecl")
8182

8283
dll.add_function('ber_free', 'VOID',[
8384
['DWORD', 'pBerElement', 'in'],
8485
['DWORD', 'fbuf', 'in'],
85-
])
86+
], 'ber_free', "cdecl")
8687

87-
dll.add_function('LdapGetLastError', 'DWORD',[])
88+
dll.add_function('LdapGetLastError', 'DWORD',[], 'LdapGetLastError', "cdecl")
8889

8990
dll.add_function('ldap_err2string', 'DWORD',[
9091
['DWORD', 'err', 'in']
91-
])
92+
], 'ldap_err2string', "cdecl")
9293

9394
dll.add_function('ldap_msgfree', 'DWORD', [
9495
['DWORD', 'res', 'in']
95-
])
96+
], 'ldap_msgfree', "cdecl")
9697

9798
dll.add_function('ldap_unbind', 'DWORD', [
9899
['DWORD', 'ld', 'in']
99-
])
100+
], 'ldap_unbind', "cdecl")
100101
return dll
101102
end
102103

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,11 +107,11 @@ def call_function(func_symbol, args, client)
107107
# When the new function is called it will return a list containing the
108108
# return value and all inout params. See #call_function.
109109
#
110-
def add_function(name, return_type, params, windows_name=nil)
110+
def add_function(name, return_type, params, windows_name=nil, calling_conv="stdcall")
111111
if windows_name == nil
112112
windows_name = name
113113
end
114-
@functions[name] = DLLFunction.new(return_type, params, windows_name)
114+
@functions[name] = DLLFunction.new(return_type, params, windows_name, calling_conv)
115115
end
116116

117117
private
@@ -257,6 +257,7 @@ def process_function_call(function, args, client)
257257

258258
request.add_tlv(TLV_TYPE_RAILGUN_DLLNAME, @dll_path )
259259
request.add_tlv(TLV_TYPE_RAILGUN_FUNCNAME, function.windows_name)
260+
request.add_tlv(TLV_TYPE_RAILGUN_CALLCONV, function.calling_conv)
260261

261262
response = client.send_request(request)
262263

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,20 +48,30 @@ class DLLFunction
4848
"PBLOB" => ["in", "out", "inout"],
4949
}.freeze
5050

51+
@@allowed_convs = ["stdcall", "cdecl"]
52+
5153
@@directions = ["in", "out", "inout", "return"].freeze
5254

53-
attr_reader :return_type, :params, :windows_name
55+
attr_reader :return_type, :params, :windows_name, :calling_conv
5456

55-
def initialize(return_type, params, windows_name)
57+
def initialize(return_type, params, windows_name, calling_conv="stdcall")
5658
check_return_type(return_type) # we do error checking as early as possible so the library is easier to use
5759
check_params(params)
60+
check_calling_conv(calling_conv)
5861
@return_type = return_type
5962
@params = params
6063
@windows_name = windows_name
64+
@calling_conv = calling_conv
6165
end
6266

6367
private
6468

69+
def check_calling_conv(conv)
70+
if not @@allowed_convs.include?(conv)
71+
raise ArgumentError, "Calling convention unknown: #{conv}."
72+
end
73+
end
74+
6575
def check_type_exists (type)
6676
if not @@allowed_datatypes.has_key?(type)
6777
raise ArgumentError, "Type unknown: #{type}. Allowed types: #{PP.pp(@@allowed_datatypes.keys, "")}"

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,7 @@ def memwrite(address, data, length)
180180
# cached dlls) an unfrozen copy is created and used henceforth for this
181181
# instance.
182182
#
183-
def add_function(dll_name, function_name, return_type, params, windows_name=nil)
183+
def add_function(dll_name, function_name, return_type, params, windows_name=nil, calling_conv="stdcall")
184184

185185
unless known_dll_names.include?(dll_name)
186186
raise "DLL #{dll_name} not found. Known DLLs: #{PP.pp(known_dll_names, "")}"
@@ -197,7 +197,7 @@ def add_function(dll_name, function_name, return_type, params, windows_name=nil)
197197
dlls[dll_name] = dll
198198
end
199199

200-
dll.add_function(function_name, return_type, params, windows_name)
200+
dll.add_function(function_name, return_type, params, windows_name, calling_conv)
201201
end
202202

203203
#

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/tlv.rb

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,4 +51,5 @@ module Railgun
5151
TLV_TYPE_RAILGUN_MEM_DATA = TLV_META_TYPE_RAW | (TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 13 )
5252
TLV_TYPE_RAILGUN_MEM_LENGTH = TLV_META_TYPE_UINT | (TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 14 )
5353

54+
TLV_TYPE_RAILGUN_CALLCONV = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 15)
5455
end; end; end; end; end; end

‎modules/post/windows/gather/enum_ad_computers.rb

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -51,11 +51,6 @@ def read_value(addr)
5151
end
5252

5353
def run
54-
unless session.platform == "x64/win64"
55-
print_error("Does not work in x86 meterpreter (use x64 instead) see: http://dev.metasploit.com/redmine/issues/7639");
56-
return
57-
end
58-
5954
print_status("Connecting to default LDAP server")
6055
session_handle = bind_default_ldap_server
6156

0 commit comments

Comments
 (0)