Skip to content

Commit fd827db

Browse files
OJOJ
committed
Fix up bind stager payload sizes
1 parent 9d7a7cb commit fd827db

File tree

5 files changed

+19
-26
lines changed

5 files changed

+19
-26
lines changed

‎lib/msf/core/payload/windows/bind_tcp.rb

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@ def generate
3030
# Generate the simple version of this stager if we don't have enough space
3131
if self.available_space.nil? || required_space > self.available_space
3232
return generate_bind_tcp({
33-
:port => datastore['LPORT'].to_i
33+
:port => datastore['LPORT'].to_i,
34+
:reliable => false
3435
})
3536
end
3637

@@ -67,8 +68,7 @@ def generate_bind_tcp(opts={})
6768
#
6869
def required_space
6970
# Start with our cached default generated size
70-
# TODO: need help with this from the likes of HD.
71-
space = 277
71+
space = cached_size
7272

7373
# EXITFUNK processing adds 31 bytes at most (for ExitThread, only ~16 for others)
7474
space += 31

‎lib/msf/core/payload/windows/x64/bind_tcp.rb

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,18 +20,15 @@ module Payload::Windows::BindTcp_x64
2020
include Msf::Payload::Windows::BlockApi_x64
2121
include Msf::Payload::Windows::Exitfunk_x64
2222

23-
def close_listen_socket
24-
datastore['StagerCloseListenSocket'].nil? || datastore['StagerCloseListenSocket'] == true
25-
end
26-
2723
#
2824
# Generate the first stage
2925
#
3026
def generate
3127
# Generate the simple version of this stager if we don't have enough space
3228
if self.available_space.nil? || required_space > self.available_space
3329
return generate_bind_tcp({
34-
:port => datastore['LPORT']
30+
:port => datastore['LPORT'],
31+
:reliable => false
3532
})
3633
end
3734

@@ -70,21 +67,17 @@ def generate_bind_tcp(opts={})
7067
def required_space
7168
# Start with our cached default generated size
7269
# TODO: need help with this from the likes of HD.
73-
space = 277
70+
space = cached_size
7471

7572
# EXITFUNK processing adds 31 bytes at most (for ExitThread, only ~16 for others)
7673
space += 31
7774

7875
# EXITFUNK unset will still call ExitProces, which adds 7 bytes (accounted for above)
7976

77+
# TODO: this is coming soon
8078
# Reliability checks add 4 bytes for the first check, 5 per recv check (2)
8179
#space += 14
8280

83-
# if the payload doesn't need the listen socket closed then we save space. This is
84-
# the case for meterpreter payloads, as metsrv now closes the listen socket once it
85-
# kicks off (needed for more reliable shells).
86-
space -= 11 unless close_listen_socket
87-
8881
# The final estimated size
8982
space
9083
end

‎modules/payloads/stagers/windows/bind_tcp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
module Metasploit4
1212

13-
CachedSize = :dynamic
13+
CachedSize = 285
1414

1515
include Msf::Payload::Stager
1616
include Msf::Payload::Windows::BindTcp

‎modules/payloads/stagers/windows/x64/bind_tcp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
module Metasploit4
1212

13-
CachedSize = :dynamic
13+
CachedSize = 479
1414

1515
include Msf::Payload::Stager
1616
include Msf::Payload::Windows::BindTcp_x64

‎spec/modules/payloads_spec.rb

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2285,7 +2285,7 @@
22852285
'stagers/windows/bind_tcp',
22862286
'stages/windows/dllinject'
22872287
],
2288-
dynamic_size: true,
2288+
dynamic_size: false,
22892289
modules_pathname: modules_pathname,
22902290
reference_name: 'windows/dllinject/bind_tcp'
22912291
end
@@ -2571,7 +2571,7 @@
25712571
'stagers/windows/bind_tcp',
25722572
'stages/windows/meterpreter'
25732573
],
2574-
dynamic_size: true,
2574+
dynamic_size: false,
25752575
modules_pathname: modules_pathname,
25762576
reference_name: 'windows/meterpreter/bind_tcp'
25772577
end
@@ -2789,7 +2789,7 @@
27892789
'stagers/windows/bind_tcp',
27902790
'stages/windows/patchupdllinject'
27912791
],
2792-
dynamic_size: true,
2792+
dynamic_size: false,
27932793
modules_pathname: modules_pathname,
27942794
reference_name: 'windows/patchupdllinject/bind_tcp'
27952795
end
@@ -2932,7 +2932,7 @@
29322932
'stagers/windows/bind_tcp',
29332933
'stages/windows/patchupmeterpreter'
29342934
],
2935-
dynamic_size: true,
2935+
dynamic_size: false,
29362936
modules_pathname: modules_pathname,
29372937
reference_name: 'windows/patchupmeterpreter/bind_tcp'
29382938
end
@@ -3075,7 +3075,7 @@
30753075
'stagers/windows/bind_tcp',
30763076
'stages/windows/shell'
30773077
],
3078-
dynamic_size: true,
3078+
dynamic_size: false,
30793079
modules_pathname: modules_pathname,
30803080
reference_name: 'windows/shell/bind_tcp'
30813081
end
@@ -3268,7 +3268,7 @@
32683268
'stagers/windows/bind_tcp',
32693269
'stages/windows/upexec'
32703270
],
3271-
dynamic_size: true,
3271+
dynamic_size: false,
32723272
modules_pathname: modules_pathname,
32733273
reference_name: 'windows/upexec/bind_tcp'
32743274
end
@@ -3411,7 +3411,7 @@
34113411
'stagers/windows/bind_tcp',
34123412
'stages/windows/vncinject'
34133413
],
3414-
dynamic_size: true,
3414+
dynamic_size: false,
34153415
modules_pathname: modules_pathname,
34163416
reference_name: 'windows/vncinject/bind_tcp'
34173417
end
@@ -3552,7 +3552,7 @@
35523552
'stagers/windows/x64/bind_tcp',
35533553
'stages/windows/x64/meterpreter'
35543554
],
3555-
dynamic_size: true,
3555+
dynamic_size: false,
35563556
modules_pathname: modules_pathname,
35573557
reference_name: 'windows/x64/meterpreter/bind_tcp'
35583558
end
@@ -3635,7 +3635,7 @@
36353635
'stagers/windows/x64/bind_tcp',
36363636
'stages/windows/x64/shell'
36373637
],
3638-
dynamic_size: true,
3638+
dynamic_size: false,
36393639
modules_pathname: modules_pathname,
36403640
reference_name: 'windows/x64/shell/bind_tcp'
36413641
end
@@ -3677,7 +3677,7 @@
36773677
'stagers/windows/x64/bind_tcp',
36783678
'stages/windows/x64/vncinject'
36793679
],
3680-
dynamic_size: true,
3680+
dynamic_size: false,
36813681
modules_pathname: modules_pathname,
36823682
reference_name: 'windows/x64/vncinject/bind_tcp'
36833683
end

0 commit comments

Comments
 (0)