x90" * 365
152 lines
4.2 KiB
Ruby
Executable File
152 lines
4.2 KiB
Ruby
Executable File
#!/usr/bin/env ruby
|
|
#
|
|
# $Id$
|
|
# $Revision$
|
|
|
|
msfbase = __FILE__
|
|
while File.symlink?(msfbase)
|
|
msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase))
|
|
end
|
|
|
|
$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib')))
|
|
$:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB']
|
|
|
|
require 'msfenv'
|
|
require 'msf/core'
|
|
require 'msf/base'
|
|
require 'rex/text'
|
|
require 'optparse'
|
|
|
|
module PatternOffset
|
|
class OptsConsole
|
|
def self.parse(args)
|
|
options = {}
|
|
parser = OptionParser.new do |opt|
|
|
opt.banner = "Usage: #{__FILE__} [options]\nExample: #{__FILE__} -l 50 -s ABC,def,123\nAd1Ad2Ad3Ae1Ae2Ae3Af1Af2Af3Bd1Bd2Bd3Be1Be2Be3Bf1Bf"
|
|
opt.separator ''
|
|
opt.separator 'Specific options:'
|
|
opt.on('-l', '--length <length>', Integer, "The length of the pattern") do |len|
|
|
options[:length] = len
|
|
end
|
|
|
|
opt.on('-s', '--sets <ABC,def,123>', Array, "Custom Pattern Sets") do |sets|
|
|
options[:sets] = sets
|
|
end
|
|
|
|
opt.on('-q', '--query Aa0A', String, "Query to Locate") do |value|
|
|
options[:value] = value
|
|
end
|
|
|
|
opt.on_tail('-h', '--help', 'Show this message') do
|
|
$stdout.puts opt
|
|
exit
|
|
end
|
|
|
|
end
|
|
|
|
parser.parse!(args)
|
|
|
|
if options.empty?
|
|
raise OptionParser::MissingArgument, 'No options set, try -h for usage'
|
|
elsif options[:length].blank? && options[:sets]
|
|
raise OptionParser::MissingArgument, '-l <length> is required'
|
|
end
|
|
|
|
options[:sets] = nil unless options[:sets]
|
|
|
|
options
|
|
end
|
|
end
|
|
|
|
class Driver
|
|
def initialize
|
|
begin
|
|
@opts = OptsConsole.parse(ARGV)
|
|
rescue OptionParser::ParseError => e
|
|
$stderr.puts "[x] #{e.message}"
|
|
exit
|
|
end
|
|
end
|
|
|
|
def run
|
|
value = (@opts[:value])
|
|
pattern = Rex::Text.pattern_create(@opts[:length], @opts[:sets])
|
|
puts "Pattern #{pattern}"
|
|
|
|
|
|
if (value.length >= 8 and value.hex > 0)
|
|
value = value.hex
|
|
# However, you can also specify a four-byte string
|
|
elsif (value.length == 4)
|
|
value = value.unpack("V").first
|
|
else
|
|
# Or even a hex value that isn't 8 bytes long
|
|
value = value.to_i(16)
|
|
end
|
|
|
|
buffer = Rex::Text.pattern_create(@opts[:length], @opts[:sets])
|
|
offset = Rex::Text.pattern_offset(buffer, value)
|
|
|
|
# Handle cases where there is no match by looking for "close" matches
|
|
unless offset
|
|
found = false
|
|
$stderr.puts "[*] No exact matches, looking for likely candidates..."
|
|
|
|
# Look for shifts by a single byte
|
|
0.upto(3) do |idx|
|
|
0.upto(255) do |c|
|
|
nvb = [value].pack("V")
|
|
nvb[idx, 1] = [c].pack("C")
|
|
nvi = nvb.unpack("V").first
|
|
|
|
off = Rex::Text.pattern_offset(buffer, nvi)
|
|
if off
|
|
mle = value - buffer[off,4].unpack("V").first
|
|
mbe = value - buffer[off,4].unpack("N").first
|
|
puts "[+] Possible match at offset #{off} (adjusted [ little-endian: #{mle} | big-endian: #{mbe} ] ) byte offset #{idx}"
|
|
found = true
|
|
end
|
|
end
|
|
end
|
|
|
|
exit! if found
|
|
|
|
# Look for 16-bit offsets
|
|
[0, 2].each do |idx|
|
|
0.upto(65535) do |c|
|
|
nvb = [value].pack("V")
|
|
nvb[idx, 2] = [c].pack("v")
|
|
nvi = nvb.unpack("V").first
|
|
|
|
off = Rex::Text.pattern_offset(buffer, nvi)
|
|
if off
|
|
mle = value - buffer[off,4].unpack("V").first
|
|
mbe = value - buffer[off,4].unpack("N").first
|
|
puts "[+] Possible match at offset #{off} (adjusted [ little-endian: #{mle} | big-endian: #{mbe} ] )"
|
|
found = true
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
while offset
|
|
puts "[*] Exact match at offset #{offset}"
|
|
offset = Rex::Text.pattern_offset(buffer, value, offset + 1)
|
|
end
|
|
|
|
end
|
|
end
|
|
end
|
|
|
|
if __FILE__ == $PROGRAM_NAME
|
|
driver = PatternOffset::Driver.new
|
|
begin
|
|
driver.run
|
|
rescue ::Exception => e
|
|
elog("#{e.class}: #{e.message}\n#{e.backtrace * "\n"}")
|
|
$stderr.puts "[x] #{e.class}: #{e.message}"
|
|
$stderr.puts "[*] If necessary, please refer to framework.log for more details."
|
|
|
|
end
|
|
end
|