Brent Cook
159 lines
5.1 KiB
Ruby
159 lines
5.1 KiB
Ruby
# -*- coding: binary -*-
|
|
|
|
require 'rex/parser/arguments'
|
|
|
|
module Msf
|
|
module Ui
|
|
module Console
|
|
module CommandDispatcher
|
|
###
|
|
# Payload module command dispatcher.
|
|
###
|
|
class Payload
|
|
include Msf::Ui::Console::ModuleCommandDispatcher
|
|
|
|
# Load supported formats
|
|
supported_formats = \
|
|
Msf::Simple::Buffer.transform_formats + \
|
|
Msf::Util::EXE.to_executable_fmt_formats
|
|
|
|
@@generate_opts = Rex::Parser::Arguments.new(
|
|
"-b" => [ true, "The list of characters to avoid: '\\x00\\xff'" ],
|
|
"-E" => [ false, "Force encoding." ],
|
|
"-e" => [ true, "The name of the encoder module to use." ],
|
|
"-h" => [ false, "Help banner." ],
|
|
"-o" => [ true, "A comma separated list of options in VAR=VAL format." ],
|
|
"-s" => [ true, "NOP sled length." ],
|
|
"-f" => [ true, "The output file name (otherwise stdout)" ],
|
|
"-t" => [ true, "The output format: #{supported_formats.join(',')}" ],
|
|
"-p" => [ true, "The Platform for output." ],
|
|
"-k" => [ false, "Keep the template executable functional" ],
|
|
"-x" => [ true, "The executable template to use" ],
|
|
"-i" => [ true, "the number of encoding iterations." ]
|
|
)
|
|
|
|
#
|
|
# Returns the hash of commands specific to payload modules.
|
|
#
|
|
def commands
|
|
super.update(
|
|
"generate" => "Generates a payload",
|
|
"to_handler" => "Creates a handler with the specified payload"
|
|
)
|
|
end
|
|
|
|
def cmd_to_handler(*_args)
|
|
handler = framework.modules.create('exploit/multi/handler')
|
|
|
|
handler_opts = {
|
|
'Payload' => mod.refname,
|
|
'LocalInput' => driver.input,
|
|
'LocalOutput' => driver.output,
|
|
'ExitOnSession' => false,
|
|
'RunAsJob' => true
|
|
}
|
|
|
|
handler.datastore.merge!(mod.datastore)
|
|
handler.exploit_simple(handler_opts)
|
|
job_id = handler.job_id
|
|
|
|
print_status "Payload Handler Started as Job #{job_id}"
|
|
end
|
|
|
|
#
|
|
# Returns the command dispatcher name.
|
|
#
|
|
def name
|
|
"Payload"
|
|
end
|
|
|
|
#
|
|
# Generates a payload.
|
|
#
|
|
def cmd_generate(*args)
|
|
# Parse the arguments
|
|
encoder_name = nil
|
|
sled_size = nil
|
|
option_str = nil
|
|
badchars = nil
|
|
type = "ruby"
|
|
ofile = nil
|
|
iter = 1
|
|
force = nil
|
|
template = nil
|
|
plat = nil
|
|
keep = false
|
|
|
|
@@generate_opts.parse(args) do |opt, _idx, val|
|
|
case opt
|
|
when '-b'
|
|
badchars = Rex::Text.hex_to_raw(val)
|
|
when '-e'
|
|
encoder_name = val
|
|
when '-E'
|
|
force = true
|
|
when '-o'
|
|
option_str = val
|
|
when '-s'
|
|
sled_size = val.to_i
|
|
when '-t'
|
|
type = val
|
|
when '-f'
|
|
ofile = val
|
|
when '-i'
|
|
iter = val
|
|
when '-k'
|
|
keep = true
|
|
when '-p'
|
|
plat = val
|
|
when '-x'
|
|
template = val
|
|
when '-h'
|
|
print(
|
|
"Usage: generate [options]\n\n" \
|
|
"Generates a payload.\n" +
|
|
@@generate_opts.usage
|
|
)
|
|
return true
|
|
end
|
|
end
|
|
if encoder_name.nil? && mod.datastore['ENCODER']
|
|
encoder_name = mod.datastore['ENCODER']
|
|
end
|
|
|
|
# Generate the payload
|
|
begin
|
|
buf = mod.generate_simple(
|
|
'BadChars' => badchars,
|
|
'Encoder' => encoder_name,
|
|
'Format' => type,
|
|
'NopSledSize' => sled_size,
|
|
'OptionStr' => option_str,
|
|
'ForceEncode' => force,
|
|
'Template' => template,
|
|
'Platform' => plat,
|
|
'KeepTemplateWorking' => keep,
|
|
'Iterations' => iter
|
|
)
|
|
rescue
|
|
log_error("Payload generation failed: #{$ERROR_INFO}")
|
|
return false
|
|
end
|
|
|
|
if !ofile
|
|
# Display generated payload
|
|
print(buf)
|
|
else
|
|
print_status("Writing #{buf.length} bytes to #{ofile}...")
|
|
fd = File.open(ofile, "wb")
|
|
fd.write(buf)
|
|
fd.close
|
|
end
|
|
true
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|