2007-02-18 00:10:39 +00:00
|
|
|
##
|
2014-10-17 16:47:33 +00:00
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
2013-10-15 18:50:46 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
2007-02-18 00:10:39 +00:00
|
|
|
##
|
|
|
|
|
|
|
|
|
2005-12-30 04:06:41 +00:00
|
|
|
require 'msf/core'
|
|
|
|
|
|
|
|
|
|
|
|
###
|
|
|
|
#
|
|
|
|
# SingleByte
|
|
|
|
# ----------
|
|
|
|
#
|
|
|
|
# This class implements simple NOP generator for PowerPC
|
|
|
|
#
|
|
|
|
###
|
2016-03-07 19:19:55 +00:00
|
|
|
class Metasploit3 < Msf::Nop
|
2005-12-30 04:06:41 +00:00
|
|
|
|
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
def initialize
|
|
|
|
super(
|
|
|
|
'Name' => 'Simple',
|
|
|
|
'Alias' => 'ppc_simple',
|
|
|
|
'Description' => 'Simple NOP generator',
|
|
|
|
'Author' => 'hdm',
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
'Arch' => ARCH_PPC)
|
2005-12-30 04:06:41 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
register_advanced_options(
|
|
|
|
[
|
|
|
|
OptBool.new('RandomNops', [ false, "Generate a random NOP sled", true ])
|
|
|
|
], self.class)
|
|
|
|
end
|
2005-12-30 04:06:41 +00:00
|
|
|
|
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
def generate_sled(length, opts)
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
badchars = opts['BadChars'] || ''
|
|
|
|
random = opts['Random'] || datastore['RandomNops']
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
if( random and random.match(/^(t|y|1)/i) )
|
|
|
|
1.upto(1024) do |i|
|
|
|
|
regs_d = (rand(0x8000 - 0x0800) + 0x0800).to_i
|
|
|
|
regs_b = [regs_d].pack('n').unpack('B*')[0][1, 15]
|
|
|
|
flag_o = rand(2).to_i
|
|
|
|
flag_r = rand(2).to_i
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
pcword = ["011111#{regs_b}#{flag_o}100001010#{flag_r}"].pack("B*")
|
|
|
|
failed = false
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
pcword.each_byte do |c|
|
|
|
|
failed = true if badchars.include?(c.chr)
|
|
|
|
end
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
next if failed
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
return (pcword * (length / 4))[0, length]
|
|
|
|
end
|
|
|
|
end
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
return ("\x60" * length)[0, length]
|
|
|
|
end
|
2005-12-30 04:06:41 +00:00
|
|
|
|
2012-03-18 05:07:27 +00:00
|
|
|
end
|