2014-08-17 22:31:53 +00:00
|
|
|
# -*- coding: binary -*-
|
2015-03-21 08:15:08 +00:00
|
|
|
require 'msf/core/payload/uuid'
|
|
|
|
|
2015-04-03 03:42:25 +00:00
|
|
|
module Rex
|
|
|
|
module Payloads
|
|
|
|
module Meterpreter
|
2014-01-13 21:18:16 +00:00
|
|
|
module UriChecksum
|
|
|
|
|
|
|
|
#
|
|
|
|
# Define 8-bit checksums for matching URLs
|
|
|
|
# These are based on charset frequency
|
|
|
|
#
|
2015-04-14 06:33:01 +00:00
|
|
|
URI_CHECKSUM_INITW = 92 # Windows
|
|
|
|
URI_CHECKSUM_INITN = 92 # Native (same as Windows)
|
|
|
|
URI_CHECKSUM_INITP = 80 # Python
|
|
|
|
URI_CHECKSUM_INITJ = 88 # Java
|
|
|
|
URI_CHECKSUM_CONN = 98 # Existing session
|
|
|
|
URI_CHECKSUM_INIT_CONN = 95 # New stageless session
|
2014-01-13 21:18:16 +00:00
|
|
|
|
2015-03-21 08:15:08 +00:00
|
|
|
# Mapping between checksums and modes
|
|
|
|
URI_CHECKSUM_MODES = Hash[
|
2015-04-14 06:33:01 +00:00
|
|
|
URI_CHECKSUM_INITN, :init_native,
|
|
|
|
URI_CHECKSUM_INITP, :init_python,
|
|
|
|
URI_CHECKSUM_INITJ, :init_java,
|
|
|
|
URI_CHECKSUM_INIT_CONN, :init_connect,
|
|
|
|
URI_CHECKSUM_CONN, :connect
|
2014-01-13 21:18:16 +00:00
|
|
|
]
|
|
|
|
|
2015-03-21 08:15:08 +00:00
|
|
|
URI_CHECKSUM_MIN_LEN = 5
|
|
|
|
|
|
|
|
# Limit how long :connect URLs are to stay within 256 bytes when including
|
|
|
|
# the hostname, colon, port, and leading slash
|
|
|
|
URI_CHECKSUM_CONN_MAX_LEN = 128
|
|
|
|
|
|
|
|
URI_CHECKSUM_UUID_MIN_LEN = URI_CHECKSUM_MIN_LEN + Msf::Payload::UUID::UriLength
|
|
|
|
|
2014-01-13 21:18:16 +00:00
|
|
|
# Map "random" URIs to static strings, allowing us to randomize
|
|
|
|
# the URI sent in the first request.
|
2014-04-16 23:32:35 +00:00
|
|
|
#
|
2015-04-06 03:09:35 +00:00
|
|
|
# @param uri [String] The URI string from the HTTP request
|
2015-03-21 08:15:08 +00:00
|
|
|
# @return [Hash] The attributes extracted from the URI
|
|
|
|
def process_uri_resource(uri)
|
|
|
|
|
|
|
|
# Ignore non-base64url characters in the URL
|
|
|
|
uri_bare = uri.gsub(/[^a-zA-Z0-9_\-]/, '')
|
|
|
|
|
|
|
|
# Figure out the mode based on the checksum
|
|
|
|
uri_csum = Rex::Text.checksum8(uri_bare)
|
|
|
|
|
2015-03-22 21:17:12 +00:00
|
|
|
# Extract the UUID if the URI is long enough
|
2015-03-21 08:15:08 +00:00
|
|
|
uri_uuid = nil
|
|
|
|
if uri_bare.length >= URI_CHECKSUM_UUID_MIN_LEN
|
2015-03-22 21:17:12 +00:00
|
|
|
uri_uuid = Msf::Payload::UUID.new(uri: uri_bare)
|
2014-01-13 21:18:16 +00:00
|
|
|
end
|
|
|
|
|
2015-03-21 08:15:08 +00:00
|
|
|
uri_mode = URI_CHECKSUM_MODES[uri_csum]
|
|
|
|
|
2015-03-22 21:17:12 +00:00
|
|
|
# Return a hash of URI attributes
|
|
|
|
{ uri: uri_bare, sum: uri_csum, uuid: uri_uuid, mode: uri_mode }
|
2015-03-21 08:15:08 +00:00
|
|
|
end
|
|
|
|
|
2015-03-31 20:44:18 +00:00
|
|
|
# Create a URI that matches the specified checksum and payload uuid
|
2015-03-21 08:15:08 +00:00
|
|
|
#
|
2015-03-31 20:44:18 +00:00
|
|
|
# @param sum [Fixnum] A checksum mode value to use for the generated url
|
2015-03-22 21:17:12 +00:00
|
|
|
# @param uuid [Msf::Payload::UUID] A valid UUID object
|
2015-03-31 20:44:18 +00:00
|
|
|
# @param len [Fixnum] An optional URI length value, including the leading slash
|
2015-03-22 21:17:12 +00:00
|
|
|
# @return [String] The URI string for connections
|
2015-03-31 20:44:18 +00:00
|
|
|
def generate_uri_uuid(sum, uuid, len=nil)
|
2015-03-21 08:15:08 +00:00
|
|
|
curl_uri_len = URI_CHECKSUM_UUID_MIN_LEN+rand(URI_CHECKSUM_CONN_MAX_LEN-URI_CHECKSUM_UUID_MIN_LEN)
|
2015-03-22 21:17:12 +00:00
|
|
|
curl_prefix = uuid.to_uri
|
2015-03-21 08:15:08 +00:00
|
|
|
|
2015-03-31 20:44:18 +00:00
|
|
|
if len
|
|
|
|
# Subtract a byte to take into account the leading /
|
|
|
|
curl_uri_len = len - 1
|
|
|
|
end
|
|
|
|
|
|
|
|
if curl_uri_len < URI_CHECKSUM_UUID_MIN_LEN
|
|
|
|
raise ArgumentError, "Length must be #{URI_CHECKSUM_UUID_MIN_LEN+1} bytes or greater"
|
|
|
|
end
|
|
|
|
|
|
|
|
# Pad out the URI and make the checksum match the specified sum
|
|
|
|
"/" + generate_uri_checksum(sum, curl_uri_len, curl_prefix)
|
2014-01-13 21:18:16 +00:00
|
|
|
end
|
|
|
|
|
2015-03-10 17:48:30 +00:00
|
|
|
# Create an arbitrary length URI that matches a given checksum
|
|
|
|
#
|
2015-03-20 21:29:07 +00:00
|
|
|
# @param sum [Fixnum] The checksum value that the generated URI should match
|
|
|
|
# @param len [Fixnum] The length of the URI to generate
|
|
|
|
# @param prefix [String] The optional prefix to use to build the URI
|
2015-03-10 17:48:30 +00:00
|
|
|
# @return [String] The URI string that checksums to the given value
|
2015-03-20 21:29:07 +00:00
|
|
|
def generate_uri_checksum(sum, len=5, prefix="")
|
2015-03-10 17:48:30 +00:00
|
|
|
# Lengths shorter than 4 bytes are unable to match all possible checksums
|
|
|
|
# Lengths of exactly 4 are relatively slow to find for high checksum values
|
|
|
|
# Lengths of 5 or more bytes find a matching checksum fairly quickly (~80ms)
|
2015-03-21 08:15:08 +00:00
|
|
|
if len < URI_CHECKSUM_MIN_LEN
|
|
|
|
raise ArgumentError, "Length must be #{URI_CHECKSUM_MIN_LEN} bytes or greater"
|
2015-03-20 21:29:07 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
gen_len = len-prefix.length
|
2015-03-21 08:15:08 +00:00
|
|
|
if gen_len < URI_CHECKSUM_MIN_LEN
|
|
|
|
raise ArgumentError, "Prefix must be at least {URI_CHECKSUM_MIN_LEN} bytes smaller than total length"
|
2015-03-20 21:29:07 +00:00
|
|
|
end
|
2015-03-10 17:48:30 +00:00
|
|
|
|
2015-03-20 21:29:07 +00:00
|
|
|
# Brute force a matching checksum for shorter URIs
|
|
|
|
if gen_len < 40
|
2015-03-10 17:48:30 +00:00
|
|
|
loop do
|
2015-03-20 21:29:07 +00:00
|
|
|
uri = prefix + Rex::Text.rand_text_base64url(gen_len)
|
2015-03-10 17:48:30 +00:00
|
|
|
return uri if Rex::Text.checksum8(uri) == sum
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2015-03-20 21:29:07 +00:00
|
|
|
# The rand_text_base64url() method becomes a bottleneck at around 40 bytes
|
2015-03-10 17:48:30 +00:00
|
|
|
# Calculating a static prefix flattens out the average runtime for longer URIs
|
2015-03-20 21:29:07 +00:00
|
|
|
prefix << Rex::Text.rand_text_base64url(gen_len-20)
|
2015-03-10 17:48:30 +00:00
|
|
|
|
|
|
|
loop do
|
2015-03-20 21:29:07 +00:00
|
|
|
uri = prefix + Rex::Text.rand_text_base64url(20)
|
2015-03-10 17:48:30 +00:00
|
|
|
return uri if Rex::Text.checksum8(uri) == sum
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2015-03-31 20:44:18 +00:00
|
|
|
# Return the numerical checksum for a given mode symbol
|
|
|
|
#
|
|
|
|
# @param mode [Symbol] The mode symbol to lookup (:connect, :init_native, :init_python, :init_java)
|
|
|
|
# @return [Fixnum] The URI checksum value corresponding with the mode
|
|
|
|
def uri_checksum_lookup(mode)
|
|
|
|
sum = URI_CHECKSUM_MODES.keys.select{|ksum| URI_CHECKSUM_MODES[ksum] == mode}.first
|
|
|
|
unless sum
|
|
|
|
raise ArgumentError, "Unknown checksum mode: #{mode}"
|
|
|
|
end
|
|
|
|
sum
|
|
|
|
end
|
2014-01-13 21:18:16 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|