2012-06-29 05:18:28 +00:00
|
|
|
# -*- coding: binary -*-
|
2006-08-26 02:13:25 +00:00
|
|
|
require 'msf/core'
|
|
|
|
|
|
|
|
module Msf
|
|
|
|
|
|
|
|
###
|
|
|
|
#
|
|
|
|
# The generic payloads are used to define a generalized payload type that
|
|
|
|
# is both architecture and platform independent. Under the hood, generic
|
|
|
|
# payloads seek out the correct payload for the appropriate architecture
|
|
|
|
# and platform that is being targeted.
|
|
|
|
#
|
|
|
|
###
|
|
|
|
module Payload::Generic
|
|
|
|
|
2013-08-30 21:28:33 +00:00
|
|
|
#
|
|
|
|
# Registers options that are common to all generic payloads, such as
|
|
|
|
# platform and arch.
|
|
|
|
#
|
|
|
|
def initialize(info = {})
|
|
|
|
super(merge_info(info,
|
|
|
|
'Arch' => ARCH_ALL - [ARCH_TTY],
|
|
|
|
'Platform' => ''))
|
|
|
|
|
|
|
|
register_advanced_options(
|
|
|
|
[
|
|
|
|
OptString.new('PLATFORM',
|
|
|
|
[
|
|
|
|
false,
|
|
|
|
"The platform that is being targeted",
|
|
|
|
nil
|
|
|
|
]),
|
|
|
|
OptString.new('ARCH',
|
|
|
|
[
|
|
|
|
false,
|
|
|
|
"The architecture that is being targeted",
|
|
|
|
nil
|
|
|
|
])
|
|
|
|
], Msf::Payload::Generic)
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Reset's the generic payload's internal state so that it can find a new
|
|
|
|
# actual payload.
|
|
|
|
#
|
|
|
|
def reset
|
|
|
|
self.explicit_arch = nil
|
|
|
|
self.explicit_platform = nil
|
|
|
|
self.actual_payload = nil
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Generate is different from other methods -- it will try to re-detect
|
|
|
|
# the actual payload in case settings have changed. Other methods will
|
|
|
|
# use the cached version if possible.
|
|
|
|
#
|
|
|
|
def generate
|
|
|
|
reset
|
|
|
|
|
|
|
|
redirect_to_actual(:generate)
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Overrides -- we have to redirect all potential payload methods
|
|
|
|
# to the actual payload so that they get handled appropriately, cuz
|
|
|
|
# we're like a proxy and stuff. We can't use method_undefined
|
|
|
|
# because all of these methods are actually defined.
|
|
|
|
#
|
|
|
|
|
|
|
|
def payload
|
|
|
|
redirect_to_actual(:payload)
|
|
|
|
end
|
|
|
|
|
|
|
|
def offsets
|
|
|
|
redirect_to_actual(:offsets)
|
|
|
|
end
|
|
|
|
|
|
|
|
def substitute_vars(*args)
|
|
|
|
redirect_to_actual(:substitute_vars, *args)
|
|
|
|
end
|
|
|
|
|
|
|
|
def replace_var(*args)
|
|
|
|
redirect_to_actual(:replace_var, *args)
|
|
|
|
end
|
|
|
|
|
|
|
|
def compatible_encoders
|
|
|
|
redirect_to_actual(:compatible_encoders)
|
|
|
|
end
|
|
|
|
|
|
|
|
def compatible_nops
|
|
|
|
redirect_to_actual(:compatible_nops)
|
|
|
|
end
|
|
|
|
|
|
|
|
def handle_connection(*args)
|
|
|
|
redirect_to_actual(:handle_connection, *args)
|
|
|
|
end
|
|
|
|
|
|
|
|
def on_session(*args)
|
|
|
|
redirect_to_actual(:on_session, *args)
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Stager overrides
|
|
|
|
#
|
|
|
|
|
|
|
|
def stage_payload
|
|
|
|
redirect_to_actual(:stage_payload)
|
|
|
|
end
|
|
|
|
|
|
|
|
def stage_offsets
|
|
|
|
redirect_to_actual(:stage_offsets)
|
|
|
|
end
|
|
|
|
|
|
|
|
def stager_payload
|
|
|
|
redirect_to_actual(:stager_payload)
|
|
|
|
end
|
|
|
|
|
|
|
|
def stager_offsets
|
|
|
|
redirect_to_actual(:stager_offsets)
|
|
|
|
end
|
|
|
|
|
|
|
|
def stage_over_connection?
|
|
|
|
redirect_to_actual(:stage_over_connection?)
|
|
|
|
end
|
|
|
|
|
|
|
|
def generate_stage
|
|
|
|
redirect_to_actual(:generate_stage)
|
|
|
|
end
|
|
|
|
|
|
|
|
def handle_connection_stage(*args)
|
|
|
|
redirect_to_actual(:handle_connection_stage, *args)
|
|
|
|
end
|
|
|
|
|
|
|
|
def handle_intermediate_stage(*args)
|
|
|
|
redirect_to_actual(:handle_intermediate_stage, *args)
|
|
|
|
end
|
|
|
|
|
|
|
|
def stage_prefix
|
|
|
|
redirect_to_actual(:stage_prefix)
|
|
|
|
end
|
|
|
|
|
|
|
|
def stage_prefix=(*args)
|
|
|
|
redirect_to_actual(:stage_prefix=, *args)
|
|
|
|
end
|
|
|
|
|
|
|
|
def user_input=(h)
|
|
|
|
@user_input = h
|
|
|
|
redirect_to_actual(:user_input, h) if actual_payload
|
|
|
|
end
|
|
|
|
|
|
|
|
def user_output=(h)
|
|
|
|
@user_output = h
|
|
|
|
redirect_to_actual(:user_output, h) if actual_payload
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# First, find the underlying payload and then pass all methods onto it.
|
|
|
|
#
|
|
|
|
def redirect_to_actual(name, *args)
|
|
|
|
find_actual_payload
|
|
|
|
actual_payload.send(name, *args)
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Accessor that makes it possible to define an explicit platform. This is
|
|
|
|
# used for things like payload regeneration.
|
|
|
|
#
|
|
|
|
attr_accessor :explicit_platform
|
|
|
|
#
|
|
|
|
# Accessor that makes it possible to define an explicit architecture. This
|
|
|
|
# is used for things like payload regeneration.
|
|
|
|
#
|
|
|
|
attr_accessor :explicit_arch
|
2006-08-26 02:13:25 +00:00
|
|
|
|
|
|
|
protected
|
|
|
|
|
2013-08-30 21:28:33 +00:00
|
|
|
#
|
|
|
|
# The actual underlying platform/arch-specific payload instance that should
|
|
|
|
# be used.
|
|
|
|
#
|
|
|
|
attr_accessor :actual_payload
|
|
|
|
|
|
|
|
#
|
|
|
|
# Returns the actual platform that should be used for the payload.
|
|
|
|
#
|
|
|
|
def actual_platform
|
|
|
|
platform = nil
|
|
|
|
|
|
|
|
if explicit_platform.nil? == false
|
|
|
|
platform = explicit_platform
|
|
|
|
elsif datastore['PLATFORM']
|
|
|
|
platform = datastore['PLATFORM']
|
|
|
|
elsif assoc_exploit
|
|
|
|
platform = assoc_exploit.target_platform
|
|
|
|
end
|
|
|
|
|
|
|
|
# If we still have an invalid platform, then we suck.
|
|
|
|
if platform.nil?
|
|
|
|
raise NoCompatiblePayloadError, "A platform could not be determined by the generic payload"
|
|
|
|
elsif platform.kind_of?(String)
|
|
|
|
platform = Msf::Module::PlatformList.transform(platform)
|
|
|
|
end
|
|
|
|
|
|
|
|
return platform
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Returns the actual architecture that should be used for the payload.
|
|
|
|
#
|
|
|
|
def actual_arch
|
|
|
|
arch = nil
|
|
|
|
|
|
|
|
if explicit_arch.nil? == false
|
|
|
|
arch = explicit_arch
|
|
|
|
elsif datastore['ARCH']
|
|
|
|
arch = datastore['ARCH']
|
|
|
|
elsif assoc_exploit
|
|
|
|
arch = assoc_exploit.target_arch || ARCH_X86
|
|
|
|
end
|
|
|
|
|
|
|
|
# If we still have an invalid architecture, then we suck.
|
|
|
|
if arch.nil?
|
|
|
|
raise NoCompatiblePayloadError, "An architecture could not be determined by the generic payload"
|
|
|
|
elsif arch.kind_of?(String)
|
|
|
|
arch = [ arch ]
|
|
|
|
end
|
|
|
|
|
|
|
|
return arch
|
|
|
|
end
|
|
|
|
|
|
|
|
def find_actual_payload
|
|
|
|
return if not actual_payload.nil?
|
|
|
|
|
|
|
|
# Look for one based on the exploit's compatible set
|
|
|
|
if(assoc_exploit)
|
|
|
|
self.actual_payload = framework.payloads.find_payload_from_set(
|
|
|
|
assoc_exploit.compatible_payloads,
|
|
|
|
actual_platform,
|
|
|
|
actual_arch,
|
|
|
|
handler_klass,
|
|
|
|
session,
|
|
|
|
payload_type)
|
|
|
|
end
|
|
|
|
|
|
|
|
# Fall back to the generic match (ignores size, compat flags, etc)
|
|
|
|
if(actual_payload.nil?)
|
|
|
|
self.actual_payload = framework.payloads.find_payload(
|
|
|
|
actual_platform,
|
|
|
|
actual_arch,
|
|
|
|
handler_klass,
|
|
|
|
session,
|
|
|
|
payload_type)
|
|
|
|
end
|
|
|
|
|
|
|
|
if actual_payload.nil?
|
|
|
|
raise NoCompatiblePayloadError, "Could not locate a compatible payload for #{actual_platform.names.join("/")}/#{actual_arch}"
|
|
|
|
else
|
|
|
|
dlog("Selected payload #{actual_payload.refname} from generic payload #{refname}", 'core', LEV_2)
|
|
|
|
# Share our datastore with the actual payload so that it has the
|
|
|
|
# appropriate values to substitute ad so on.
|
|
|
|
self.actual_payload.share_datastore(self.datastore)
|
|
|
|
|
|
|
|
# Set the associated exploit for the payload.
|
|
|
|
self.actual_payload.assoc_exploit = self.assoc_exploit
|
|
|
|
|
|
|
|
# Set the parent payload to this payload so that we can handle
|
|
|
|
# things like session creation (so that event notifications will
|
|
|
|
# work properly)
|
|
|
|
self.actual_payload.parent_payload = self
|
|
|
|
|
|
|
|
# Set the cached user_input/user_output
|
|
|
|
self.actual_payload.user_input = self.user_input
|
|
|
|
self.actual_payload.user_output = self.user_output
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
end
|
2006-08-26 02:13:25 +00:00
|
|
|
|
|
|
|
|
|
|
|
end
|
|
|
|
|
2009-01-14 05:46:10 +00:00
|
|
|
end
|
2009-11-25 02:24:41 +00:00
|
|
|
|