metasploit-framework/msfpayload

#!/usr/bin/env ruby

msfbase = __FILE__
while File.symlink?(msfbase)
	msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase))
end

$:.unshift(File.join(File.dirname(msfbase), 'lib'))
$:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB']

require 'rex'
require 'msf/ui'
require 'msf/base'

#
# Dump the list of payloads
#
def dump_payloads
	tbl = Rex::Ui::Text::Table.new(
		'Indent'  => 4,
		'Header'  => "Framework Payloads (#{$framework.stats.num_payloads} total)",
		'Columns' => 
			[
				"Name",
				"Description"
			])

	$framework.payloads.each_module { |name, mod|
		tbl << [ name, mod.new.description ]
	}

	"\n" + tbl.to_s + "\n"
end

# Initialize the simplified framework instance.
$framework = Msf::Simple::Framework.create(
	:module_types => [ Msf::MODULE_PAYLOAD ]
)


if (ARGV.length <= 1)
	puts "\n" + "    Usage: #{$0} <payload> [var=val] <S[ummary]|C|P[erl]|[Rub]y|R[aw]|J[avascript]|e[X]ecutable|[V]BA>\n"
	puts dump_payloads
	exit
end

# Get the payload name we'll be using
payload_name = ARGV.shift

# Process special var/val pairs...
Msf::Ui::Common.process_cli_arguments($framework, ARGV)

# Create the payload instance
payload = $framework.payloads.create(payload_name)

if (payload == nil)
	puts "Invalid payload: #{payload_name}"
	exit
end

# Evalulate the command
cmd = ARGV.pop.downcase

# Populate the framework datastore
options = ARGV.join(',')

if (cmd =~ /^(p|y|r|c|j|x|b|v)/)
	fmt = 'perl' if (cmd =~ /^p/)
	fmt = 'ruby' if (cmd =~ /^y/)
	fmt = 'raw' if (cmd =~ /^(r|x)/)
	fmt = 'raw' if (cmd =~ /^v/)
	fmt = 'c' if (cmd == 'c')
	fmt = 'js_be' if (cmd =~ /^j/ and Rex::Arch.endian(payload.arch) == ENDIAN_BIG)
	fmt = 'js_le' if (cmd =~ /^j/ and ! fmt)
	fmt = 'java'  if (cmd =~ /^b/)
	enc = options['ENCODER']
		
	begin
		buf = payload.generate_simple(
				'Format'    => fmt,
				'OptionStr' => options,
				'Encoder'   => enc)
	rescue
		puts "Error generating payload: #{$!}"
		exit
	end
			
	$stdout.binmode
	
	if (cmd =~ /^x/)
		note = 
			"Created by msfpayload (http://www.metasploit.com).\n" +
			"Payload: " + payload.refname + "\n" +
			" Length: " + buf.length.to_s + "\n" +
			"Options: " + options + "\n"
			
		arch = payload.arch
		plat = payload.platform.platforms

		if (arch.index(ARCH_X86))

			# XXX: Automatically prepend stack adjustment
			# XXX: buf = Rex::Arch.adjust_stack_pointer('x86', -3500) + buf

			if (plat.index(Msf::Module::Platform::Windows))
				buf = Rex::Text.to_win32pe(buf, note)
				$stderr.puts(note)
				$stdout.write(buf)
				exit(0)
			end

			if (plat.index(Msf::Module::Platform::Linux))
				buf = Rex::Text.to_linux_x86_elf(buf, note)
				$stderr.puts(note)
				$stdout.write(buf)
				exit(0)
			end
			
			if(plat.index(Msf::Module::Platform::OSX))
				buf = Rex::Text.to_osx_x86_macho(buf, note)
				$stderr.puts(note)
				$stdout.write(buf)
				exit(0)			
			end						
		end

		if(arch.index(ARCH_ARMLE))
			if(plat.index(Msf::Module::Platform::OSX))
				buf = Rex::Text.to_osx_arm_macho(buf, note)
				$stderr.puts(note)
				$stdout.write(buf)
				exit(0)			
			end
		end

		if(arch.index(ARCH_PPC))
			if(plat.index(Msf::Module::Platform::OSX))
				buf = Rex::Text.to_osx_ppc_macho(buf, note)
				$stderr.puts(note)
				$stdout.write(buf)
				exit(0)			
			end
		end
						
		$stderr.puts "No executable format support for this arch/platform"
		exit(-1)
	end

	if(cmd =~ /^v/)
		exe = Rex::Text.to_win32pe(buf, '')
		note = 
			"'Created by msfpayload (http://www.metasploit.com).\r\n" +
			"'Payload: " + payload.refname + "\r\n" +
			"' Length: " + buf.length.to_s + "\r\n" +
			"'Options: " + options + "\r\n"

		vba = note + "\r\n" + Rex::Text.to_exe_vba(exe)
		$stdout.write(vba)
		exit(0)
	end
			
	$stdout.puts(buf)


elsif (cmd =~ /^(s|o)/)
	payload.datastore.import_options_from_s(ARGV.join('_|_'), '_|_')
	puts Msf::Serializer::ReadableText.dump_module(payload)
end