Shuffle RDI stuff into more appropriate structure
Now broken into two modules, one for loading RDI DLLs off disk and finding the loader function offset, and another for doing the process specific stuff of loading into the target.bug/bundler_fix
parent
fb84d7e7fe
commit
2cb991cace
|
@ -1,7 +1,7 @@
|
|||
# -*- coding: binary -*-
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/reflective_dll_injection'
|
||||
require 'msf/core/reflective_dll_loader'
|
||||
|
||||
module Msf
|
||||
|
||||
|
@ -15,7 +15,7 @@ module Msf
|
|||
|
||||
module Payload::Windows::ReflectiveDllInject
|
||||
|
||||
include Msf::ReflectiveDLLInjection
|
||||
include Msf::ReflectiveDLLLoader
|
||||
include Msf::Payload::Windows
|
||||
|
||||
def initialize(info = {})
|
||||
|
|
|
@ -1,7 +1,7 @@
|
|||
# -*- coding: binary -*-
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/reflective_dll_injection'
|
||||
require 'msf/core/reflective_dll_loader'
|
||||
|
||||
module Msf
|
||||
|
||||
|
@ -15,7 +15,7 @@ module Msf
|
|||
|
||||
module Payload::Windows::ReflectiveDllInject_x64
|
||||
|
||||
include Msf::ReflectiveDLLInjection
|
||||
include Msf::ReflectiveDLLLoader
|
||||
include Msf::Payload::Windows
|
||||
|
||||
def initialize(info = {})
|
||||
|
|
|
@ -1,5 +1,7 @@
|
|||
# -*- coding: binary -*-
|
||||
|
||||
require 'msf/core/reflective_dll_loader'
|
||||
|
||||
###
|
||||
#
|
||||
# This module exposes functionality which makes it easier to do
|
||||
|
@ -7,7 +9,9 @@
|
|||
#
|
||||
###
|
||||
|
||||
module Msf::ReflectiveDLLInjection
|
||||
module Msf::Post::Windows::ReflectiveDLLInjection
|
||||
|
||||
include Msf::ReflectiveDLLLoader
|
||||
|
||||
PAGE_ALIGN = 1024
|
||||
|
||||
|
@ -34,33 +38,6 @@ module Msf::ReflectiveDLLInjection
|
|||
return shellcode_mem
|
||||
end
|
||||
|
||||
#
|
||||
# Load a reflectively-injectable DLL from disk and find the offset
|
||||
# to the ReflectiveLoader function inside the DLL.
|
||||
#
|
||||
# @param dll_path Path to the DLL to load.
|
||||
#
|
||||
# @return [Array] Tuple of DLL contents and offset to the
|
||||
# +ReflectiveLoader+ function within the DLL.
|
||||
#
|
||||
def load_rdi_dll(dll_path)
|
||||
dll = ''
|
||||
offset = nil
|
||||
|
||||
::File.open(dll_path, 'rb') { |f| dll = f.read }
|
||||
|
||||
pe = Rex::PeParsey::Pe.new(Rex::ImageSource::Memory.new(dll))
|
||||
|
||||
pe.exports.entries.each do |e|
|
||||
if e.name =~ /^\S*ReflectiveLoader\S*/
|
||||
offset = pe.rva_to_file_offset(e.rva)
|
||||
break
|
||||
end
|
||||
end
|
||||
|
||||
return dll, offset
|
||||
end
|
||||
|
||||
#
|
||||
# Inject a reflectively-injectable DLL into the given process
|
||||
# using reflective injection.
|
|
@ -0,0 +1,39 @@
|
|||
# -*- coding: binary -*-
|
||||
|
||||
###
|
||||
#
|
||||
# This mixin contains functionality which loads a Reflective
|
||||
# DLL from disk into memory and finds the offset of the
|
||||
# reflective loader's entry point.
|
||||
#
|
||||
###
|
||||
|
||||
module Msf::ReflectiveDLLLoader
|
||||
|
||||
#
|
||||
# Load a reflectively-injectable DLL from disk and find the offset
|
||||
# to the ReflectiveLoader function inside the DLL.
|
||||
#
|
||||
# @param dll_path Path to the DLL to load.
|
||||
#
|
||||
# @return [Array] Tuple of DLL contents and offset to the
|
||||
# +ReflectiveLoader+ function within the DLL.
|
||||
#
|
||||
def load_rdi_dll(dll_path)
|
||||
dll = ''
|
||||
offset = nil
|
||||
|
||||
::File.open(dll_path, 'rb') { |f| dll = f.read }
|
||||
|
||||
pe = Rex::PeParsey::Pe.new(Rex::ImageSource::Memory.new(dll))
|
||||
|
||||
pe.exports.entries.each do |e|
|
||||
if e.name =~ /^\S*ReflectiveLoader\S*/
|
||||
offset = pe.rva_to_file_offset(e.rva)
|
||||
break
|
||||
end
|
||||
end
|
||||
|
||||
return dll, offset
|
||||
end
|
||||
end
|
|
@ -4,16 +4,16 @@
|
|||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/reflective_dll_injection'
|
||||
require 'msf/core/post/windows/reflective_dll_injection'
|
||||
require 'msf/core/exploit/exe'
|
||||
require 'rex'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Local
|
||||
Rank = GreatRanking
|
||||
|
||||
include Msf::ReflectiveDLLInjection
|
||||
include Post::File
|
||||
include Post::Windows::Priv
|
||||
include Msf::Post::File
|
||||
include Msf::Post::Windows::Priv
|
||||
include Msf::Post::Windows::ReflectiveDLLInjection
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
|
|
|
@ -4,17 +4,17 @@
|
|||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/reflective_dll_injection'
|
||||
require 'msf/core/post/windows/reflective_dll_injection'
|
||||
require 'rex'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Local
|
||||
Rank = AverageRanking
|
||||
|
||||
include Msf::ReflectiveDLLInjection
|
||||
include Msf::Post::File
|
||||
include Msf::Post::Windows::Priv
|
||||
include Msf::Post::Windows::Process
|
||||
include Msf::Post::Windows::FileInfo
|
||||
include Msf::Post::Windows::ReflectiveDLLInjection
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info, {
|
||||
|
|
|
@ -4,12 +4,12 @@
|
|||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/reflective_dll_injection'
|
||||
require 'msf/core/post/windows/reflective_dll_injection'
|
||||
require 'rex'
|
||||
|
||||
class Metasploit3 < Msf::Post
|
||||
|
||||
include Msf::ReflectiveDLLInjection
|
||||
include Msf::Post::Windows::ReflectiveDLLInjection
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
|
|
Loading…
Reference in New Issue