Shuffle RDI stuff into more appropriate structure

Now broken into two modules, one for loading RDI DLLs off disk and
finding the loader function offset, and another for doing the process
specific stuff of loading into the target.
bug/bundler_fix
OJ 2013-12-06 08:25:24 +10:00
parent fb84d7e7fe
commit 2cb991cace
7 changed files with 56 additions and 40 deletions

View File

@ -1,7 +1,7 @@
# -*- coding: binary -*-
require 'msf/core'
require 'msf/core/reflective_dll_injection'
require 'msf/core/reflective_dll_loader'
module Msf
@ -15,7 +15,7 @@ module Msf
module Payload::Windows::ReflectiveDllInject
include Msf::ReflectiveDLLInjection
include Msf::ReflectiveDLLLoader
include Msf::Payload::Windows
def initialize(info = {})

View File

@ -1,7 +1,7 @@
# -*- coding: binary -*-
require 'msf/core'
require 'msf/core/reflective_dll_injection'
require 'msf/core/reflective_dll_loader'
module Msf
@ -15,7 +15,7 @@ module Msf
module Payload::Windows::ReflectiveDllInject_x64
include Msf::ReflectiveDLLInjection
include Msf::ReflectiveDLLLoader
include Msf::Payload::Windows
def initialize(info = {})

View File

@ -1,5 +1,7 @@
# -*- coding: binary -*-
require 'msf/core/reflective_dll_loader'
###
#
# This module exposes functionality which makes it easier to do
@ -7,7 +9,9 @@
#
###
module Msf::ReflectiveDLLInjection
module Msf::Post::Windows::ReflectiveDLLInjection
include Msf::ReflectiveDLLLoader
PAGE_ALIGN = 1024
@ -34,33 +38,6 @@ module Msf::ReflectiveDLLInjection
return shellcode_mem
end
#
# Load a reflectively-injectable DLL from disk and find the offset
# to the ReflectiveLoader function inside the DLL.
#
# @param dll_path Path to the DLL to load.
#
# @return [Array] Tuple of DLL contents and offset to the
# +ReflectiveLoader+ function within the DLL.
#
def load_rdi_dll(dll_path)
dll = ''
offset = nil
::File.open(dll_path, 'rb') { |f| dll = f.read }
pe = Rex::PeParsey::Pe.new(Rex::ImageSource::Memory.new(dll))
pe.exports.entries.each do |e|
if e.name =~ /^\S*ReflectiveLoader\S*/
offset = pe.rva_to_file_offset(e.rva)
break
end
end
return dll, offset
end
#
# Inject a reflectively-injectable DLL into the given process
# using reflective injection.

View File

@ -0,0 +1,39 @@
# -*- coding: binary -*-
###
#
# This mixin contains functionality which loads a Reflective
# DLL from disk into memory and finds the offset of the
# reflective loader's entry point.
#
###
module Msf::ReflectiveDLLLoader
#
# Load a reflectively-injectable DLL from disk and find the offset
# to the ReflectiveLoader function inside the DLL.
#
# @param dll_path Path to the DLL to load.
#
# @return [Array] Tuple of DLL contents and offset to the
# +ReflectiveLoader+ function within the DLL.
#
def load_rdi_dll(dll_path)
dll = ''
offset = nil
::File.open(dll_path, 'rb') { |f| dll = f.read }
pe = Rex::PeParsey::Pe.new(Rex::ImageSource::Memory.new(dll))
pe.exports.entries.each do |e|
if e.name =~ /^\S*ReflectiveLoader\S*/
offset = pe.rva_to_file_offset(e.rva)
break
end
end
return dll, offset
end
end

View File

@ -4,16 +4,16 @@
##
require 'msf/core'
require 'msf/core/reflective_dll_injection'
require 'msf/core/post/windows/reflective_dll_injection'
require 'msf/core/exploit/exe'
require 'rex'
class Metasploit3 < Msf::Exploit::Local
Rank = GreatRanking
include Msf::ReflectiveDLLInjection
include Post::File
include Post::Windows::Priv
include Msf::Post::File
include Msf::Post::Windows::Priv
include Msf::Post::Windows::ReflectiveDLLInjection
def initialize(info={})
super( update_info( info,

View File

@ -4,17 +4,17 @@
##
require 'msf/core'
require 'msf/core/reflective_dll_injection'
require 'msf/core/post/windows/reflective_dll_injection'
require 'rex'
class Metasploit3 < Msf::Exploit::Local
Rank = AverageRanking
include Msf::ReflectiveDLLInjection
include Msf::Post::File
include Msf::Post::Windows::Priv
include Msf::Post::Windows::Process
include Msf::Post::Windows::FileInfo
include Msf::Post::Windows::ReflectiveDLLInjection
def initialize(info={})
super(update_info(info, {

View File

@ -4,12 +4,12 @@
##
require 'msf/core'
require 'msf/core/reflective_dll_injection'
require 'msf/core/post/windows/reflective_dll_injection'
require 'rex'
class Metasploit3 < Msf::Post
include Msf::ReflectiveDLLInjection
include Msf::Post::Windows::ReflectiveDLLInjection
def initialize(info={})
super( update_info( info,