infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

make x86/nonupper raise the right exception type, prettify some formatting 

git-svn-id: file:///home/svn/framework3/trunk@7083 4d416f70-5f16-0410-b530-b9f4589650da
unstable
James Lee 2009-09-28 05:23:23 +00:00
parent bbf2aca050
commit 53e3f166f8
2 changed files with 52 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
lib/rex/encoder/nonupper.rb
View File

@ -6,59 +6,59 @@ module Rex
module Encoder
class NonUpper
def NonUpper.gen_decoder()
decoder =
"\x66\xB9\xFF\xFF" +
"\xEB\x19" + # Jmp to table
"\x5E" + # pop esi
"\x8B\xFE" + # mov edi, esi - Get table addr
"\x83\xC7" + "A" + # add edi, tablelen - Get shellcode addr
"\x8B\xD7" + # mov edx, edi - Hold end of table ptr
"\x3B\xF2" + # cmp esi, edx
"\x7D\x0B" + # jle to end
"\xB0\x7B" + # mov eax, 0x7B - Set up eax with magic
"\xF2\xAE" + # repne scasb - Find magic!
"\xFF\xCF" + # dec edi - scasb purs us one ahead
"\xAC" + # lodsb
"\x28\x07" + # subb [edi], al
"\xEB\xF1" + # jmp BACK!
"\xEB" + "B" + # jmp [shellcode]
"\xE8\xE2\xFF\xFF\xFF"
end
decoder =
"\x66\xB9\xFF\xFF" +
"\xEB\x19" + # Jmp to table
"\x5E" + # pop esi
"\x8B\xFE" + # mov edi, esi - Get table addr
"\x83\xC7" + "A" + # add edi, tablelen - Get shellcode addr
"\x8B\xD7" + # mov edx, edi - Hold end of table ptr
"\x3B\xF2" + # cmp esi, edx
"\x7D\x0B" + # jle to end
"\xB0\x7B" + # mov eax, 0x7B - Set up eax with magic
"\xF2\xAE" + # repne scasb - Find magic!
"\xFF\xCF" + # dec edi - scasb purs us one ahead
"\xAC" + # lodsb
"\x28\x07" + # subb [edi], al
"\xEB\xF1" + # jmp BACK!
"\xEB" + "B" + # jmp [shellcode]
"\xE8\xE2\xFF\xFF\xFF"
end
def NonUpper.encode_byte(badchars, block, table, tablelen)
if (tablelen > 255) or (block == 0x40)
raise RuntimeError, "BadChar"
end
if (tablelen > 255) or (block == 0x40)
raise RuntimeError, "BadChar"
end
if (block >= 0x41 and block <= 0x40) or (badchars =~ block)
# gen offset, return magic
offset = 0x40 - block;
table += offset.chr
tablelen = tablelen + 1
block = 0x40
end
if (block >= 0x41 and block <= 0x40) or (badchars =~ block)
# gen offset, return magic
offset = 0x40 - block;
table += offset.chr
tablelen = tablelen + 1
block = 0x40
end
return [block.chr, table, tablelen]
end
return [block.chr, table, tablelen]
end
def NonUpper.encode(buf)
table = ""
tablelen = 0
nonascii = ""
encoded = gen_decoder()
table = ""
tablelen = 0
nonascii = ""
encoded = gen_decoder()
buf.each_byte {
|block|
newchar, table, tablelen = encode_byte(block.unpack('C')[0], table, tablelen)
nonascii += newchar
nonascii += newchar
}
encoded.gsub!(/A/, tablelen)
encoded.gsub!(/B/, tablelen+5)
encoded += table
encoded.gsub!(/A/, tablelen)
encoded.gsub!(/B/, tablelen+5)
encoded += table
encoded += nonascii
end
end end end
end end end

14
modules/encoders/x86/nonupper.rb
View File

@ -53,7 +53,17 @@ class Metasploit3 < Msf::Encoder::NonUpper
# payload.
#
def encode_block(state, block)
newchar, state.key, state.decoder_key_size = Rex::Encoder::NonUpper::encode_byte(datastore['badchars'], block.unpack('C')[0], state.key, state.decoder_key_size)
begin
newchar, state.key, state.decoder_key_size =
Rex::Encoder::NonUpper::encode_byte(datastore['badchars'], block.unpack('C')[0], state.key, state.decoder_key_size)
rescue RuntimeError => e
# This is a bandaid to deal with the fact that, since it's in
# the Rex namespace, the encoder itself doesn't have access to the
# Msf exception classes. Turn it into an actual EncodingError
# exception so the encoder doesn't look broken when it just fails
# to encode.
raise BadcharError if e.message == "BadChar"
end
return newchar
end
@ -65,4 +75,4 @@ class Metasploit3 < Msf::Encoder::NonUpper
state.encoded.gsub!(/B/, (state.decoder_key_size+5).chr)
state.encoded[0x24, 0] = state.key
end
end
end