Fix targeting
parent
f296c204cb
commit
bcaa6e90f6
|
@ -57,6 +57,17 @@ module Evasion
|
||||||
# Verify the payload options
|
# Verify the payload options
|
||||||
driver.payload.options.validate(driver.payload.datastore)
|
driver.payload.options.validate(driver.payload.datastore)
|
||||||
|
|
||||||
|
# Set the target and then work some magic to derive index
|
||||||
|
evasion.datastore['TARGET'] = opts['Target'] if opts['Target']
|
||||||
|
target_idx = evasion.target_index
|
||||||
|
|
||||||
|
if (target_idx == nil or target_idx < 0)
|
||||||
|
raise MissingTargetError,
|
||||||
|
"You must select a target.", caller
|
||||||
|
end
|
||||||
|
|
||||||
|
driver.target_idx = target_idx
|
||||||
|
|
||||||
# Set the payload and evasion's subscriber values
|
# Set the payload and evasion's subscriber values
|
||||||
if ! opts['Quiet']
|
if ! opts['Quiet']
|
||||||
driver.evasion.init_ui(opts['LocalInput'] || evasion.user_input, opts['LocalOutput'] || evasion.user_output)
|
driver.evasion.init_ui(opts['LocalInput'] || evasion.user_input, opts['LocalOutput'] || evasion.user_output)
|
||||||
|
|
|
@ -6,7 +6,7 @@ module Msf
|
||||||
class EvasionDriver
|
class EvasionDriver
|
||||||
|
|
||||||
#
|
#
|
||||||
# Initializes the exploit driver using the supplied framework instance.
|
# Initializes the evasion driver using the supplied framework instance.
|
||||||
#
|
#
|
||||||
def initialize(framework)
|
def initialize(framework)
|
||||||
self.payload = nil
|
self.payload = nil
|
||||||
|
@ -17,12 +17,30 @@ class EvasionDriver
|
||||||
self.semaphore = Mutex.new
|
self.semaphore = Mutex.new
|
||||||
end
|
end
|
||||||
|
|
||||||
|
def target_idx=(target_idx)
|
||||||
|
if (target_idx)
|
||||||
|
# Make sure the target index is valid
|
||||||
|
if (target_idx >= evasion.targets.length)
|
||||||
|
raise Rex::ArgumentError, "Invalid target index.", caller
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
# Set the active target
|
||||||
|
@target_idx = target_idx
|
||||||
|
end
|
||||||
|
|
||||||
|
def target_idx
|
||||||
|
@target_idx
|
||||||
|
end
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# Checks to see if the supplied payload is compatible with the
|
# Checks to see if the supplied payload is compatible with the
|
||||||
# current exploit. Assumes that target_idx is valid.
|
# current evasion module. Assumes that target_idx is valid.
|
||||||
#
|
#
|
||||||
def compatible_payload?(payload)
|
def compatible_payload?(payload)
|
||||||
return ((payload.platform & evasion.platform).empty? == false)
|
evasion_platform = evasion.targets[target_idx].platform || evasion.platform
|
||||||
|
return ((payload.platform & evasion_platform).empty? == false)
|
||||||
end
|
end
|
||||||
|
|
||||||
def validate
|
def validate
|
||||||
|
@ -37,15 +55,15 @@ class EvasionDriver
|
||||||
"Incompatible payload", caller
|
"Incompatible payload", caller
|
||||||
end
|
end
|
||||||
|
|
||||||
# Associate the payload instance with the exploit
|
# Associate the payload instance with the evasion
|
||||||
payload.assoc_exploit = evasion
|
payload.assoc_exploit = evasion
|
||||||
|
|
||||||
# Finally, validate options on the exploit module to ensure that things
|
# Finally, validate options on the evasion module to ensure that things
|
||||||
# are ready to operate as they should.
|
# are ready to operate as they should.
|
||||||
evasion.options.validate(evasion.datastore)
|
evasion.options.validate(evasion.datastore)
|
||||||
|
|
||||||
# Validate the payload's options. The payload's datastore is
|
# Validate the payload's options. The payload's datastore is
|
||||||
# most likely shared against the exploit's datastore, but in case it
|
# most likely shared against the evasion's datastore, but in case it
|
||||||
# isn't.
|
# isn't.
|
||||||
payload.options.validate(payload.datastore)
|
payload.options.validate(payload.datastore)
|
||||||
|
|
||||||
|
@ -53,12 +71,12 @@ class EvasionDriver
|
||||||
end
|
end
|
||||||
|
|
||||||
#
|
#
|
||||||
# Kicks off an exploitation attempt and performs the following four major
|
# Kicks off an evasion attempt and performs the following four major
|
||||||
# operations:
|
# operations:
|
||||||
#
|
#
|
||||||
# - Generates the payload
|
# - Generates the payload
|
||||||
# - Initializes & monitors the handler
|
# - Initializes & monitors the handler
|
||||||
# - Launches the exploit
|
# - Launches the evasion
|
||||||
# - Cleans up the handler
|
# - Cleans up the handler
|
||||||
#
|
#
|
||||||
def run
|
def run
|
||||||
|
@ -72,7 +90,7 @@ class EvasionDriver
|
||||||
evasion.job_id = nil
|
evasion.job_id = nil
|
||||||
|
|
||||||
# Generate the encoded version of the supplied payload on the
|
# Generate the encoded version of the supplied payload on the
|
||||||
# exploit module instance
|
# evasion module instance
|
||||||
evasion.generate_payload(payload)
|
evasion.generate_payload(payload)
|
||||||
|
|
||||||
# No need to copy since we aren't creating a job. We wait until
|
# No need to copy since we aren't creating a job. We wait until
|
||||||
|
|
|
@ -78,12 +78,12 @@ int main() {
|
||||||
|
|
||||||
def run
|
def run
|
||||||
puts target.inspect
|
puts target.inspect
|
||||||
=begin
|
|
||||||
puts c_template
|
#puts c_template
|
||||||
bin = Metasploit::Framework::Compiler::Windows.compile_random_c(c_template)
|
bin = Metasploit::Framework::Compiler::Windows.compile_random_c(c_template)
|
||||||
print_status("Compiled binary size: #{bin.length}")
|
print_status("Compiled binary size: #{bin.length}")
|
||||||
file_create(bin)
|
file_create(bin)
|
||||||
=end
|
|
||||||
end
|
end
|
||||||
|
|
||||||
end
|
end
|
Loading…
Reference in New Issue