infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix improper use of host-endian or signed pack/unpack 

Note that there are some cases of host-endian left, these
are intentional because they operate on host-local memory
or services.

When in doubt, please use:

```
ri pack
```
bug/bundler_fix
HD Moore 2014-06-30 02:48:18 -05:00
parent 255e792ed3
commit c9b6c05eab
26 changed files with 65 additions and 65 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/bit-struct/octet-field.rb
View File

@ -37,7 +37,7 @@ class BitStruct
old_writer = "#{attr_chars}="
define_method "#{attr}=" do |val|
data = val.split(sep).map{|s|s.to_i(base)}.pack("c*")
data = val.split(sep).map{|s|s.to_i(base)}.pack("C*")
send(old_writer, data)
end
end

3
lib/msf/core/exploit/afp.rb
View File

@ -246,8 +246,7 @@ module Exploit::Remote::AFP
end
def parse_header(packet)
header = packet.unpack('CCnNNN') #ruby 1.8.7 don't support unpacking signed integers in big-endian order
header[3] = packet[4..7].reverse.unpack("l").first
header = packet.unpack('CCnNNN')
return header
end

2
lib/msf/core/post/windows/accounts.rb
View File

@ -270,7 +270,7 @@ module Accounts
#define generic mapping structure
gen_map = [0,0,0,0]
gen_map = gen_map.pack("L")
gen_map = gen_map.pack("V")
buffer_size = 500
#get Security Descriptor for the directory

4
lib/msf/core/post/windows/ldap.rb
View File

@ -248,7 +248,7 @@ module LDAP
# @param pEntry [Fixnum] Pointer to the Entry
# @return [Array] Entry data structure
def get_entry(pEntry)
return client.railgun.memread(pEntry,41).unpack('LLLLLLLLLSCCC')
return client.railgun.memread(pEntry,41).unpack('VVVVVVVVVvCCC')
end
# Get BER Element data structure from LDAPMessage
@ -256,7 +256,7 @@ module LDAP
# @param msg [String] The LDAP Message from the server
# @return [String] The BER data structure
def get_ber(msg)
ber = client.railgun.memread(msg[2],60).unpack('L*')
ber = client.railgun.memread(msg[2],60).unpack('V*')
# BER Pointer is different between x86 and x64
if client.platform =~ /x64/

2
lib/msf/core/post/windows/services.rb
View File

@ -334,7 +334,7 @@ module Services
raise RuntimeError.new("Could not query service. QueryServiceStatus error: #{handle["GetLastError"]}")
end
vals = status['lpServiceStatus'].unpack('L*')
vals = status['lpServiceStatus'].unpack('V*')
adv.CloseServiceHandle(handle["return"])
ret = {

4
lib/msf/util/exe.rb
View File

@ -654,8 +654,8 @@ require 'msf/core/exe/segment_injector'
msi = fd.read(fd.stat.size)
}
section_size = 2**(msi[30..31].unpack('s<')[0])
sector_allocation_table = msi[section_size..section_size*2].unpack('l<*')
section_size = 2**(msi[30..31].unpack('v')[0])
sector_allocation_table = msi[section_size..section_size*2].unpack('V*')
buffer_chain = []
current_secid = 5 # This is closely coupled with the template provided and ideally

2
lib/rex/encoder/ndr.rb
View File

@ -28,7 +28,7 @@ module NDR
# use to encode:
# byte element_1;
def NDR.byte(string)
return [string].pack('c')
return [string].pack('C')
end
# Encode a byte array

4
lib/rex/ole/util.rb
View File

@ -124,7 +124,7 @@ class Util
def self.getUnicodeString(buf)
buf = buf.unpack('S*').pack('C*')
buf = buf.unpack('v*').pack('C*')
if (idx = buf.index(0x00.chr))
buf.slice!(idx, buf.length)
end
@ -132,7 +132,7 @@ class Util
end
def self.putUnicodeString(buf)
buf = buf.unpack('C*').pack('S*')
buf = buf.unpack('C*').pack('v*')
if (buf.length < 0x40)
buf << "\x00" * (0x40 - buf.length)
end

4
lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb
View File

@ -452,9 +452,9 @@ class Util
# Both on x86 and x64, DWORD is 32 bits
return raw.unpack('V').first
when :BOOL
return raw.unpack('l').first == 1
return raw.unpack('V').first == 1
when :LONG
return raw.unpack('l').first
return raw.unpack('V').first
end
#If nothing worked thus far, return it raw

2
lib/rex/proto/dcerpc/ndr.rb
View File

@ -34,7 +34,7 @@ class NDR
# byte element_1;
def self.byte(string)
warn 'should be using Rex::Encoder::NDR'
return [string].pack('c')
return [string].pack('C')
end
# Encode a byte array

6
lib/rex/proto/natpmp/packet.rb
View File

@ -19,7 +19,7 @@ module NATPMP
# Parse a NAT-PMP external address response +resp+.
# Returns the decoded parts of the response as an array.
def self.parse_external_address_response(resp)
(ver, op, result, epoch, addr) = resp.unpack("CCSLN")
(ver, op, result, epoch, addr) = resp.unpack("CCvVN")
[ ver, op, result, epoch, Rex::Socket::addr_itoa(addr) ]
end
@ -31,13 +31,13 @@ module NATPMP
lport,
rport,
lifetime
].pack("ccnnnN")
].pack("CCnnnN")
end
# Parse a NAT-PMP mapping response +resp+.
# Returns the decoded parts as an array.
def self.parse_map_port_response(resp)
resp.unpack("CCSLnnN")
resp.unpack("CCvVnnN")
end
end

2
lib/rex/registry/lfkey.rb
View File

@ -41,7 +41,7 @@ class LFHashRecord
attr_accessor :nodekey_offset, :nodekey_name_verification
def initialize(hive_blob, offset)
@nodekey_offset = hive_blob[offset, 4].unpack('l').first
@nodekey_offset = hive_blob[offset, 4].unpack('V').first
@nodekey_name_verification = hive_blob[offset+0x04, 4].to_s
end

20
lib/rex/registry/nodekey.rb
View File

@ -23,16 +23,16 @@ class NodeKey
return
end
@timestamp = hive[offset+0x04, 8].unpack('q').first
@parent_offset = hive[offset+0x10, 4].unpack('l').first
@subkeys_count = hive[offset+0x14, 4].unpack('l').first
@lf_record_offset = hive[offset+0x1c, 4].unpack('l').first
@value_count = hive[offset+0x24, 4].unpack('l').first
@value_list_offset = hive[offset+0x28, 4].unpack('l').first
@security_key_offset = hive[offset+0x2c, 4].unpack('l').first
@class_name_offset = hive[offset+0x30, 4].unpack('l').first
@name_length = hive[offset+0x48, 2].unpack('c').first
@class_name_length = hive[offset+0x4a, 2].unpack('c').first
@timestamp = hive[offset+0x04, 8].unpack('Q').first
@parent_offset = hive[offset+0x10, 4].unpack('V').first
@subkeys_count = hive[offset+0x14, 4].unpack('V').first
@lf_record_offset = hive[offset+0x1c, 4].unpack('V').first
@value_count = hive[offset+0x24, 4].unpack('V').first
@value_list_offset = hive[offset+0x28, 4].unpack('V').first
@security_key_offset = hive[offset+0x2c, 4].unpack('V').first
@class_name_offset = hive[offset+0x30, 4].unpack('V').first
@name_length = hive[offset+0x48, 2].unpack('C').first
@class_name_length = hive[offset+0x4a, 2].unpack('C').first
@name = hive[offset+0x4c, @name_length].to_s
windows_time = @timestamp

10
lib/rex/registry/valuekey.rb
View File

@ -17,10 +17,10 @@ class ValueKey
return
end
@name_length = hive[offset+0x02, 2].unpack('c').first
@length_of_data = hive[offset+0x04, 4].unpack('l').first
@data_offset = hive[offset+ 0x08, 4].unpack('l').first
@value_type = hive[offset+0x0C, 4].unpack('c').first
@name_length = hive[offset+0x02, 2].unpack('C').first
@length_of_data = hive[offset+0x04, 4].unpack('V').first
@data_offset = hive[offset+ 0x08, 4].unpack('V').first
@value_type = hive[offset+0x0C, 4].unpack('C').first
if @value_type == 1
@readable_value_type = "Unicode character string"
@ -34,7 +34,7 @@ class ValueKey
@readable_value_type = "Multiple unicode strings separated with '\\x00'"
end
flag = hive[offset+0x10, 2].unpack('c').first
flag = hive[offset+0x10, 2].unpack('C').first
if flag == 0
@name = "Default"

2
lib/rex/registry/valuelist.rb
View File

@ -18,7 +18,7 @@ class ValueList
valuekey_offset = hive[offset + inner_offset, 4]
next if !valuekey_offset
valuekey_offset = valuekey_offset.unpack('l').first
valuekey_offset = valuekey_offset.unpack('V').first
@values << ValueKey.new(hive, valuekey_offset + 0x1000)
inner_offset = inner_offset + 4
end

1
lib/rex/socket/ip.rb
View File

@ -75,6 +75,7 @@ module Rex::Socket::Ip
Rex::Compat.is_macosx
)
gram=gram.dup
# Note that these are *intentionally* host order for BSD support
gram[2,2]=gram[2,2].unpack("n").pack("s")
gram[6,2]=gram[6,2].unpack("n").pack("s")
end

2
lib/sshkey/lib/sshkey.rb
View File

@ -159,7 +159,7 @@ class SSHKey
SSH_CONVERSION[type].each do |method|
byte_array = to_byte_array(key_object.public_key.send(method).to_i)
out += encode_unsigned_int_32(byte_array.length).pack("c*")
out += encode_unsigned_int_32(byte_array.length).pack("C*")
out += byte_array.pack("C*")
end

2
lib/windows_console_color_support.rb
View File

@ -36,7 +36,7 @@ class WindowsConsoleColorSupport
def setcolor(color)
csbi = 0.chr * 24
@GetConsoleScreenBufferInfo.Call(@hConsoleHandle,csbi)
wAttr = csbi[8,2].unpack('S').first
wAttr = csbi[8,2].unpack('v').first
case color
when 0 # reset

2
modules/exploits/windows/fileformat/ms14_017_rtf.rb
View File

@ -99,7 +99,7 @@ class Metasploit3 < Msf::Exploit::Remote
exploit_data << rop_chain
exploit_data << payload.encoded
exploit_data << make_nops(exploit_data.length % 2)
exploit_data = exploit_data.unpack("S<*")
exploit_data = exploit_data.unpack("v*")
exploit_data = exploit_data.map { |word| " ?\\u-#{0x10000 - word}" }
exploit_data = exploit_data.join

14
modules/exploits/windows/local/ms11_080_afdjoinleaf.rb
View File

@ -89,7 +89,7 @@ class Metasploit3 < Msf::Exploit::Local
session.railgun.add_function('psapi', 'EnumDeviceDrivers', 'BOOL', [ ["PBLOB", "lpImageBase", "out"], ["DWORD", "cb", "in"], ["PDWORD", "lpcbNeeded", "out"]])
session.railgun.add_function('psapi', 'GetDeviceDriverBaseNameA', 'DWORD', [ ["LPVOID", "ImageBase", "in"], ["PBLOB", "lpBaseName", "out"], ["DWORD", "nSize", "in"]])
results = session.railgun.psapi.EnumDeviceDrivers(4096, 1024, 4)
addresses = results['lpImageBase'][0..results['lpcbNeeded'] - 1].unpack("L*")
addresses = results['lpImageBase'][0..results['lpcbNeeded'] - 1].unpack("V*")
addresses.each do |address|
results = session.railgun.psapi.GetDeviceDriverBaseNameA(address, 48, 48)
@ -172,7 +172,7 @@ class Metasploit3 < Msf::Exploit::Local
irpstuff << rand_text_alpha(231)
if not this_proc.memory.writable?(0x1000)
result = session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ base_addr ].pack("L"), nil, [ 0x1000 ].pack("L"), "MEM_COMMIT | MEM_RESERVE", "PAGE_EXECUTE_READWRITE")
result = session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ base_addr ].pack("V"), nil, [ 0x1000 ].pack("V"), "MEM_COMMIT | MEM_RESERVE", "PAGE_EXECUTE_READWRITE")
end
if not this_proc.memory.writable?(0x1000)
print_error('Failed to properly allocate memory')
@ -202,10 +202,10 @@ class Metasploit3 < Msf::Exploit::Local
halDispatchTable0x8 = halDispatchTable + 0x8
restore_ptrs = "\x31\xc0"
restore_ptrs << "\xb8" + [ halpSetSystemInformation ].pack("L")
restore_ptrs << "\xa3" + [ halDispatchTable0x8 ].pack("L")
restore_ptrs << "\xb8" + [ haliQuerySystemInformation ].pack("L")
restore_ptrs << "\xa3" + [ halDispatchTable0x4 ].pack("L")
restore_ptrs << "\xb8" + [ halpSetSystemInformation ].pack("V")
restore_ptrs << "\xa3" + [ halDispatchTable0x8 ].pack("V")
restore_ptrs << "\xb8" + [ haliQuerySystemInformation ].pack("V")
restore_ptrs << "\xa3" + [ halDispatchTable0x4 ].pack("V")
tokenstealing = "\x52"
tokenstealing << "\x53"
@ -241,7 +241,7 @@ class Metasploit3 < Msf::Exploit::Local
this_proc.memory.write(shellcode_address_nodep, shellcode)
this_proc.memory.protect(0x00020000)
addr = [ 2, 4455, 0x7f000001, 0, 0 ].pack("s!S!L!L!L!")
addr = [ 2, 4455, 0x7f000001, 0, 0 ].pack("vvVVV")
result = session.railgun.ws2_32.connect(socket, addr, addr.length)
if result['return'] != 0xffffffff
print_error("The socket is not in the correct state")

4
modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb
View File

@ -105,11 +105,11 @@ class Metasploit3 < Msf::Exploit::Remote
# op code
req = "\xD0\x07\x00\x00"
# filename length
req << "#{[fname.length].pack('l')}"
req << "#{[fname.length].pack('V')}"
# file name
req << "#{fname}"
# data length
req << "#{[data.length].pack('l')}"
req << "#{[data.length].pack('V')}"
# data
req << "#{data}"
connect

2
modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb
View File

@ -228,7 +228,7 @@ class Metasploit3 < Msf::Exploit::Remote
exe = generate_payload_exe
# Padding to be sure we're aligned to 4 bytes.
exe << "\x00" until exe.length % 4 == 0
longs = exe.unpack("l*")
longs = exe.unpack("V*")
offset = 0
# gefebt.exe isn't able to handle (on my test environment) long

2
modules/payloads/stagers/windows/reverse_https_proxy.rb
View File

@ -129,7 +129,7 @@ module Metasploit3
jmphost_loc = p.index("\x68\x3a\x56\x79\xa7\xff\xd5") + 8 # push 0xA779563A ; hash( "wininet.dll", "InternetOpenA" ) ; call ebp
p[jmphost_loc, 4] = [p[jmphost_loc, 4].unpack("V")[0] - jmp_offset].pack("V")
#patch call Internetopen
p[p.length - 4, 4] = [p[p.length - 4, 4].unpack("l")[0] + jmp_offset].pack("V")
p[p.length - 4, 4] = [p[p.length - 4, 4].unpack("V")[0] + jmp_offset].pack("V")
# patch the LPORT
lport = datastore['LPORT']

10
modules/post/windows/gather/credentials/enum_cred_store.rb
View File

@ -37,7 +37,7 @@ class Metasploit3 < Msf::Post
if is_86
addr = [data].pack("V")
else
addr = [data].pack("Q")
addr = [data].pack("Q<")
end
return addr
end
@ -95,7 +95,7 @@ class Metasploit3 < Msf::Post
len,add = ret["pDataOut"].unpack("V2")
else
ret = c32.CryptUnprotectData("#{len}#{addr}",16,"#{elen}#{eaddr}",nil,nil,0,16)
len,add = ret["pDataOut"].unpack("Q2")
len,add = ret["pDataOut"].unpack("Q<2")
end
#get data, and return it
@ -177,14 +177,14 @@ class Metasploit3 < Msf::Post
#read array of addresses as pointers to each structure
raw = read_str(p_to_arr[0], arr_len, 2)
pcred_array = raw.unpack("V*") if is_86
pcred_array = raw.unpack("Q*") unless is_86
pcred_array = raw.unpack("Q<*") unless is_86
#loop through the addresses and read each credential structure
pcred_array.each do |pcred|
cred = {}
raw = read_str(pcred, 52,2)
cred_struct = raw.unpack("VVVVQVVVVVVV") if is_86
cred_struct = raw.unpack("VVQQQQQVVQQQ") unless is_86
cred_struct = raw.unpack("VVVVQ<VVVVVVV") if is_86
cred_struct = raw.unpack("VVQ<Q<Q<Q<Q<VVQ<Q<Q<") unless is_86
cred["flags"] = cred_struct[0]
cred["type"] = cred_struct[1]
cred["targetname"] = read_str(cred_struct[2],512, 1)

14
modules/post/windows/gather/enum_ie.rb
View File

@ -41,7 +41,7 @@ class Metasploit3 < Msf::Post
if is_86
addr = [data].pack("V")
else
addr = [data].pack("Q")
addr = [data].pack("Q<")
end
return addr
end
@ -85,7 +85,7 @@ class Metasploit3 < Msf::Post
entropy.each_byte do |c|
salt << c
end
ent = salt.pack("s*")
ent = salt.pack("v*")
#save values to memory and pack addresses
mem = mem_write(data, 1024)
@ -118,7 +118,7 @@ class Metasploit3 < Msf::Post
guid.each_byte do |c|
salt << c*4
end
ent = salt.pack("s*")
ent = salt.pack("v*")
#write entropy to memory and pack addresses
mem = mem_write(ent,1024)
@ -133,7 +133,7 @@ class Metasploit3 < Msf::Post
len,add = ret["pDataOut"].unpack("V2")
else
ret = c32.CryptUnprotectData("#{len}#{addr}",16,"#{elen}#{eaddr}",nil,nil,0,16)
len,add = ret["pDataOut"].unpack("Q2")
len,add = ret["pDataOut"].unpack("Q<2")
end
#get data, and return it
@ -356,13 +356,13 @@ class Metasploit3 < Msf::Post
#read array of addresses as pointers to each structure
raw = read_str(p_to_arr[0], arr_len,2)
pcred_array = raw.unpack("V*") if is_86
pcred_array = raw.unpack("Q*") unless is_86
pcred_array = raw.unpack("Q<*") unless is_86
#loop through the addresses and read each credential structure
pcred_array.each do |pcred|
raw = read_str(pcred, 52,2)
cred_struct = raw.unpack("VVVVQVVVVVVV") if is_86
cred_struct = raw.unpack("VVQQQQQVVQQQ") unless is_86
cred_struct = raw.unpack("VVVVQ<VVVVVVV") if is_86
cred_struct = raw.unpack("VVQ<Q<Q<Q<Q<VVQ<Q<Q<") unless is_86
location = read_str(cred_struct[2],512, 1)
if location.include? "Microsoft_WinInet"

8
modules/post/windows/gather/forensics/recovery_files.rb
View File

@ -195,9 +195,9 @@ class Metasploit3 < Msf::Post
offset << "\x00" if (offset.size % 2 != 0)
# The logical cluster value could be negative so we need to get the 2 complement in those cases
if log_cluster.size == 2
int_log_cluster = log_cluster.unpack('s*')[0]
int_log_cluster = log_cluster.unpack('v*')[0]
elsif log_cluster.size == 4
int_log_cluster = log_cluster.unpack('l')[0]
int_log_cluster = log_cluster.unpack('V')[0]
end
if offset.size == 2
@ -275,7 +275,7 @@ class Metasploit3 < Msf::Post
def get_size(entry)
data = get_attribute(entry,"\x80\x00\x00\x00")
return if data == nil
return data[48,8].unpack('Q*')[0]
return data[48,8].unpack('Q<*')[0]
end
# Gets the NTFS information and return a pointer to the beginning of the MFT
@ -295,7 +295,7 @@ class Metasploit3 < Msf::Post
vprint_status("NTFS Volumen Serial Number: #{ra['lpOutBuffer'][0,8].unpack('h*')[0].reverse}")
vprint_status("Bytes per Sector: #{ra['lpOutBuffer'][40,4].unpack('V*')[0]}")
vprint_status("Bytes per Cluster: #{bytes_per_cluster}")
vprint_status("Length of the MFT (bytes): #{ra['lpOutBuffer'][56,8].unpack('Q*')[0]}")
vprint_status("Length of the MFT (bytes): #{ra['lpOutBuffer'][56,8].unpack('Q<*')[0]}")
vprint_status("Logical cluster where MTF starts #{mft_logical_offset}")
# We set the pointer to the begining of the MFT
client.railgun.kernel32.SetFilePointer(r['return'],offset_mft_bytes,0,0)