96 lines
5.3 KiB
Ruby
96 lines
5.3 KiB
Ruby
|
|
|
|
shared_context 'Msf::Util::Exe' do
|
|
@platform_format_map = {
|
|
"windows" => [
|
|
{ :format => "dll", :arch => "x86", :file_fp => /PE32 .*DLL/ },
|
|
{ :format => "dll", :arch => "x64", :file_fp => /PE32\+.*DLL/ },
|
|
{ :format => "exe", :arch => "x86", :file_fp => /PE32 / },
|
|
{ :format => "exe", :arch => "x64", :file_fp => /PE32\+/ },
|
|
{ :format => "exe", :arch => "x86_64", :file_fp => /PE32\+/ },
|
|
{ :format => "exe-small", :arch => "x86", :file_fp => /PE32 / },
|
|
# No template for 64-bit exe-small. That's fine, we probably
|
|
# don't need one.
|
|
#{ :format => "exe-small", :arch => "x64", :file_fp => /PE32\+/ },
|
|
{ :format => "exe-only", :arch => "x86", :file_fp => /PE32 / },
|
|
{ :format => "exe-only", :arch => "x64", :file_fp => /PE32\+ / },
|
|
{ :format => "exe-only", :arch => "x86_64", :file_fp => /PE32\+ / },
|
|
{ :format => "exe-service", :arch => "x86", :file_fp => /PE32 / },
|
|
{ :format => "exe-service", :arch => "x64", :file_fp => /PE32\+ / },
|
|
{ :format => "exe-service", :arch => "x86_64", :file_fp => /PE32\+ / },
|
|
{ :format => "vbs", :arch => "x86", :file_fp => /ASCII/ },
|
|
{ :format => "vbs", :arch => "x86_64", :file_fp => /ASCII/ },
|
|
{ :format => "loop-vbs", :arch => "x86", :file_fp => /ASCII/ },
|
|
{ :format => "loop-vbs", :arch => "x86_64", :file_fp => /ASCII/ },
|
|
{ :format => "asp", :arch => "x86", :file_fp => /ASCII/ },
|
|
{ :format => "asp", :arch => "x86_64", :file_fp => /ASCII/ },
|
|
{ :format => "aspx-exe", :arch => "x86", :file_fp => /(ASCII)|(HTML document text)/ },
|
|
{ :format => "aspx-exe", :arch => "x86_64", :file_fp => /(ASCII)|(HTML document text)/ },
|
|
{ :format => "aspx", :arch => "x86", :file_fp => /(ASCII)|(HTML document text)/ },
|
|
{ :format => "aspx", :arch => "x86_64", :file_fp => /(ASCII)|(HTML document text)/ },
|
|
{ :format => "vba", :arch => "x86", :file_fp => /ASCII/ },
|
|
{ :format => "vba", :arch => "x86_64", :file_fp => /ASCII/ },
|
|
{ :format => "vba-exe", :arch => "x86", :file_fp => /ASCII/ },
|
|
{ :format => "vba-exe", :arch => "x86_64", :file_fp => /ASCII/ },
|
|
{ :format => "psh", :arch => "x86", :file_fp => /ASCII/ },
|
|
{ :format => "psh", :arch => "x86_64", :file_fp => /ASCII/ },
|
|
{ :format => "psh-net", :arch => "x86", :file_fp => /ASCII/ },
|
|
{ :format => "psh-net", :arch => "x86_64", :file_fp => /ASCII/ },
|
|
{ :format => "war", :arch => "x86", :file_fp => /zip|jar/i },
|
|
{ :format => "war", :arch => "x86_64", :file_fp => /zip|jar/i },
|
|
{ :format => "msi", :arch => "x86", :file_fp => /(Composite Document)|(CDF V2 Document)/ },
|
|
{ :format => "msi", :arch => "x64", :file_fp => /(Composite Document)|(CDF V2 Document)/ },
|
|
{ :format => "msi", :arch => "x86_64", :file_fp => /(Composite Document)|(CDF V2 Document)/ },
|
|
{ :format => "msi-nouac", :arch => "x86", :file_fp => /(Composite Document)|(CDF V2 Document)/ },
|
|
{ :format => "msi-nouac", :arch => "x64", :file_fp => /(Composite Document)|(CDF V2 Document)/ },
|
|
{ :format => "msi-nouac", :arch => "x86_64", :file_fp => /(Composite Document)|(CDF V2 Document)/ },
|
|
],
|
|
"linux" => [
|
|
{ :format => "elf", :arch => "x86", :file_fp => /ELF 32.*SYSV/ },
|
|
{ :format => "elf", :arch => "x64", :file_fp => /ELF 64.*SYSV/ },
|
|
{ :format => "elf-so", :arch => "x64", :file_fp => /ELF 64.*SYSV/ },
|
|
{ :format => "elf", :arch => "armle", :file_fp => /ELF 32.*ARM/ },
|
|
{ :format => "elf", :arch => "mipsbe", :file_fp => /ELF 32-bit MSB\s+executable, MIPS/ },
|
|
{ :format => "elf", :arch => "mipsle", :file_fp => /ELF 32-bit LSB\s+executable, MIPS/ },
|
|
{ :format => "war", :arch => "x86", :file_fp => /zip|jar/i },
|
|
{ :format => "war", :arch => "x64", :file_fp => /zip|jar/i },
|
|
{ :format => "war", :arch => "armle", :file_fp => /zip|jar/i },
|
|
{ :format => "war", :arch => "mipsbe", :file_fp => /zip|jar/i },
|
|
{ :format => "war", :arch => "mipsle", :file_fp => /zip|jar/i },
|
|
],
|
|
"bsd" => [
|
|
{ :format => "elf", :arch => "x86", :file_fp => /ELF 32.*BSD/ },
|
|
{ :format => "war", :arch => "x86", :file_fp => /zip|jar/i },
|
|
],
|
|
"solaris" => [
|
|
{ :format => "elf", :arch => "x86", :file_fp => /ELF 32/ },
|
|
{ :format => "war", :arch => "x86", :file_fp => /zip|jar/i },
|
|
],
|
|
"osx" => [
|
|
{ :format => "macho", :arch => "x86", :file_fp => /Mach-O.*i386/ },
|
|
{ :format => "macho", :arch => "x64", :file_fp => /Mach-O 64/ },
|
|
{ :format => "macho", :arch => "armle", :file_fp => /Mach-O.*(acorn|arm)/ },
|
|
{ :format => "macho", :arch => "ppc", :file_fp => /Mach-O.*ppc/ },
|
|
{ :format => "war", :arch => "x86", :file_fp => /zip|jar/i },
|
|
{ :format => "war", :arch => "x64", :file_fp => /zip|jar/i },
|
|
{ :format => "war", :arch => "armle", :file_fp => /zip|jar/i },
|
|
{ :format => "war", :arch => "ppc", :file_fp => /zip|jar/i },
|
|
],
|
|
}
|
|
|
|
def verify_bin_fingerprint(format_hash, bin)
|
|
bin.should be_a(String)
|
|
fp = IO.popen("file -","w+") do |io|
|
|
begin
|
|
io.write(bin)
|
|
rescue Errno::EPIPE
|
|
end
|
|
io.close_write
|
|
io.read
|
|
end
|
|
if format_hash[:file_fp]
|
|
fp.should =~ format_hash[:file_fp]
|
|
end
|
|
end
|
|
end
|