333 lines
9.0 KiB
Ruby
333 lines
9.0 KiB
Ruby
# -*- coding: binary -*-
|
|
require 'msf/core'
|
|
|
|
module Msf
|
|
|
|
###
|
|
#
|
|
# This class drives the exploitation process from start to finish for a given
|
|
# exploit module instance. It's responsible for payload generation, encoding,
|
|
# and padding as well as initialization handlers and finally launching the
|
|
# exploit.
|
|
#
|
|
###
|
|
class ExploitDriver
|
|
|
|
#
|
|
# Initializes the exploit driver using the supplied framework instance.
|
|
#
|
|
def initialize(framework)
|
|
self.payload = nil
|
|
self.exploit = nil
|
|
self.use_job = false
|
|
self.job_id = nil
|
|
self.force_wait_for_session = false
|
|
end
|
|
|
|
#
|
|
# Specification of the exploit target index.
|
|
#
|
|
def target_idx=(target_idx)
|
|
if (target_idx)
|
|
# Make sure the target index is valid
|
|
if (target_idx >= exploit.targets.length)
|
|
raise Rex::ArgumentError, "Invalid target index.", caller
|
|
end
|
|
end
|
|
|
|
# Set the active target
|
|
@target_idx = target_idx
|
|
end
|
|
|
|
#
|
|
# This method returns the currently selected target index.
|
|
#
|
|
def target_idx
|
|
@target_idx
|
|
end
|
|
|
|
#
|
|
# Checks to see if the supplied payload is compatible with the
|
|
# current exploit. Assumes that target_idx is valid.
|
|
#
|
|
def compatible_payload?(payload)
|
|
# Try to use the target's platform in preference of the exploit's
|
|
exp_platform = exploit.targets[target_idx].platform || exploit.platform
|
|
|
|
return ((payload.platform & exp_platform).empty? == false)
|
|
end
|
|
|
|
##
|
|
#
|
|
# Exploit execution
|
|
#
|
|
##
|
|
|
|
#
|
|
# Makes sure everything's in tip-top condition prior to launching the
|
|
# exploit. For things that aren't good to go, an exception is thrown.
|
|
#
|
|
def validate
|
|
# First, validate that a target has been selected
|
|
if (target_idx == nil)
|
|
raise MissingTargetError,
|
|
"A payload cannot be selected until a target is specified.",
|
|
caller
|
|
end
|
|
|
|
# Next, validate that a payload has been selected
|
|
if (payload == nil)
|
|
raise MissingPayloadError,
|
|
"A payload has not been selected.", caller
|
|
end
|
|
|
|
# Make sure the payload is compatible after all
|
|
if (compatible_payload?(payload) == false)
|
|
raise IncompatiblePayloadError.new(payload.refname),
|
|
"Incompatible payload", caller
|
|
end
|
|
|
|
# Associate the payload instance with the exploit
|
|
payload.assoc_exploit = exploit
|
|
|
|
# Finally, validate options on the exploit module to ensure that things
|
|
# are ready to operate as they should.
|
|
exploit.options.validate(exploit.datastore)
|
|
|
|
# Validate the payload's options. The payload's datastore is
|
|
# most likely shared against the exploit's datastore, but in case it
|
|
# isn't.
|
|
payload.options.validate(payload.datastore)
|
|
|
|
return true
|
|
end
|
|
|
|
#
|
|
# Kicks off an exploitation attempt and performs the following four major
|
|
# operations:
|
|
#
|
|
# - Generates the payload
|
|
# - Initializes & monitors the handler
|
|
# - Launches the exploit
|
|
# - Cleans up the handler
|
|
#
|
|
def run
|
|
|
|
# First thing's first -- validate the state. Make sure all requirement
|
|
# parameters are set, including those that are derived from the
|
|
# datastore.
|
|
validate()
|
|
|
|
# After validation has occurred, it's time to set some values on the
|
|
# exploit instance and begin preparing the payload
|
|
exploit.datastore['TARGET'] = target_idx
|
|
|
|
# Default the session to nil
|
|
self.session = nil
|
|
|
|
# Explicitly clear the module's job_id in case it was set in a previous
|
|
# run
|
|
exploit.job_id = nil
|
|
|
|
# If we are being instructed to run as a job then let's create that job
|
|
# like a good person.
|
|
if (use_job or exploit.stance == Msf::Exploit::Stance::Passive)
|
|
# Since references to the exploit and payload will hang around for
|
|
# awhile in the job, make sure we copy them so further changes to
|
|
# the datastore don't alter settings in existing jobs
|
|
e = exploit.replicant
|
|
p = payload.replicant
|
|
|
|
# Assign the correct exploit instance to the payload
|
|
p.assoc_exploit = e
|
|
|
|
# Generate the encoded version of the supplied payload for the
|
|
# newly copied exploit module instance
|
|
e.generate_payload(p)
|
|
ctx = [ e, p ]
|
|
|
|
e.job_id = e.framework.jobs.start_bg_job(
|
|
"Exploit: #{e.refname}",
|
|
ctx,
|
|
Proc.new { |ctx_| job_run_proc(ctx_) },
|
|
Proc.new { |ctx_| job_cleanup_proc(ctx_) }
|
|
)
|
|
self.job_id = e.job_id
|
|
else
|
|
# Generate the encoded version of the supplied payload on the
|
|
# exploit module instance
|
|
exploit.generate_payload(payload)
|
|
|
|
# No need to copy since we aren't creating a job. We wait until
|
|
# they're finished running to do anything else with them, so
|
|
# nothing should be able to modify their datastore or other
|
|
# settings until after they're done.
|
|
ctx = [ exploit, payload ]
|
|
job_run_proc(ctx)
|
|
job_cleanup_proc(ctx)
|
|
end
|
|
|
|
return session
|
|
end
|
|
|
|
attr_accessor :exploit # :nodoc:
|
|
attr_accessor :payload # :nodoc:
|
|
attr_accessor :use_job # :nodoc:
|
|
#
|
|
# The identifier of the job this exploit is launched as, if it's run as a
|
|
# job.
|
|
#
|
|
attr_accessor :job_id
|
|
attr_accessor :force_wait_for_session # :nodoc:
|
|
attr_accessor :session # :nodoc:
|
|
|
|
protected
|
|
|
|
|
|
|
|
#
|
|
# Job run proc, sets up the exploit and kicks it off.
|
|
#
|
|
def job_run_proc(ctx)
|
|
# Default session wait time..
|
|
delay = payload.wfs_delay + exploit.wfs_delay
|
|
delay = nil if exploit.passive?
|
|
|
|
begin
|
|
exploit, payload = ctx
|
|
|
|
# Set the exploit up the bomb
|
|
exploit.setup
|
|
|
|
exploit.framework.events.on_module_run(exploit)
|
|
|
|
# Launch the exploit
|
|
exploit.exploit
|
|
|
|
|
|
|
|
rescue ::Exception => e
|
|
|
|
if [::RuntimeError, ::Interrupt].include?(e.class)
|
|
# Wait for session, but don't wait long.
|
|
delay = 0.01
|
|
end
|
|
|
|
# Build a user-friendly error message
|
|
msg = "#{e}"
|
|
unless e.class == Msf::Exploit::Failed
|
|
msg = "#{e.class} #{e}"
|
|
end
|
|
|
|
exploit.error = e
|
|
|
|
# Record the detailed reason
|
|
exploit.fail_detail ||= e.to_s
|
|
|
|
case e.class
|
|
when Msf::Exploit::Complete
|
|
# Nothing to show in this case
|
|
return
|
|
|
|
when Msf::Exploit::Failed
|
|
exploit.print_error("Exploit aborted due to failure: #{exploit.fail_reason}: #{msg}")
|
|
|
|
# The caller should have already set exploit.fail_reason
|
|
if exploit.fail_reason == Msf::Exploit::Failure::None
|
|
exploit.fail_reason = Msf::Exploit::Failure::Unknown
|
|
end
|
|
|
|
when Rex::ConnectionError
|
|
exploit.fail_reason = Msf::Exploit::Failure::Unreachable
|
|
exploit.print_error("Exploit failed [#{exploit.fail_reason}]: #{msg}")
|
|
elog("Exploit failed (#{exploit.refname}): #{msg}", 'core', LEV_0)
|
|
dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3)
|
|
|
|
when Timeout::Error
|
|
exploit.fail_reason = Msf::Exploit::Failure::TimeoutExpired
|
|
exploit.print_error("Exploit failed [#{exploit.fail_reason}]: #{msg}")
|
|
elog("Exploit failed (#{exploit.refname}): #{msg}", 'core', LEV_0)
|
|
dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3)
|
|
else
|
|
|
|
# Compare as a string since not all error classes may be loaded
|
|
case msg
|
|
when /access.denied|Login Failed/i # Covers SMB as well as some generic errors
|
|
exploit.fail_reason = Msf::Exploit::Failure::NoAccess
|
|
when /connection reset/i
|
|
exploit.fail_reason = Msf::Exploit::Failure::Disconnected
|
|
when /connection timed out|SSL_connect|unreachable|connection was refused/i
|
|
exploit.fail_reason = Msf::Exploit::Failure::Unreachable
|
|
when /unable.*target/i
|
|
exploit.fail_reason = Msf::Exploit::Failure::NoTarget
|
|
when /execution expired/i
|
|
exploit.fail_reason = Msf::Exploit::Failure::TimeoutExpired
|
|
when /(doesn.t|not).*vulnerable|may.*patched/i
|
|
exploit.fail_reason = Msf::Exploit::Failure::NotVulnerable
|
|
end
|
|
|
|
# The caller should have already set exploit.fail_reason
|
|
if exploit.fail_reason == Msf::Exploit::Failure::None
|
|
exploit.fail_reason = Msf::Exploit::Failure::Unknown
|
|
end
|
|
|
|
if exploit.fail_reason == Msf::Exploit::Failure::Unknown
|
|
exploit.print_error("Exploit failed: #{msg}")
|
|
else
|
|
exploit.print_error("Exploit failed [#{exploit.fail_reason}]: #{msg}")
|
|
end
|
|
|
|
elog("Exploit failed (#{exploit.refname}): #{msg}", 'core', LEV_0)
|
|
dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3)
|
|
end
|
|
|
|
# Record the error to various places
|
|
exploit.framework.events.on_module_error(exploit, msg)
|
|
|
|
# Report the failure (and attempt) in the database
|
|
exploit.report_failure
|
|
end
|
|
|
|
# Wait the payload to acquire a session if this isn't a passive-style
|
|
# exploit.
|
|
return if not delay
|
|
|
|
|
|
if (force_wait_for_session == true) or
|
|
(exploit.passive? == false and exploit.handler_enabled?)
|
|
begin
|
|
self.session = payload.wait_for_session(delay)
|
|
rescue ::Interrupt
|
|
# Don't let interrupt pass upward
|
|
end
|
|
end
|
|
|
|
return self.session if self.session
|
|
|
|
if exploit.fail_reason == Msf::Exploit::Failure::None
|
|
exploit.fail_reason = Msf::Exploit::Failure::PayloadFailed
|
|
exploit.fail_detail = "No session created"
|
|
exploit.report_failure
|
|
end
|
|
end
|
|
|
|
#
|
|
# Clean up the exploit and the handler after the job completes.
|
|
#
|
|
def job_cleanup_proc(ctx)
|
|
exploit, payload = ctx
|
|
|
|
# Ensure that, no matter what, clean up of the handler occurs
|
|
payload.stop_handler
|
|
|
|
exploit.framework.events.on_module_complete(exploit)
|
|
|
|
# Allow the exploit to cleanup after itself, that messy bugger.
|
|
exploit.cleanup
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|