Class: Msf::Util::PayloadCachedSize

Inherits:
Object
  • Object
show all
Defined in:
lib/msf/util/payload_cached_size.rb

Overview

The class provides helper methods for verifying and updating the embedded CachedSize constant within payload modules.

Constant Summary collapse

OPTS =
{
  'Format'      => 'raw',
  'Options'     => {
    'CPORT' => 4444,
    'LPORT' => 4444,
    'LHOST' => '255.255.255.255',
    'KHOST' => '255.255.255.255',
    'AHOST' => '255.255.255.255',
    'CMD' => '/bin/sh',
    'URL' => 'http://a.com',
    'PATH' => '/',
    'BUNDLE' => 'data/isight.bundle',
    'DLL' => 'external/source/byakugan/bin/XPSP2/detoured.dll',
    'RC4PASSWORD' => 'Metasploit',
    'DNSZONE' => 'corelan.eu',
    'PEXEC' => '/bin/sh',
    'StagerURILength' => 5
  },
  'Encoder'     => nil,
  'DisableNops' => true
}
OPTS6 =
{
  'Format'      => 'raw',
  'Options'     => {
    'CPORT' => 4444,
    'LPORT' => 4444,
    'LHOST' => 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff',
    'KHOST' => 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff',
    'AHOST' => 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff',
    'CMD' => '/bin/sh',
    'URL' => 'http://a.com',
    'PATH' => '/',
    'BUNDLE' => 'data/isight.bundle',
    'DLL' => 'external/source/byakugan/bin/XPSP2/detoured.dll',
    'RC4PASSWORD' => 'Metasploit',
    'DNSZONE' => 'corelan.eu',
    'PEXEC' => '/bin/sh',
    'StagerURILength' => 5
  },
  'Encoder'     => nil,
  'DisableNops' => true
}

Class Method Summary collapse

Class Method Details

.compute_cached_size(mod) ⇒ Integer

Calculates the CachedSize value for a payload module

Parameters:

  • mod (Msf::Payload)

    The class of the payload module to update

Returns:

  • (Integer)

105
106
107
108
109
# File 'lib/msf/util/payload_cached_size.rb', line 105

def self.compute_cached_size(mod)
  return ":dynamic" if is_dynamic?(mod)
  return mod.generate_simple(OPTS6).size if mod.shortname =~ /6/
  return mod.generate_simple(OPTS).size
end

.is_cached_size_accurate?(mod) ⇒ Boolean

Determines whether a payload's CachedSize is up to date

Parameters:

  • mod (Msf::Payload)

    The class of the payload module to update

Returns:

  • (Boolean)

131
132
133
134
135
136
137
138
139
# File 'lib/msf/util/payload_cached_size.rb', line 131

def self.is_cached_size_accurate?(mod)
  return true if mod.dynamic_size? && is_dynamic?(mod)
  return false if mod.cached_size.nil?
  if mod.shortname =~ /6/
    mod.cached_size == mod.generate_simple(OPTS6).size
  else
    mod.cached_size == mod.generate_simple(OPTS).size
  end
end

.is_dynamic?(mod, generation_count = 5) ⇒ Integer

Determines whether a payload generates a static sized output

Parameters:

  • mod (Msf::Payload)

    The class of the payload module to update

  • generation_count (Integer) (defaults to: 5)

    The number of iterations to use to verify that the size is static.

Returns:

  • (Integer)

117
118
119
120
121
122
123
124
125
# File 'lib/msf/util/payload_cached_size.rb', line 117

def self.is_dynamic?(mod, generation_count=5)
  [*(1..generation_count)].map do |x|
    if mod.shortname =~ /6/
      mod.generate_simple(OPTS6).size
    else
      mod.generate_simple(OPTS).size
    end
  end.uniq.length != 1
end

.update_cache_constant(data, cached_size) ⇒ String

Insert a new CachedSize value into the text of a payload module

Parameters:

  • data (String)

    The source code of a payload module

  • cached_size (String)

    The new value for cached_size, which which should be either numeric or the string :dynamic

Returns:

  • (String)

67
68
69
70
71
72
73
# File 'lib/msf/util/payload_cached_size.rb', line 67

def self.update_cache_constant(data, cached_size)
  data.
    gsub(/^\s*CachedSize\s*=\s*(\d+|:dynamic).*/, '').
    gsub(/^(module MetasploitModule)\s*\n/) do |m|
      "#{m.strip}\n\n  CachedSize = #{cached_size}\n\n"
    end
end

.update_cached_size(mod, cached_size) ⇒ void

This method returns an undefined value.

Insert a new CachedSize value into a payload module file

Parameters:

  • mod (Msf::Payload)

    The class of the payload module to update

  • cached_size (String)

    The new value for cached_size, which which should be either numeric or the string :dynamic


81
82
83
84
85
86
87
88
89
90
91
# File 'lib/msf/util/payload_cached_size.rb', line 81

def self.update_cached_size(mod, cached_size)
  mod_data = ""

  ::File.open(mod.file_path, 'rb') do |fd|
    mod_data = fd.read(fd.stat.size)
  end

  ::File.open(mod.file_path, 'wb') do |fd|
    fd.write update_cache_constant(mod_data, cached_size)
  end
end

.update_module_cached_size(mod) ⇒ void

This method returns an undefined value.

Updates the payload module specified with the current CachedSize

Parameters:

  • mod (Msf::Payload)

    The class of the payload module to update


97
98
99
# File 'lib/msf/util/payload_cached_size.rb', line 97

def self.update_module_cached_size(mod)
  update_cached_size(mod, compute_cached_size(mod))
end