Class: Rex::Post::Meterpreter::Extensions::Bofloader::BofPack

Inherits:
Object
  • Object
show all
Defined in:
lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb

Overview

Code referenced from: github.com/trustedsec/COFFLoader/blob/main/beacon_generate.py Emulates the native Cobalt Strike bof_pack() function. Documented here: hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics_aggressor-scripts/as-resources_functions.htm#bof_pack

Type Description Unpack With © ——–|—————————————|—————————— b | binary data | BeaconDataExtract i | 4-byte integer | BeaconDataInt s | 2-byte short integer | BeaconDataShort z | zero-terminated+encoded string | BeaconDataExtract Z | zero-terminated wide-char string | (wchar_t *)BeaconDataExtract

Instance Method Summary collapse

Constructor Details

#initialize ⇒ BofPack

Returns a new instance of BofPack.



39
40
41
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 39

def initialize
  reset
end

Instance Method Details

#add_binary(binary) ⇒ Object 



43
44
45
46
47
48
49
50
51
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 43

def add_binary(binary)
  # Add binary data to the buffer
  binary = binary.bytes if binary.is_a? String
  b_length = binary.length
  binary = [b_length] + binary
  buf = binary.pack("I<c#{b_length}")
  @size += buf.length
  @buffer << buf
end

#add_int(dint) ⇒ Object 



53
54
55
56
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 53

def add_int(dint)
  @buffer << [dint.to_i].pack('I<')
  @size += 4
end

#add_short(short) ⇒ Object 



58
59
60
61
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 58

def add_short(short)
  @buffer << [short.to_i].pack('s<')
  @size += 2
end

#add_str(str) ⇒ Object 



63
64
65
66
67
68
69
70
71
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 63

def add_str(str)
  str = str.encode('utf-8').bytes
  str << 0x00 # Null terminated strings...
  s_length = str.length
  str = [s_length] + str
  buf = str.pack("I<c#{s_length}")
  @size += buf.length
  @buffer << buf
end

#add_wstr(wstr) ⇒ Object 



73
74
75
76
77
78
79
80
81
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 73

def add_wstr(wstr)
  wstr = wstr.encode('utf-16le').bytes
  wstr << 0x00 << 0x00 # Null terminated wide string
  s_length = wstr.length
  wstr = [s_length] + wstr
  buf = wstr.pack("I<c#{s_length}")
  @size += buf.length
  @buffer << buf
end

#bof_pack(fstring, args) ⇒ Object 



94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 94

def bof_pack(fstring, args)
  # Wrapper function to pack an entire bof command line into a buffer
  if fstring.nil? || args.nil?
    return finalize_buffer
  end

  if fstring.length != args.length
    raise BofPackingError, 'Mismatched format and argument lengths'
  end

  fstring.chars.zip(args).each do |c, arg|
    case c
    when 'b'
      add_binary(arg)
    when 'i'
      add_int(arg)
    when 's'
      add_short(arg)
    when 'z'
      add_str(arg)
    when 'Z'
      add_wstr(arg)
    else
      raise BofPackingError, "Invalid character in format string: #{c}. Must be one of \"b, i, s, z, Z\""
    end
  end

  # return the packed bof_string
  finalize_buffer
end

#finalize_buffer ⇒ Object 



83
84
85
86
87
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 83

def finalize_buffer
  output = [@size].pack('I<') + @buffer
  reset
  output
end

#reset ⇒ Object 



89
90
91
92
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 89

def reset
  @buffer = ''
  @size = 0
end