Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
# -*- coding: binary -*-
2

3

4
module Msf
5
module Simple
6

7
###
8
#
9
# Simple payload wrapper class for performing generation.
10
#
11
###
12
module Payload
13

14
  include Module
15

16
  #
17
  # Generate a payload with the mad skillz.  The payload can be generated in
18
  # a number of ways.
19
  #
20
  # opts can have:
21
  #
22
  #   Encoder     => A encoder module name.
23
  #   BadChars    => A string of bad characters.
24
  #   Format      => The format to represent the data as: ruby, perl, c, raw
25
  #   Options     => A hash of options to set.
26
  #   OptionStr   => A string of options in VAR=VAL form separated by
27
  #                  whitespace.
28
  #   NoComment   => Disables prepention of a comment
29
  #   NopSledSize => The number of NOPs to use
30
  #   MaxSize     => The maximum size of the payload.
31
  #   Iterations  => Number of times to encode.
32
  #   ForceEncode => Force encoding.
33
  #
34
  # raises:
35
  #
36
  #   BadcharError => If the supplied encoder fails to encode the payload
37
  #   NoKeyError => No valid encoder key could be found
38
  #   ArgumentParseError => Options were supplied improperly
39
  #
40
  def self.generate_simple(payload, opts, &block)
41

42
    # Clone the module to prevent changes to the original instance
43
    payload = payload.replicant
44
    Msf::Simple::Framework.simplify_module(payload)
45
    yield(payload) if block_given?
46

47
    # Import any options we may need
48
    payload._import_extra_options(opts)
49
    framework = payload.framework
50

51
    # Generate the payload
52
    e = EncodedPayload.create(payload,
53
        'BadChars'    => opts['BadChars'],
54
        'MinNops'     => opts['NopSledSize'],
55
        'PadNops'     => opts['PadNops'],
56
        'Encoder'     => opts['Encoder'],
57
        'Iterations'  => opts['Iterations'],
58
        'ForceEncode' => opts['ForceEncode'],
59
        'DisableNops' => opts['DisableNops'],
60
        'Space'       => opts['MaxSize'])
61

62
    fmt = opts['Format'] || 'raw'
63

64
    exeopts = {
65
      :inject => opts['KeepTemplateWorking'],
66
      :template => opts['Template'],
67
      :template_path => opts['ExeDir'],
68
      :secname => opts['SecName']
69
    }
70

71
    arch = payload.arch
72
    plat = opts['Platform'] || payload.platform
73

74
    # Save off the original payload length
75
    len = e.encoded.length
76

77

78
    if arch.index(ARCH_JAVA) and fmt == 'war'
79
      return e.encoded_war.pack
80
    end
81

82
    output = Msf::Util::EXE.to_executable_fmt(framework, arch, plat, e.encoded, fmt, exeopts)
83

84
    if not output
85
      # Generate jar if necessary
86
      if fmt == 'jar'
87
        return e.encoded_jar.pack
88
      end
89

90
      # Serialize the generated payload to some sort of format
91
      fmt ||= "ruby"
92
      output = Buffer.transform(e.encoded, fmt)
93

94
      # Prepend a comment
95
      if (fmt != 'raw' and opts['NoComment'] != true)
96
        ((ou = payload.options.options_used_to_s(payload.datastore)) and ou.length > 0) ? ou += "\n" : ou = ''
97
        output =
98
          Buffer.comment(
99
            "#{payload.refname} - #{len} bytes#{payload.staged? ? " (stage 1)" : ""}\n" +
100
            "https://metasploit.com/\n" +
101
            ((e.encoder) ? "Encoder: #{e.encoder.refname}\n" : '') +
102
            ((e.nop) ?     "NOP gen: #{e.nop.refname}\n" : '') +
103
            "#{ou}",
104
            fmt) +
105
          output
106

107
        # If verbose was requested and it's multistage, include the second stage too
108
        if opts['Verbose'] && payload.staged?
109
          stage = payload.generate_stage
110

111
          # If a stage was generated, then display it
112
          if stage and stage.length > 0
113
            output +=
114
              "\n" +
115
              Buffer.comment(
116
                "#{payload.refname} - #{stage.length} bytes (stage 2)\n" +
117
                "https://metasploit.com/\n",
118
                fmt) +
119
              Buffer.transform(stage, fmt)
120
          end
121
        end
122

123
      end
124

125
    end
126

127
    # How to warn?
128
    #if exeopts[:fellback]
129
    #	$stderr.puts(OutError + "Warning: Falling back to default template: #{exeopts[:fellback]}")
130
    #end
131

132
    return output
133
  end
134

135
  #
136
  # Calls the class method.
137
  #
138
  def generate_simple(opts, &block)
139
    Msf::Simple::Payload.generate_simple(self, opts, &block)
140
  end
141

142
end
143

144
end
145
end
146

147