1
module Msf::Util::EXE::Windows::X64
2
  include Msf::Util::EXE::Common
3
  include Msf::Util::EXE::Windows::Common
4
  
5
  def self.included(base)
6
    base.extend(ClassMethods)
7
  end
8

9
  module ClassMethods
10
    # Construct a Windows x64 PE executable with the given shellcode.
11
    # to_win64pe
12
    #
13
    # @param framework [Msf::Framework] The Metasploit framework instance.
14
    # @param code [String] The shellcode to embed in the executable.
15
    # @param opts [Hash] Additional options.
16
    # @return [String] The constructed PE executable as a binary string.
17

18
    def to_win64pe(framework, code, opts = {})
19
      # Use the standard template if not specified by the user.
20
      # This helper finds the full path and stores it in opts[:template].
21
      set_template_default(opts, 'template_x64_windows.exe')
22

23
      # Try to inject code into executable by adding a section without affecting executable behavior
24
      if opts[:inject]
25
        injector = Msf::Exe::SegmentInjector.new({
26
           :payload  => code,
27
           :template => opts[:template],
28
           :arch     => :x64,
29
           :secname  => opts[:secname]
30
        })
31
        return injector.generate_pe
32
      end
33

34
      # Append a new section instead
35
      appender = Msf::Exe::SegmentAppender.new({
36
        :payload  => code,
37
        :template => opts[:template],
38
        :arch     => :x64,
39
        :secname	=> opts[:secname]
40
      })
41
      return appender.generate_pe
42
    end
43
    
44
    # to_win64pe
45
    #
46
    # @param framework  [Msf::Framework]  The framework of you want to use
47
    # @param code       [String]
48
    # @param opts       [Hash]
49
    # @return           [String]
50
    def to_win64pe(framework, code, opts = {})
51
      # Allow the user to specify their own EXE template
52
      set_template_default(opts, "template_x64_windows.exe")
53

54
      # Try to inject code into executable by adding a section without affecting executable behavior
55
      if opts[:inject]
56
        injector = Msf::Exe::SegmentInjector.new({
57
          :payload  => code,
58
          :template => opts[:template],
59
          :arch     => :x64,
60
          :secname  => opts[:secname]
61
        })
62
        return injector.generate_pe
63
      end
64

65
      # Append a new section instead
66
      appender = Msf::Exe::SegmentAppender.new({
67
        :payload  => code,
68
        :template => opts[:template],
69
        :arch     => :x64,
70
        :secname	=> opts[:secname]
71
      })
72
      return appender.generate_pe
73
    end
74

75
    # to_win64pe_service
76
    #
77
    # @param framework  [Msf::Framework]  The framework of you want to use
78
    # @param code       [String]
79
    # @param opts       [Hash]
80
    # @option           [String] :exe_type
81
    # @option           [String] :service_exe
82
    # @option           [String] :dll
83
    # @option           [String] :inject
84
    # @return           [String]
85
    def to_win64pe_service(framework, code, opts = {})
86
      # Allow the user to specify their own service EXE template
87
      set_template_default(opts, "template_x64_windows_svc.exe")
88
      opts[:exe_type] = :service_exe
89
      exe_sub_method(code,opts)
90
    end
91

92
    # to_win64pe_dll
93
    #
94
    # @param framework  [Msf::Framework]  The framework of you want to use
95
    # @param code       [String]
96
    # @param opts       [Hash]
97
    # @option           [String] :exe_type
98
    # @option           [String] :dll
99
    # @option           [String] :inject
100
    # @return           [String]
101
    def to_win64pe_dll(framework, code, opts = {})
102
      flavor = opts.fetch(:mixed_mode, false) ? 'mixed_mode' : nil
103
      set_template_default_winpe_dll(opts, ARCH_X64, code.size, flavor: flavor)
104

105
      opts[:exe_type] = :dll
106

107
      if opts[:inject]
108
        raise RuntimeError, 'Template injection unsupported for x64 DLLs'
109
      else
110
        exe_sub_method(code,opts)
111
      end
112
    end
113
    
114
    # to_win64pe_dccw_gdiplus_dll
115
    #
116
    # @param framework  [Msf::Framework]  The framework of you want to use
117
    # @param code       [String]
118
    # @param opts       [Hash]
119
    # @option           [String] :exe_type
120
    # @option           [String] :dll
121
    # @option           [String] :inject
122
    # @return           [String]
123
    def to_win64pe_dccw_gdiplus_dll(framework, code, opts = {})
124
      set_template_default_winpe_dll(opts, ARCH_X64, code.size, flavor: 'dccw_gdiplus')
125
      to_win64pe_dll(framework, code, opts)
126
    end
127
  end
128
  class << self
129
    include ClassMethods
130
  end
131
end
132

133