1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Encoder
7
  Rank = GoodRanking
8

9
  def initialize
10
    super(
11
      'Name' => 'Echo Command Encoder',
12
      'Description' => %q{
13
        This encoder uses echo and backlash escapes to avoid commonly restricted characters.
14
      },
15
      'Author' => 'hdm',
16
      'Arch' => ARCH_CMD,
17
      'Platform' => %w[linux unix],
18
      'EncoderType' => Msf::Encoder::Type::CmdPosixEcho)
19
  end
20

21
  #
22
  # Encodes the payload
23
  #
24
  def encode_block(state, buf)
25
    # Skip encoding for empty badchars
26
    return buf if state.badchars.empty?
27

28
    raise EncodingError if state.badchars.include?('-')
29

30
    # echo won't work without an escape character
31
    raise EncodingError if state.badchars.include?('\\')
32

33
    encode_block_bash_echo(state, buf)
34
  end
35

36
  #
37
  # Uses bash's echo -ne command to hex encode the command string
38
  #
39
  def encode_block_bash_echo(state, buf)
40
    hex = ''
41

42
    # Can we use single quotes to enclose the echo arguments?
43
    if state.badchars.include?("'")
44
      hex = buf.unpack('C*').collect { |c| '\\\\\\x%.2x' % c }.join
45
    else
46
      hex = "'" + buf.unpack('C*').collect { |c| '\\x%.2x' % c }.join + "'"
47
    end
48

49
    # Are pipe characters restricted?
50
    if state.badchars.include?('|')
51
      # How about backticks?
52
      if state.badchars.include?('`')
53
        # Last ditch effort, dollar paren
54
        if state.badchars.include?('$') || state.badchars.include?('(')
55
          raise EncodingError
56
        else
57
          buf = "$(/bin/echo -ne #{hex})"
58
        end
59
      else
60
        buf = "`/bin/echo -ne #{hex}`"
61
      end
62
    else
63
      buf = "/bin/echo -ne #{hex}|sh"
64
    end
65

66
    # Remove spaces from the command string
67
    if state.badchars.include?(' ')
68
      buf.gsub!(/\s/, '${IFS}')
69
    end
70

71
    return buf
72
  end
73
end
74

75