Path: blob/master/modules/encoders/mipsbe/longxor.rb
19664 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45require 'metasm'67class MetasploitModule < Msf::Encoder::Xor89def initialize10super(11'Name' => 'XOR Encoder',12'Description' => %q{13Mips Web server exploit friendly xor encoder.14},15'Author' => [16'Julien Tinnes <julien[at]cr0.org>', # original shellcode17'Pedro Ribeiro <[email protected]>', # fix Linux >= 2.6.11 and toupper() compat18],19'Arch' => ARCH_MIPSBE,20'License' => MSF_LICENSE,21'Decoder' => {22'KeySize' => 4,23'BlockSize' => 4,24'KeyPack' => 'N'25})26end2728#29# Returns the decoder stub that is adjusted for the size of the buffer30# being encoded.31#32def decoder_stub(state)33# add one xor operation for the key (see comment below)34number_of_passes = state.buf.length / 4 + 135raise EncodingError, "The payload being encoded is too long (#{state.buf.length} bytes)" if number_of_passes > 1024036raise EncodingError, "The payload is not padded to 4-bytes (#{state.buf.length} bytes)" if state.buf.length % 4 != 03738# 16-bits not (again, see below)39reg_10 = (number_of_passes + 1) ^ 0xFFFF40reg_5 = state.buf.length ^ 0xFFFF41decoder = Metasm::Shellcode.assemble(Metasm::MIPS.new(:big), <<~EOS).encoded.data42;43; MIPS nul-free xor decoder44;45; (C) 2006 Julien TINNES46; <julien at cr0.org>47;48; The first four bytes in encoded shellcode must be the xor key49; This means that you have to put the xor key right after50; this xor decoder51; This key will be considered part of the encoded shellcode52; by this decoder and will be xored, thus becoming 4NULs, meaning nop53;54; This is Linux-only because I use the cacheflush system call55;56; You can use shellforge to assemble this, but be sure to discard all57; the nul bytes at the end (everything after x01\\x4a\\x54\\x0c)58;59; change 2 bytes in the first instruction's opcode with the number of passes60; the number of passes is the number of xor operations to apply, which should be61; 1 (for the key) + the number of 4-bytes words you have in your shellcode62; you must encode ~(number_of_passes + 1) (to ensure that you're nul-free)636465;.text66;.align 267;.globl main68;.ent main69;.type main,@function7071main:7273li macro reg, imm74; lui reg, ((imm) >> 16) & 0ffffh75; ori reg, reg, (imm) & 0ffffh76addiu reg, $0, imm ; sufficient if imm.abs <= 0x7fff77endm7879li( $10, #{reg_10}) ; load number of passes ^ 0xffff80nor $10, $10, $0 ; put number of passes in $108182li( $11,-89) ; addend to calculated PC is 7383;.set noreorder84next:85bltzal $8, next86;.set reorder87slti $8, $0, 0x828288nor $11, $11, $0 ; addend in $989addu $25, $31, $11 ; $25 points to encoded shellcode +490addu $16, $31, $11 ; $16 too (used to set up the cacheflush() arg down below)9192; lui $2, 0xDDDD ; first part of the xor (old method)93slti $23, $0, 0x8282 ; store 0 in $23 (our counter)94; ori $17, $2, 0xDDDD ; second part of the xor (old method)95lw $17, -4($25) ; load xor key in $17969798li( $9, -5)99nor $9, $9, $0 ; 4 in $9100101addi $15, $9, -3 ; 1 in $15102loop:103lw $8, -4($25)104105addu $23, $23, $15 ; increment counter106xor $3, $8, $17107sltu $30, $23, $10 ; enough loops?108sw $3, -4($25)109addi $6, $9, -1 ; 3 in $6 (for cacheflush)110bne $0, $30, loop111addu $25, $25, $9 ; next instruction to decode :)112113114addiu $4, $16, -4 ; cacheflush() addr parameter115li( $10,#{reg_5}) ; cacheflush() nbytes parameter116nor $5, $10, $0 ; same as above117; li $6,3 ; $6 is set above, 3rd arg for cacheflush()118119; .set noreorder120li( $2, 4147) ; cacheflush121; .ascii "\\x01JT\\x0c" ; nul-free syscall122syscall 0x52950123; .set reorder124125126; write last decoder opcode and decoded shellcode127; li $4,1 ; stdout128; addi $5, $16, -8129; li $6,40 ; how much to write130; .set noreorder131; li $2, 4004 ; write132; syscall133; .set reorder134135136nop ; encoded shellcoded must be here (xor key right here ;)137; $t9 (aka $25) points here138139EOS140# put the key at the end of the decoder141state.decoder_key_offset = decoder.length - 4142143return decoder144end145end146147148