Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Encoder::Xor
7

8
  def initialize
9
    super(
10
      'Name'             => 'Call+4 Dword XOR Encoder',
11
      'Description'      => 'Call+4 Dword XOR Encoder',
12
      'Author'           => [ 'hdm', 'spoonm' ],
13
      'Arch'             => ARCH_X86,
14
      'License'          => MSF_LICENSE,
15
      'Decoder'          =>
16
        {
17
          'KeySize'    => 4,
18
          'BlockSize'  => 4,
19
        })
20
  end
21

22
  #
23
  # Returns the decoder stub that is adjusted for the size of
24
  # the buffer being encoded
25
  #
26
  def decoder_stub(state)
27

28
    # Sanity check that saved_registers doesn't overlap with modified_registers
29
    if (modified_registers & saved_registers).length > 0
30
      raise BadGenerateError
31
    end
32

33
    decoder =
34
      Rex::Arch::X86.sub(-(((state.buf.length - 1) / 4) + 1), Rex::Arch::X86::ECX,
35
        state.badchars) +
36
      "\xe8\xff\xff\xff" + # call $+4
37
      "\xff\xc0"         + # inc eax
38
      "\x5e"             + # pop esi
39
      "\x81\x76\x0eXORK" + # xor [esi + 0xe], xork
40
      "\x83\xee\xfc"     + # sub esi, -4
41
      "\xe2\xf4"           # loop xor
42

43
    # Calculate the offset to the XOR key
44
    state.decoder_key_offset = decoder.index('XORK')
45

46
    return decoder
47
  end
48

49
  # Indicate that this module can preserve some registers
50
  def can_preserve_registers?
51
    true
52
  end
53

54
  # A list of registers always touched by this encoder
55
  def modified_registers
56
    [ Rex::Arch::X86::ECX, Rex::Arch::X86::EAX, Rex::Arch::X86::ESI ]
57
  end
58

59
  # Convert the SaveRegisters to an array of x86 register constants
60
  def saved_registers
61
    Rex::Arch::X86.register_names_to_ids(datastore['SaveRegisters'])
62
  end
63
end
64

65