1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'rex/encoder/nonupper'
7

8
class MetasploitModule < Msf::Encoder::NonUpper
9
  Rank = LowRanking
10

11
  def initialize
12
    super(
13
      'Name' => 'Non-Upper Encoder',
14
      'Description' => %q{
15
          Encodes payloads as non-alpha based bytes. This allows
16
        payloads to bypass tolower() calls, but will fail isalpha().
17
        Table based design from Russel Sanford.
18
      },
19
      'Author' => [ 'pusscat'],
20
      'Arch' => ARCH_X86,
21
      'License' => BSD_LICENSE,
22
      'EncoderType' => Msf::Encoder::Type::NonUpper,
23
      'Decoder' => {
24
        'BlockSize' => 1
25
      })
26
  end
27

28
  #
29
  # Returns the decoder stub that is adjusted for the size of the buffer
30
  # being encoded.
31
  #
32
  def decoder_stub(state)
33
    state.key = ''
34
    state.decoder_key_size = 0
35
    Rex::Encoder::NonUpper.gen_decoder
36
  end
37

38
  #
39
  # Encodes a one byte block with the current index of the length of the
40
  # payload.
41
  #
42
  def encode_block(state, block)
43
    begin
44
      newchar, state.key, state.decoder_key_size =
45
        Rex::Encoder::NonUpper.encode_byte(datastore['BadChars'], block.unpack('C')[0], state.key, state.decoder_key_size)
46
    rescue RuntimeError => e
47
      # This is a bandaid to deal with the fact that, since it's in
48
      # the Rex namespace, the encoder itself doesn't have access to the
49
      # Msf exception classes.  Turn it into an actual EncodingError
50
      # exception so the encoder doesn't look broken when it just fails
51
      # to encode.
52
      raise BadcharError if e.message == 'BadChar'
53
    end
54
    return newchar
55
  end
56

57
  #
58
  # Fix stuff, and add the table :)
59
  #
60
  def encode_end(state)
61
    state.encoded.gsub!(/A/, state.decoder_key_size.chr)
62
    state.encoded.gsub!(/B/, (state.decoder_key_size + 5).chr)
63
    state.encoded[0x24, 0] = state.key
64
  end
65
end
66

67