Class: Msf::Exe::ElfInjector::X86

Inherits:
Object
  • Object
show all
Defined in:
lib/msf/core/exe/elf_injector/x86.rb

Overview

Builds an x86 trampoline that forks before running the payload.

Constant Summary collapse

ASSEMBLY = 
%q{
  pushfd
  pushad
  mov eax, 2
  int 0x80
  test eax, eax
  jz child
  popad
  popfd
  jmp entrypoint
child:
  popad
  popfd
}

Instance Method Summary collapse

Constructor Details

#initialize(entrypoint:, injected_address:) ⇒ X86

Returns a new instance of X86.

Parameters:

  • entrypoint (Integer) —

    Original ELF entry point.

  • injected_address (Integer) —

    Virtual address of the injected segment.



25
26
27
28
 
# File 'lib/msf/core/exe/elf_injector/x86.rb', line 25

def initialize(entrypoint:, injected_address:)
  @entrypoint = entrypoint
  @injected_address = injected_address
end

Instance Method Details

#generate ⇒ String

Returns Encoded x86 trampoline.

Returns:

  • (String) —

    Encoded x86 trampoline.



31
32
33
34
35
 
# File 'lib/msf/core/exe/elf_injector/x86.rb', line 31

def generate
  shellcode = Metasm::Shellcode.assemble(Metasm::Ia32.new, ASSEMBLY)
  shellcode.base_addr = @injected_address
  shellcode.encode_string('entrypoint' => @entrypoint)
end