Class: Msf::Exe::SegmentInjector

Inherits:
SegmentAppender show all
Defined in:
lib/msf/core/exe/segment_injector.rb

Overview

Appends a payload section and injects it via a CreateThread entrypoint stub.

Constant Summary

Constants inherited from SegmentAppender

Msf::Exe::SegmentAppender::DEFAULT_SECTION_CHARACTERISTICS, Msf::Exe::SegmentAppender::MAX_PE_SECTION_NAME_LENGTH, Msf::Exe::SegmentAppender::MAX_SECTION_NAME_WITHOUT_DOT_LENGTH

Instance Attribute Summary collapse

Attributes inherited from SegmentAppender

#arch, #payload, #section_characteristics, #section_name, #template

Instance Method Summary collapse

Methods inherited from SegmentAppender

#append_section, #build_section_name, #copy_pe, #processor, #random_section_name

Constructor Details

#initialize(opts = {}) ⇒ SegmentInjector

Returns a new instance of SegmentInjector.



9
10
11
12
13
14
 
# File 'lib/msf/core/exe/segment_injector.rb', line 9

def initialize(opts = {})
  super

  @buffer_register = opts[:buffer_register] || (arch == :x86 ? 'edx' : 'rdx')
  validate_buffer_register!
end

Instance Attribute Details

#buffer_register ⇒ Object

Returns the value of attribute buffer_register.



7
8
9
 
# File 'lib/msf/core/exe/segment_injector.rb', line 7

def buffer_register
  @buffer_register
end

Instance Method Details

#generate_pe ⇒ Object 



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
 
# File 'lib/msf/core/exe/segment_injector.rb', line 16

def generate_pe
  pe_orig = Metasm::PE.decode_file(template)
  if is_warbird?(pe_orig)
    raise 'The template to inject to appears to have license verification (warbird)'
  end

  if pe_orig.export && pe_orig.export.num_exports == 0
    raise "The template file doesn't have any exports to inject into!"
  end

  pe = copy_pe(pe_orig)
  section = append_section(pe, prefix: dll_prefix(pe), default_name: '.text')

  # Tell our section where the original entrypoint was
  if pe.optheader.entrypoint != 0
    section.encoded.fixup!('entrypoint' => pe.optheader.image_base + pe.optheader.entrypoint)
  end

  pe.optheader.entrypoint = 'hook_entrypoint'
  pe.cpu = pe_orig.cpu

  pe.encode_string
end