Module: Msf::ReflectiveDLLLoader

Included in:
Payload::Windows::MeterpreterLoader, Payload::Windows::MeterpreterLoader_x64, Payload::Windows::ReflectiveDllInject, Payload::Windows::ReflectiveDllInject_x64, Post::Windows::ReflectiveDLLInjection, Rex::Payloads::Meterpreter::Config
Defined in:
lib/msf/core/reflective_dll_loader.rb

Constant Summary collapse

EXPORT_REFLECTIVELOADER =

This is the ordinal of the reflective loader by default In new RDI DLLs that come with MSF

1
MIN_CUSTOM_LOADER_SIZE =

Minimum plausible size, in bytes, for a site-local custom reflective loader. This is only a sanity floor to catch obviously-broken input (empty files, truncated downloads, the wrong file entirely) – it is not, and cannot be, a correctness check of the shellcode itself.

64

Instance Method Summary collapse

Instance Method Details

#load_rdi_dll(dll_path, loader_name: 'ReflectiveLoader', loader_ordinal: EXPORT_REFLECTIVELOADER) ⇒ Array

Load a reflectively-injectable DLL from disk and find the offset to the ReflectiveLoader function inside the DLL.

Parameters:

  • dll_path (String) —

    Path to the DLL to load.

Returns:

  • (Array) —

    Tuple of DLL contents and offset to the ReflectiveLoader function within the DLL.



32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'lib/msf/core/reflective_dll_loader.rb', line 32

def load_rdi_dll(dll_path, loader_name: 'ReflectiveLoader', loader_ordinal: EXPORT_REFLECTIVELOADER)
  encrypted_dll = ::File.binread(dll_path)
  dll = ::MetasploitPayloads::Crypto.decrypt(ciphertext: encrypted_dll)

  offset = parse_pe(dll, loader_name: loader_name, loader_ordinal: loader_ordinal)

  unless offset
    raise "Cannot find the ReflectiveLoader entry point in #{dll_path}"
  end

  return dll, offset
end

#load_rdi_dll_from_data(dll_data, loader_name: 'ReflectiveLoader', loader_ordinal: EXPORT_REFLECTIVELOADER) ⇒ Integer

Load a reflectively-injectable DLL from a string and find the offset to the ReflectiveLoader function inside the DLL.

Parameters:

  • dll_data (String) —

    the DLL data to load.

Returns:

  • (Integer) —

    offset to the ReflectiveLoader function within the DLL.



51
52
53
54
55
56
57
58
59
60
 
# File 'lib/msf/core/reflective_dll_loader.rb', line 51

def load_rdi_dll_from_data(dll_data, loader_name: 'ReflectiveLoader', loader_ordinal: EXPORT_REFLECTIVELOADER)
  decrypted_dll_data = ::MetasploitPayloads::Crypto.decrypt(ciphertext: dll_data)
  offset = parse_pe(decrypted_dll_data, loader_name: loader_name, loader_ordinal: loader_ordinal)

  unless offset
    raise 'Cannot find the ReflectiveLoader entry point in DLL data'
  end

  offset
end