Module: Msf::Util::EXE::Windows::X64::ClassMethods

Included in:
Msf::Util::EXE::Windows::X64
Defined in:
lib/msf/util/exe/windows/x64.rb

Instance Method Summary collapse

Instance Method Details

#to_win64pe(framework, code, opts = {}) ⇒ String

to_win64pe

Construct a Windows x64 PE executable with the given shellcode.

Parameters:

  • framework (Msf::Framework) —

    The framework of you want to use

  • code (String)
  • opts (Hash) (defaults to: {})

Returns:

  • (String) 


19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/msf/util/exe/windows/x64.rb', line 19

def to_win64pe(framework, code, opts = {})
  # Allow the user to specify their own EXE template
  set_template_default(opts, "template_x64_windows.exe")

  # Try to inject code into executable by adding a section without affecting executable behavior
  if opts[:inject]
    injector = Msf::Exe::SegmentInjector.new({
      :payload      => code,
      :template     => opts[:template],
      :arch         => :x64,
      :section_name => opts[:section_name] || opts[:secname]
    })
    return injector.generate_pe
  end

  # Append a new section instead
  hijacker = Msf::Exe::SegmentHijacker.new({
    :payload      => code,
    :template     => opts[:template],
    :arch         => :x64,
    :section_name => opts[:section_name] || opts[:secname]
  })
  return hijacker.generate_pe
end

#to_win64pe_dccw_gdiplus_dll(framework, code, opts = {}) ⇒ String

to_win64pe_dccw_gdiplus_dll

Parameters:

  • framework (Msf::Framework) —

    The framework of you want to use

  • code (String)
  • opts (Hash) (defaults to: {})
  • [String] (Hash) —

    a customizable set of options

Returns:

  • (String) 


92
93
94
95
 
# File 'lib/msf/util/exe/windows/x64.rb', line 92

def to_win64pe_dccw_gdiplus_dll(framework, code, opts = {})
  set_template_default_winpe_dll(opts, ARCH_X64, code.size, flavor: 'dccw_gdiplus')
  to_win64pe_dll(framework, code, opts)
end

#to_win64pe_dll(framework, code, opts = {}) ⇒ String

to_win64pe_dll

Parameters:

  • framework (Msf::Framework) —

    The framework of you want to use

  • code (String)
  • opts (Hash) (defaults to: {})
  • [String] (Hash) —

    a customizable set of options

Returns:

  • (String) 


70
71
72
73
74
75
76
77
78
79
80
81
 
# File 'lib/msf/util/exe/windows/x64.rb', line 70

def to_win64pe_dll(framework, code, opts = {})
  flavor = opts.fetch(:mixed_mode, false) ? 'mixed_mode' : nil
  set_template_default_winpe_dll(opts, ARCH_X64, code.size, flavor: flavor)

  opts[:exe_type] = :dll

  if opts[:inject]
    raise RuntimeError, 'Template injection unsupported for x64 DLLs'
  else
    exe_sub_method(code,opts)
  end
end

#to_win64pe_service(framework, code, opts = {}) ⇒ String

to_win64pe_service

Embeds the payload into a Windows service EXE template as a dedicated PE section, which the service template locates at runtime.

Parameters:

  • framework (Msf::Framework) —

    The framework of you want to use

  • code (String)
  • opts (Hash) (defaults to: {})
  • [String] (Hash) —

    a customizable set of options

Returns:

  • (String) 


55
56
57
58
59
 
# File 'lib/msf/util/exe/windows/x64.rb', line 55

def to_win64pe_service(framework, code, opts = {})
  # Allow the user to specify their own service EXE template
  set_template_default(opts, "template_x64_windows_svc.exe")
  to_winpe_service(code, :x64, opts)
end