Class: Rex::Post::Meterpreter::Extensions::Bofloader::Bofloader

Inherits:
Rex::Post::Meterpreter::Extension show all
Defined in:
lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb

Overview

Beacon object file (BOF) loader

Instance Attribute Summary collapse

Attributes inherited from Rex::Post::Meterpreter::Extension

#client, #name

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(client) ⇒ Bofloader

Typical extension initialization routine.



137
138
139
140
141
142
143
144
145
146
147
148
149
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 137

def initialize(client)
  super(client, 'bofloader')
  @cna_catalog = { 'path' => nil, 'bofs' => {}, 'warnings' => [] }

  client.register_extension_aliases(
    [
      {
        'name' => 'bofloader',
        'ext' => self
      },
    ]
  )
end

Instance Attribute Details

#cna_catalog ⇒ Hash (readonly)

Returns the CNA catalog loaded in this Meterpreter session.

Returns:

  • (Hash) —

    Loaded script path, BOF definitions, and warnings.



154
155
156
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 154

def cna_catalog
  @cna_catalog
end

Class Method Details

.extension_id ⇒ Object 



130
131
132
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 130

def self.extension_id
  EXTENSION_ID_BOFLOADER
end

Instance Method Details

#cna_bof(name) ⇒ Hash?

Looks up one CNA-backed BOF.

Parameters:

  • name (String) —

    CNA alias name.

Returns:

  • (Hash, nil) —

    BOF definition when found.



185
186
187
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 185

def cna_bof(name)
  @cna_catalog['bofs'][name]
end

#cna_invocation(name, arguments: []) ⇒ Hash

Resolves one CNA alias into native BOF execution input.

Parameters:

  • name (String) —

    CNA alias name.

  • arguments (Array<String>) (defaults to: []) —

    Alias positional arguments.

Returns:

  • (Hash) —

    BOF bytes, packed values, format, and entry point.

Raises:



194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 194

def cna_invocation(name, arguments: [])
  definition = cna_bof(name)
  raise CnaParser::Error, "Unknown CNA BOF: #{name}" unless definition

  bof_path = definition['files'][client.arch]
  unless bof_path && ::File.file?(bof_path) && ::File.readable?(bof_path)
    raise CnaParser::Error, "CNA alias '#{name}' has no readable BOF for #{client.arch}."
  end

  parsed = CnaArgumentParser.new(arguments: definition['arguments']).parse(arguments)
  {
    'data' => ::File.binread(bof_path),
    'entry' => definition['entry'],
    'format' => parsed['format'],
    'values' => parsed['values']
  }
end

#execute(bof_data, args_format: nil, args: nil, entry: 'go') ⇒ String?

Executes a BOF in the current Meterpreter session.

Parameters:

  • bof_data (String) —

    COFF bytes.

  • args_format (String, nil) (defaults to: nil) —

    Cobalt Strike bof_pack format.

  • args (Array, nil) (defaults to: nil) —

    Values corresponding to args_format.

  • entry (String) (defaults to: 'go') —

    Exported BOF entry point.

Returns:

  • (String, nil) —

    Captured BOF output.



219
220
221
222
223
224
225
226
227
228
229
230
231
232
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 219

def execute(bof_data, args_format: nil, args: nil, entry: 'go')
  request = Packet.create_request(COMMAND_ID_BOFLOADER_EXECUTE)

  # Pack up beacon object file data and arguments into one single binary blob
  bof = BofPack.new
  packed_args = bof.bof_pack(args_format, args)

  # Send the meterpreter TLV packet and get the output back
  request.add_tlv(TLV_TYPE_BOFLOADER_EXECUTE_BUFFER, bof_data)
  request.add_tlv(TLV_TYPE_BOFLOADER_EXECUTE_BUFFER_ENTRY, entry)
  request.add_tlv(TLV_TYPE_BOFLOADER_EXECUTE_ARGUMENTS, packed_args)
  response = client.send_request(request)
  return response.get_tlv_value(TLV_TYPE_BOFLOADER_EXECUTE_RESULT)
end

#load_cna(path) ⇒ Hash

Loads compatible BOF aliases from an Aggressor script.

Parameters:

  • path (String) —

    Local CNA script path.

Returns:

  • (Hash) —

    The new CNA catalog.



160
161
162
163
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 160

def load_cna(path)
  catalog = CnaParser.parse(path: ::File.expand_path(path))
  @cna_catalog = catalog
end

#reload_cna ⇒ Hash

Reloads the currently loaded Aggressor script.

Returns:

  • (Hash) —

    The new CNA catalog.

Raises:



168
169
170
171
172
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 168

def reload_cna
  raise CnaParser::Error, 'No CNA script is loaded.' unless @cna_catalog['path']

  load_cna(@cna_catalog['path'])
end

#unload_cna ⇒ Hash

Unloads all CNA-backed BOF aliases.

Returns:

  • (Hash) —

    The empty CNA catalog.



177
178
179
 
# File 'lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb', line 177

def unload_cna
  @cna_catalog = { 'path' => nil, 'bofs' => {}, 'warnings' => [] }
end