## # $Id: messagebox.rb 4 2010-02-26 00:28:00:00Z corelanc0d3r & rick2600 $ ## # # Installation instructions : # Drop file in framework3/modules/payloads/singles/windows folder # # Usage : ./msfpayload windows/messagebox TITLE="Corelan" TEXT="Greetz to corelanc0d3r" P #
require 'msf/core' module Metasploit3
include Msf::Payload::Windows include Msf::Payload::Single
def initialize(info = {}) super(update_info(info, 'Name' => 'Windows Messagebox with custom title and text', 'Version' => '$Revision: 4 $', 'Description' => 'Spawns MessageBox with a customizable title & text', 'Author' => [ 'corelanc0d3r - peter.ve[at]corelan.be', 'rick2600 - ricks2600[at]gmail.com' ], 'License' => BSD_LICENSE, 'Platform' => 'win', 'Arch' => ARCH_X86, 'Privileged' => false, 'Payload' => { 'Offsets' => { }, 'Payload' => "\xd9\xeb\x9b\xd9\x74\x24\xf4\x31"+ "\xd2\xb2\x7a\x31\xc9\x64\x8b\x71"+ "\x30\x8b\x76\x0c\x8b\x76\x1c\x8b"+ "\x46\x08\x8b\x7e\x20\x8b\x36\x38"+ "\x4f\x18\x75\xf3\x59\x01\xd1\xff"+ "\xe1\x60\x8b\x6c\x24\x24\x8b\x45"+ "\x3c\x8b\x54\x05\x78\x01\xea\x8b"+ "\x4a\x18\x8b\x5a\x20\x01\xeb\xe3"+ "\x37\x49\x8b\x34\x8b\x01\xee\x31"+ "\xff\x31\xc0\xfc\xac\x84\xc0\x74"+ "\x0a\xc1\xcf\x0d\x01\xc7\xe9\xf1"+ "\xff\xff\xff\x3b\x7c\x24\x28\x75"+ "\xde\x8b\x5a\x24\x01\xeb\x66\x8b"+ "\x0c\x4b\x8b\x5a\x1c\x01\xeb\x8b"+ "\x04\x8b\x01\xe8\x89\x44\x24\x1c"+ "\x61\xc3\xb2\x08\x29\xd4\x89\xe5"+ "\x89\xc2\x68\x8e\x4e\x0e\xec\x52"+ "\xe8\x9c\xff\xff\xff\x89\x45\x04"+ "\xbb" } ))
# EXITFUNC : Only support Process and Thread :/ deregister_options('EXITFUNC')
# Register MessageBox options register_options( [ OptString.new('EXITFUNC', [ false, "Only Process (default) or Thread are supported","process"]), OptString.new('TITLE', [ true, "Messagebox Title (max 255 chars)" ]), OptString.new('TEXT', [ true, "Messagebox Text" ]) ], self.class) end
# # Constructs the payload # def generate strExitFunc = datastore['EXITFUNC'] || "process" strExitFuncHash = "\x7e\xd8\xe2\x73" #ExitProcess()
strTitle = datastore['TITLE'] if (strTitle) #ExitFunc if (strExitFunc) then strExitFunc=strExitFunc.downcase if strExitFunc == "thread" then strExitFuncHash="\xEF\xCE\xE0\x60" #ExitThread() end end
#================Process Title================================== strTitle=strTitle+"X" iTitle=strTitle.length if (iTitle < 256) iNrLines=iTitle/4 iCheckChars = iNrLines * 4 strSpaces="" iSniperTitle=iTitle-1 if iCheckChars != iTitle then iTargetChars=(iNrLines+1)*4 while iTitle < iTargetChars strSpaces+=" " #add space iTitle+=1 end end strTitle=strTitle+strSpaces #title is now 4 byte aligned #and string ends with X #at index iSniperTitle
#push Title to stack #start at back of string strPushTitle="" strLine="" icnt=strTitle.length-1 icharcnt=0 while icnt >= 0 thisChar=strTitle[icnt,1] strLine=thisChar+strLine if icharcnt < 3 icharcnt+=1 else strPushTitle=strPushTitle+"h"+strLine #h = \68 = push strLine="" icharcnt=0 end icnt=icnt-1 end
#generate opcode to write null byte strWriteTitleNull="\x31\xDB\x88\x5C\x24" strWriteTitleNull += iSniperTitle.chr + "\x89\xe3"
#================Process Text=============================== #cut text into 4 byte push instructions strText = datastore['TEXT'] strText=strText+"X" iText=strText.length iNrLines=iText/4 iCheckChars = iNrLines * 4 strSpaces="" iSniperText=iText-1 if iCheckChars != iText then iTargetChars=(iNrLines+1)*4 while iText < iTargetChars strSpaces+=" " #add space iText+=1 end end strText=strText+strSpaces #text is now 4 byte aligned #and string ends with X #at index iSniperTitle
#push Text to stack #start at back of string strPushText="" strLine="" icnt=strText.length-1 icharcnt=0 while icnt >= 0 thisChar=strText[icnt,1] strLine=thisChar+strLine if icharcnt < 3 icharcnt+=1 else strPushText=strPushText+"h"+strLine #h = \68 = push strLine="" icharcnt=0 end icnt=icnt-1 end
#generate opcode to write null byte strWriteTextNull="\x31\xc9\x88\x4C\x24" strWriteTextNull += iSniperText.chr + "\x89\xe1"
#build payload payload_data = module_info['Payload']['Payload'] payload_data += strExitFuncHash payload_data += "\x87\x1c\x24" payload_data += "\x52\xe8\x8b\xff\xff\xff\x89\x45" payload_data += "\x08\x68\x6c\x6c\x20\xff\x68\x33" payload_data += "\x32\x2e\x64\x68\x75\x73\x65\x72" payload_data += "\x88\x5c\x24\x0a\x89\xe6\x56\xff" payload_data += "\x55\x04\x89\xc2\x50\xbb\xa8\xa2" payload_data += "\x4d\xbc\x87\x1c\x24\x52\xe8\x5e" payload_data += "\xff\xff\xff" payload_data += strPushTitle + strWriteTitleNull payload_data += strPushText + strWriteTextNull payload_data += "\x31\xd2\x52" payload_data += "\x53\x51\x52\xff\xd0\x31\xc0\x50" payload_data += "\xff\x55\x08"
return payload_data else raise ArgumentError, "Title should be 255 characters or less" end end end end
|