1
mirror of https://github.com/rapid7/metasploit-framework synced 2024-10-29 18:07:27 +01:00
metasploit-framework/modules/encoders
sinn3r a543d957d4 Fix #4717 - Change AllowWin32SEH's default to false
This is patch to change AllowWin32SEH to false.

Root cause:

The truely intended behavior is that if the user doesn't set a
BufferRegister and the encoder is for Windows, the AllowWin32SEH
code should kick in.

The problem here is that msfencode and msfvenom handle the platform
information differently, so we get different results.

With msfencode, the platform information isn't passed when alpha_mixed
is used, so even if you're using the encoder for Win32, the encoder
doesn't actually know about this. But everything works out just fine
anyway because people don't actually rely on AllowWin32SEH.

With msfvenom, the platform information is passed, so the encoder
actually knows it's for Windows. The two conditions are met (regster
and platform), so AllowWin32SEH kicks in. However, the AllowWin32SEH
technique enforces the BufferRegister to ECX, and that there's no
GetPC, so by default this isn't going to work.

The solution:

We are actually better off with setting AllowWin32SEH to false, mainly
because the SEH technique is pretty much dead (congrats MSFT!). And we
want the GetPC routine by default.

If people want to use AllowWin32SEH routine, they can simply set
AllowWin32SEH to true to bring it right back. For example:

e = framework.encoders.create('x86/alpha_mixed')
e.datastore.import_options_from_hash({'AllowWin32SEH'=>true})
buf = e.encode("AAAA", nil, nil, ::Msf::Module::PlatformList.win32)

Or in msfvenom:

msfvenom -p windows/meterpreter/bind_tcp -e x86/alpha_mixed
AllowWin32SEH=true -f raw

Fix #4717
2015-02-06 12:38:04 -06:00
..
cmd fix invalid URI scheme, closes #4362 2014-12-11 23:34:10 +01:00
generic Fix up comment splats with the correct URI 2014-10-17 11:47:33 -05:00
mipsbe Fix up comment splats with the correct URI 2014-10-17 11:47:33 -05:00
mipsle Fix up comment splats with the correct URI 2014-10-17 11:47:33 -05:00
php Fix up comment splats with the correct URI 2014-10-17 11:47:33 -05:00
ppc Fix up comment splats with the correct URI 2014-10-17 11:47:33 -05:00
sparc Fix up comment splats with the correct URI 2014-10-17 11:47:33 -05:00
x64 Fix up comment splats with the correct URI 2014-10-17 11:47:33 -05:00
x86 Fix #4717 - Change AllowWin32SEH's default to false 2015-02-06 12:38:04 -06:00