github/metasploit-payloads
1
Fork 0
mirror of https://github.com/rapid7/metasploit-payloads synced 2024-12-08 23:33:07 +01:00
Code Releases Activity

Add error message support to the railgun code

Browse Source 
This code was lost in the transition when the meterpreter source was
removed from the metasploit-framework source. I'm pulling this in by
request of @dmaloney-r7 who originally requested this code be inculded
as part of https://github.com/rapid7/metasploit-framework/pull/740

I added an extra bit of code to free up memory that is allocated by the
call to FormatMessage and forced the ASCII-version (FormatMessageA) of
the call.
This commit is contained in:
OJ 2013-09-12 14:21:19 +10:00
parent 7c5e7e930c
commit f0e7e0ec3c
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
c/meterpreter/source/extensions/stdapi/server/railgun/railgun.c
View File

@ -82,6 +82,14 @@ DWORD railgun_call( RAILGUN_INPUT * pInput, RAILGUN_OUTPUT * pOutput )
DWORD dwStackSizeInElements = 0;
DWORD dwIndex = 0;
// Set up vars for FormatMessage call
DWORD dwNumChars = 0;
// Set flags to look in the system error table if not found in the module table
DWORD dwMsgFlags = FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_IGNORE_INSERTS;
// Set the Language ID for the Message to US English
DWORD dwLangId = 0;
LPSTR buffer;
do
{
if( !pInput || !pOutput )
@ -105,6 +113,7 @@ DWORD railgun_call( RAILGUN_INPUT * pInput, RAILGUN_OUTPUT * pOutput )
pOutput->pBufferINOUT = pInput->pBufferINOUT;
pOutput->dwBufferSizeOUT = pInput->dwBufferSizeOUT;
pOutput->dwBufferSizeINOUT = pInput->dwBufferSizeINOUT;
pOutput->pErrMsg = NULL;
if( pOutput->dwBufferSizeOUT )
{
@ -330,6 +339,8 @@ DWORD railgun_call( RAILGUN_INPUT * pInput, RAILGUN_OUTPUT * pOutput )
}
pOutput->dwLastError = GetLastError();
dwNumChars = FormatMessageA(dwMsgFlags, hDll, pOutput->dwLastError, dwLangId, (LPSTR)&buffer, 0, NULL);
pOutput->pErrMsg = buffer;
#ifdef _WIN64
dprintf("[RAILGUN] railgun_call: pOutput->dwLastError=0x%08X, pOutput->qwReturnValue=0x%llX", pOutput->dwLastError, pOutput->qwReturnValue );
@ -527,9 +538,18 @@ DWORD request_railgun_api( Remote * pRemote, Packet * pPacket )
packet_add_tlv_qword( pResponse, TLV_TYPE_RAILGUN_BACK_RET, rOutput.qwReturnValue );
packet_add_tlv_raw( pResponse, TLV_TYPE_RAILGUN_BACK_BUFFERBLOB_OUT, rOutput.pBufferOUT, (DWORD)rOutput.dwBufferSizeOUT );
packet_add_tlv_raw( pResponse, TLV_TYPE_RAILGUN_BACK_BUFFERBLOB_INOUT, rOutput.pBufferINOUT, (DWORD)rOutput.dwBufferSizeINOUT );
packet_add_tlv_string( pResponse, TLV_TYPE_RAILGUN_BACK_MSG, rOutput.pErrMsg );
}
dwResult = packet_transmit( pRemote, pResponse, NULL );
// FormatMessage calls that use the FORMAT_MESSAGE_ALLOCATE_BUFFER flag allocate memory using LocalAlloc().
// We need to free this memory up here to prevent leaks.
if ( rOutput.pErrMsg != NULL )
{
LocalFree( (HLOCAL)rOutput.pErrMsg );
rOutput.pErrMsg = NULL;
}
}
if( rInput.pBufferIN )

2
c/meterpreter/source/extensions/stdapi/server/railgun/railgun.h
View File

@ -19,6 +19,7 @@
#define TLV_TYPE_RAILGUN_MEM_DATA MAKE_CUSTOM_TLV( TLV_META_TYPE_RAW, TLV_TYPE_EXTENSION_RAILGUN, TLV_EXTENSIONS + 13 )
#define TLV_TYPE_RAILGUN_MEM_LENGTH MAKE_CUSTOM_TLV( TLV_META_TYPE_UINT, TLV_TYPE_EXTENSION_RAILGUN, TLV_EXTENSIONS + 14 )
#define TLV_TYPE_RAILGUN_CALLCONV MAKE_CUSTOM_TLV( TLV_META_TYPE_STRING, TLV_TYPE_EXTENSION_RAILGUN, TLV_EXTENSIONS + 15 )
#define TLV_TYPE_RAILGUN_BACK_MSG MAKE_CUSTOM_TLV( TLV_META_TYPE_STRING, TLV_TYPE_EXTENSION_RAILGUN, TLV_EXTENSIONS + 16 )
typedef struct _RAILGUN_INPUT
{
@ -37,6 +38,7 @@ typedef struct _RAILGUN_OUTPUT
{
DWORD dwLastError;
QWORD qwReturnValue;
const char * pErrMsg;
BYTE * pBufferOUT;
BYTE * pBufferINOUT;
ULONG_PTR dwBufferSizeOUT;