Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix an edge case in .to_win32pe #18094

Merged
merged 1 commit into from
Jun 15, 2023
Merged

Fix an edge case in .to_win32pe #18094

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions lib/msf/util/exe.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,8 +306,8 @@ def self.to_win32pe(framework, code, opts = {})
block = blocks.first

# TODO: Allow the entry point in a different block
if payload.length + 256 > block[1]
raise RuntimeError, "The largest block in .text does not have enough contiguous space (need:#{payload.length+256} found:#{block[1]})"
if payload.length + 256 >= block[1]
raise RuntimeError, "The largest block in .text does not have enough contiguous space (need:#{payload.length+257} found:#{block[1]})"
end
Comment on lines +309 to 311
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was switched to ensure that block[1] is greater than payload.length + 256. 256 is the max size of the entry as you can see on L324. 5 bytes are reserved for the jump instruction.

This should prevent future calls to rand() from receiving 0 in the event that payload.length + 256 == block[1]. When Ruby's rand() function is called with 0, it will return a float which is unexpected.


# Make a copy of the entire .text section
Expand All @@ -328,8 +328,8 @@ def self.to_win32pe(framework, code, opts = {})
poff += 256
eidx = rand(poff-(entry.length + 5))
else # place the entry pointer after the payload
poff -= 256
eidx = rand(block[1] - (poff + payload.length)) + poff + payload.length
poff -= [256, poff].min
eidx = rand(block[1] - (poff + payload.length + 256)) + poff + payload.length
Comment on lines +331 to +332
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These two lines are the real fix for the boundary issues.

end

# Relative jump from the end of the nops to the payload
Expand Down