Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add MSFvenom support for Nim shellcode #16973

Merged
merged 2 commits into from
Sep 7, 2022
Merged

Add MSFvenom support for Nim shellcode #16973

merged 2 commits into from
Sep 7, 2022

Conversation

HuskyHacks
Copy link
Contributor

@HuskyHacks HuskyHacks commented Sep 2, 2022

This PR Requires the Nim shellcode format support PR from Rex-Text: rapid7/rex-text#55

Verification

List the steps needed to make sure this thing works

  • Start msfconsole
  • use windows/x64/exec
  • set cmd calc.exe
  • generate -f nim or generate -f nimlang
  • Verify Insert generated shellcode into a Nim shellcode runner (see Rex-Text PR)

msfconsole:
image

msfvenom
image

@HuskyHacks HuskyHacks changed the title working on nim shellcode generator Add MSFvenom support for Nim shellcode Sep 2, 2022
@smcintyre-r7 smcintyre-r7 self-assigned this Sep 2, 2022
@smcintyre-r7
Copy link
Contributor

Alright now that rex-text#55 has been landed. We just need this to bump the version of rex-text in the gem to 0.2.45.

The easiest way to do this is likely to:

  1. Rebase this branch against master to pull in the other gem changes (doing this first should reduce the chance of running into conflicts and ensure things go more smoothly)
  2. Bump rex-text to 0.2.45 (changes look like 66ac389)

Once that's done, I can go ahead and land this.

@smcintyre-r7
Copy link
Contributor

Handled the rebase, and version bump. With those changes in place everything looks good to me. Once the tests all pass, I'll get this landed. Thanks for your contribution.

Testing Output

msfconsole

msf6 exploit(windows/smb/ms08_067_netapi) > use payload/windows/x64/exec
msf6 payload(windows/x64/exec) > set CMD calc.exe
CMD => calc.exe
msf6 payload(windows/x64/exec) > generate -f nim
#[
windows/x64/exec - 276 bytes
https://metasploit.com/
VERBOSE=false, PrependMigrate=false, EXITFUNC=process, 
CMD=calc.exe
]#
var buf: array[276, byte] = [
byte 0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,
0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,
0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,0x8b,
0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,
0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,
0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,
0x8b,0x42,0x3c,0x48,0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,
0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,
0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,
0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,
0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,
0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,
0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,
0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,
0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,
0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,
0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,
0x48,0xba,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x8d,
0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,0x87,0xff,
0xd5,0xbb,0xf0,0xb5,0xa2,0x56,0x41,0xba,0xa6,0x95,0xbd,0x9d,
0xff,0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,
0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,
0x89,0xda,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,
0x00]
msf6 payload(windows/x64/exec) > exit

nim

[smcintyre@localhost nim-1.6.6]$ cat test55.nim 
import strutils

proc hexDump*[T](v: T): string =
  var s: seq[uint8] = @[]
  s.setLen(v.sizeof)
  copymem(addr(s[0]), v.unsafeAddr, v.sizeof)
  result = ""
  for i in s: result.add(i.toHex)

#[
windows/x64/exec - 276 bytes
https://metasploit.com/
VERBOSE=false, PrependMigrate=false, EXITFUNC=process, 
CMD=calc.exe
]#
var buf: array[276, byte] = [
byte 0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,
0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,
0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,0x8b,
0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,
0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,
0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,
0x8b,0x42,0x3c,0x48,0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,
0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,
0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,
0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,
0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,
0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,
0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,
0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,
0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,
0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,
0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,
0x48,0xba,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x8d,
0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,0x87,0xff,
0xd5,0xbb,0xf0,0xb5,0xa2,0x56,0x41,0xba,0xa6,0x95,0xbd,0x9d,
0xff,0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,
0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,
0x89,0xda,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,
0x00]


echo buf.hexDump
[smcintyre@localhost nim-1.6.6]$ bin/nim c -r --verbosity:0 test55.nim
FC4883E4F0E8C0000000415141505251564831D265488B5260488B5218488B5220488B7250480FB74A4A4D31C94831C0AC3C617C022C2041C1C90D4101C1E2ED524151488B52208B423C4801D08B80880000004885C074674801D0508B4818448B40204901D0E35648FFC9418B34884801D64D31C94831C0AC41C1C90D4101C138E075F14C034C24084539D175D858448B40244901D066418B0C48448B401C4901D0418B04884801D0415841585E595A41584159415A4883EC204152FFE05841595A488B12E957FFFFFF5D48BA0100000000000000488D8D0101000041BA318B6F87FFD5BBF0B5A25641BAA695BD9DFFD54883C4283C067C0A80FBE07505BB4713726F6A00594189DAFFD563616C632E65786500
[smcintyre@localhost nim-1.6.6]$

@HuskyHacks
Copy link
Contributor Author

Thanks again @smcintyre-r7 and the Rapid7 team!

@smcintyre-r7 smcintyre-r7 merged commit 11eef99 into rapid7:master Sep 7, 2022
@smcintyre-r7
Copy link
Contributor

Release Notes

This adds support for formatting buffers for nim.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants