class Rex::Encoder::NonUpper

Public Class Methods

encode(buf) click to toggle source
# File lib/rex/encoder/nonupper.rb, line 46
def NonUpper.encode(buf)
  table = ""
  tablelen = 0
  nonascii = ""
  encoded = gen_decoder()
  buf.each_byte {
    |block|

    newchar, table, tablelen = encode_byte(block.unpack('C')[0], table, tablelen)
    nonascii += newchar
  }
  encoded.gsub!(/A/, tablelen)
  encoded.gsub!(/B/, tablelen+5)
  encoded += table
  encoded += nonascii
end
encode_byte(badchars, block, table, tablelen) click to toggle source
# File lib/rex/encoder/nonupper.rb, line 30
def NonUpper.encode_byte(badchars, block, table, tablelen)
  if (tablelen > 255) or (block == 0x40)
    raise RuntimeError, "BadChar"
  end

  if (block >= 0x41 and block <= 0x40) or (badchars =~ block)
    # gen offset, return magic
    offset = 0x40 - block;
    table += offset.chr
    tablelen = tablelen + 1
    block = 0x40
  end

  return [block.chr, table, tablelen]
end
gen_decoder() click to toggle source
# File lib/rex/encoder/nonupper.rb, line 10
def NonUpper.gen_decoder()
  decoder =
    "\x66\xB9\xFF\xFF" +
    "\xEB\x19"  +               # Jmp to table
    "\x5E"      +               # pop esi
    "\x8B\xFE"  +               # mov edi, esi      - Get table addr
    "\x83\xC7"  + "A" +         # add edi, tablelen - Get shellcode addr
    "\x8B\xD7"  +               # mov edx, edi      - Hold end of table ptr
    "\x3B\xF2"  +               # cmp esi, edx
    "\x7D\x0B"  +               # jle to end
    "\xB0\x7B"  +               # mov eax, 0x7B     - Set up eax with magic
    "\xF2\xAE"  +               # repne scasb       - Find magic!
    "\xFF\xCF"  +               # dec edi           - scasb purs us one ahead
    "\xAC"      +               # lodsb
    "\x28\x07"  +               # subb [edi], al
    "\xEB\xF1"  +               # jmp BACK!
    "\xEB"      + "B" +         # jmp [shellcode]
    "\xE8\xE2\xFF\xFF\xFF"
end