diff --git a/README.md b/README.md index d19bf51c..426a2bb7 100644 --- a/README.md +++ b/README.md @@ -208,6 +208,7 @@ $ ronin-payloads encoders js/hex_encode js/node/base64_encode perl/base64_encode + perl/hex_encode php/base64_encode php/hex_encode powershell/hex_encode diff --git a/lib/ronin/payloads/encoders/builtin/perl/hex_encode.rb b/lib/ronin/payloads/encoders/builtin/perl/hex_encode.rb new file mode 100644 index 00000000..7fccbd21 --- /dev/null +++ b/lib/ronin/payloads/encoders/builtin/perl/hex_encode.rb @@ -0,0 +1,71 @@ +# frozen_string_literal: true +# +# ronin-payloads - A Ruby micro-framework for writing and running exploit +# payloads. +# +# Copyright (c) 2007-2024 Hal Brodigan (postmodern.mod3 at gmail.com) +# +# ronin-payloads is free software: you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published +# by the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# ronin-payloads is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with ronin-payloads. If not, see . +# + +require 'ronin/payloads/encoders/perl_encoder' +require 'ronin/support/encoding/hex' + +module Ronin + module Payloads + module Encoders + module Perl + # + # A Perl encoder that encodes the given Perl code as an hex string, + # then decodes it using `pack("H*","...")`, and then evaluates the + # decoded Perl code using `eval()`. + # + # print "PWNED\n" -> eval(pack("H*","7072696e74202250574e45445c6e22")) + # + # @since 0.3.0 + # + class HexEncode < PerlEncoder + + register 'perl/hex_encode' + + summary 'Encodes Perl as a hex string' + + description <<~DESC + Encodes the given Perl code as an hex string, then decodes it + using `binascii.unhexlify()`, and then evaluates the decoded Perl + code using `eval()`. + + print "PWNED\\n" -> eval(pack("H*","7072696e74202250574e45445c6e22")) + + DESC + + # + # Encodes the given Perl code. + # + # @param [String] perl + # The Perl code to encode. + # + # @return [String] + # + def encode(perl) + hex = Support::Encoding::Hex.encode(perl) + + %{eval(pack("H*","#{hex}"))} + end + + end + end + end + end +end diff --git a/spec/encoders/builtin/perl/hex_encode_spec.rb b/spec/encoders/builtin/perl/hex_encode_spec.rb new file mode 100644 index 00000000..429db880 --- /dev/null +++ b/spec/encoders/builtin/perl/hex_encode_spec.rb @@ -0,0 +1,17 @@ +require 'spec_helper' +require 'ronin/payloads/encoders/builtin/perl/hex_encode' + +describe Ronin::Payloads::Encoders::Perl::HexEncode do + it "must inherit from Ronin::Payloads::Encoders::PerlEncoder" do + expect(described_class).to be < Ronin::Payloads::Encoders::PerlEncoder + end + + describe "#encode" do + let(:perl) { 'print "PWNED\n"' } + let(:encoded) { %{eval(pack("H*","7072696e74202250574e45445c6e22"))} } + + it "must encode the given Perl code as a hex string and embed it into the 'eval(pack(\"H*\",\"...\"))' string" do + expect(subject.encode(perl)).to eq(encoded) + end + end +end