Ticket #199: base64.patch

modules/encoders/php/base64.rb

@@ +1 @@
+##
+# $Id: $
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to 
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/projects/Framework/
+##
+
+
+require 'msf/core'
+
+module Msf
+module Encoders
+module Php
+
+class Base64 < Msf::Encoder
+
+        def initialize
+                super(
+                        'Name'             => 'PHP code Base64 encoder',
+                        'Version'          => '$Revision: $',
+                        'Description'      => %q{
+                                This encoder returns a base64 string encapsulated in
+                                eval(base64_decode()), increasing the size by roughly one
+                                third.
+                        },
+                        'Author'           => 'egypt <egypt@nmt.edu>',
+                        'License'          => BSD_LICENSE,
+                        'Arch'             => ARCH_PHP)
+        end
+
+        def encode_block(state, buf)
+                # Try not to insert quotes as PHP escapes these by default with
+                # magic_quotes_gpc.  The '==' at the end of the base64 encoded data is
+                # unnecessary and can cause parse errors when we use it as a raw
+                # string, so strip it off.
+                #
+                # The raw, unquoted base64 without the terminating equals works because
+                # PHP treats it like a string, with a couple of caveats.  For payloads
+                # that encode to more than 998 characters, only part of the payload
+                # gets unencoded on the victim, presumably due to a limitation in php
+                # identifier names, so we break the encoded payload into 900-byte
+                # chunks. We also must be careful not to begin a chunk with a digit
+                # because then PHP thinks it's a number and chokes.
+
+                b64 = Rex::Text.encode_base64(buf)
+                b64.gsub!(/[=\n]+/, '')
+                block = ''
+                i = 900;
+                while i < b64.length
+                        while (b64[i].chr =~ /^[0-9]/)
+                                i += 1
+                        end
+                        b64.insert(i,'.')
+                        i += 900
+                end
+                block = "eval(base64_decode(" + b64 + "));"
+                return block
+        end
+
+end
+
+end end end