diff --git a/nselib/data/psexec/encoder.c b/nselib/data/psexec/encoder.c new file mode 100644 index 000000000..05fdb4143 --- /dev/null +++ b/nselib/data/psexec/encoder.c @@ -0,0 +1,30 @@ +/* encoder.c + * By Ron Bowes + * Created January 23, 2010 + * + * This program encodes (or decodes) a .exe file (or any other kind of file) + * to be uploaded by smb-psexec.nse. This will prevent antivirus on the + * scanner from picking up the file, but not on the target. That's probably + * best. + */ + +#include +#include + +int main(int argc, char *argv[]) +{ + int ch; + + /* Check the argument. */ + if(argc != 1) + { + fprintf(stderr, "Usage: %s < infile > outfile\n", argv[0]); + return 1; + } + + /* Retrieve + encode each character till we're done. */ + while((ch = getchar()) != EOF) + printf("%c", ch ^ 0xFF); + + return 0; +} diff --git a/nselib/data/psexec/nmap_service.exe b/nselib/data/psexec/nmap_service.exe index 7b4ac3102..ea8ce8845 100644 Binary files a/nselib/data/psexec/nmap_service.exe and b/nselib/data/psexec/nmap_service.exe differ diff --git a/nselib/smb.lua b/nselib/smb.lua index 83b9c9e65..f08dc56cd 100644 --- a/nselib/smb.lua +++ b/nselib/smb.lua @@ -2175,8 +2175,10 @@ end --@param share The share to upload it to (eg, C$). --@param remotefile The remote file on the machine. It is relative to the share's root. --@param overrides A table of override values that's passed to the smb functions. +--@param encoded Set to 'true' if the file is encoded (xor'ed with 0xFF), It will be decoded before upload. Default: false --@return (status, err) If status is false, err is an error message. Otherwise, err is undefined. -function file_upload(host, localfile, share, remotefile, overrides) +require 'nsedebug' +function file_upload(host, localfile, share, remotefile, overrides, encoded) local status, err, smbstate local chunk = 1024 @@ -2196,6 +2198,14 @@ function file_upload(host, localfile, share, remotefile, overrides) local i = 0 while(data ~= nil and #data > 0) do + + if(encoded) then + local new_data = "" + for j = 1, #data, 1 do + new_data = new_data .. string.char(bit.bxor(0xFF, string.byte(data, j))) + end + data = new_data + end status, err = smb.write_file(smbstate, data, i) if(status == false) then diff --git a/scripts/smb-psexec.nse b/scripts/smb-psexec.nse index 752357a8a..7ea5db5d2 100644 --- a/scripts/smb-psexec.nse +++ b/scripts/smb-psexec.nse @@ -943,7 +943,7 @@ local function upload_everything(host, config) -- Upload the service file stdnse.print_debug(1, "smb-psexec: Uploading: nselib/data/psexec/nmap_service.exe => \\\\%s\\%s", config.share, config.service_file) - status, err = smb.file_upload(host, "nselib/data/psexec/nmap_service.exe", config.share, "\\" .. config.service_file, overrides) + status, err = smb.file_upload(host, "nselib/data/psexec/nmap_service.exe", config.share, "\\" .. config.service_file, overrides, true) if(status == false) then cleanup(host, config) return false, string.format("Couldn't upload the service file: %s\n", err)