Merge pull request rapid7#790 from xHector1337/add-extension-encryption

Extension Encryption For Meterpreter: Add RC4 Dependency

Author: dledda-r7

c/meterpreter/source/common/common_core.h

@@ -85,6 +85,13 @@ typedef enum
  */
 #define LOAD_LIBRARY_FLAG_LOCAL     (1 << 2)
 
+ /*!
+  * @brief Indicates that the library in question supports runtime encryption.
+  * @detail Libraries can be encrypted runtime, depending on how they interact with the system
+  *         if this flag is present, it means this library support the runtime encryption.
+  */
+#define LOAD_LIBRARY_EXTENSION_ENCRYPTABLE (1 << 3)
+
 /*! @brief An indication of whether the challen is synchronous or asynchronous. */
 #define CHANNEL_FLAG_SYNCHRONOUS    (1 << 0)
 /*! @brief An indication of whether the content written to the channel should be compressed. */

c/meterpreter/source/metsrv/rc4.c

@@ -0,0 +1,48 @@
+#include "rc4.h"
+
+BOOL InitRc4(RC4_CTX* Context, unsigned char* Key, size_t len) {
+	unsigned char T = 0;
+	unsigned int j = 0;
+
+	if (Context == NULL || Key == NULL || len == 0) {
+		return FALSE;
+	}
+
+	memset(Context, 0x00, sizeof(RC4_CTX));
+
+	for (unsigned int i = 0; i < 256; i++) {
+		Context->s[i] = i;
+	}
+
+	for (unsigned int i = 0; i < 256; i++) {
+		j = (j + Context->s[i] + Key[i % len]) % 256;
+		T = Context->s[i];
+		Context->s[i] = Context->s[j];
+		Context->s[j] = T;
+	}
+
+	Context->i = 0;
+	Context->j = 0;
+
+	return TRUE;
+}
+
+BOOL RC4Cipher(RC4_CTX* Context, unsigned char* buf, size_t len) {
+	unsigned char T = 0;
+	unsigned int i = Context->i;
+	unsigned int j = Context->j;
+
+	for (unsigned int k = 0; k < len;k++) {
+		i = (i+1) % 256;
+		j = (j + Context->s[i]) % 256;
+		T = Context->s[i];
+		Context->s[i] = Context->s[j];
+		Context->s[j] = T;
+		buf[k] ^= Context->s[(Context->s[i] + Context->s[j]) % 256];
+	}
+
+	Context->i = i;
+	Context->j = j;
+
+	return TRUE;
+}

c/meterpreter/source/metsrv/rc4.h

@@ -0,0 +1,10 @@
+#include <windows.h>
+
+typedef struct {
+	unsigned int i, j;
+	unsigned char s[256];
+} RC4_CTX;
+
+BOOL InitRc4(RC4_CTX* Context, unsigned char* Key, size_t len);
+BOOL RC4Cipher(RC4_CTX* Context, unsigned char* buf, size_t len);
+

c/meterpreter/source/metsrv/remote_dispatch.c

@@ -423,6 +423,9 @@ DWORD request_core_loadlib(Remote *remote, Packet *packet)
 		if ((flags & LOAD_LIBRARY_FLAG_EXTENSION) && library)
 		{
 			res = load_extension(library, bLibLoadedReflectivly, remote, response, first);
+			if (flags & LOAD_LIBRARY_EXTENSION_ENCRYPTABLE) {
+				dprintf("[DEBUG] This extension can be encrypted!");
+			}
 		}
 
 	} while (0);

c/meterpreter/workspace/metsrv/metsrv.vcxproj

@@ -570,6 +570,7 @@ copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\"</Command>
     <ClInclude Include="..\..\source\metsrv\pool_party.h" />
     <ClInclude Include="..\..\source\metsrv\pool_party_ext.h" />
     <ClInclude Include="..\..\source\metsrv\winapi.h" />
+    <ClInclude Include="..\..\source\metsrv\rc4.h" />
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="..\..\source\metsrv\base.c" />
@@ -601,6 +602,7 @@ copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\"</Command>
     <ClCompile Include="..\..\source\logging\logging.c" />
     <ClCompile Include="..\..\source\metsrv\pool_party.c" />
     <ClCompile Include="..\..\source\metsrv\winapi.c" />
+    <ClCompile Include="..\..\source\metsrv\rc4.c" />
   </ItemGroup>
   <ItemGroup>
     <MASM Include="..\..\source\ReflectiveDLLInjection\dll\src\GateTrampoline32.asm">
@@ -618,4 +620,4 @@ copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\"</Command>
   <ImportGroup Label="ExtensionTargets">
     <Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
   </ImportGroup>
-</Project>
+</Project>

c/meterpreter/workspace/metsrv/metsrv.vcxproj.filters

@@ -27,6 +27,8 @@
     <ClInclude Include="..\..\source\metsrv\metapi.h" />
     <ClInclude Include="..\..\source\metsrv\pool_party.h" />
     <ClInclude Include="..\..\source\metsrv\pool_party_ext.h" />
+    <ClInclude Include="..\..\source\metsrv\winapi.h" />
+    <ClInclude Include="..\..\source\metsrv\rc4.h" />
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="..\..\source\metsrv\pivot_tree.c" />
@@ -57,9 +59,11 @@
     <ClCompile Include="..\..\source\metsrv\metapi.c" />
     <ClCompile Include="..\..\source\logging\logging.c" />
     <ClCompile Include="..\..\source\metsrv\pool_party.c" />
+    <ClCompile Include="..\..\source\metsrv\winapi.c" />
+    <ClCompile Include="..\..\source\metsrv\rc4.c" />
   </ItemGroup>
   <ItemGroup>
     <MASM Include="..\..\source\ReflectiveDLLInjection\dll\src\GateTrampoline64.asm" />
     <MASM Include="..\..\source\ReflectiveDLLInjection\dll\src\GateTrampoline32.asm" />
   </ItemGroup>
-</Project>
+</Project>