library/src/exploitation/Utilities/PHP/GadgetGenerators/BP-PHPGadgetGenerators.cc
// The gadget preprocessor generates runtime substitutions based on the
// defined argument configuration of the gadget supplied.  This includes
// creating random elements as necessary.
The gadget preprocessor generates runtime substitutions based on the
defined argument configuration of the gadget supplied.  This includes
creating random elements as necessary.
The gadget preprocessor generates runtime substitutions based on the defined argument configuration of the gadget supplied . This includes creating random elements as necessary .
BP_ERROR_T BP_PHPGadgetPreprocessor(P_BP_PHP_GADGET gadget)
{
	if(!gadget)
		return ERR_FAILURE;
	if(!gadget->runtime_tq)
	{
		gadget->runtime_tq = BP_CreateLinkL("PHP Gadget Runtime Allocator", BP_TRUE);
	}
	char ** find_strs     = NULL;
	size_t find_strs_n    = 0;
	char ** replace_strs  = NULL;
	size_t replace_strs_n = 0;
	P_BP_LINKL tmp_tq = BP_CreateLinkL("tmp", BP_TRUE);
	char * encoded_argument = NULL;
	uint64_t uint64_data = 0;
	uint32_t uint32_data = 0;
	uint16_t uint16_data = 0;
	uint8_t  uint8_data  = 0;
	int64_t int64_data = 0;
	int32_t int32_data = 0;
	int16_t int16_data = 0;
	int8_t  int8_data  = 0;
	size_t n = 0;
	for(; n < gadget->arguments_n; n++)
	{
		switch(gadget->arguments[n].type)
		{
			case BP_GADGET_ARG_TYPE_CHAR_STRING:
			case BP_GADGET_ARG_TYPE_UCHAR_STRING:
				encoded_argument = BP_GenPHPGadgetEncodeBufferAsRandomEncode(gadget->arguments[n].arg, gadget->arguments[n].size, NULL);
				break;
			case BP_GADGET_ARG_TYPE_UINT64:
				if(gadget->arguments[n].size != sizeof(uint64_t))
					break;
				uint64_data = (uint64_t) *gadget->arguments[n].arg;
				encoded_argument = BP_UInt64ToASCII(uint64_data, BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION);
				break;
			case BP_GADGET_ARG_TYPE_UINT32:
				uint32_data = (uint32_t) *gadget->arguments[n].arg;
				encoded_argument = BP_UInt32ToASCII(uint32_data, BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION);
				break;
			case BP_GADGET_ARG_TYPE_UINT16:
				uint16_data = (uint16_t) *gadget->arguments[n].arg;
				encoded_argument = BP_UInt16ToASCII(uint16_data, BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION);
				break;
			case BP_GADGET_ARG_TYPE_UINT8:
				uint8_data = (uint8_t) *gadget->arguments[n].arg;
				encoded_argument = BP_UInt8ToASCII(uint8_data, BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION);
				break;
			case BP_GADGET_ARG_TYPE_INT64:
				int64_data = (int64_t) *gadget->arguments[n].arg;
				encoded_argument = BP_Int64ToASCII(int64_data, BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION);
				break;
			case BP_GADGET_ARG_TYPE_INT32:
				int64_data = (int32_t) *gadget->arguments[n].arg;
				encoded_argument = BP_Int32ToASCII(int32_data, BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION);
				break;
			case BP_GADGET_ARG_TYPE_INT16:
				int16_data = (int16_t) *gadget->arguments[n].arg;
				encoded_argument = BP_Int16ToASCII(int16_data, BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION);
				break;
			case BP_GADGET_ARG_TYPE_INT8:
				int8_data = (int8_t) *gadget->arguments[n].arg;
				encoded_argument = BP_Int8ToASCII(int8_data, BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION);
				break;
			default:
				break;
		}
		if(!encoded_argument)
			return ERR_FAILURE;
		BP_ArrayPushDupStringTQ(tmp_tq, gadget->arguments[n].arg_php_symbol, &find_strs,  &find_strs_n);
		BP_ArrayPushDupStringTQ(tmp_tq, encoded_argument, &replace_strs,  &replace_strs_n);
		bpfree(encoded_argument);
		encoded_argument = NULL;
	}
	char * sub_template = BP_GenerateSubstitutedTemplate(gadget->gadget_fmt, find_strs, replace_strs);
	printf("\n template: %s", sub_template);
	gadget->prepared_gadget = sub_template;
	tq_link(gadget->runtime_tq, gadget->prepared_gadget, bpstrlen(gadget->prepared_gadget), BPLN);
	BP_DestroyLinkL(tmp_tq, BP_TRUE);
	return ERR_SUCCESS;
}
BP_ERROR_T BP_PHPGadgetPreprocessor ( P_BP_PHP_GADGET gadget ) { if ( ! gadget ) return ERR_FAILURE ; if ( ! gadget -> runtime_tq ) { gadget -> runtime_tq = BP_CreateLinkL ( " " , BP_TRUE ) ; } char * * find_strs = NULL ; size_t find_strs_n = 0 ; char * * replace_strs = NULL ; size_t replace_strs_n = 0 ; P_BP_LINKL tmp_tq = BP_CreateLinkL ( " " , BP_TRUE ) ; char * encoded_argument = NULL ; uint64_t uint64_data = 0 ; uint32_t uint32_data = 0 ; uint16_t uint16_data = 0 ; uint8_t uint8_data = 0 ; int64_t int64_data = 0 ; int32_t int32_data = 0 ; int16_t int16_data = 0 ; int8_t int8_data = 0 ; size_t n = 0 ; for ( ; n < gadget -> arguments_n ; n ++ ) { switch ( gadget -> arguments [ n ] . type ) { case BP_GADGET_ARG_TYPE_CHAR_STRING : case BP_GADGET_ARG_TYPE_UCHAR_STRING : encoded_argument = BP_GenPHPGadgetEncodeBufferAsRandomEncode ( gadget -> arguments [ n ] . arg , gadget -> arguments [ n ] . size , NULL ) ; break ; case BP_GADGET_ARG_TYPE_UINT64 : if ( gadget -> arguments [ n ] . size != sizeof ( uint64_t ) ) break ; uint64_data = ( uint64_t ) * gadget -> arguments [ n ] . arg ; encoded_argument = BP_UInt64ToASCII ( uint64_data , BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION ) ; break ; case BP_GADGET_ARG_TYPE_UINT32 : uint32_data = ( uint32_t ) * gadget -> arguments [ n ] . arg ; encoded_argument = BP_UInt32ToASCII ( uint32_data , BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION ) ; break ; case BP_GADGET_ARG_TYPE_UINT16 : uint16_data = ( uint16_t ) * gadget -> arguments [ n ] . arg ; encoded_argument = BP_UInt16ToASCII ( uint16_data , BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION ) ; break ; case BP_GADGET_ARG_TYPE_UINT8 : uint8_data = ( uint8_t ) * gadget -> arguments [ n ] . arg ; encoded_argument = BP_UInt8ToASCII ( uint8_data , BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION ) ; break ; case BP_GADGET_ARG_TYPE_INT64 : int64_data = ( int64_t ) * gadget -> arguments [ n ] . arg ; encoded_argument = BP_Int64ToASCII ( int64_data , BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION ) ; break ; case BP_GADGET_ARG_TYPE_INT32 : int64_data = ( int32_t ) * gadget -> arguments [ n ] . arg ; encoded_argument = BP_Int32ToASCII ( int32_data , BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION ) ; break ; case BP_GADGET_ARG_TYPE_INT16 : int16_data = ( int16_t ) * gadget -> arguments [ n ] . arg ; encoded_argument = BP_Int16ToASCII ( int16_data , BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION ) ; break ; case BP_GADGET_ARG_TYPE_INT8 : int8_data = ( int8_t ) * gadget -> arguments [ n ] . arg ; encoded_argument = BP_Int8ToASCII ( int8_data , BP_NUMERIC_STRING_CONVERSIONS_RANDOM_STANDARD_OR_0xHEX_CONVERSION ) ; break ; default : break ; } if ( ! encoded_argument ) return ERR_FAILURE ; BP_ArrayPushDupStringTQ ( tmp_tq , gadget -> arguments [ n ] . arg_php_symbol , & find_strs , & find_strs_n ) ; BP_ArrayPushDupStringTQ ( tmp_tq , encoded_argument , & replace_strs , & replace_strs_n ) ; bpfree ( encoded_argument ) ; encoded_argument = NULL ; } char * sub_template = BP_GenerateSubstitutedTemplate ( gadget -> gadget_fmt , find_strs , replace_strs ) ; printf ( " \n " , sub_template ) ; gadget -> prepared_gadget = sub_template ; tq_link ( gadget -> runtime_tq , gadget -> prepared_gadget , bpstrlen ( gadget -> prepared_gadget ) , BPLN ) ; BP_DestroyLinkL ( tmp_tq , BP_TRUE ) ; return ERR_SUCCESS ; }
The gadget preprocessor generates runtime substitutions based on the
defined argument configuration of the gadget supplied.
The gadget preprocessor generates runtime substitutions based on the defined argument configuration of the gadget supplied .
// ensure we have a gadget // ensure gadget has a tail queue allocator // find and replace strings // set the replace strings // create link list // set encoded argument value // types for unsigned values // types for signed values // walk the arguments and generate substitution strings // encode char/uchars the same // ensure the parameter is the correct size // set the uint64 data from the buffer // set the uint32 data from the buffer // set the uint32 data from the buffer // set the uint8 data from the buffer // set the int64 data from the buffer // set the int32 data from the buffer // set the int32 data from the buffer // set the int32 data from the buffer // default means we have a bad or unmatched type // BP_GenHexStringFromBuffer() // ensure that we have created an encoded argument // add symbol as find string (updates via reference_ // add encoded argument as replacement string (updates via reference) // destroy the argument and nullify on loop // run substitutions // set the prepared gadget // link in the substituted template // destroy the temporary linkl // perform substitutions // gadget->gadget_fmt // return indicating success