Ronin Exploits is a Ruby library for Ronin that provides exploitation and payload crafting functionality.

Ronin is a Ruby platform for exploit development and security research. Ronin allows for the rapid development and distribution of code, exploits or payloads over many common Source-Code-Management (SCM) systems.

Ruby

Extend

Publish

• Ability to define payloads based on:
  • Contributing authors.
  • Behaviors they control.
  • Helpers they use.
• Ability to define payload encoders:
  • Architectures they target.
  • OSes they target.
• Ability to define exploits based on:
  • Wether they are local or remote.
  • Protocol they use.
  • Contributing authors.
  • Disclosure status.
  • Level of weaponization.
  • Behaviors the vulnerability allows.
  • Architectures they target.
  • OSes they target.
  • Products they target.
  • Helpers they use.
• Provides a simple three phase process of building, verifying and deploying Exploits and Payloads.
• Allows adding arbitrary target data to the targets of Exploits.
• Allows combining Payloads with Exploits.
• Allows using a raw-payload with an Exploit.
• Allows the addition of multiple Payload Encoders to an Exploit.
• Allows chaining multiple Payloads together.
• Provides a multitude of exploit and payload generators which can create customized skeleton Ruby Exploits and Payloads.

• Generate a skeleton exploit, with some custom information:

  $ ronin-gen exploit exploit.rb --name Example \
                                 --controls command_exec \
                                 --status proven \
                                 --authors Postmodern \
                                 --description "This is an example."

  To generate other types of exploits, you can specify local_exploit, remote_exploit, remote_tcp_exploit, remote_udp_exploit, ftp_exploit, http_exploit, web_exploit instead of simply exploit.

• Generate a skeleton payload, with some custom information:

  ronin-gen payload payload.rb --name Example \
                               --controls file_read file_write \
                               --authors Postmodern \
                               --description "This is an example."

  To generate other types of payloads, you can specify binary_payload, shellcode or nops, instead of simply payload.

• List available payloads:

  $ ronin-payloads

• Print information about a payload:

  $ ronin-payloads -n NAME -v

• Build and output a payload:

  $ ronin-payload NAME

• Build and output a raw unescaped payload:

  $ ronin-payload NAME --raw

• Load a payload from a file, then build and output it:

  $ ronin-payload -f FILE

• List available exploits:

  $ ronin-exploits

• Print information about an exploit:

  $ ronin-exploits -n NAME -v

• Build and deploy an exploit:

  $ ronin-exploit -n NAME --host example.com --port 9999

• Load an exploit from a file, then build and deploy it:

  $ ronin-exploit -f FILE --host example.com --port 9999

• Build and deploy an exploit, with a payload:

  $ ronin-exploit -n NAME --host example.com --port 9999 -P PAYLOAD_NAME

• Build and deploy an exploit, with a raw payload:

  $ ronin-exploit -n NAME --host example.com --port 9999 \
                  --raw-payload \
                  `echo -en "\x66\x31\xc0\xfe\xc0\xb3\xff\xcd\x80"`

• Ronin >= 0.3.0

$ sudo gem install ronin-exploits

• Define a shellcode payload:

  ronin_shellcode do
    #
    # Cacheable data.
    #
    cache do
      self.name = 'test'
      self.version = '0.5'
      self.description = %{This is an example shellcode payload.}
  
      author(:name => 'Postmodern', :organization => 'SophSec')
  
      self.arch :i686
      self.os :name => 'Linux'
    end
  
    #
    # Configurable parameters.
    #
    parameter :exit_status,
              :default => 0,
              :description => 'Exit status of shellcode'
  
    #
    # Builds the assembly payload, which will call the SYS_EXIT
    # syscall with the exit_status of the shellcode.
    #
    def build
      @payload = "\x66\x31\xc0\xfe\xc0"
  
      unless @exit_status == 0
        @payload << "\xb3#{@exit_status.chr}\xcd\x80"
      else
        @payload << "\x66\x31\xdb\xcd\x80"
      end
    end
  end

• Define a payload encoder:

  ronin_payload_encoder do
    #
    # Cacheable data.
    #
    cache do
      self.name = 'base64_encode'
      self.description = %{Example base64 payload encoder}
  
      self.arch :i686
      self.os :name => 'Linux'
    end
  
    #
    # Base64 encodes the specified _data_.
    #
    def encode(data)
      return data.to_s.base64_encode
    end
  end

• Define a remote TCP exploit:

  ronin_remote_tcp_exploit do
    helper :buffer_overflow
  
    #
    # Cacheable data.
    #
    cache do
      self.name = 'test'
      self.description = %{This is an example exploit.}
  
      self.status = :potential
      self.disclosure = [:in_wild, :public]
  
      author(:name => 'Postmodern', :organization => 'SophSec')
  
      control :code_exec
  
      targeting do |target|
        target.arch :i686
        target.os :name => 'Linux'
        target.product :name => 'ExampleWare', :version => '2.4.7b'
      end
    end
  
    #
    # Builds the exploit.
    #
    def build
      @buffer = "USER #{build_buffer}\n"
    end
  
    #
    # Deploys the built exploit.
    #
    def deploy
      tcp_send @buffer
    end
  end

• API Documentation
• Source Code
• Issue Tracker