Skip to content

Commit

Permalink
Use smallest stager size
Browse files Browse the repository at this point in the history
Since these stagers can shrink based on the expected size of the next
stage, do our best to anticipate a small size. This makes the cached
payload size consistent for now, though if the x64 mettle stager grows
past 128 bytes I think we'll see the stager start oscillating in size
again. If you run into that and are reading this, sorry :(
  • Loading branch information
acammack-r7 committed Sep 4, 2019
1 parent 4d89dd8 commit 2ee5ec9
Show file tree
Hide file tree
Showing 3 changed files with 7 additions and 1 deletion.
2 changes: 2 additions & 0 deletions lib/msf/core/payload/linux/reverse_tcp.rb
Expand Up @@ -94,6 +94,8 @@ def asm_reverse_tcp(opts={})
if respond_to?(:generate_intermediate_stage)
pay_mod = framework.payloads.create(self.refname)
read_length = pay_mod.generate_intermediate_stage(pay_mod.generate_stage(datastore.to_h)).size
elsif !module_info['Stage']['Payload'].empty?
read_length = module_info['Stage']['Payload'].size
else
# If we don't know, at least use small instructions
read_length = 0x0c00 + mprotect_flags
Expand Down
4 changes: 4 additions & 0 deletions lib/msf/core/payload/linux/x64/reverse_tcp.rb
Expand Up @@ -88,12 +88,16 @@ def asm_reverse_tcp(opts={})
seconds = (opts[:sleep_seconds] || 5.0)
sleep_seconds = seconds.to_i
sleep_nanoseconds = (seconds % 1 * 1000000000).to_i

if respond_to?(:generate_intermediate_stage)
pay_mod = framework.payloads.create(self.refname)
read_length = pay_mod.generate_intermediate_stage(pay_mod.generate_stage(datastore.to_h)).size
elsif !module_info['Stage']['Payload'].empty?
read_length = module_info['Stage']['Payload'].size
else
read_length = 4096
end

asm = %Q^
mmap:
xor rdi, rdi
Expand Down
2 changes: 1 addition & 1 deletion modules/payloads/stagers/linux/x64/reverse_tcp.rb
Expand Up @@ -8,7 +8,7 @@

module MetasploitModule

CachedSize = 133
CachedSize = 130

include Msf::Payload::Stager
include Msf::Payload::Linux::ReverseTcp_x64
Expand Down

0 comments on commit 2ee5ec9

Please sign in to comment.