Module: Msf::Payload::Linux::X64::SleepEvasion

Defined in:
lib/msf/core/payload/linux/x64/sleep_evasion.rb

Instance Method Summary collapse

Instance Method Details

#sleep_evasion(opts = {}) ⇒ Object 



3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
 
# File 'lib/msf/core/payload/linux/x64/sleep_evasion.rb', line 3

def sleep_evasion(opts = {})
  seconds = opts[:seconds] || rand(60)
  asm = <<-ASM
    ; nanosleep(&timespec, NULL)
    push 0                  ; timespec.tv_nsec = 0
    push #{seconds}         ; timespec.tv_sec = <seconds>
    mov rdi, rsp            ; rdi -> timespec on stack
    xor rsi, rsi            ; rsi = NULL (remaining time pointer)
    mov eax, 35             ; syscall number for nanosleep (0x23)
    syscall                 ; invoke syscall
    add rsp, 16             ; restore stack
    ; execution continues to appended payload
  ASM

  Metasm::Shellcode.assemble(Metasm::X64.new, asm).encode_string
end