Module: Msf::Payload::Windows::Exitfunk_Aarch64

Includes:
Aarch64
Included in:
ReverseTcp_Aarch64
Defined in:
lib/msf/core/payload/windows/exitfunk_aarch64.rb

Overview

Exit routines for Windows ARCH_AArch64 payloads.

Mirrors Msf::Payload::Windows::Exitfunk_x64: process/thread/none call a kernel32 exit API resolved by ROR-13 hash; seh clears the unhandled exception filter then branches to NULL for a predictable crash.

Instance Method Summary collapse

Methods included from Aarch64

#asm_block_api_aarch64, #compile_aarch64, #ror13_hash, #without_inline_comments

Instance Method Details

#asm_exitfunk_aarch64(opts = {}) ⇒ String

AArch64 assembly for the exitfunk label.

Expects kernel32 base at [x29, #0x00] and &find_function at [x29, #0x08] (same slot table as the Windows AArch64 payloads).

Parameters:

  • opts (Hash) (defaults to: {}) —

    a customizable set of options

Options Hash (opts):

  • :exitfunk (String) —

    One of process, thread, none, seh

Returns:

  • (String) —

    assembly including the exitfunk: label



47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
 
# File 'lib/msf/core/payload/windows/exitfunk_aarch64.rb', line 47

def asm_exitfunk_aarch64(opts = {})
  exitfunk = opts[:exitfunk].to_s.downcase
  hash = exitfunk_hash(exitfunk)
  exit_lo = hash & 0xFFFF
  exit_hi = (hash >> 16) & 0xFFFF

  if exitfunk == 'seh'
    <<~ASM
      exitfunk:
        ldr     x3, [x29, #0x00]
        movz    w0, ##{format('0x%04x', exit_lo)}
        movk    w0, ##{format('0x%04x', exit_hi)}, lsl #16
        ldr     x9, [x29, #0x08]
        blr     x9
        mov     x10, x0
        mov     x0, xzr
        blr     x10
        br      xzr
    ASM
  else
    <<~ASM
      exitfunk:
        ldr     x3, [x29, #0x00]
        movz    w0, ##{format('0x%04x', exit_lo)}
        movk    w0, ##{format('0x%04x', exit_hi)}, lsl #16
        ldr     x9, [x29, #0x08]
        blr     x9
        mov     x10, x0
        movn    x0, #0
        mov     w1, wzr
        blr     x10
        brk     #0
    ASM
  end
end

#exitfunk_hash(value) ⇒ Integer

ROR-13 hash of the kernel32 API used for the given EXITFUNC value. For seh this is SetUnhandledExceptionFilter (the call sequence is built by #asm_exitfunk_aarch64, not the generic exit-API stub).

Parameters:

  • value (String, nil) —

    EXITFUNC datastore value

Returns:

  • (Integer) 


22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
 
# File 'lib/msf/core/payload/windows/exitfunk_aarch64.rb', line 22

def exitfunk_hash(value)
  case value.to_s.downcase
  when 'thread'
    ror13_hash('ExitThread')
  when 'seh'
    ror13_hash('SetUnhandledExceptionFilter')
  when 'none'
    # Still need a real call so execution does not fall into garbage.
    ror13_hash('ExitProcess')
  when 'process', ''
    0x78b5b983 # TerminateProcess
  else
    0x78b5b983
  end
end