Skip to content

MIPS Payload updates#21445

Open
dledda-r7 wants to merge 10 commits into
rapid7:masterfrom
dledda-r7:feat/payloads/mips-update
Open

MIPS Payload updates#21445
dledda-r7 wants to merge 10 commits into
rapid7:masterfrom
dledda-r7:feat/payloads/mips-update

Conversation

@dledda-r7
Copy link
Copy Markdown
Contributor

MIPS64 exec payload, mipsle and mipsbe exec payload update, and prepends for everybody.

@dledda-r7 dledda-r7 added the rn-payload-enhancement release notes for enhanced payloads label May 12, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates Metasploit’s Linux MIPS payload set by introducing a new linux/mips64/exec single payload, modernizing the existing mipsle/mipsbe exec payloads (including prepend support), and correcting MIPS64 ELF generation/template metadata to better match expected endianness and header values.

Changes:

  • Add a new linux/mips64/exec single payload and a corresponding cached-size spec.
  • Update mipsle/mipsbe exec payloads to support prepend stubs and to run /bin/sh when CMD is unset.
  • Enable Linux prepend stubs (set*uid) for MIPS LE/BE/MIPS64 and adjust MIPS64 ELF generation/template header values.

Impact Analysis:

  • Blast radius: medium; affects users generating Linux MIPS64 executables (EXE generation) and users selecting linux/mips{le,be,mips64}/exec payloads; downstream impact Unknown.
  • Data and contract effects: payload behavior changes when CMD is unset (now spawns /bin/sh for mipsle/mipsbe/mips64 exec); MIPS64 ELF template/header interpretation changes via endianness handling.
  • Rollback and test focus: rollback is straightforward (revert payload/template/util changes); focus testing on generated MIPS64 ELF validity/executability and verifying exec payload behavior for both empty CMD and non-empty CMD, with/without prepend options.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
spec/modules/payloads_spec.rb Adds cached-size consistency coverage for the new linux/mips64/exec payload.
modules/payloads/singles/linux/mipsle/exec.rb Updates MIPSLE exec payload to spawn /bin/sh when CMD is empty and adds prepend support.
modules/payloads/singles/linux/mipsbe/exec.rb Updates MIPSBE exec payload to spawn /bin/sh when CMD is empty and adds prepend support.
modules/payloads/singles/linux/mips64/exec.rb Introduces a new MIPS64 exec payload supporting /bin/sh and -c CMD forms with prepends.
lib/msf/util/exe/linux/mips64.rb Adjusts MIPS64 ELF generation to pass big-endian handling into the common ELF builder.
lib/msf/core/payload/linux/mipsle/prepends.rb Enables set*uid prepend options and provides MIPSLE syscall stubs.
lib/msf/core/payload/linux/mipsbe/prepends.rb Enables set*uid prepend options and provides MIPSBE syscall stubs.
lib/msf/core/payload/linux/mips64/prepends.rb Enables set*uid prepend options and provides MIPS64 syscall stubs.
data/templates/src/elf/exe/elf_mips64_template.s Updates MIPS64 ELF header fields (version/flags) in the source template.

Comment on lines 18 to 21
# @return [String] Returns an elf
def to_linux_mips64_elf(framework, code, opts = {})
Msf::Util::EXE::Common.to_exe_elf(framework, opts, "template_mips64_linux.bin", code)
Msf::Util::EXE::Common.to_exe_elf(framework, opts, "template_mips64_linux.bin", code, true)
end
Comment thread lib/msf/util/exe/linux/mips64.rb Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

rn-payload-enhancement release notes for enhanced payloads

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

3 participants