Creating Bind Shell

[ub3rduck]

Hi,
I'm trying to establish a bind shell on my RouterOS 6.38.4 (MIPSBE) rather than starting a reverse shell like in the examples.
I've been trying few methods but I can't seem to execute any command using the script except for opening a reverse shell.
I tried to create a new file with test, echo > /tmp/test, touch /tmp/test but none seem to be working.

Any idea why echo with output redirect command doesn't work or other idea how to establish a bind shell on the mk? (uploading files via web interface not relevant)

Thanks

P.S
Great job reversing and exploiting !

[BigNerd95]

On routeros the busybox contains very few programs.
To bind with telnetd or netcat you have to upload a binary to do that.

Does echo "" > /ram/test work?

Anyway I'm going to modify the mipsbe exploit to reuse the http socket to spawn a shell, so a reverse shell is no more needed (as soon as i have enough time).

[ub3rduck]

Nope. It works from within an established shell (reverse shell spawned by the original script), but when trying to execute echo command using the script, it does not create anything on the server. Can someone please verify this issue on different device?
And thanks a lot, that would be very helpful

[BigNerd95]

https://github.com/BigNerd95/Chimay-Red/blob/master/StackClash_resock_mips.py