exploit the possibilities
Showing 1 - 25 of 1,166 RSS Feed

Shellcode Files

Safari Type Confusion / Sandbox Escape
Posted Oct 1, 2020
Authored by timwr, Insu Yun, Taesoo Kim, Jungwon Lim, Yonghwi Jin | Site metasploit.com

This Metasploit module exploits an incorrect side-effect modeling of the 'in' operator. The DFG compiler assumes that the 'in' operator is side-effect free, however the embed element with the PDF plugin provides a callback that can trigger side-effects leading to type confusion (CVE-2020-9850). The type confusion can be used as addrof and fakeobj primitives that then lead to arbitrary read/write of memory. These primitives allow us to write shellcode into a JIT region (RWX memory) containing the next stage of the exploit. The next stage uses CVE-2020-9856 to exploit a heap overflow in CVM Server, and extracts a macOS application containing our payload into /var/db/CVMS. The payload can then be opened with CVE-2020-9801, executing the payload as a user but without sandbox restrictions.

tags | exploit, overflow, arbitrary, shellcode
advisories | CVE-2020-9801, CVE-2020-9850, CVE-2020-9856
MD5 | 2dc9b201150ea12e09390643b437b269
Linux/x86 Reverse TCP Shellcode
Posted Aug 24, 2020
Authored by Xenofon Vassilakopoulos

84 bytes small Linux/x86 reverse TCP shellcode.

tags | x86, tcp, shellcode
systems | linux
MD5 | d27c925e63f6be65e2fe56789bbf7646
Linux/x86 execve /bin/sh Shellcode
Posted Aug 21, 2020
Authored by cybersaki

10 bytes small Linux/x86 execve "/bin/sh" shellcode.

tags | x86, shellcode
systems | linux
MD5 | 17eba74611ee88dd5e7b38ff76974d98
Linux/x86 /dev/sda Partition Wiping Shellcode
Posted Aug 21, 2020
Authored by cybersaki

35 bytes small Linux/x86 /dev/sda wiping shellcode.

tags | x86, shellcode
systems | linux
MD5 | 19e25cdfd1453bac178a73395ba04bfa
Safari Webkit For iOS 7.1.2 JIT Optimization Bug
Posted Aug 14, 2020
Authored by timwr, Ian Beer, kudima, WanderingGlitch | Site metasploit.com

This Metasploit module exploits a JIT optimization bug in Safari Webkit. This allows us to write shellcode to an RWX memory section in JavaScriptCore and execute it. The shellcode contains a kernel exploit (CVE-2016-4669) that obtains kernel rw, obtains root and disables code signing. Finally we download and execute the meterpreter payload. This module has been tested against iOS 7.1.2 on an iPhone 4.

tags | exploit, kernel, root, shellcode
systems | apple, iphone, ios
advisories | CVE-2016-4669, CVE-2018-4162
MD5 | 193bef4f6ec1463a50a80fcde4b59fa1
Linux/x86 Egghunter(0x50905090) + sigaction + execve(/bin/sh) Shellcode
Posted Jul 24, 2020
Authored by danf42

35 bytes small Linux/x86 Egghunter(0x50905090) + sigaction + execve(/bin/sh) shellcode.

tags | x86, shellcode
systems | linux
MD5 | f1b110ff59b4adb7c79737eb1fc046c4
Windows/x86 mshta.exe Download Shellcode
Posted Jul 24, 2020
Authored by Siddharth Sharma

100 bytes small Windows/x86 download using mshta.exe shellcode.

tags | x86, shellcode
systems | windows
MD5 | 35ca25f1d948941abefae3daa165c025
EternalBlueC EternalBlue Suite
Posted Jul 23, 2020
Authored by bhassani | Site github.com

EternalBlueC is the EternalBlue suite remade in C which includes an MS17-010 exploit, EternalBlue/MS17-010 vulnerability detector, DoublePulsar detector, and DoublePulsar UploadDLL and shellcode.

tags | exploit, shellcode
MD5 | f0bed2dc06084b8a89c0c2fe9adefb55
NetPCLinker 1.0.0.0 Buffer Overflow
Posted Jun 29, 2020
Authored by Saeed reza Zamanian

NetPCLinker version 1.0.0.0 SEH with egghunter shellcode buffer overflow exploit.

tags | exploit, overflow, shellcode
MD5 | e76e96a4dcb2e6ca5a001536d6231df6
Linux/ARM 0.0.0.0:1337/TCP Bindshell Shellcode
Posted Jun 16, 2020
Authored by Anurag Srivastava

100 bytes small null-free Linux/ARM shellcode that binds /bin/sh to 0.0.0.0:1337/TCP.

tags | tcp, shellcode
systems | linux
MD5 | 111a5d97d0327b4f3d4106f084eac97e
Linux/ARM execve /bin/dash Shellcode
Posted Jun 16, 2020
Authored by Anurag Srivastava

32 bytes small Linux/ARM execve /bin/dash shellcode.

tags | shellcode
systems | linux
MD5 | abc2225ec6ad691079909d8f03eab5a9
Linux/x86 /etc/hosts Mapping Add Polymorphic Shellcode
Posted Jun 15, 2020
Authored by Xenofon Vassilakopoulos

102 bytes small Linux/x86 add map in /etc/hosts file polymorphic shellcode.

tags | x86, shellcode
systems | linux
MD5 | 979a6e0e42c8f46c1647b1c2de0c533a
Linux/x86 ASLR Deactivation Polymorphic Shellcode
Posted Jun 11, 2020
Authored by Xenofon Vassilakopoulos

124 bytes small ASLR deactivation polymorphic shellcode.

tags | shellcode
MD5 | 68fed31edbc95b6538cd08d866de9910
Linux/x86 Tiny Read Polymorphic Shellcode
Posted Jun 9, 2020
Authored by Xenofon Vassilakopoulos

75 bytes small Linux/x86 tiny read polymorphic shellcode.

tags | x86, shellcode
systems | linux
MD5 | d6f58fd7c7c280218ab60f1656e524b7
macOS/x64 zsh RickRolling Shellcode
Posted May 31, 2020
Authored by Bobby Cooke

198 bytes small macOS/x64 RickRolling shellcode.

tags | shellcode
MD5 | 629ad7b064b5d84ed3f906842421a4f2
Linux/x64 Anti-Debug Trick INT3 Trap Shellcode
Posted May 5, 2020
Authored by Dario Castrogiovanni

113 bytes small Linux/x64 anti-debug trick (INT3 trap) with execve("/bin/sh") shellcode that is NULL free.

tags | shellcode
systems | linux
MD5 | ba4326c992e6781e3f2d205bf50de438
Linux/x86 Egghunter Shellcode
Posted Apr 24, 2020
Authored by Bobby Cooke

39 bytes small Linux/x86 egghunter null-free shellcode. The egghunter dynamically searches memory for 2 instances of the egg. When the eggs are found, the egghunter passes execution control to the payload at the memory address of the eggs.

tags | x86, shellcode
systems | linux
MD5 | 3cc1d7e8ad5391ad63e8cd52726be7e0
Linux/x86 Reverse Shell Generator Shellcode
Posted Apr 24, 2020
Authored by Bobby Cooke

80 bytes small Linux/x86 reverse shell generator shellcode with customizable TCP port and IP address.

tags | shell, x86, tcp, shellcode
systems | linux
MD5 | 937201f1ff92ab4fabd623cad7224a07
Linux/x86 Dynamic MMX+FPU Encoded Add Root User Shellcode
Posted Apr 24, 2020
Authored by Bobby Cooke

155 bytes small Linux/x86 shellcode that has a MMX stub decoder that dynamically decodes the payload in memory. The FPU GetPC technique is used to determine the offset from EIP dynamically in running memory. Once decoded. this shellcode adds the user 'ctl' with the password 'ctl' to the /etc/passwd file with the UID and GID of 0 (root). This shellcode uses legacy passwd functionality. Therefore the /etc/shadow file does not need to be accessed or modified.

tags | x86, root, shellcode
systems | linux
MD5 | b4cd1c73f54aff707a22b55b2944bd8d
Linux/x86 Add Root User Shellcode
Posted Apr 24, 2020
Authored by Bobby Cooke

107 bytes small Linux/x86 shellcode that adds the user 'ctl' with the password 'ctl' to the /etc/passwd file with the UID and GID of 0 (root). This shellcode uses legacy passwd functionality. Therefore the /etc/shadow file does not need to be accessed or modified.

tags | x86, root, shellcode
systems | linux
MD5 | 20be4a130a7c7deaf759ff5c00029968
Linux/x64_86 ROL Encoded Execve Shellcode
Posted Apr 24, 2020
Authored by Bobby Cooke

57 bytes small Linux/x64_86 /bin/bash shellcode. The stub decodes the ROL Encoded shellcode. When the stub has finished decoding the payload, execution control is passed to the payload.

tags | shellcode, bash
systems | linux
MD5 | 8dfa373d1ce188f0f22dd71251acb232
Linux Password Protected Bindshell Shellcode
Posted Apr 24, 2020
Authored by Bobby Cooke

272 bytes small Linux/x86_64 null free password protected bindshell shellcode.

tags | shellcode
systems | linux
MD5 | b2aad21499e34b3822eb8138541d15fd
Linux/x64_86 Egghunter Execve Shellcode
Posted Apr 24, 2020
Authored by Bobby Cooke

63 bytes small Linux/x64_86 dynamic egghunter shellcode that searches memory for 2 instances of the egg. When the eggs are found, the egghunter passes execution control to the payload at the memory address of the eggs. The payload is an execve(/bin/bash) shellcode.

tags | shellcode, bash
systems | linux
MD5 | a26b8168f0e16f88cec1b72030695f38
Microsoft Windows Firewall Disabling Shellcode
Posted Apr 20, 2020
Authored by Bobby Cooke

644 bytes small Microsoft Windows x86 shellcode that disables the Windows firewall, adds the user MajinBuu with password TurnU2C@ndy!! to the system, adds the user MajinBuu to the local groups Administrators and Remote Desktop Users, and then enables the RDP Service.

tags | remote, x86, local, shellcode
systems | windows
MD5 | a1d9a1235afb2e385b7e22e9cfe721eb
Linux/x86 Egghunter / Null-Free Shellcode
Posted Apr 20, 2020
Authored by Shubham Singh

33 bytes small Linux/x86 egghunter null-free shellcode.

tags | x86, shellcode
systems | linux
MD5 | f143c7106d8f990b5f7946ceed5264ed
Page 1 of 47
Back12345Next

File Archive:

October 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    25 Files
  • 2
    Oct 2nd
    13 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    1 Files
  • 5
    Oct 5th
    15 Files
  • 6
    Oct 6th
    15 Files
  • 7
    Oct 7th
    15 Files
  • 8
    Oct 8th
    11 Files
  • 9
    Oct 9th
    3 Files
  • 10
    Oct 10th
    1 Files
  • 11
    Oct 11th
    1 Files
  • 12
    Oct 12th
    8 Files
  • 13
    Oct 13th
    12 Files
  • 14
    Oct 14th
    23 Files
  • 15
    Oct 15th
    4 Files
  • 16
    Oct 16th
    13 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    1 Files
  • 19
    Oct 19th
    27 Files
  • 20
    Oct 20th
    41 Files
  • 21
    Oct 21st
    15 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close