#
# -=[ Happy B-day 'HKM' Shellcode (50 bytes)
# -=[ Platform: Linux x86_64
# -=[ Author: nitr0us - http://twitter.com/nitr0usmx
# -=[ Date: XX/Sept/2012
#
# _ _ ____ _ _ _ _
# | | | | | _ \ | | | | | | | |
# | |__| | __ _ _ __ _ __ _ _ | |_) | __| | __ _ _ _ | | | | | |
# | __ |/ _` | '_ \| '_ \| | | | | _ < / _` |/ _` | | | | | | | | | |
# | | | | (_| | |_) | |_) | |_| | | |_) | (_| | (_| | |_| | |_| |_| |_|
# |_| |_|\__,_| .__/| .__/ \__, | |____/ \__,_|\__,_|\__, | (_) (_) (_)
# | | | | __/ | __/ |
# |_| |_| |___/ |___/
#
# ___ ___ ___
# /\__\ /\__\ /\__\
# /:/ / /:/ / /::| |
# /:/__/ /:/__/ /:|:| |
# /::\ \ ___ /::\__\____ /:/|:|__|__
# /:/\:\ /\__\ /:/\:::::\__\ /:/ |::::\__\
# \/__\:\/:/ / \/_|:|~~|~ \/__/~~/:/ /
# \::/ / |:| | /:/ /
# /:/ / |:| | /:/ /
# /:/ / |:| | /:/ /
# \/__/ \|__| \/__/
#
# char hkm_bday_shellcode[] =
# "\xeb\x12\x59\x48\x31\xc0\x48\x31"
# "\xdb\x48\x31\xd2\xb0\x04\xfe\xc3"
# "\xb2\x19\xcd\x80\xe8\xe9\xff\xff"
# "\xff\x7c\x2d\x7c\x34\x70\x70\x59"
# "\x20\x62\x2d\x44\x40\x79\x20\x48"
# "\x4b\x4d\x20\x3d\x44\x20\x21\x21"
# "\x21\x0a";
#
# $gcc -c hkm_bday.s
# $objdump -d ./hkm_bday.o
# Disassembly of section .text:
# 0000000000000000 <main>:
# 0: eb 12 jmp 14 <happy>
# 0000000000000002 <birthday>:
# 2: 59 pop %rcx
# 3: 48 31 c0 xor %rax,%rax
# 6: 48 31 db xor %rbx,%rbx
# 9: 48 31 d2 xor %rdx,%rdx
# c: b0 04 mov $0x4,%al
# e: fe c3 inc %bl
# 10: b2 00 mov $0x0,%dl
# 12: cd 80 int $0x80
# 0000000000000014 <happy>:
# 14: e8 e9 ff ff ff callq 2 <birthday>
# 0000000000000019 <CAKE>:
# 19: 7c 2d jl 48 <CAKE+0x2f>
# 1b: 7c 34 jl 51 <CAKE+0x38>
# 1d: 70 70 jo 8f <CAKE+0x76>
# 1f: 59 pop %rcx
# 20: 20 62 2d and %ah,0x2d(%rdx)
# 23: 44 rex.R
# 24: 40 79 20 rex jns 47 <CAKE+0x2e>
# 27: 48 rex.W
# 28: 4b rex.WXB
# 29: 4d 20 3d 44 20 21 21 rex.WRB and %r15b,0x21212044(%rip) # 21212074 <CAKE+0x2121205b>
# 30: 21 0a and %ecx,(%rdx)
#
# $gcc hkm_bday.o -o hkm_bday
# $./hkm_bday
# |-|4ppY b-D@y HKM =D !!!
#
.section .text
.globl main
main:
jmp happy
birthday:
pop %rcx
xorq %rax, %rax
xorq %rbx, %rbx
xorq %rdx, %rdx
movb $4, %al
incb %bl
movb $CAKESIZE, %dl
int $0x80
happy:
call birthday
CAKE:
.byte 0x7c,0x2d,0x7c,0x34,0x70,0x70,0x59,0x20
.byte 0x62,0x2d,0x44,0x40,0x79,0x20,0x48,0x4b
.byte 0x4d,0x20,0x3d,0x44,0x20,0x21,0x21,0x21
.byte 0x0a
CAKESIZE = . - CAKE
