Cooler_

mmap() shellcode

May 26th, 2014
360
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 1.18 KB | None | 0 0
  1. // example to use mmap() to exec shellcode
  2. //credits: s3my0n
  3. #include <stdio.h>
  4. #include <sys/mman.h>
  5. #include <string.h>
  6. #include <stdlib.h>
  7.  
  8. int (*sc)();
  9. char shellcode[] =
  10. "\x31\xc0"              // xor    %eax,%eax
  11. "\xb0\x04"              // mov    $0x4,%al
  12. "\x31\xdb"              // xor    %ebx,%ebx
  13. "\x53"                  // push   %ebx
  14. "\x43"                  // inc    %ebx
  15. "\x6a\x6f"              // push   $0x6f
  16. "\x68\x4d\x75\x6e\x64"  // push   $0x646e754d
  17. "\x68\x41\x6c\x6f\x20"  // push   $0x206f6c41
  18. "\x89\xe1"              // mov    %esp,%ecx
  19. "\x31\xd2"              // xor    %edx,%edx
  20. "\xb2\x0a"              // mov    $0xa,%dl
  21. "\xcd\x80"              // int    $0x80
  22. "\x31\xc0"              // xor    %eax,%eax
  23. "\x31\xdb"              // xor    %ebx,%ebx
  24. "\x40"                  // inc    %eax
  25. "\xcd\x80"              // int    $0x80
  26. ;
  27.  
  28. int main(int argc, char **argv) {
  29.  
  30.     void *ptr = mmap(0, sizeof(shellcode),PROT_EXEC | PROT_WRITE | PROT_READ, MAP_ANON | MAP_PRIVATE, -1, 0);
  31.  
  32.     if(ptr == MAP_FAILED)
  33.     {
  34.      perror("mmap");
  35.      exit(-1);
  36.     }
  37.  
  38.     memcpy(ptr, shellcode, sizeof(shellcode));
  39.     sc = ptr;
  40.  
  41.     sc();
  42.  
  43.     return 0;
  44. }
Advertisement
Add Comment
Please, Sign In to add comment