|
| 1 | +//#include <sys/syscall.h> |
| 2 | + |
| 3 | + |
| 4 | +/* |
| 5 | +1) compile code: |
| 6 | +/usr/local/Cellar/gcc/6.3.0_1/bin/gcc-6 -c test.c --shared -fpic -static -O0 -fno-asynchronous-unwind-tables -D LIB |
| 7 | +
|
| 8 | +or for byte savings: (86 bytes) |
| 9 | +
|
| 10 | +/usr/local/Cellar/gcc/6.3.0_1/bin/gcc-6 -c test.c --shared -fpic -static -O3 -fno-asynchronous-unwind-tables -D LIB |
| 11 | +
|
| 12 | +2) link your code: |
| 13 | +ld test.o -o test -S -static -dylib -order_file order_file.txt |
| 14 | +
|
| 15 | +2) get hex of shel code of section: |
| 16 | +gobjcopy -O binary --only-section=.text test test.output |
| 17 | +*/ |
| 18 | + |
| 19 | +// int main1(); |
| 20 | + |
| 21 | +// int myexec(char* arg1, long arg2, long arg3); |
| 22 | + |
| 23 | +static volatile int myexec(char * arg1, long arg2, long arg3) { |
| 24 | + /* |
| 25 | + asm ( assembler template |
| 26 | + : output operands |
| 27 | + : input operands |
| 28 | + : list of clobbered registers |
| 29 | + ); |
| 30 | + // */ |
| 31 | + // int a=10, b; |
| 32 | + // asm ("movl %1, %%eax; |
| 33 | + // movl %%eax, %0;" |
| 34 | + // :"=r"(b) /* output */ |
| 35 | + // :"r"(a) /* input */ |
| 36 | + // :"%eax" /* clobbered register */ |
| 37 | + // ); |
| 38 | + volatile int x = 0; |
| 39 | + int y = 0x200003b; |
| 40 | + asm volatile( "movq %4,%%rax;\n\t" |
| 41 | + "movq %1,%%rdi;\n\t" |
| 42 | + "mov %2,%%rsi;\n\t" |
| 43 | + "mov %3,%%rdx;\n\t" |
| 44 | + "syscall" |
| 45 | + :"=g"(x) |
| 46 | + :"g"(arg1),"g"(arg2),"g"(arg3),"g"(y) |
| 47 | + :"%rcx", "%r11", "%rax", "%rdi", "%rsi", "%rdx" |
| 48 | + ); |
| 49 | + return x; |
| 50 | + |
| 51 | +} |
| 52 | + |
| 53 | +int main1(char* mystring) { |
| 54 | + // char mystring[] = {'/','b','i','n','/','s','h',0}; |
| 55 | + //seteuid(0); |
| 56 | + //fork(); |
| 57 | + // write(1,mystring,8); //size_t write(int fildes, const void *buf, size_t nbytes); |
| 58 | + //system ("ls"); |
| 59 | + // char* command="/bin/sh" |
| 60 | + myexec(mystring, 0, 0); |
| 61 | + return 0; |
| 62 | +} |
| 63 | + |
| 64 | + |
| 65 | + |
| 66 | + |
0 commit comments