Skip to content

Commit 34b50bb

Browse files
inital push
1 parent bad7914 commit 34b50bb

File tree

5 files changed

+78
-0
lines changed

5 files changed

+78
-0
lines changed

.DS_Store

10 KB
Binary file not shown.

README.md

Whitespace-only changes.

shellcode/.DS_Store

6 KB
Binary file not shown.

shellcode/README.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Using C to build OSX Shellcode
2+
3+
A small setup that I used to learn X86_x64 shellcode generation using ASM and compiled C code.
4+
5+
6+
## OSX Setup
7+
8+
Please ensure you have the following installed before starting to build.
9+
10+
- Install XCode: `xcode-select --install`
11+
- Install Brew: `/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"`
12+
- Install Brew GCC: `brew install gcc`

shellcode/system-execve-shell.c

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
//#include <sys/syscall.h>
2+
3+
4+
/*
5+
1) compile code:
6+
/usr/local/Cellar/gcc/6.3.0_1/bin/gcc-6 -c test.c --shared -fpic -static -O0 -fno-asynchronous-unwind-tables -D LIB
7+
8+
or for byte savings: (86 bytes)
9+
10+
/usr/local/Cellar/gcc/6.3.0_1/bin/gcc-6 -c test.c --shared -fpic -static -O3 -fno-asynchronous-unwind-tables -D LIB
11+
12+
2) link your code:
13+
ld test.o -o test -S -static -dylib -order_file order_file.txt
14+
15+
2) get hex of shel code of section:
16+
gobjcopy -O binary --only-section=.text test test.output
17+
*/
18+
19+
// int main1();
20+
21+
// int myexec(char* arg1, long arg2, long arg3);
22+
23+
static volatile int myexec(char * arg1, long arg2, long arg3) {
24+
/*
25+
asm ( assembler template
26+
: output operands
27+
: input operands
28+
: list of clobbered registers
29+
);
30+
// */
31+
// int a=10, b;
32+
// asm ("movl %1, %%eax;
33+
// movl %%eax, %0;"
34+
// :"=r"(b) /* output */
35+
// :"r"(a) /* input */
36+
// :"%eax" /* clobbered register */
37+
// );
38+
volatile int x = 0;
39+
int y = 0x200003b;
40+
asm volatile( "movq %4,%%rax;\n\t"
41+
"movq %1,%%rdi;\n\t"
42+
"mov %2,%%rsi;\n\t"
43+
"mov %3,%%rdx;\n\t"
44+
"syscall"
45+
:"=g"(x)
46+
:"g"(arg1),"g"(arg2),"g"(arg3),"g"(y)
47+
:"%rcx", "%r11", "%rax", "%rdi", "%rsi", "%rdx"
48+
);
49+
return x;
50+
51+
}
52+
53+
int main1(char* mystring) {
54+
// char mystring[] = {'/','b','i','n','/','s','h',0};
55+
//seteuid(0);
56+
//fork();
57+
// write(1,mystring,8); //size_t write(int fildes, const void *buf, size_t nbytes);
58+
//system ("ls");
59+
// char* command="/bin/sh"
60+
myexec(mystring, 0, 0);
61+
return 0;
62+
}
63+
64+
65+
66+

0 commit comments

Comments
 (0)