shellcode

“A vulnerability provides an assembly language for a computer that has never been programmed before, and that was not designed with programmability in mind.”

-- Halvar Flake

A collection of new and old shellcode samples.

Article

• https://hnsecurity.it/blog/new-and-old-shellcode-samples/

Shellcode

x86

• setuid-linux.c. Old setuid/execve shellcode for Linux/x86 (30 bytes).
• portbind-linux.c. Old setuid/portbind shellcode for Linux/x86 (96 bytes).
• reusage-linux.c. Old execve shellcode for Linux/x86 that reuses "/bin/sh" in .rodata (16 bytes).
• gets-linux.c. Old stdin-reopen/execve shellcode for Linux/x86, useful against gets() buffer overflows.
• raptorcode.c. Old shellcode for Linux/x86 that writes a message to the current tty.
• setuid-bsd.c. Old setuid/execve shellcode for BSD/x86 (30 bytes).
• portbind-bsd.c. Old setuid/portbind shellcode for BSD/x86 (94 bytes).
• leetcode.c. Old setuid/execve shellcode for BSD/x86, with an ASCII message buried in the code.

x86_64

• read-no-H.s. Linux/x86_64 sendfile shellcode without 0x48 bytes.
• exec-no-H.s. Linux/x86_64 exec shellcode without 0x48 bytes.
• read-no-syscall.s. Linux/x86_64 sendfile shellcode without 0x0f05 bytes.
• read-write.s. Linux/x86_64 file read/write shellcode.
• chmod-tiny.s. 12-bytes Linux/x86_64 chmod 4 shellcode.
• exec-tiny.s. 12-bytes Linux/x86_64 exec shellcode.

SPARC

• sparc_solaris_exec.c. Solaris/SPARC setuid/execve shellcode (60 bytes).
• sparc_solaris_chmod.c. Solaris/SPARC setuid/chmod/exit shellcode (64 bytes).
• sparc_solaris_chmod2.c. Very small Solaris/SPARC chmod shellcode (36 bytes).

MIPS

• mips_n32_msb_linux_revsh.c. Basic MIPS N32 MSB Linux reverse shellcode.