|
1 | 1 | # Shellcodes Linux ARMv7 (32 bits)
|
2 | 2 |
|
3 |
| -Voici une collection de shellcodes pour Linux ARMv7, pour l'instant ceux-là sont disponibles j'en rajouterai sûrement à l'avenir. |
| 3 | +Linux ARMv7 shellcode collection without any nullbytes, spaces or newlines. |
4 | 4 |
|
5 |
| -### **[exit(0) (16 octets)](https://github.com/voydstack/shellcoding/tree/master/ARM32/exit)** |
| 5 | +### **[exit(0) (16 bytes)](https://github.com/voydstack/shellcoding/tree/master/ARM32/exit)** |
6 | 6 |
|
7 |
| -Sort du programme en cours d'exécution avec 0 en code de retour. |
| 7 | +Simply exits. |
8 | 8 |
|
9 |
| -### **[Hello, World (43 octets)](https://github.com/voydstack/shellcoding/tree/master/ARM32/hello)** |
| 9 | +### **[Hello, World (36 bytes)](https://github.com/voydstack/shellcoding/tree/master/ARM32/hello)** |
10 | 10 |
|
11 |
| -Affiche "Hello, World !\n" puis quitte le programme. |
| 11 | +Displays "Hello,World!". |
12 | 12 |
|
13 |
| -### **[/bin/sh (28 octets)](https://github.com/voydstack/shellcoding/tree/master/ARM32/shell)** |
| 13 | +### **[/bin/sh (28 bytes)](https://github.com/voydstack/shellcoding/tree/master/ARM32/shell)** |
14 | 14 |
|
15 |
| -Ouvre un shell sans fixer les permissions. |
| 15 | +Executes `execve("/bin/sh", NULL, NULL)`. |
16 | 16 |
|
17 |
| -### **[setreuid /bin/sh (40 octets)](https://github.com/voydstack/shellcoding/tree/master/ARM32/setreuid-shell)** |
| 17 | +### **[setreuid /bin/sh (40 bytes)](https://github.com/voydstack/shellcoding/tree/master/ARM32/setreuid-shell)** |
18 | 18 |
|
19 |
| -Ouvre un shell en fixant les permissions avec setreuid(1000, 1000). |
| 19 | +Executes `setreuid(1000, 1000); execve("/bin/sh", NULL, NULL)`. |
20 | 20 |
|
21 |
| -### **[bindshell (104 octets)](https://github.com/voydstack/shellcoding/tree/master/ARM32/bind-shell)** |
| 21 | +### **[bindshell (92 bytes)](https://github.com/voydstack/shellcoding/tree/master/ARM32/bind-shell)** |
22 | 22 |
|
23 |
| -Attache un shell au port 1337. |
| 23 | +Runs a bind-shell on port 4444. |
24 | 24 |
|
25 |
| -### **[reverse shell (84 octets)](https://github.com/voydstack/shellcoding/tree/master/ARM32/reverse-shell)** |
| 25 | +### **[reverse shell (72 bytes)](https://github.com/voydstack/shellcoding/tree/master/ARM32/reverse-shell)** |
26 | 26 |
|
27 |
| -Se connecte en retour à l'adresse 192.168.1.64 au port 1337. |
| 27 | +Runs a reverse shell on 127.0.0.1:4444. |
28 | 28 |
|
29 |
| -### **[read /etc/passwd (52 octets)](https://github.com/voydstack/shellcoding/tree/master/ARM32/readfile)** |
| 29 | +### **[read /etc/passwd (56 bytes)](https://github.com/voydstack/shellcoding/tree/master/ARM32/readfile)** |
30 | 30 |
|
31 |
| -Lit un fichier (dans ce cas là /etc/passwd) et affiche son contenu sur stdout. |
| 31 | +Reads a file (/etc/passwd in the shellcode). |
32 | 32 |
|
33 |
| -## Modifier et assembler un shellcode |
| 33 | +### **[read second stage (20 bytes)](https://github.com/voydstack/shellcoding/tree/master/ARM32/read-stage)** |
34 | 34 |
|
35 |
| -Pour modifier les shellcodes présents ici, par exemple pour changer le numéro de port, il suffit de faire la modification directement dans le code du shellcode, puis de l'assembler avec la commande: |
| 35 | +Reads a second stage shellcode next to it. |
36 | 36 |
|
37 |
| -```sh |
38 |
| -as shellcode.s -o shellcode.o && ld shellcode.o -N -o shellcode |
39 |
| -objcopy -O binary shellcode shellcode.bin && rm shellcode.o shellcode |
| 37 | + |
| 38 | + |
| 39 | +### Assemble shellcodes |
| 40 | + |
| 41 | +``` |
| 42 | +arm-linux-gnueabihf-gcc shellcode.s -c && arm-linux-gnueabihf-ld shellcode.o -o shellcode |
| 43 | +arm-linux-gnueabihf-objcopy -O binary shellcode shellcode.bin && rm shellcode.o shellcode |
| 44 | +``` |
| 45 | + |
| 46 | +### Run shellcodes |
| 47 | + |
| 48 | +``` |
| 49 | +qemu-arm -L /usr/lib/arm-linux-gnueabihf/ ./executor < shellcode.bin |
40 | 50 | ```
|
41 | 51 |
|
42 |
| -Pour le tester, on peut utiliser le programme executor qui va mapper une zone mémoire exécutable puis l'exécuter avec notre shellcode à l'intérieur. |
| 52 | +### References |
43 | 53 |
|
44 |
| -```sh |
45 |
| -cat shellcode.bin | ./executor |
46 |
| -# Ou encore |
47 |
| -./executor "$(cat shellcode.bin)" |
48 |
| -``` |
| 54 | +- [https://azeria-labs.com/writing-arm-shellcode/](https://azeria-labs.com/writing-arm-shellcode/) |
| 55 | +- https://www.ic.unicamp.br/~ranido/mc404/docs/ARMv7-cheat-sheet.pdf |
0 commit comments